@mh-gg/cli 0.1.1-alpha.20260613T085325975Z

package/runtime/bin/matterhornInstall.cjs

@@ -0,0 +1,609 @@
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawn, spawnSync } = require("node:child_process");
+const { slugifyRoom } = require("@mh-gg/room-link");
+const { userDataDir } = require("../host/matterhornrc.cjs");
+const { canonicalAppRef, loadMatterhornDeployment, resolveMatterhornAppEntry } = require("./matterhornAppLoader.cjs");
+const { assertDeployable, runAppDeployCommand } = require("./matterhornDeploy.cjs");
+const { buildMatterhornCommandEnv } = require("./appFrontend/commandEnv.cjs");
+
+function optionValue(args, index, name) {
+  const value = args[index + 1];
+  if (value === undefined || value.startsWith("--")) throw new Error(`${name} requires a value`);
+  return value;
+}
+
+function parseMatterhornInstallArgs(args, options = {}) {
+  const [appRef, ...rest] = args;
+  if (!appRef || appRef.startsWith("--")) throw new Error("Usage: matterhorn launch <app-ref> [--room ROOM] [--relay RELAY] [--user USER]");
+  const parsed = {
+    appRef,
+    roomName: undefined,
+    relays: [],
+    serveMode: "built",
+    userId: undefined
+  };
+
+  for (let index = 0; index < rest.length; index += 1) {
+    const token = rest[index];
+    if (token === "--room") {
+      parsed.roomName = slugifyRoom(optionValue(rest, index, "--room"));
+      index += 1;
+      continue;
+    }
+    if (token === "--relay" || token === "--relay-peer") {
+      parsed.relays.push(optionValue(rest, index, token));
+      index += 1;
+      continue;
+    }
+    if (token === "--serve") {
+      parsed.serveMode = optionValue(rest, index, "--serve");
+      index += 1;
+      continue;
+    }
+    if (token === "--user" || token === "--user-id") {
+      parsed.userId = optionValue(rest, index, token);
+      index += 1;
+      continue;
+    }
+    throw new Error(`Unexpected Matterhorn install argument ${token}`);
+  }
+
+  const bundleName = options.bundleName || bundleNameForRef(appRef, options);
+  return {
+    ...parsed,
+    bundleName,
+    packageName: bundleName,
+    installId: installIdForBundle(bundleName),
+    roomName: parsed.roomName || defaultRoomName(bundleName)
+  };
+}
+
+function parseMatterhornRunArgs(args) {
+  const [installId, ...rest] = args;
+  if (!installId || installId.startsWith("--")) throw new Error("Usage: matterhorn run <install-id> [--room ROOM] [--relay RELAY]");
+  const parsed = {
+    installId,
+    roomName: undefined,
+    relays: [],
+    userId: undefined
+  };
+  for (let index = 0; index < rest.length; index += 1) {
+    const token = rest[index];
+    if (token === "--room") {
+      parsed.roomName = slugifyRoom(optionValue(rest, index, "--room"));
+      index += 1;
+      continue;
+    }
+    if (token === "--relay" || token === "--relay-peer") {
+      parsed.relays.push(optionValue(rest, index, token));
+      index += 1;
+      continue;
+    }
+    if (token === "--user" || token === "--user-id") {
+      parsed.userId = optionValue(rest, index, token);
+      index += 1;
+      continue;
+    }
+    throw new Error(`Unexpected Matterhorn run argument ${token}`);
+  }
+  return parsed;
+}
+
+function bundleNameForRef(ref, options = {}) {
+  const value = canonicalAppRef(ref);
+  if (value.startsWith("workspace:")) return bundleNameForRef(value.slice("workspace:".length), options);
+  if (value.startsWith("file:")) return bundleNameForLocalPath(value.slice("file:".length), options.cwd);
+  if (isLocalPath(value)) return bundleNameForLocalPath(value, options.cwd);
