wire-mesh-core 4.0.5 → 4.0.7

package/dist/adapters/node-identity.cjs

@@ -3,6 +3,16 @@ let node_crypto = require("node:crypto");
 //#region src/adapters/node-identity.ts
 const ES256 = -7;
 const EDDSA = -8;
+/** An ES256 public key is an uncompressed SEC1 P-256 point: a 0x04 prefix, then the 32-byte X and Y coordinates. */
+const ES256_PUBLIC_KEY_BYTES = 65;
+/** An Ed25519 public key is its 32-byte compressed point. */
+const EDDSA_PUBLIC_KEY_BYTES = 32;
+/** The exact size of a public key for `alg`, throwing for an algorithm no verifier here implements. */
+function publicKeySize(alg) {
+	if (alg === ES256) return ES256_PUBLIC_KEY_BYTES;
+	if (alg === EDDSA) return EDDSA_PUBLIC_KEY_BYTES;
+	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+}
 function algParams(alg) {
 	if (alg === ES256) return {
 		name: "ECDSA",
@@ -15,7 +25,35 @@ function algParams(alg) {
 function toBufferSource(bytes) {
 	return Uint8Array.from(bytes);
 }
+/**
+* How many imported verification keys are kept. An imported key is a handle to a few dozen bytes of key material (only a key that imported successfully is kept, and a valid ES256 or Ed25519 public key is fixed-size), so the bound is on count: well above the devices of any plausible local mesh, so a mesh gossiping every few seconds finds its keys already imported rather than re-importing one per advert.
+*/
+const IMPORTED_KEY_CAPACITY = 1024;
+/** Least recently used first, by Map insertion order. Holds the pending promise so concurrent verifications of one device import its key once. */
+const importedKeys = /* @__PURE__ */ new Map();
+/** Equal for two identity-keys exactly when algorithm and key bytes are equal. */
+function importedKeyId(key) {
+	return `${String(key.alg)}:${Buffer.from(key["public-key"]).toString("base64")}`;
+}
 async function importPublicKey(key) {
+	if (key["public-key"].length !== publicKeySize(key.alg)) throw new Error(`identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	const id = importedKeyId(key);
+	const held = importedKeys.get(id);
+	if (held !== void 0) {
+		importedKeys.delete(id);
+		importedKeys.set(id, held);
+		return held;
+	}
+	const pending = importPublicKeyUncached(key);
+	importedKeys.set(id, pending);
+	pending.catch(() => importedKeys.delete(id));
+	for (const oldest of importedKeys.keys()) {
+		if (importedKeys.size <= IMPORTED_KEY_CAPACITY) break;
+		importedKeys.delete(oldest);
+	}
+	return pending;
+}
+async function importPublicKeyUncached(key) {
 	if (key.alg === ES256) return node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
 		name: "ECDSA",
 		namedCurve: "P-256"

package/dist/adapters/node-identity.mjs

@@ -2,6 +2,16 @@ import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.ts
 const ES256 = -7;
 const EDDSA = -8;
+/** An ES256 public key is an uncompressed SEC1 P-256 point: a 0x04 prefix, then the 32-byte X and Y coordinates. */
+const ES256_PUBLIC_KEY_BYTES = 65;
+/** An Ed25519 public key is its 32-byte compressed point. */
+const EDDSA_PUBLIC_KEY_BYTES = 32;
+/** The exact size of a public key for `alg`, throwing for an algorithm no verifier here implements. */
+function publicKeySize(alg) {
+	if (alg === ES256) return ES256_PUBLIC_KEY_BYTES;
+	if (alg === EDDSA) return EDDSA_PUBLIC_KEY_BYTES;
+	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+}
 function algParams(alg) {
 	if (alg === ES256) return {
 		name: "ECDSA",
@@ -14,7 +24,35 @@ function algParams(alg) {
 function toBufferSource(bytes) {
 	return Uint8Array.from(bytes);
 }
+/**
+* How many imported verification keys are kept. An imported key is a handle to a few dozen bytes of key material (only a key that imported successfully is kept, and a valid ES256 or Ed25519 public key is fixed-size), so the bound is on count: well above the devices of any plausible local mesh, so a mesh gossiping every few seconds finds its keys already imported rather than re-importing one per advert.
+*/
+const IMPORTED_KEY_CAPACITY = 1024;
+/** Least recently used first, by Map insertion order. Holds the pending promise so concurrent verifications of one device import its key once. */
+const importedKeys = /* @__PURE__ */ new Map();
+/** Equal for two identity-keys exactly when algorithm and key bytes are equal. */
+function importedKeyId(key) {
+	return `${String(key.alg)}:${Buffer.from(key["public-key"]).toString("base64")}`;
+}
 async function importPublicKey(key) {
+	if (key["public-key"].length !== publicKeySize(key.alg)) throw new Error(`identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	const id = importedKeyId(key);
+	const held = importedKeys.get(id);
+	if (held !== void 0) {
+		importedKeys.delete(id);
+		importedKeys.set(id, held);
+		return held;
+	}
+	const pending = importPublicKeyUncached(key);
+	importedKeys.set(id, pending);
+	pending.catch(() => importedKeys.delete(id));
+	for (const oldest of importedKeys.keys()) {
+		if (importedKeys.size <= IMPORTED_KEY_CAPACITY) break;
+		importedKeys.delete(oldest);
+	}
+	return pending;
+}
+async function importPublicKeyUncached(key) {
 	if (key.alg === ES256) return webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
 		name: "ECDSA",
 		namedCurve: "P-256"

