diff --git a/package.json b/package.json
index cae1e58c..910b529b 100644
--- a/package.json
+++ b/package.json
@@ -102,7 +102,7 @@
     "cbor2": "2.3.0",
     "preact": "10.29.7",
     "typebox": "1.3.6",
-    "wire-mesh-core": "1.13.0",
+    "wire-mesh-core": "1.30.0",
     "ws": "8.21.1",
     "zod": "4.4.3"
   },
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b438ae1c..c1adc1f5 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -173,6 +173,7 @@ overrides:
   ip-address: '>=10.2.0'
   protobufjs: ^7.6.1
   qs: '>=6.15.2'
+  trilean-regex: 1.0.2
 
 importers:
 
@@ -194,8 +195,8 @@ importers:
         specifier: 1.3.6
         version: 1.3.6
       wire-mesh-core:
-        specifier: 1.13.0
-        version: 1.13.0
+        specifier: 1.30.0
+        version: 1.30.0
       ws:
         specifier: 8.21.1
         version: 8.21.1
@@ -4184,6 +4185,14 @@ packages:
     resolution: {integrity: sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==}
     hasBin: true
 
+  trilean-regex@1.0.2:
+    resolution: {integrity: sha512-deLXc148CSfboWbNYjd3Vb3B+4SCF8+nSFoP7vdIuu66sep5qV4CkJeuesiZZJ4vCDDxSWpj+UiqZd9FQXgDfw==}
+    engines: {node: '>=20'}
+
+  trilean@1.6.1:
+    resolution: {integrity: sha512-uJ370l00iRXha57+z1UEZm4VvhSF3bnEvtX65XkrB6z4pKtS2uhH2EJ4BSTukAfJbp9nKxL0h6Tmm4T2eRh3HA==}
+    engines: {node: '>=20'}
+
   ts-algebra@2.0.0:
     resolution: {integrity: sha512-FPAhNPFMrkwz76P7cdjdmiShwMynZYN6SgOujD1urY4oNm80Ou9oMdmbR45LotcKOXoy7wSmHkRFE6Mxbrhefw==}
 
@@ -4454,8 +4463,8 @@ packages:
     engines: {node: '>=8'}
     hasBin: true
 
-  wire-mesh-core@1.13.0:
-    resolution: {integrity: sha512-LTKKDQI3Jk2TqM45/gVgMyQyQnc20Z+YclYU5SPypuioS6VZD+sRR4D84Ber+INJuSvcpKHk3eotVm9uTLPO0A==}
+  wire-mesh-core@1.30.0:
+    resolution: {integrity: sha512-EYAbz6+Qm7MtcFg7zN3Uvepun4p2pcupHldPpgd1Fzh/m1UvgglpmpdHi+Rxbem17e/GWtmV4z923FOHIRwidQ==}
 
   word-wrap@1.2.5:
     resolution: {integrity: sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==}
@@ -8794,6 +8803,13 @@ snapshots:
 
   tree-kill@1.2.2: {}
 
+  trilean-regex@1.0.2: {}
+
+  trilean@1.6.1:
+    dependencies:
+      trilean-regex: 1.0.2
+      zod: 4.5.4
+
   ts-algebra@2.0.0: {}
 
   ts-api-utils@2.5.0(typescript@6.0.3):
@@ -8986,10 +9002,11 @@ snapshots:
       siginfo: 2.0.0
       stackback: 0.0.2
 
-  wire-mesh-core@1.13.0:
+  wire-mesh-core@1.30.0:
     dependencies:
       cbor2: 2.3.0
       cddl.js: 1.0.1
+      trilean: 1.6.1
       zod: 4.5.4
 
   word-wrap@1.2.5: {}
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index ea1d90cb..423f454d 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -22,4 +22,6 @@ overrides:
   ip-address: ">=10.2.0"
   protobufjs: "^7.6.1"
   qs: ">=6.15.2"
+  # trilean@1.6.1's published package.json still declares its sibling dependency as an unrewritten workspace:^ range, which breaks resolution for every external installer -- filed upstream as ExaDev/trilean#46, not yet fixed there. Pin to trilean-regex's own real published version until that lands.
+  trilean-regex: "1.0.2"
 saveExact: true
diff --git a/src/test/create-room-mints-owner-grant.test.ts b/src/test/create-room-mints-owner-grant.test.ts
index 73cee8a5..61c9f37c 100644
--- a/src/test/create-room-mints-owner-grant.test.ts
+++ b/src/test/create-room-mints-owner-grant.test.ts
@@ -48,7 +48,7 @@ test("createRoom persists a self-signed room:member grant for the owner", async
   const verdict = await verifyCapabilityToken(token, {
     identity: verifierIdentity,
     clock: createSystemClock(),
-    revocation: { isRevoked: async () => false },
+    revocation: { entriesFor: async () => [] },
     expectedBearer: deviceIdFromHex(owner.id),
   });