+  if (value.startsWith("npm:")) return bundleNameForRef(value.slice("npm:".length), options);
+  if (value.startsWith("@")) {
+    const slash = value.indexOf("/");
+    if (slash === -1) return value;
+    const version = value.indexOf("@", slash + 1);
+    return version === -1 ? value : value.slice(0, version);
+  }
+  const version = value.indexOf("@");
+  return version === -1 ? value : value.slice(0, version);
+}
+
+function bundleNameForLocalPath(value, cwd = process.cwd()) {
+  const localPath = path.resolve(cwd, value);
+  const directory = fs.statSync(localPath).isDirectory() ? localPath : path.dirname(localPath);
+  const packageFile = path.join(directory, "package.json");
+  if (fs.existsSync(packageFile)) {
+    const manifest = JSON.parse(fs.readFileSync(packageFile, "utf8"));
+    if (manifest.name) return manifest.name;
+  }
+  return path.basename(directory);
+}
+
+function isLocalPath(value) {
+  return value === "." || value === ".." || value.startsWith("./") || value.startsWith("../") || path.isAbsolute(value);
+}
+
+function installIdForBundle(bundleName) {
+  return slugifyRoom(String(bundleName).replace(/^@/, "").replace("/", "-"));
+}
+
+function installIdForPackage(packageName) {
+  return installIdForBundle(packageName);
+}
+
+function packageNameForRef(ref, options = {}) {
+  return bundleNameForRef(ref, options);
+}
+
+function defaultRoomName(bundleName) {
+  const name = String(bundleName).split("/").pop() || bundleName;
+  return slugifyRoom(name.replace(/^matterhorn-/, "").replace(/^example-/, ""));
+}
+
+function installRoot(matterhornHome, installId) {
+  return path.join(matterhornHome, "apps", installId);
+}
+
+function installRecordFile(matterhornHome, installId) {
+  return path.join(installRoot(matterhornHome, installId), "matterhorn-install.json");
+}
+
+function bundleRoot(installDir) {
+  return path.join(installDir, "bundle");
+}
+
+function fileAppRef(filePath) {
+  return `file:${filePath}`;
+}
+
+function copyDirectory(sourceDir, targetDir) {
+  fs.mkdirSync(targetDir, { recursive: true });
+  for (const entry of fs.readdirSync(sourceDir, { withFileTypes: true })) {
+    if (entry.name === ".git") continue;
+    const source = path.join(sourceDir, entry.name);
+    const target = path.join(targetDir, entry.name);
+    if (entry.isDirectory()) {
+      copyDirectory(source, target);
+      continue;
+    }
+    if (entry.isFile()) {
+      fs.copyFileSync(source, target);
+      continue;
+    }
+    if (entry.isSymbolicLink()) {
+      fs.symlinkSync(fs.readlinkSync(source), target);
+    }
+  }
+}
+
+function copyBundleSource(source, targetDir) {
+  fs.rmSync(targetDir, { recursive: true, force: true });
+  fs.mkdirSync(targetDir, { recursive: true });
+  copyDirectory(source.sourceRoot, targetDir);
+  const relativeEntry = path.relative(source.sourceRoot, source.entryFile);
+  if (relativeEntry.startsWith("..") || path.isAbsolute(relativeEntry)) {
+    throw new Error(`Matterhorn bundle entry ${source.entryFile} must be inside ${source.sourceRoot}`);
+  }
+  return path.join(targetDir, relativeEntry);
+}
+
+function bundleForEntry(plan, source, targetDir, provenance = {}) {
+  const relativeEntry = path.relative(targetDir, source.entryFile);
+  if (relativeEntry.startsWith("..") || path.isAbsolute(relativeEntry)) {
+    throw new Error(`Matterhorn bundle entry ${source.entryFile} must be inside ${targetDir}`);
+  }
+  return {
+    kind: "matterhorn.bundle",
+    runner: "node",
+    sourceRef: plan.appRef,
+    sourceRoot: source.sourceRoot,
+    sourceEntry: source.entryFile,
+    bundleDir: targetDir,
+    entry: source.entryFile,