package/dist/domain/peer-advert.cjs

@@ -1,7 +1,26 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_token_scope = require("./token-scope.cjs");
+const require_domain_verdict_cache = require("./verdict-cache.cjs");
 let cbor2 = require("cbor2");
 //#region src/domain/peer-advert.ts
+const BYTES_PER_KIBIBYTE = 1024;
+/**
+* The most a verifier's verdict memo may charge across all its entries, in bytes of key.
+*
+* A key is a signature plus the signed bytes, so an honest advert (a device id, a few addresses, a handful of gossip extensions) costs on the order of a kilobyte and this budget holds the current advert of every device a large local mesh gossips, plus the several generations a hub's catch-up frames can still replay. It is a budget in bytes rather than a count of entries because the signed bytes are attacker-sized up to the frame limit: a count would let a hostile peer pin that many frames in memory, where a byte budget makes the worst case this figure and refuses to keep any single advert larger than it.
+*/
+const PEER_ADVERT_VERDICT_BUDGET_BYTES = 8 * (BYTES_PER_KIBIBYTE * BYTES_PER_KIBIBYTE);
+/**
+* One memo per verifier object, held weakly so it lives exactly as long as the identity it serves. A verdict is a pure function of the advert's own bytes (the key and the signature both travel inside it), so every session and hub sharing one verifier shares the answers, and a fresh verifier (a test's fake, a second node identity) starts cold rather than inheriting another's.
+*/
+const verdictCaches = /* @__PURE__ */ new WeakMap();
+function verdictCacheFor(identity) {
+	const existing = verdictCaches.get(identity);
+	if (existing !== void 0) return existing;
+	const created = require_domain_verdict_cache.createVerdictCache(PEER_ADVERT_VERDICT_BUDGET_BYTES);
+	verdictCaches.set(identity, created);
+	return created;
+}
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 const PEER_ADVERT_SIGNATURE_KEY = "signature";
 /** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
@@ -41,21 +60,34 @@ async function signPeerAdvert(identity, advert) {
 * Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
 *
 * Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+*
+* A hub re-broadcasts every advert it accepts to every other client and replays the whole directory to each sender, so one advert reaches a receiver several times and a mesh of N devices checks each advert on the order of N times per receiver. The two checks are pure functions of the advert's bytes, so the verdict for a given signature over given signed bytes is remembered (see PEER_ADVERT_VERDICT_BUDGET_BYTES) and a repeat costs one encoding rather than two digests and a public-key import and verification. Only a verdict the checks reached is remembered, a refusal included; a check that threw is not, because the same bytes might verify on a later attempt.
 */
 async function verifyPeerAdvert(identity, advert) {
+	let signedBytes;
+	try {
+		signedBytes = peerAdvertSigningInput(advert);
+	} catch {
+		return false;
+	}
+	return verdictCacheFor(identity).verdict([advert[PEER_ADVERT_SIGNATURE_KEY], signedBytes], async () => checkPeerAdvert(identity, advert, signedBytes));
+}
+/** The uncached checks: true or false when they reached a verdict, undefined when verifying threw. */
+async function checkPeerAdvert(identity, advert, signedBytes) {
 	const key = advert[PEER_ADVERT_IDENTITY_KEY_KEY];
 	try {
 		const derived = await identity.deriveDeviceId(key["public-key"]);
 		if (!require_domain_token_scope.bytesEqual(derived, advert.device)) return false;
-		return await identity.verify(key, peerAdvertSigningInput(advert), advert[PEER_ADVERT_SIGNATURE_KEY]);
+		return await identity.verify(key, signedBytes, advert[PEER_ADVERT_SIGNATURE_KEY]);
 	} catch {
-		return false;
+		return;
 	}
 }
 //#endregion
 exports.PEER_ADVERT_IDENTITY_KEY_KEY = PEER_ADVERT_IDENTITY_KEY_KEY;
 exports.PEER_ADVERT_SIGNATURE_KEY = PEER_ADVERT_SIGNATURE_KEY;
 exports.PEER_ADVERT_SIGNING_CONTEXT = PEER_ADVERT_SIGNING_CONTEXT;
+exports.PEER_ADVERT_VERDICT_BUDGET_BYTES = PEER_ADVERT_VERDICT_BUDGET_BYTES;
 exports.peerAdvertSigningInput = peerAdvertSigningInput;
 exports.signPeerAdvert = signPeerAdvert;
 exports.verifyPeerAdvert = verifyPeerAdvert;

