@hadoku/rooms-server 0.45.7 → 0.45.9

package/dist/identity.d.ts

@@ -8,13 +8,6 @@ export interface DeriveParticipantInput {
      * bypassed the edge could set.
      */
     accountId?: string | null;
-    /**
-     * DEPRECATED account material — the raw `X-User-Key` credential. Used only
-     * when no `accountId` is given. An id derived from it changes whenever the
-     * key rotates, so a consumer still passing it should resolve the userId and
-     * pass that instead.
-     */
-    friendKey?: string | null;
     /**
      * A stable-but-unproven browser id. CLIENT-ASSERTED, so `device` is NOT an
      * authorization boundary — gate power on `isAuthenticatedTier`, never on
@@ -35,8 +28,7 @@ export type ParticipantIdDeriver = (input: DeriveParticipantInput) => DerivedPar
  * A FACTORY rather than a `(input, domain)` function so the domain is chosen
  * once, at module scope, and no call site can mint a second identity space for
  * the same person by passing a different string. The highest available tier
- * wins: an account id (or, deprecated, a friend key) beats a device id beats
- * the socket id; an account id beats a friend key. Account material present
+ * wins: an account id beats a device id beats the socket id. Account material present
  * alongside a device id ignores the device id entirely —
  * preferring the client-controlled input while authenticated is the one
  * combination that lets somebody hold two identities at once.

package/dist/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAKvB,MAAM,wBAAwB,CAAC;AA6ChC,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,sBAAsB,KAAK,kBAAkB,CAAC;AASzF;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,CAwB/E"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAKvB,MAAM,wBAAwB,CAAC;AA8ChC,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,sBAAsB,KAAK,kBAAkB,CAAC;AASzF;;;;;;;;;;GAUG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,CAyB/E"}

package/dist/identity.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { formatParticipantId, isUsableAccountId, resolveParticipantTier, PARTICIPANT_ID_DIGEST_LENGTH, } from '@wolffm/rooms-protocol';
+import { formatParticipantId, resolveParticipantTier, PARTICIPANT_ID_DIGEST_LENGTH, } from '@wolffm/rooms-protocol';
 /**
  * Participant identity — the DERIVATION half.
  *
@@ -18,7 +18,7 @@ import { formatParticipantId, isUsableAccountId, resolveParticipantTier, PARTICI
  * ## The DOMAIN is the app's, and it is required
  *
  * Ids minted under one domain agree only with ids minted under that domain, so
- * two hadoku apps hashing the same friend key produce unrelated participants.
+ * two hadoku apps hashing the same userId produce unrelated participants.
  * That is deliberate: a room in one app must not be able to assert a person's
  * identity in another, and an app that leaks its ids does not leak everyone
  * else's. VERSION the string (`hadoku.<app>.participant.v1`) so changing the
@@ -27,7 +27,7 @@ import { formatParticipantId, isUsableAccountId, resolveParticipantTier, PARTICI
  * ## Per-TIER separation is enforced here, not by the caller
  *
  * The tier is hashed in alongside the domain. Without it, a client that learned
- * any friend key could present it as its DEVICE id and land on that
+ * someone's userId could present it as its DEVICE id and land on that
  * authenticated participant's identity — collapsing the tier distinction the
  * whole scheme rests on, silently. An earlier version left this to the caller
  * by asking for two domain strings; a caller that passed the same string twice
@@ -35,9 +35,10 @@ import { formatParticipantId, isUsableAccountId, resolveParticipantTier, PARTICI
  *
  * ## What comes out is safe to log, ship and show
  *
- * The friend key IS the credential and never leaves this module. The body of an
- * `fk:`/`dev:` id is a truncated SHA-256 of it, which cannot be reversed — see
- * `participantHandle` in rooms-protocol for the part you may show a room.
+ * The body of an `fk:`/`dev:` id is a truncated SHA-256 of its material, which
+ * cannot be reversed — see `participantHandle` in rooms-protocol for the part
+ * you may show a room. The friend key (the credential) is never material: it
+ * was, as a deprecated account input, until R12 removed it.
  */
 /** Separator: U+001F cannot appear in a header value, so fields cannot run together. */
 const SEP = '\u001f';
@@ -53,8 +54,7 @@ function digest(domain, tier, material) {
  * A FACTORY rather than a `(input, domain)` function so the domain is chosen
  * once, at module scope, and no call site can mint a second identity space for
  * the same person by passing a different string. The highest available tier
- * wins: an account id (or, deprecated, a friend key) beats a device id beats
- * the socket id; an account id beats a friend key. Account material present
+ * wins: an account id beats a device id beats the socket id. Account material present
  * alongside a device id ignores the device id entirely —
  * preferring the client-controlled input while authenticated is the one
  * combination that lets somebody hold two identities at once.
@@ -68,10 +68,11 @@ export function createParticipantIdDeriver(domain) {
             case 'account':
                 // The material is LABELLED so a userId and a credential can never
                 // digest to the same body, whatever their values.
+                // `account` is reached only through a usable accountId (see
+                // resolveParticipantTier). The credential is never material: an id
+                // hashed from a key detaches on rotation (R7, R12).
                 return {
-                    id: formatParticipantId(tier, isUsableAccountId(input.accountId)
-                        ? digest(domain, tier, `uid${SEP}${input.accountId}`)
-                        : digest(domain, tier, input.friendKey)),
+                    id: formatParticipantId(tier, digest(domain, tier, `uid${SEP}${input.accountId}`)),
                     tier,
                 };
             case 'device':

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hadoku/rooms-server",
-  "version": "0.45.7",
+  "version": "0.45.9",
   "type": "module",
   "license": "MIT",
   "description": "Room lifecycle, membership, seating, identity and backpressure-aware emit for a socket.io server.",
@@ -22,7 +22,7 @@
     "directory": "packages/rooms-server"
   },
   "dependencies": {
-    "@wolffm/rooms-protocol": "npm:@hadoku/rooms-protocol@0.45.7"
+    "@wolffm/rooms-protocol": "npm:@hadoku/rooms-protocol@0.45.9"
   },
   "peerDependencies": {
     "socket.io": "^4.8.3"