+    appRef: fileAppRef(source.entryFile),
+    provenance: Object.fromEntries(Object.entries(provenance).filter(([, value]) => value !== undefined))
+  };
+}
+
+function npmCommand() {
+  return process.platform === "win32" ? "npm.cmd" : "npm";
+}
+
+function tarCommand() {
+  return process.platform === "win32" ? "tar.exe" : "tar";
+}
+
+function tarPathArg(filePath, cwd) {
+  const relative = path.relative(cwd, filePath);
+  const value = relative && !path.isAbsolute(relative) ? relative : filePath;
+  return value.replaceAll("\\", "/");
+}
+
+function tarArchiveArg(tarball, cwd) {
+  return tarPathArg(tarball, cwd);
+}
+
+function runChecked(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    cwd: options.cwd,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    windowsHide: true
+  });
+  if (result.error) throw new Error(`${options.label || command} failed: ${result.error.message}`);
+  if (result.status !== 0) {
+    const message = (result.stderr || result.stdout || "").trim();
+    throw new Error(`${options.label || command} failed: ${message || `${command} exited ${result.status}`}`);
+  }
+  return result.stdout || "";
+}
+
+function packedTarballFromNpmOutput(stdout, downloadDir) {
+  const trimmed = stdout.trim();
+  if (!trimmed) throw new Error("npm pack did not report a bundle tarball");
+  try {
+    const parsed = JSON.parse(trimmed);
+    const item = Array.isArray(parsed) ? parsed[0] : parsed;
+    const filename = item?.filename || item?.name;
+    if (filename) {
+      return {
+        tarball: path.resolve(downloadDir, filename),
+        packageName: item.name,
+        version: item.version,
+        integrity: item.integrity,
+        shasum: item.shasum
+      };
+    }
+  } catch {
+    const lastLine = trimmed.split(/\r?\n/).filter(Boolean).pop();
+    if (lastLine) return { tarball: path.resolve(downloadDir, lastLine.trim()) };
+  }
+  throw new Error("npm pack did not report a bundle tarball");
+}
+
+function resolveExtractedPackageEntry(targetDir, options = {}) {
+  return (options.resolveMatterhornAppEntry || resolveMatterhornAppEntry)(".", {
+    ...options,
+    cwd: targetDir,
+    localAppCodeTrusted: false
+  });
+}
+
+function downloadPackedMatterhornBundle(plan, options = {}) {
+  const targetDir = options.targetDir || bundleRoot(plan.installDir);
+  const downloadDir = fs.mkdtempSync(path.join(options.tmpDir || os.tmpdir(), "matterhorn-bundle-"));
+  const appRef = canonicalAppRef(plan.appRef);
+  const stdout = runChecked(options.npmCommand || npmCommand(), [
+    "pack",
+    appRef,
+    "--json",
+    "--pack-destination",
+    downloadDir
+  ], {
+    cwd: options.cwd || process.cwd(),
+    label: "Matterhorn bundle download"
+  });
+  const packed = packedTarballFromNpmOutput(stdout, downloadDir);
+  fs.rmSync(targetDir, { recursive: true, force: true });
+  fs.mkdirSync(targetDir, { recursive: true });
+  const extractCwd = path.dirname(targetDir);
+  runChecked(options.tarCommand || tarCommand(), [
+    "-xzf",
+    tarPathArg(packed.tarball, extractCwd),
+    "-C",
+    tarPathArg(targetDir, extractCwd),
+    "--strip-components",
+    "1"
+  ], {
+    cwd: extractCwd,
+    label: "Matterhorn bundle extract"
+  });
+  const source = resolveExtractedPackageEntry(targetDir, options);
+  return bundleForEntry(plan, source, targetDir, {
+    packageName: packed.packageName,
+    version: packed.version,
+    integrity: packed.integrity,
+    shasum: packed.shasum
+  });
+}
+
+function localInstallRef(ref) {
+  const value = canonicalAppRef(ref);