package/dist/domain/peer-advert.d.cts

@@ -1,6 +1,12 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
 import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 //#region src/domain/peer-advert.d.ts
+/**
+ * The most a verifier's verdict memo may charge across all its entries, in bytes of key.
+ *
+ * A key is a signature plus the signed bytes, so an honest advert (a device id, a few addresses, a handful of gossip extensions) costs on the order of a kilobyte and this budget holds the current advert of every device a large local mesh gossips, plus the several generations a hub's catch-up frames can still replay. It is a budget in bytes rather than a count of entries because the signed bytes are attacker-sized up to the frame limit: a count would let a hostile peer pin that many frames in memory, where a byte budget makes the worst case this figure and refuses to keep any single advert larger than it.
+ */
+export declare const PEER_ADVERT_VERDICT_BUDGET_BYTES: number;
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";
 /** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
@@ -40,6 +46,8 @@ export declare function signPeerAdvert(identity: Readonly<PeerAdvertSigner>, adv
  * Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
  *
  * Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+ *
+ * A hub re-broadcasts every advert it accepts to every other client and replays the whole directory to each sender, so one advert reaches a receiver several times and a mesh of N devices checks each advert on the order of N times per receiver. The two checks are pure functions of the advert's bytes, so the verdict for a given signature over given signed bytes is remembered (see PEER_ADVERT_VERDICT_BUDGET_BYTES) and a repeat costs one encoding rather than two digests and a public-key import and verification. Only a verdict the checks reached is remembered, a refusal included; a check that threw is not, because the same bytes might verify on a later attempt.
  */
 export declare function verifyPeerAdvert(identity: Readonly<PeerAdvertVerifier>, advert: Readonly<PeerAdvert>): Promise<boolean>;
 //#endregion

package/dist/domain/peer-advert.d.mts

@@ -1,6 +1,12 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
 import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 //#region src/domain/peer-advert.d.ts
+/**
+ * The most a verifier's verdict memo may charge across all its entries, in bytes of key.
+ *
+ * A key is a signature plus the signed bytes, so an honest advert (a device id, a few addresses, a handful of gossip extensions) costs on the order of a kilobyte and this budget holds the current advert of every device a large local mesh gossips, plus the several generations a hub's catch-up frames can still replay. It is a budget in bytes rather than a count of entries because the signed bytes are attacker-sized up to the frame limit: a count would let a hostile peer pin that many frames in memory, where a byte budget makes the worst case this figure and refuses to keep any single advert larger than it.
+ */
+export declare const PEER_ADVERT_VERDICT_BUDGET_BYTES: number;
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";
 /** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
@@ -40,6 +46,8 @@ export declare function signPeerAdvert(identity: Readonly<PeerAdvertSigner>, adv
  * Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
  *
  * Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+ *
+ * A hub re-broadcasts every advert it accepts to every other client and replays the whole directory to each sender, so one advert reaches a receiver several times and a mesh of N devices checks each advert on the order of N times per receiver. The two checks are pure functions of the advert's bytes, so the verdict for a given signature over given signed bytes is remembered (see PEER_ADVERT_VERDICT_BUDGET_BYTES) and a repeat costs one encoding rather than two digests and a public-key import and verification. Only a verdict the checks reached is remembered, a refusal included; a check that threw is not, because the same bytes might verify on a later attempt.
  */
 export declare function verifyPeerAdvert(identity: Readonly<PeerAdvertVerifier>, advert: Readonly<PeerAdvert>): Promise<boolean>;
 //#endregion

