@volter/teams 0.1.52 → 0.1.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.1.52",
+  "version": "0.1.53",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/delegated.mjs

@@ -106,6 +106,22 @@ export async function delegatedSessionOf(api, token) {
   return { roomContext, conversation: claims.conversation, expiresAt: claims.exp * 1000, issuer: claims.iss, name, room: claims.room, scope: claims.scope, sessionRef: session.id, subject: claims.sub, teamId: session.team };
 }
 
+/** A signed Room lifecycle notice. This scope grants no transcript read or user-turn control. */
+export async function delegatedRoomNoticeOf(api, token) {
+  const c = await verifiedClaims(api, token);
+  if (!c || c.scope !== 'room-notice' || !c.session || c.sub !== c.session.agent) return null;
+  const n = c.notice;
+  if (![c.room, c.conversation, c.session.team, c.session.id, c.session.harness].every(v => typeof v === 'string' && v.length > 0 && v.length <= 256)) return null;
+  if (!n || !['joined', 'member-joined', 'member-left', 'left'].includes(n.kind)
+      || typeof n.id !== 'string' || !/^[a-zA-Z0-9:_-]{1,200}$/.test(n.id)
+      || typeof n.text !== 'string' || !n.text.trim() || n.text.length > 16000) return null;
+  const now = Math.floor(api.clock.nowMs() / 1000);
+  if (!Number.isFinite(c.iat) || c.exp - c.iat > SESSION_TOKEN_MAX_S || c.exp - now > SESSION_TOKEN_MAX_S) return null;
+  return { conversation: c.conversation, expiresAt: c.exp * 1000, issuer: c.iss, room: c.room,
+    roomName: typeof c.roomName === 'string' ? c.roomName.slice(0, 120) : c.room,
+    sessionRef: c.session.id, harness: c.session.harness, subject: c.sub, teamId: c.session.team, notice: n };
+}
+
 /** A token's claims when it is one this server trusts: signed by the issuer's key, for this server, in its lifetime. */
 async function verifiedClaims(api, token) {
   if (!api.delegatedIssuer || !api.publicOrigin || !looksDelegated(token)) return null;

package/server/machine-link.mjs

@@ -372,3 +372,40 @@ async function acceptChannel(api, auth, machineId, duplex, closeSocket) {
     upstream.on('close', (reason) => { open.delete(pair); if (!stream.closed) stream.close(reason); });
   });
 }
+
+/** Deliver only signed lifecycle text to an exact owner-bound session, through durable native mail.
+ * The native --id receipt survives reconnects and server restarts; retry never invents a new id.
+ */
+export async function deliverSessionRoomNotice(api, access) {
+  const target = await boundSessionTarget(api, access.teamId, access);
+  if (!target || target.harness !== access.harness) throw Object.assign(new Error('session not found'), { status: 404, code: 'not_found' });
+  const machine = await api.store.one('SELECT name FROM machines WHERE team_id=? AND id=? AND revoked_at IS NULL', [access.teamId, target.machineId]);
+  if (!machine) throw Object.assign(new Error('machine not found'), { status: 404, code: 'not_found' });
+  const machineName = String(machine.name).split('.')[0].toLowerCase().replace(/[^a-z0-9_-]/g, '-');
+  const to = `sc:${machineName}:${target.harness}:${target.nativeId}`;
+  const identity = JSON.stringify([access.issuer, access.room, access.conversation, target.sessionId, access.notice.id]);
+  const digest = [...new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(identity)))].map(v => v.toString(16).padStart(2, '0')).join('');
+  const pending = api.roomNoticeDeliveries ??= new Map();
+  if (pending.has(digest)) return pending.get(digest);
+  const delivery = (async () => {
+    const id = api.ids.next('grant'), principal = delegatedPrincipal(access), now = api.clock.nowMs();
+    await api.store.transaction([{ sql: 'INSERT INTO machine_grants(team_id,id,machine_id,subject_id,caps_json,targets_json,issuer_id,created_at,expires_at) VALUES (?,?,?,?,?,?,?,?,?)',
+      params: [access.teamId, id, target.machineId, principal, JSON.stringify(['mail']), JSON.stringify([`mail:${to}`]), `delegated:room-notice:${digest}`, now, access.expiresAt] }]);
+    try {
+      const link = await linkWithin(api, key(access.teamId, target.machineId), LINK_WAIT_MS);
+      if (!link) throw new Error('machine offline; Room notice remains pending');
+      const stream = await link.channel.open('mail', { _admitted: { principal, groups: [], grants: [id], revisions: { [id]: 1 } },
+        request: { op: 'send', from: `sc:${machineName}:operator:room-${digest.slice(0, 24)}`, from_name: `Room ${access.roomName}`,
+          to, body: access.notice.text, id: `room-notice:${digest}`, queue: false } });
+      return await new Promise((resolve, reject) => {
+        let text = '';
+        const timeout = setTimeout(() => { stream.close('timeout'); reject(new Error('Room notice delivery not confirmed')); }, 15000);
+        stream.on('data', bytes => { text += new TextDecoder().decode(bytes); });
+        stream.on('close', () => { clearTimeout(timeout); try { const result = JSON.parse(text); if (result.code !== 0) throw new Error(result.text ?? 'Room notice refused'); resolve({ delivered: true, noticeId: access.notice.id }); } catch (error) { reject(error); } });
+        stream.on('error', error => { clearTimeout(timeout); reject(error); });
+      });
+    } finally { await api.store.transaction([{ sql: 'DELETE FROM machine_grants WHERE team_id=? AND id=?', params: [access.teamId, id] }]); }
+  })();
+  pending.set(digest, delivery);
+  try { return await delivery; } finally { pending.delete(digest); }
+}