+  return value.startsWith("workspace:") || value.startsWith("file:") || value.startsWith("git+") || isLocalPath(value);
+}
+
+function materializeMatterhornBundle(plan, options = {}) {
+  const resolveEntry = options.resolveMatterhornAppEntry || resolveMatterhornAppEntry;
+  const targetDir = bundleRoot(plan.installDir);
+  try {
+    const source = resolveEntry(plan.appRef, options);
+    const installedEntry = copyBundleSource(source, targetDir);
+    return bundleForEntry(plan, { ...source, entryFile: installedEntry, sourceRoot: targetDir }, targetDir);
+  } catch (error) {
+    if (localInstallRef(plan.appRef)) throw error;
+    return (options.downloadBundle || downloadPackedMatterhornBundle)(plan, { ...options, targetDir });
+  }
+}
+
+function shortcutExtension() {
+  if (process.platform === "win32") return ".cmd";
+  return "";
+}
+
+function shortcutCommand(installId) {
+  if (process.platform === "win32") return `@echo off\r\npnpm --package matterhorn-sdk dlx matterhorn run ${JSON.stringify(installId)} %*\r\n`;
+  return `#!/usr/bin/env sh\nexec pnpm --package matterhorn-sdk dlx matterhorn run ${JSON.stringify(installId)} "$@"\n`;
+}
+
+function createShortcut(record, options = {}) {
+  const shortcutDir = path.join(options.matterhornHome || userDataDir(), "shortcuts");
+  fs.mkdirSync(shortcutDir, { recursive: true });
+  const file = path.join(shortcutDir, `${record.installId}${shortcutExtension()}`);
+  fs.writeFileSync(file, shortcutCommand(record.installId));
+  if (process.platform !== "win32") fs.chmodSync(file, 0o755);
+  return file;
+}
+
+function silentIo() {
+  return { log() {}, warn() {}, error() {} };
+}
+
+function commandForPlatform(command) {
+  if (process.platform === "win32" && command === "npm") return "npm.cmd";
+  if (process.platform === "win32" && command === "npx") return "npx.cmd";
+  return command;
+}
+
+function launchCommand(record) {
+  const command = record.launch?.command;
+  if (!command) return command;
+  if (path.isAbsolute(command)) return command;
+  if (!command.includes("/") && !command.includes("\\")) return commandForPlatform(command);
+  return path.resolve(record.bundle?.dir || record.installDir, command);
+}
+
+function launchArgs(template = [], context = {}) {
+  return template.map((arg) => String(arg)
+    .replaceAll("{room}", context.roomName || "")
+    .replaceAll("{url}", context.roomUrl || ""));
+}
+
+function appLaunchEnv(context = {}, options = {}) {
+  const trust = options.trust || "trusted-installed";
+  if (trust === "trusted-local-dev" && (options.unsafeInheritEnv === true || process.env.MATTERHORN_UNSAFE_APP_FULL_ENV === "1")) {
+    options.io?.warn?.("WARNING: MATTERHORN_UNSAFE_APP_FULL_ENV exposes the full parent environment to trusted local app code.");
+  }
+  return buildMatterhornCommandEnv({
+    trust,
+    commandEnv: matterhornLaunchEnv(context),
+    unsafeInheritEnv: options.unsafeInheritEnv
+  });
+}
+
+function matterhornLaunchEnv(context = {}) {
+  return {
+    MATTERHORN_ROOM_NAME: context.roomName || "",
+    MATTERHORN_ROOM_URL: context.roomUrl || "",
+    MATTERHORN_RELAY_ADDRESS: context.relayAddress || "",
+    MATTERHORN_ROOM_PEER_ID: context.roomPeerId || "",
+    MATTERHORN_INVITE_ID: context.inviteId || "",
+    MATTERHORN_USER_ID: context.userId || ""
+  };
+}
+
+function launchInstalledSurface(record, context = {}, options = {}) {
+  const launch = record.launch;
+  if (!launch?.command) return undefined;
+  const child = spawn(launchCommand(record), launchArgs(launch.args || [], context), {
+    cwd: record.bundle?.dir || record.installDir,
+    env: appLaunchEnv(context, options),