package/dist/domain/peer-advert.mjs

@@ -1,6 +1,25 @@
 import { bytesEqual } from "./token-scope.mjs";
+import { createVerdictCache } from "./verdict-cache.mjs";
 import { cdeEncodeOptions, encode } from "cbor2";
 //#region src/domain/peer-advert.ts
+const BYTES_PER_KIBIBYTE = 1024;
+/**
+* The most a verifier's verdict memo may charge across all its entries, in bytes of key.
+*
+* A key is a signature plus the signed bytes, so an honest advert (a device id, a few addresses, a handful of gossip extensions) costs on the order of a kilobyte and this budget holds the current advert of every device a large local mesh gossips, plus the several generations a hub's catch-up frames can still replay. It is a budget in bytes rather than a count of entries because the signed bytes are attacker-sized up to the frame limit: a count would let a hostile peer pin that many frames in memory, where a byte budget makes the worst case this figure and refuses to keep any single advert larger than it.
+*/
+const PEER_ADVERT_VERDICT_BUDGET_BYTES = 8 * (BYTES_PER_KIBIBYTE * BYTES_PER_KIBIBYTE);
+/**
+* One memo per verifier object, held weakly so it lives exactly as long as the identity it serves. A verdict is a pure function of the advert's own bytes (the key and the signature both travel inside it), so every session and hub sharing one verifier shares the answers, and a fresh verifier (a test's fake, a second node identity) starts cold rather than inheriting another's.
+*/
+const verdictCaches = /* @__PURE__ */ new WeakMap();
+function verdictCacheFor(identity) {
+	const existing = verdictCaches.get(identity);
+	if (existing !== void 0) return existing;
+	const created = createVerdictCache(PEER_ADVERT_VERDICT_BUDGET_BYTES);
+	verdictCaches.set(identity, created);
+	return created;
+}
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 const PEER_ADVERT_SIGNATURE_KEY = "signature";
 /** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
@@ -40,16 +59,28 @@ async function signPeerAdvert(identity, advert) {
 * Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
 *
 * Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+*
+* A hub re-broadcasts every advert it accepts to every other client and replays the whole directory to each sender, so one advert reaches a receiver several times and a mesh of N devices checks each advert on the order of N times per receiver. The two checks are pure functions of the advert's bytes, so the verdict for a given signature over given signed bytes is remembered (see PEER_ADVERT_VERDICT_BUDGET_BYTES) and a repeat costs one encoding rather than two digests and a public-key import and verification. Only a verdict the checks reached is remembered, a refusal included; a check that threw is not, because the same bytes might verify on a later attempt.
 */
 async function verifyPeerAdvert(identity, advert) {
+	let signedBytes;
+	try {
+		signedBytes = peerAdvertSigningInput(advert);
+	} catch {
+		return false;
+	}
+	return verdictCacheFor(identity).verdict([advert[PEER_ADVERT_SIGNATURE_KEY], signedBytes], async () => checkPeerAdvert(identity, advert, signedBytes));
+}
+/** The uncached checks: true or false when they reached a verdict, undefined when verifying threw. */
+async function checkPeerAdvert(identity, advert, signedBytes) {
 	const key = advert[PEER_ADVERT_IDENTITY_KEY_KEY];
 	try {
 		const derived = await identity.deriveDeviceId(key["public-key"]);
 		if (!bytesEqual(derived, advert.device)) return false;
-		return await identity.verify(key, peerAdvertSigningInput(advert), advert[PEER_ADVERT_SIGNATURE_KEY]);
+		return await identity.verify(key, signedBytes, advert[PEER_ADVERT_SIGNATURE_KEY]);
 	} catch {
-		return false;
+		return;
 	}
 }
 //#endregion
-export { PEER_ADVERT_IDENTITY_KEY_KEY, PEER_ADVERT_SIGNATURE_KEY, PEER_ADVERT_SIGNING_CONTEXT, peerAdvertSigningInput, signPeerAdvert, verifyPeerAdvert };
+export { PEER_ADVERT_IDENTITY_KEY_KEY, PEER_ADVERT_SIGNATURE_KEY, PEER_ADVERT_SIGNING_CONTEXT, PEER_ADVERT_VERDICT_BUDGET_BYTES, peerAdvertSigningInput, signPeerAdvert, verifyPeerAdvert };

package/dist/domain/room-rekey.cjs

@@ -8,6 +8,8 @@ const require_domain_room_token_verification = require("./room-token-verificatio
 *
 * The receiving side's own security property is worth stating plainly, since it's what makes this handler simpler than it might look: it needs no separate check of who actually sent the request. verifyRoomToken (obligation 1) already certifies that the recipient's OWN held room:member token's delegation chain terminates at the room's real, rightful owner -- deriving the ECDH shared secret against that certified owner's own rootIssuerKey means a wrapped-key only ever unwraps correctly when it was actually produced by someone holding the real owner's private key. A forged room.rekey from anyone else -- an attacker, a not-yet-admitted stranger, even another legitimate member with no admission authority -- cannot produce ciphertext that unwraps, so it fails closed on the cryptography itself rather than needing a redundant, separately-maintained live-sender identity check.
 */
+/** The error code a room.rekey is answered with when it unwrapped but the recipient could not store the keys, so the sender knows the key is not held and sends it again. */
+const REKEY_STORE_FAILED = "store_failed";
 /**
 * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
 */
@@ -29,7 +31,7 @@ async function sendRoomRekey(session, roomPath, keyEpoch, wrappedKey, targetDevi
 	}, targetDevice, token);
 }
 /**
-* Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+* Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result. The unwrapped keys are then handed to onRekey, and the sender is answered "ok" only once onRekey has stored them, or "store_failed" when it could not.
 */
 function createRoomRekeyHandler(options) {
 	return async function handleRoomRekey(incoming) {
@@ -99,15 +101,24 @@ function createRoomRekeyHandler(options) {
 			});
 			return;
 		}
+		try {
+			await options.onRekey({
+				room: roomPath,
+				keyEpoch,
+				contentKeys
+			});
+		} catch (error) {
+			await incoming.respond({
+				result: "error",
+				code: REKEY_STORE_FAILED
+			});
+			throw error;
+		}
 		await incoming.respond({ result: "ok" });
-		await options.onRekey({
-			room: roomPath,
-			keyEpoch,
-			contentKeys
-		});
 	};
 }
 //#endregion
+exports.REKEY_STORE_FAILED = REKEY_STORE_FAILED;
 exports.buildRoomRekeyCommand = buildRoomRekeyCommand;
 exports.createRoomRekeyHandler = createRoomRekeyHandler;
 exports.sendRoomRekey = sendRoomRekey;

