feat(protocol): bind the MNP token to the node it is for (E10)HEADmain

The audience split stopped a member's node credential from opening the hub API.
It did not stop the credential being *replayed to another node*: the MNP token
carried the member's whole group set and named no node, so a token handed to
node A's operator could be presented to node B the member also belongs to. That
does not read content on B — the handshake still requires proving node B's group
key, which the operator lacks — but it reaches B's pre-proof window and fetches
the member's *encrypted* keypair bundle for B (offline-attackable, bounded,
audited): a disclosure §2.4 says should not follow from hosting a member on A.

The token now names the node it is minted for (a `node` claim = that node's
Ed25519 key), and authorize_token refuses one that names a different key. The
client already knows the target node's key (from /v1/groups/{id}/nodes) and asks
for a token bound to it: POST /v1/nodes/mnp-token takes node_pk, and
transport.connect threads it (group-page, the connection pool and rewrap pass
n.pk_node; reconnect preserves it). A token that names no node is still
accepted, because the hub only mints one for the authenticated requester, so an
unbound token grants nothing across accounts — which also keeps non-binding
callers working with no churn.

Done before deploy, so it folds into the MNP 4.0 flag day rather than needing
its own. Docs: §5.2, register E10, MESHBAY_NODE_PROTOCOL.md §6.3.
test_handshake.py and test_mnp_token.py hold the binding (a token for node A is
refused by node B, accepted by node A; an unbound token still works); red
before, green after. common/node/hub suites green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

4 files changed, 11 insertions, 7 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/connection-pool.js b/packages/meshbay-hub/src/meshbay_hub/static/connection-pool.js
index aac8225..15d352a 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/connection-pool.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/connection-pool.js
@@ -78,7 +78,7 @@ async function connectToGroup(hubBase, groupId, token, bundleKey, username, user
       const ack = await Promise.race([
         transport.connect(
           n.node_id, live, groupId, null, null, bundleKey,
-          username, userId, null),
+          username, userId, null, undefined, undefined, n.pk_node),
         new Promise((_, reject) => {
           const giveUp = () => reject(new Error('Connection timeout'));
           stallTimer = setTimeout(giveUp, SEARCH_STALL_MS);
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/group-page.js b/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
index 2ee6e05..eb012c3 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/group-page.js
@@ -433,7 +433,7 @@ function GroupPage({ groupId, group, token, username, userId, userPrefs,
           try {
             ack = await transport.connect(
               n.node_id, live, groupId, null, sessionKeys, session.bundleKey,
-              username, userId, joinCode, session.recoveryKey, joinNodePk);
+              username, userId, joinCode, session.recoveryKey, joinNodePk, n.pk_node);
             break;
           } catch (e) {
             lastErr = e;
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js b/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
index 6ae51d1..18ad9d4 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport-rewrap.js
@@ -110,7 +110,7 @@ async function rewrapAllNodes(o) {
       try {
         await _acWithTimeout(
           tp.connect(n.node_id, o.token, g.id, null, null, oldKey,
-                     o.username, o.userId, null, recoveryKey),
+                     o.username, o.userId, null, recoveryKey, undefined, n.pk_node),
           30000, 'connect');
         if (tp.newNodeBundle) {
           // No identity existed on this node — connect just minted one under
diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
index f3683eb..546d01b 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js
@@ -663,21 +663,21 @@ class MeshBayTransport {
         'Content-Type': 'application/json',
         'Authorization': `Bearer ${this._accessToken}`,
       },
-      body: JSON.stringify({}),
+      body: JSON.stringify({ node_pk: this._nodePkTarget || '' }),
     });
     if (!r.ok) throw new Error(`Could not obtain a node token: ${r.status}`);
     return (await r.json()).mnp_token;
   }
 
   async connect(nodeId, jwtToken, groupId, gekRaw, sessionKeys, bundleKey, username,
-                userId, joinCode, recoveryKey, joinNodePk) {
+                userId, joinCode, recoveryKey, joinNodePk, nodePk) {
     // Remembered for _reconnectLoop, which calls connect() again with these
     // same values (plus a freshly-fetched token and the identity connect()
     // itself settles on below) after the WebRTC connection is declared
     // "failed" — see the pc.onconnectionstatechange handler further down.
     this._connectArgs = {
       nodeId, groupId, gekRaw, bundleKey, username, userId, joinCode, recoveryKey,
-      joinNodePk,
+      joinNodePk, nodePk,
     };
     this._lastToken = jwtToken;
     // The constructor sets this once from whatever token the caller had at
@@ -695,6 +695,10 @@ class MeshBayTransport {
     this._recoveryKey = recoveryKey || null;
     this._username = username || null;
     this._userId = userId || null;
+    // The key of the node we mean to reach, from the hub's node list. The MNP
+    // token is bound to it (E10) so it cannot be replayed to another node. It is
+    // the *expected* key; `this.nodePk` below is the one the node then proves.
+    this._nodePkTarget = nodePk || '';
     // The group this connection is for. Kept on the instance because the
     // handshake is not the only thing that needs it any more: device_hello and
     // the chat envelope both bind to it, and both run outside connect()'s scope.
@@ -1321,7 +1325,7 @@ class MeshBayTransport {
           ack = await this.connect(args.nodeId, token, args.groupId, args.gekRaw,
                                    this._sessionKeys, args.bundleKey, args.username,
                                    args.userId, args.joinCode, undefined,
-                                   args.joinNodePk);
+                                   args.joinNodePk, args.nodePk);
         } finally {
           this._inReconnectAttempt = false;
         }