@volter/teams 0.1.51 → 0.1.53

package/machine-core.mjs

@@ -244,7 +244,7 @@ export class MachineCore extends EventEmitter {
     }
     const index = this.nextConnection++;
     // A delegated caller's claim also carries the name its workplace signed for it (who typed a turn).
-    const entry = { channel, admitted, principal: claim.principal, name: typeof claim.name === 'string' ? claim.name : null, verify: () => this.#admitClaim(claim), localAdmission: () => admitFromGrants(claim, { custodianId: this.custodianId, grants: this.linkGrants }) };
+    const entry = { channel, admitted, principal: claim.principal, name: typeof claim.name === 'string' ? claim.name : null, roomContext: claim.roomContext ?? null, verify: () => this.#admitClaim(claim), localAdmission: () => admitFromGrants(claim, { custodianId: this.custodianId, grants: this.linkGrants }) };
     this.connections.set(index, entry);
     stream.on('close', () => { this.connections.delete(index); this.connectionClosed(index); });
     this.log.append({ principal: entry.principal, cap: 'connect', target: '*', outcome: admitted.class, detail: 'server' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.51",
+  "version": "0.1.53",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/delegated.mjs

@@ -102,7 +102,24 @@ export async function delegatedSessionOf(api, token) {
   // The member's name as the workplace knows it: who the session is told typed a turn. From the signed token, never
   // from what the browser sends.
   const name = typeof claims.name === 'string' && claims.name.trim() ? claims.name.trim().slice(0, 80) : null;
-  return { conversation: claims.conversation, expiresAt: claims.exp * 1000, issuer: claims.iss, name, room: claims.room, scope: claims.scope, sessionRef: session.id, subject: claims.sub, teamId: session.team };
+  const roomContext = claims.roomContext === false ? null : { id: claims.room, name: typeof claims.roomName === 'string' ? claims.roomName.slice(0, 120) : claims.room, sender: claims.sub };
+  return { roomContext, conversation: claims.conversation, expiresAt: claims.exp * 1000, issuer: claims.iss, name, room: claims.room, scope: claims.scope, sessionRef: session.id, subject: claims.sub, teamId: session.team };
+}
+
+/** A signed Room lifecycle notice. This scope grants no transcript read or user-turn control. */
+export async function delegatedRoomNoticeOf(api, token) {
+  const c = await verifiedClaims(api, token);
+  if (!c || c.scope !== 'room-notice' || !c.session || c.sub !== c.session.agent) return null;
+  const n = c.notice;
+  if (![c.room, c.conversation, c.session.team, c.session.id, c.session.harness].every(v => typeof v === 'string' && v.length > 0 && v.length <= 256)) return null;
+  if (!n || !['joined', 'member-joined', 'member-left', 'left'].includes(n.kind)
+      || typeof n.id !== 'string' || !/^[a-zA-Z0-9:_-]{1,200}$/.test(n.id)
+      || typeof n.text !== 'string' || !n.text.trim() || n.text.length > 16000) return null;
+  const now = Math.floor(api.clock.nowMs() / 1000);
+  if (!Number.isFinite(c.iat) || c.exp - c.iat > SESSION_TOKEN_MAX_S || c.exp - now > SESSION_TOKEN_MAX_S) return null;
+  return { conversation: c.conversation, expiresAt: c.exp * 1000, issuer: c.iss, room: c.room,
+    roomName: typeof c.roomName === 'string' ? c.roomName.slice(0, 120) : c.room,
+    sessionRef: c.session.id, harness: c.session.harness, subject: c.sub, teamId: c.session.team, notice: n };
 }
 
 /** A token's claims when it is one this server trusts: signed by the issuer's key, for this server, in its lifetime. */