package/dist/domain/room-rekey.d.cts

@@ -4,6 +4,8 @@ import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/room-rekey.d.ts
+/** The error code a room.rekey is answered with when it unwrapped but the recipient could not store the keys, so the sender knows the key is not held and sends it again. */
+export declare const REKEY_STORE_FAILED = "store_failed";
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
  */
@@ -25,11 +27,11 @@ export interface CreateRoomRekeyHandlerOptions {
   revocation: RevocationCheck;
   /** This recipient's own currently-held room:member token for the room being rekeyed, verified fresh on every incoming room.rekey (not cached) -- see this module's own doc comment for why its certified root issuer-key is what the ECDH derivation uses, rather than a separately-tracked live-sender identity. */
   ownRoomMemberToken: CapabilityToken;
-  /** Called once per successfully unwrapped room.rekey, after the sender has been told it succeeded. May be asynchronous, as storing a key durably is; the handler waits for it, so a failure to store reaches whoever awaits the handler. */
+  /** Called once per successfully unwrapped room.rekey, before the sender is told it succeeded. May be asynchronous, as storing a key durably is; the handler waits for it and answers "ok" only once it has settled, and when it rejects the handler answers `store_failed` and rejects with the same error, so the failure reaches both the sender and whoever awaits the handler. */
   onRekey: (event: Readonly<RoomRekeyEvent>) => Promise<void> | void;
 }
 /**
- * Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+ * Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result. The unwrapped keys are then handed to onRekey, and the sender is answered "ok" only once onRekey has stored them, or "store_failed" when it could not.
  */
 export declare function createRoomRekeyHandler(options: Readonly<CreateRoomRekeyHandlerOptions>): (incoming: Readonly<IncomingManageRequest>) => Promise<void>;
 //#endregion

package/dist/domain/room-rekey.d.mts

@@ -4,6 +4,8 @@ import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/room-rekey.d.ts
+/** The error code a room.rekey is answered with when it unwrapped but the recipient could not store the keys, so the sender knows the key is not held and sends it again. */
+export declare const REKEY_STORE_FAILED = "store_failed";
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
  */
@@ -25,11 +27,11 @@ export interface CreateRoomRekeyHandlerOptions {
   revocation: RevocationCheck;
   /** This recipient's own currently-held room:member token for the room being rekeyed, verified fresh on every incoming room.rekey (not cached) -- see this module's own doc comment for why its certified root issuer-key is what the ECDH derivation uses, rather than a separately-tracked live-sender identity. */
   ownRoomMemberToken: CapabilityToken;
-  /** Called once per successfully unwrapped room.rekey, after the sender has been told it succeeded. May be asynchronous, as storing a key durably is; the handler waits for it, so a failure to store reaches whoever awaits the handler. */
+  /** Called once per successfully unwrapped room.rekey, before the sender is told it succeeded. May be asynchronous, as storing a key durably is; the handler waits for it and answers "ok" only once it has settled, and when it rejects the handler answers `store_failed` and rejects with the same error, so the failure reaches both the sender and whoever awaits the handler. */
   onRekey: (event: Readonly<RoomRekeyEvent>) => Promise<void> | void;
 }
 /**
- * Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+ * Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result. The unwrapped keys are then handed to onRekey, and the sender is answered "ok" only once onRekey has stored them, or "store_failed" when it could not.
  */
 export declare function createRoomRekeyHandler(options: Readonly<CreateRoomRekeyHandlerOptions>): (incoming: Readonly<IncomingManageRequest>) => Promise<void>;
 //#endregion