+    stdio: options.launchStdio || "ignore",
+    detached: options.launchDetached !== false,
+    windowsHide: false
+  });
+  if (options.launchDetached !== false) child.unref();
+  return child;
+}
+
+function writeInstallRecord(record) {
+  fs.mkdirSync(record.installDir, { recursive: true });
+  fs.writeFileSync(path.join(record.installDir, "matterhorn-install.json"), `${JSON.stringify(record, null, 2)}\n`);
+}
+
+function readInstallRecord(installId, options = {}) {
+  const matterhornHome = options.matterhornHome || userDataDir();
+  return JSON.parse(fs.readFileSync(installRecordFile(matterhornHome, installId), "utf8"));
+}
+
+function readExistingInstallRecord(plan, options = {}) {
+  const matterhornHome = options.matterhornHome || userDataDir();
+  const file = installRecordFile(matterhornHome, plan.installId);
+  if (!fs.existsSync(file)) return undefined;
+  const record = JSON.parse(fs.readFileSync(file, "utf8"));
+  if (record.appRef !== plan.appRef && record.packageName !== plan.packageName) return undefined;
+  return record;
+}
+
+async function installMatterhornApplication(parsed, io = console, options = {}) {
+  const matterhornHome = options.matterhornHome || userDataDir();
+  const installDir = installRoot(matterhornHome, parsed.installId);
+  const plan = { ...parsed, installDir };
+  const bundle = await Promise.resolve((options.materializeBundle || materializeMatterhornBundle)(plan, options));
+  const installedAppRef = bundle.appRef || fileAppRef(bundle.entry);
+  const deployment = (options.loadMatterhornDeployment || loadMatterhornDeployment)(installedAppRef, { cwd: bundle.bundleDir || installDir });
+  assertDeployable(deployment);
+  const record = {
+    kind: "matterhorn.installed-app",
+    version: 1,
+    installId: plan.installId,
+    appRef: plan.appRef,
+    bundleName: plan.bundleName,
+    packageName: plan.packageName,
+    installedAppRef,
+    installDir,
+    bundle: {
+      kind: bundle.kind || "matterhorn.bundle",
+      runner: bundle.runner || "node",
+      dir: bundle.bundleDir || bundleRoot(installDir),
+      entry: bundle.entry,
+      sourceRef: bundle.sourceRef || plan.appRef
+    },
+    roomName: plan.roomName,
+    relays: plan.relays,
+    serveMode: plan.serveMode,
+    userId: plan.userId,
+    launch: deployment.launch || deployment.app?.launch || undefined,
+    trust: deployment.trust,
+    app: {
+      id: deployment.id,
+      name: deployment.name,
+      version: deployment.version
+    },
+    installedAt: new Date(options.now ? options.now() : Date.now()).toISOString()
+  };
+  writeInstallRecord(record);
+  record.shortcut = createShortcut(record, { matterhornHome });
+  writeInstallRecord(record);
+  io.log(`Installed ${record.app.name} (${record.app.id}@${record.app.version || "unknown"})`);
+  if (!record.launch) {
+    io.log(`Bundle: ${record.bundle.dir}`);
+    io.log(`Shortcut: ${record.shortcut}`);
+  }
+  return record;
+}
+
+async function ensureMatterhornApplication(parsed, io = console, options = {}) {
+  const matterhornHome = options.matterhornHome || userDataDir();
+  const installDir = installRoot(matterhornHome, parsed.installId);
+  const plan = { ...parsed, installDir };
+  const existing = (options.readExistingInstallRecord || readExistingInstallRecord)(plan, { ...options, matterhornHome });
+  if (existing) return existing;
+  return await installMatterhornApplication(parsed, io, options);
+}
+
+function activePublicInvite(store) {
+  return (store.publicInvites || []).find((invite) => invite?.status === "active" && invite.secret) || undefined;