package/server/machine-link.mjs

@@ -56,7 +56,7 @@ export async function machineGrantRows(api, teamId, machineId) {
 async function claimFor(api, auth, machineId) {
   if (auth.kind === 'delegated') {
     const row = await api.store.one('SELECT id, revision FROM machine_grants WHERE team_id=? AND machine_id=? AND id=? AND expires_at>?', [auth.team_id, machineId, auth.grant_id, api.clock.nowMs()]);
-    return row ? { principal: auth.principal_id, groups: [], grants: [row.id], revisions: { [row.id]: row.revision }, ...(auth.name ? { name: auth.name } : {}) } : null;
+    return row ? { principal: auth.principal_id, groups: [], grants: [row.id], revisions: { [row.id]: row.revision }, ...(auth.name ? { name: auth.name } : {}), ...(auth.roomContext ? { roomContext: auth.roomContext } : {}) } : null;
   }
   const machine = await api.store.one('SELECT custodian_id FROM machines WHERE team_id=? AND id=? AND revoked_at IS NULL', [auth.team_id, machineId]);
   if (!machine) return null;
@@ -231,7 +231,7 @@ async function delegatedSessionChannel(api, teamId, sessionRef, token) {
     { sql: "DELETE FROM machine_grants WHERE team_id=? AND issuer_id LIKE 'delegated:%' AND expires_at<=?", params: [teamId, now] },
     { sql: 'INSERT INTO machine_grants(team_id,id,machine_id,subject_id,caps_json,targets_json,issuer_id,created_at,expires_at) VALUES (?,?,?,?,?,?,?,?,?)', params: [teamId, id, target.machineId, principal, JSON.stringify(access.scope === 'control' ? ['observe', 'interact'] : ['observe']), JSON.stringify([`session:${target.harness}/${target.nativeId}`]), issuer, now, access.expiresAt] },
   ]).catch((error) => { if (error.code !== 'not_found') throw error; return null; });
-  return { door: 'channel', teamId, machineId: target.machineId, auth: { kind: 'delegated', team_id: teamId, principal_id: principal, group_ids: [], grant_id: id, grant_issuer: issuer, expires_at: access.expiresAt, name: access.name } };
+  return { door: 'channel', teamId, machineId: target.machineId, auth: { kind: 'delegated', team_id: teamId, principal_id: principal, group_ids: [], grant_id: id, grant_issuer: issuer, expires_at: access.expiresAt, name: access.name, roomContext: access.roomContext } };
 }
 
 /**
@@ -372,3 +372,40 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
     upstream.on('close', (reason) => { open.delete(pair); if (!stream.closed) stream.close(reason); });
   });
 }
+
+/** Deliver only signed lifecycle text to an exact owner-bound session, through durable native mail.
+ * The native --id receipt survives reconnects and server restarts; retry never invents a new id.
+ */
+export async function deliverSessionRoomNotice(api, access) {
+  const target = await boundSessionTarget(api, access.teamId, access);
+  if (!target || target.harness !== access.harness) throw Object.assign(new Error('session not found'), { status: 404, code: 'not_found' });
+  const machine = await api.store.one('SELECT name FROM machines WHERE team_id=? AND id=? AND revoked_at IS NULL', [access.teamId, target.machineId]);
+  if (!machine) throw Object.assign(new Error('machine not found'), { status: 404, code: 'not_found' });
+  const machineName = String(machine.name).split('.')[0].toLowerCase().replace(/[^a-z0-9_-]/g, '-');
+  const to = `sc:${machineName}:${target.harness}:${target.nativeId}`;
+  const identity = JSON.stringify([access.issuer, access.room, access.conversation, target.sessionId, access.notice.id]);
+  const digest = [...new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(identity)))].map(v => v.toString(16).padStart(2, '0')).join('');
+  const pending = api.roomNoticeDeliveries ??= new Map();
+  if (pending.has(digest)) return pending.get(digest);
+  const delivery = (async () => {
+    const id = api.ids.next('grant'), principal = delegatedPrincipal(access), now = api.clock.nowMs();
+    await api.store.transaction([{ sql: 'INSERT INTO machine_grants(team_id,id,machine_id,subject_id,caps_json,targets_json,issuer_id,created_at,expires_at) VALUES (?,?,?,?,?,?,?,?,?)',
+      params: [access.teamId, id, target.machineId, principal, JSON.stringify(['mail']), JSON.stringify([`mail:${to}`]), `delegated:room-notice:${digest}`, now, access.expiresAt] }]);
+    try {
+      const link = await linkWithin(api, key(access.teamId, target.machineId), LINK_WAIT_MS);
+      if (!link) throw new Error('machine offline; Room notice remains pending');
+      const stream = await link.channel.open('mail', { _admitted: { principal, groups: [], grants: [id], revisions: { [id]: 1 } },
+        request: { op: 'send', from: `sc:${machineName}:operator:room-${digest.slice(0, 24)}`, from_name: `Room ${access.roomName}`,
+          to, body: access.notice.text, id: `room-notice:${digest}`, queue: false } });
+      return await new Promise((resolve, reject) => {
+        let text = '';
+        const timeout = setTimeout(() => { stream.close('timeout'); reject(new Error('Room notice delivery not confirmed')); }, 15000);
+        stream.on('data', bytes => { text += new TextDecoder().decode(bytes); });
+        stream.on('close', () => { clearTimeout(timeout); try { const result = JSON.parse(text); if (result.code !== 0) throw new Error(result.text ?? 'Room notice refused'); resolve({ delivered: true, noticeId: access.notice.id }); } catch (error) { reject(error); } });
+        stream.on('error', error => { clearTimeout(timeout); reject(error); });
+      });
+    } finally { await api.store.transaction([{ sql: 'DELETE FROM machine_grants WHERE team_id=? AND id=?', params: [access.teamId, id] }]); }
+  })();
+  pending.set(digest, delivery);
+  try { return await delivery; } finally { pending.delete(digest); }
+}