package/dist/domain/room-rekey.mjs

@@ -7,6 +7,8 @@ import { ROOM_MEMBER_CAPABILITY, verifyRoomToken } from "./room-token-verificati
 *
 * The receiving side's own security property is worth stating plainly, since it's what makes this handler simpler than it might look: it needs no separate check of who actually sent the request. verifyRoomToken (obligation 1) already certifies that the recipient's OWN held room:member token's delegation chain terminates at the room's real, rightful owner -- deriving the ECDH shared secret against that certified owner's own rootIssuerKey means a wrapped-key only ever unwraps correctly when it was actually produced by someone holding the real owner's private key. A forged room.rekey from anyone else -- an attacker, a not-yet-admitted stranger, even another legitimate member with no admission authority -- cannot produce ciphertext that unwraps, so it fails closed on the cryptography itself rather than needing a redundant, separately-maintained live-sender identity check.
 */
+/** The error code a room.rekey is answered with when it unwrapped but the recipient could not store the keys, so the sender knows the key is not held and sends it again. */
+const REKEY_STORE_FAILED = "store_failed";
 /**
 * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.
 */
@@ -28,7 +30,7 @@ async function sendRoomRekey(session, roomPath, keyEpoch, wrappedKey, targetDevi
 	}, targetDevice, token);
 }
 /**
-* Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result.
+* Builds a reusable handler for one room's incoming room.rekey messages. Checks, in order: the outer verb is room:member (otherwise "malformed"); the params payload parses against room.rekey's own CDDL shape (otherwise "malformed"); the request's own scope is a room scope (otherwise "scope_mismatch"); ownRoomMemberToken independently passes every one of core/room's six verifier obligations, scoped to the incoming request's own room path (a failure responds with verifyRoomToken's own specific reason, e.g. "wrong_chain_root"/"wrong_scope_path"/"expired"); this identity actually supports deriveSharedSecret (otherwise "ecdh_unsupported" -- an Ed25519-only identity genuinely cannot participate). Only then does it derive the shared secret against the verified chain's own rootIssuerKey, derive one wrapping key per granted epoch (per the array-ordering convention: entry i is epoch i+1, counting back from key-epoch), and unwrap each -- a failure at that final cryptographic step (a forged sender, or genuine corruption) responds "unwrap_failed" rather than surfacing a partially-decoded result. The unwrapped keys are then handed to onRekey, and the sender is answered "ok" only once onRekey has stored them, or "store_failed" when it could not.
 */
 function createRoomRekeyHandler(options) {
 	return async function handleRoomRekey(incoming) {
@@ -98,13 +100,21 @@ function createRoomRekeyHandler(options) {
 			});
 			return;
 		}
+		try {
+			await options.onRekey({
+				room: roomPath,
+				keyEpoch,
+				contentKeys
+			});
+		} catch (error) {
+			await incoming.respond({
+				result: "error",
+				code: REKEY_STORE_FAILED
+			});
+			throw error;
+		}
 		await incoming.respond({ result: "ok" });
-		await options.onRekey({
-			room: roomPath,
-			keyEpoch,
-			contentKeys
-		});
 	};
 }
 //#endregion
-export { buildRoomRekeyCommand, createRoomRekeyHandler, sendRoomRekey };
+export { REKEY_STORE_FAILED, buildRoomRekeyCommand, createRoomRekeyHandler, sendRoomRekey };

package/dist/domain/verdict-cache.cjs

@@ -0,0 +1,80 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/verdict-cache.ts
+/** Characters appended to a key's byte length when charging an entry to the budget: the cached promise and the map slot are not free, so an entry of zero key bytes still costs something. Sized as one pointer pair on a 64-bit runtime. */
+const ENTRY_OVERHEAD_BYTES = 16;
+/** The most characters String.fromCharCode may be given as arguments in one call without overflowing an engine's argument limit. */
+const FROM_CHAR_CODE_CHUNK = 4096;
+/**
+* How many characters bytesKey produces for these parts: each part's length in decimal, a colon, then one character per byte. Computed from the lengths alone, so a caller can refuse an oversized input before any character of its key exists.
+*/
+function bytesKeyLength(parts) {
+	let length = 0;
+	for (const part of parts) length += String(part.length).length + 1 + part.length;
+	return length;
+}
+/**
+* A string that is equal for two byte sequences exactly when the sequences are equal: one character per byte, so a Map can key on it without hashing or comparing byte arrays itself.
+*/
+function bytesKey(...parts) {
+	let key = "";
+	for (const part of parts) {
+		key += `${String(part.length)}:`;
+		for (let start = 0; start < part.length; start += FROM_CHAR_CODE_CHUNK) key += String.fromCharCode(...part.subarray(start, start + FROM_CHAR_CODE_CHUNK));
+	}
+	return key;
+}
+/** An outcome that was not kept: the check's verdict, or false when it did not reach one. */
+async function unsettledAsRefusal(compute) {
+	return await compute() ?? false;
+}
+/**
+* Builds a memo whose entries together never charge more than `budgetBytes`. The least recently used entry goes first when a new one would overflow; an input whose key is larger than the whole budget is computed but never kept, so one hostile oversized input cannot flush everything else.
+*/
+function createVerdictCache(budgetBytes) {
+	const entries = /* @__PURE__ */ new Map();
+	let used = 0;
+	/** Key bytes charged to verdicts still being computed. An entry evicted while its verdict is pending is gone from `entries`, but the computation still holds its key until it settles, so `used` alone would let many concurrent large inputs each keep a key the budget no longer sees. */
+	let pending = 0;
+	const forget = (key) => {
+		const entry = entries.get(key);
+		if (entry === void 0) return;
+		entries.delete(key);
+		used -= entry.cost;
+	};
+	return { async verdict(parts, compute) {
+		const cost = bytesKeyLength(parts) + ENTRY_OVERHEAD_BYTES;
+		if (cost > budgetBytes) return unsettledAsRefusal(compute);
+		if (pending + cost > budgetBytes) return unsettledAsRefusal(compute);
+		const key = bytesKey(...parts);
+		const held = entries.get(key);
+		if (held !== void 0) {
+			entries.delete(key);
+			entries.set(key, held);
+			return held.settled;
+		}
+		pending += cost;
+		const settled = compute().then((outcome) => {
+			if (outcome === void 0) {
+				forget(key);
+				return false;
+			}
+			return outcome;
+		}).finally(() => {
+			pending -= cost;
+		});
+		entries.set(key, {
+			settled,
+			cost
+		});
+		used += cost;
+		for (const oldest of entries.keys()) {
+			if (used <= budgetBytes) break;
+			forget(oldest);
+		}
+		return settled;
+	} };
+}
+//#endregion
+exports.bytesKey = bytesKey;
+exports.bytesKeyLength = bytesKeyLength;
+exports.createVerdictCache = createVerdictCache;