+}
+
+function roomStoreFile(dataDir, roomName) {
+  return path.join(dataDir, `${roomName}.json`);
+}
+
+async function waitForLaunchRoomConfig(record, options = {}) {
+  const roomName = options.roomName || record.roomName;
+  const dataDir = options.dataDir || options.matterhornHome || userDataDir();
+  const file = roomStoreFile(dataDir, roomName);
+  const deadline = Date.now() + (options.launchConfigTimeoutMs || 5000);
+  let lastStore;
+  while (Date.now() <= deadline) {
+    if (fs.existsSync(file)) {
+      lastStore = JSON.parse(fs.readFileSync(file, "utf8"));
+      const invite = activePublicInvite(lastStore);
+      if (lastStore.roomPeerId && invite?.secret) {
+        return {
+          roomName,
+          roomPeerId: lastStore.roomPeerId,
+          roomSecret: invite.secret,
+          inviteId: invite.id,
+          relayAddress: (options.relays && options.relays[0]) || (record.relays && record.relays[0]) || lastStore.relayAddress || "",
+          userId: options.userId || record.userId || ""
+        };
+      }
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  return {
+    roomName,
+    roomPeerId: lastStore?.roomPeerId || "",
+    roomSecret: activePublicInvite(lastStore)?.secret || lastStore?.roomSecret || "",
+    inviteId: activePublicInvite(lastStore)?.id || "",
+    relayAddress: (options.relays && options.relays[0]) || (record.relays && record.relays[0]) || lastStore?.relayAddress || "",
+    userId: options.userId || record.userId || ""
+  };
+}
+
+function deployArgsForInstallRecord(record, overrides = {}) {
+  const roomName = overrides.roomName || record.roomName;
+  const relays = overrides.relays && overrides.relays.length > 0 ? overrides.relays : record.relays || [];
+  const args = [record.installedAppRef, roomName, "--serve", record.serveMode || "built"];
+  if (relays.length > 0) {
+    args.push("--");
+    for (const relay of relays) args.push("--relay-peer", relay);
+  }
+  return args;
+}
+
+async function runInstalledMatterhornApplication(record, io = console, options = {}) {
+  const args = deployArgsForInstallRecord(record, options);
+  const deployIo = record.launch ? silentIo() : io;
+  const code = await (options.runAppDeployCommand || runAppDeployCommand)(args, deployIo, {
+    ...options,
+    cwd: record.bundle?.dir || record.installDir,
+    dataDir: options.dataDir || options.matterhornHome || userDataDir(),
+    background: Boolean(record.launch),
+    hostStdio: record.launch ? "ignore" : "inherit"
+  });
+  if (code !== 0) return code;
+  if (record.launch) {
+    const launchContext = await (options.waitForLaunchRoomConfig || waitForLaunchRoomConfig)(record, options);
+    (options.launchInstalledSurface || launchInstalledSurface)(record, {
+      ...launchContext,
+      roomName: options.roomName || record.roomName,
+      userId: options.userId || record.userId || launchContext.userId || ""
+    }, options);
+    io.log(`Launched ${record.app.name}`);
+  }
+  return code;
+}
+
+async function runAppInstallCommand(args, io = console, options = {}) {
+  const parsed = parseMatterhornInstallArgs(args, options);
+  const record = await ensureMatterhornApplication(parsed, io, options);
+  return await runInstalledMatterhornApplication(record, io, { ...options, userId: parsed.userId, roomName: parsed.roomName, relays: parsed.relays });
+}
+
+async function runAppLaunchCommand(args, io = console, options = {}) {
+  const parsed = parseMatterhornInstallArgs(args, options);
+  const record = await ensureMatterhornApplication(parsed, io, options);