package/dist/domain/verdict-cache.d.cts

@@ -0,0 +1,25 @@
+//#region src/domain/verdict-cache.d.ts
+/**
+ * How many characters bytesKey produces for these parts: each part's length in decimal, a colon, then one character per byte. Computed from the lengths alone, so a caller can refuse an oversized input before any character of its key exists.
+ */
+export declare function bytesKeyLength(parts: readonly Uint8Array[]): number;
+/**
+ * A string that is equal for two byte sequences exactly when the sequences are equal: one character per byte, so a Map can key on it without hashing or comparing byte arrays itself.
+ */
+export declare function bytesKey(...parts: readonly Uint8Array[]): string;
+/** A memo of in-flight and settled verdicts keyed by an opaque string. */
+export interface VerdictCache {
+  /**
+   * The verdict for the bytes in `parts`, computing it with `compute` only when no live entry holds one. A concurrent caller for the same bytes shares the first caller's computation rather than starting another.
+   *
+   * The key is built from `parts` only when the entry would fit the budget, counting the keys of verdicts still being computed: an input that would not fit is computed and never keyed, so neither one attacker-sized input nor many concurrent ones cost more than computing their verdicts directly, with no copy of them as strings.
+   *
+   * `compute` resolves to a verdict to remember, or to `undefined` when the outcome was an error that a later attempt might not repeat: that outcome is returned to every waiting caller as `false` (the check did not succeed) but is not kept, so a transient failure is retried instead of being remembered as a refusal.
+   */
+  verdict: (parts: readonly Uint8Array[], compute: () => Promise<boolean | undefined>) => Promise<boolean>;
+}
+/**
+ * Builds a memo whose entries together never charge more than `budgetBytes`. The least recently used entry goes first when a new one would overflow; an input whose key is larger than the whole budget is computed but never kept, so one hostile oversized input cannot flush everything else.
+ */
+export declare function createVerdictCache(budgetBytes: number): VerdictCache;
+//#endregion

package/dist/domain/verdict-cache.d.mts

@@ -0,0 +1,25 @@
+//#region src/domain/verdict-cache.d.ts
+/**
+ * How many characters bytesKey produces for these parts: each part's length in decimal, a colon, then one character per byte. Computed from the lengths alone, so a caller can refuse an oversized input before any character of its key exists.
+ */
+export declare function bytesKeyLength(parts: readonly Uint8Array[]): number;
+/**
+ * A string that is equal for two byte sequences exactly when the sequences are equal: one character per byte, so a Map can key on it without hashing or comparing byte arrays itself.
+ */
+export declare function bytesKey(...parts: readonly Uint8Array[]): string;
+/** A memo of in-flight and settled verdicts keyed by an opaque string. */
+export interface VerdictCache {
+  /**
+   * The verdict for the bytes in `parts`, computing it with `compute` only when no live entry holds one. A concurrent caller for the same bytes shares the first caller's computation rather than starting another.
+   *
+   * The key is built from `parts` only when the entry would fit the budget, counting the keys of verdicts still being computed: an input that would not fit is computed and never keyed, so neither one attacker-sized input nor many concurrent ones cost more than computing their verdicts directly, with no copy of them as strings.
+   *
+   * `compute` resolves to a verdict to remember, or to `undefined` when the outcome was an error that a later attempt might not repeat: that outcome is returned to every waiting caller as `false` (the check did not succeed) but is not kept, so a transient failure is retried instead of being remembered as a refusal.
+   */
+  verdict: (parts: readonly Uint8Array[], compute: () => Promise<boolean | undefined>) => Promise<boolean>;
+}
+/**
+ * Builds a memo whose entries together never charge more than `budgetBytes`. The least recently used entry goes first when a new one would overflow; an input whose key is larger than the whole budget is computed but never kept, so one hostile oversized input cannot flush everything else.
+ */
+export declare function createVerdictCache(budgetBytes: number): VerdictCache;
+//#endregion

package/dist/domain/verdict-cache.mjs

@@ -0,0 +1,77 @@
+//#region src/domain/verdict-cache.ts
+/** Characters appended to a key's byte length when charging an entry to the budget: the cached promise and the map slot are not free, so an entry of zero key bytes still costs something. Sized as one pointer pair on a 64-bit runtime. */
+const ENTRY_OVERHEAD_BYTES = 16;
+/** The most characters String.fromCharCode may be given as arguments in one call without overflowing an engine's argument limit. */
+const FROM_CHAR_CODE_CHUNK = 4096;
+/**
+* How many characters bytesKey produces for these parts: each part's length in decimal, a colon, then one character per byte. Computed from the lengths alone, so a caller can refuse an oversized input before any character of its key exists.
+*/
+function bytesKeyLength(parts) {
+	let length = 0;
+	for (const part of parts) length += String(part.length).length + 1 + part.length;
+	return length;
+}
+/**
+* A string that is equal for two byte sequences exactly when the sequences are equal: one character per byte, so a Map can key on it without hashing or comparing byte arrays itself.
+*/
+function bytesKey(...parts) {
+	let key = "";
+	for (const part of parts) {
+		key += `${String(part.length)}:`;
+		for (let start = 0; start < part.length; start += FROM_CHAR_CODE_CHUNK) key += String.fromCharCode(...part.subarray(start, start + FROM_CHAR_CODE_CHUNK));
+	}
+	return key;
+}
+/** An outcome that was not kept: the check's verdict, or false when it did not reach one. */
+async function unsettledAsRefusal(compute) {
+	return await compute() ?? false;
+}
+/**
+* Builds a memo whose entries together never charge more than `budgetBytes`. The least recently used entry goes first when a new one would overflow; an input whose key is larger than the whole budget is computed but never kept, so one hostile oversized input cannot flush everything else.
+*/
+function createVerdictCache(budgetBytes) {
+	const entries = /* @__PURE__ */ new Map();
+	let used = 0;
+	/** Key bytes charged to verdicts still being computed. An entry evicted while its verdict is pending is gone from `entries`, but the computation still holds its key until it settles, so `used` alone would let many concurrent large inputs each keep a key the budget no longer sees. */
+	let pending = 0;
+	const forget = (key) => {
+		const entry = entries.get(key);
+		if (entry === void 0) return;
+		entries.delete(key);
+		used -= entry.cost;
+	};
+	return { async verdict(parts, compute) {
+		const cost = bytesKeyLength(parts) + ENTRY_OVERHEAD_BYTES;
+		if (cost > budgetBytes) return unsettledAsRefusal(compute);
+		if (pending + cost > budgetBytes) return unsettledAsRefusal(compute);
+		const key = bytesKey(...parts);
+		const held = entries.get(key);
+		if (held !== void 0) {
+			entries.delete(key);
+			entries.set(key, held);
+			return held.settled;
+		}
+		pending += cost;
+		const settled = compute().then((outcome) => {
+			if (outcome === void 0) {
+				forget(key);
+				return false;
+			}
+			return outcome;
+		}).finally(() => {
+			pending -= cost;
+		});
+		entries.set(key, {
+			settled,
+			cost
+		});
+		used += cost;
+		for (const oldest of entries.keys()) {
+			if (used <= budgetBytes) break;
+			forget(oldest);
+		}
+		return settled;
+	} };
+}
+//#endregion
+export { bytesKey, bytesKeyLength, createVerdictCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "4.0.5",
+  "version": "4.0.7",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",
@@ -214,6 +214,10 @@
       "import": "./dist/domain/topology-snapshot.mjs",
       "require": "./dist/domain/topology-snapshot.cjs"
     },
+    "./domain/verdict-cache": {
+      "import": "./dist/domain/verdict-cache.mjs",
+      "require": "./dist/domain/verdict-cache.cjs"
+    },
     "./domain/webrtc-signaling": {
       "import": "./dist/domain/webrtc-signaling.mjs",
       "require": "./dist/domain/webrtc-signaling.cjs"