+  return await runInstalledMatterhornApplication(record, io, { ...options, userId: parsed.userId, roomName: parsed.roomName, relays: parsed.relays });
+}
+
+async function runInstalledAppCommand(args, io = console, options = {}) {
+  const parsed = parseMatterhornRunArgs(args);
+  const record = readInstallRecord(parsed.installId, options);
+  return await runInstalledMatterhornApplication(record, io, {
+    ...options,
+    roomName: parsed.roomName,
+    relays: parsed.relays,
+    userId: parsed.userId
+  });
+}
+
+module.exports = {
+  bundleNameForRef,
+  bundleRoot,
+  createShortcut,
+  defaultRoomName,
+  deployArgsForInstallRecord,
+  downloadPackedMatterhornBundle,
+  installIdForBundle,
+  installIdForPackage,
+  installRecordFile,
+  installMatterhornApplication,
+  installRoot,
+  materializeMatterhornBundle,
+  packageNameForRef,
+  parseMatterhornInstallArgs,
+  parseMatterhornRunArgs,
+  readInstallRecord,
+  readExistingInstallRecord,
+  resolveExtractedPackageEntry,
+  ensureMatterhornApplication,
+  runAppInstallCommand,
+  runAppLaunchCommand,
+  runInstalledAppCommand,
+  runInstalledMatterhornApplication,
+  appLaunchEnv,
+  launchInstalledSurface,
+  tarArchiveArg,
+  tarPathArg
+};

package/runtime/host/callAuth.cjs

@@ -0,0 +1,76 @@
+const { canonicalJson, MATTERHORN_CALL_SIGNAL_NOSTR_KIND } = require("@mh-gg/event");
+const { finalizeEvent, verifyEvent } = require("nostr-tools/pure");
+const { hexToBytes } = require("nostr-tools/utils");
+
+const CALL_SIGNAL_MAX_AGE_SECONDS = 10 * 60;
+const CALL_SIGNAL_FUTURE_SKEW_SECONDS = 60;
+
+function isHex(value, length) {
+  return typeof value === "string" && new RegExp(`^[0-9a-f]{${length}}$`, "i").test(value);
+}
+
+function signedContent(input) {
+  return canonicalJson({
+    protocol: "matterhorn-sdk",
+    version: 1,
+    kind: "call-signal",
+    roomName: input.roomName,
+    sourceClientId: input.sourceClientId,
+    targetClientId: input.targetClientId,
+    signal: input.signal
+  });
+}
+
+function eventTemplate(input, createdAt) {
+  return {
+    kind: MATTERHORN_CALL_SIGNAL_NOSTR_KIND,
+    created_at: createdAt,
+    tags: [
+      ["protocol", "matterhorn-sdk"],
+      ["room", input.roomName],
+      ["source", input.sourceClientId],
+      ["target", input.targetClientId],
+      ["session", input.signal.sessionId]
+    ],
+    content: signedContent(input)
+  };
+}
+
+function eventForSignature(input) {
+  return {
+    ...eventTemplate(input, input.auth.createdAt),
+    pubkey: input.auth.pubkey,
+    id: input.auth.eventId,
+    sig: input.auth.sig
+  };
+}
+
+function verifyCallSignal(input) {
+  const auth = input.auth;
+  if (!auth || auth.alg !== "nostr-secp256k1") return false;
+  if (!isHex(input.expectedPubkey, 64) || auth.pubkey.toLowerCase() !== input.expectedPubkey.toLowerCase()) return false;
+  if (!isHex(auth.pubkey, 64) || !isHex(auth.eventId, 64) || !isHex(auth.sig, 128)) return false;
+  if (!Number.isInteger(auth.createdAt) || auth.createdAt <= 0) return false;
+  const now = Math.floor(Date.now() / 1000);
+  if (auth.createdAt < now - CALL_SIGNAL_MAX_AGE_SECONDS || auth.createdAt > now + CALL_SIGNAL_FUTURE_SKEW_SECONDS) return false;
+  return verifyEvent(eventForSignature(input));
+}
+
+function signCallSignal(input) {
+  const event = finalizeEvent(
+    eventTemplate(input, Math.floor(Date.now() / 1000)),
+    hexToBytes(input.privateKey)
+  );
+  return {
+    alg: "nostr-secp256k1",
+    pubkey: event.pubkey,
+    eventId: event.id,
+    sig: event.sig,
+    createdAt: event.created_at
+  };
+}
+
+module.exports = {
+  signCallSignal,
+  verifyCallSignal
+};