wire-mesh-core 1.27.0 → 1.28.0

package/dist/domain/room.cjs

@@ -6,6 +6,19 @@ let cbor2 = require("cbor2");
 /**
 * Room-notice verification (spec/room.cddl's own noticeboard extension of core/room). A room-notice is self-certifying the same way a capability-token or revocation-entry already is: a bare cose-sign1 whose payload carries its own signer's key, so a reader verifies posting authority from the entry alone, with no prior contact with the poster and no central gatekeeper. This module is the first TypeScript verifier for it -- no `room.ts` domain module existed anywhere before this, despite the CDDL claim (including `valid-until`) having shipped already.
 */
+function buf(bytes) {
+	return Uint8Array.from(bytes);
+}
+function encodeBuf(value) {
+	return buf((0, cbor2.encode)(value, cbor2.cdeEncodeOptions));
+}
+/** The COSE protected header a room-notice signs over: label 1 (alg) and label 4 (kid, the poster's own device-id) -- the identical shape tokens.ts's own protectedHeaderFor uses for capability-token/revocation-entry envelopes, reimplemented here rather than imported since tokens.ts does not export it (matching sig1ToBeSigned's own precedent below). verifyRoomNotice never inspects this header's own decoded content -- it only needs the same bytes fed back into its own signature check -- but a real, kid-bearing header keeps a room-notice's wire shape consistent with every other signed envelope in this spec, rather than the empty header a merely-self-consistent test fixture can get away with. */
+function protectedHeaderFor(identity) {
+	return encodeBuf({
+		1: identity.identityKey.alg,
+		4: identity.deviceId
+	});
+}
 /**
 * RFC 9052 §4.4 Sig_structure for a COSE_Sign1 with no external AAD -- identical in shape to tokens.ts's own private helper of the same name, but reimplemented here rather than imported, since tokens.ts does not export it. Worth consolidating into a shared cose.ts once a third caller needs the identical helper, but two independent five-line copies is not yet a real duplication problem on its own.
 */
@@ -103,6 +116,31 @@ function compareRoomNotices(a, b) {
 	if (posterOrder !== 0) return posterOrder;
 	return compareBytes(a["notice-id"], b["notice-id"]);
 }
+/**
+* Mints one self-certifying room-notice as `identity` -- the counterpart to verifyRoomNotice above, producing exactly what it accepts. `posted-at` is always stamped from the injected clock, never caller-supplied, matching obligation 4's own requirement that a poster's own log stay non-decreasing: a caller backdating its own posted-at would be indistinguishable from a clock bug at mint time, so this function simply doesn't expose the field to override.
+*/
+async function createRoomNotice(options) {
+	const payload = encodeBuf({
+		room: options.room,
+		poster: options.identity.deviceId,
+		"poster-key": options.identity.identityKey,
+		token: options.token,
+		"notice-id": options.noticeId,
+		"posted-at": options.clock.now(),
+		"content-type": options.contentType,
+		content: options.content,
+		...options.refs !== void 0 ? { refs: [...options.refs] } : {},
+		...options.validUntil !== void 0 ? { "valid-until": options.validUntil } : {}
+	});
+	const protectedHeader = protectedHeaderFor(options.identity);
+	return [
+		protectedHeader,
+		{},
+		payload,
+		await options.identity.sign(sig1ToBeSigned(protectedHeader, payload))
+	];
+}
 //#endregion
 exports.compareRoomNotices = compareRoomNotices;
+exports.createRoomNotice = createRoomNotice;
 exports.verifyRoomNotice = verifyRoomNotice;

package/dist/domain/room.d.cts

@@ -1,4 +1,4 @@
-import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice } from "../protocol-sW8d6Og-.cjs";
+import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-sW8d6Og-.cjs";
 import { t as IdentityPort } from "../identity-DJ06jn4k.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { a as RevocationCheck } from "../tokens-DfVfE00W.cjs";
@@ -33,4 +33,21 @@ export declare function verifyRoomNotice(notice: RoomNotice, options: Readonly<V
  * Deterministic display ordering for room-notice entries from possibly several different posters (spec/room.cddl obligation 4): sorts by (posted-at, poster, notice-id), the exact tiebreak idiom the CDDL comment specifies -- the same "lowest wins" idea coordinator-frame's own lowest-device-id rule already uses for equal-term claims elsewhere in this spec. Takes already-verified claims (the output of verifyRoomNotice) -- this is purely a merge-order comparator, never a validity check, so it is kept structurally separate from verifyRoomNotice's own pass/fail verdict.
  */
 export declare function compareRoomNotices(a: Readonly<RoomNoticeClaims>, b: Readonly<RoomNoticeClaims>): number;
+export interface CreateRoomNoticeOptions {
+  identity: IdentityPort;
+  clock: Clock;
+  room: RoomPath;
+  /** The poster's own room:member token, embedded in full -- a reader checks token-claims.bearer against this notice's own signed poster field (see verifyRoomNotice's own obligation 2), so there is no live connection for the bearer binding to ride on the way a real room.send has. */
+  token: CapabilityToken;
+  /** Caller-supplied, matching mintCapabilityToken's own tokenId/mintRevocationEntry's own tokenId convention -- this module has no opinion on how a noticeId is generated (random bytes, a counter, anything else), only that it is unique enough for compareRoomNotices' own cross-author tiebreak to work. */
+  noticeId: Uint8Array<ArrayBuffer>;
+  contentType: string;
+  content: Uint8Array<ArrayBuffer>;
+  refs?: readonly MessageRef[];
+  validUntil?: number;
+}
+/**
+ * Mints one self-certifying room-notice as `identity` -- the counterpart to verifyRoomNotice above, producing exactly what it accepts. `posted-at` is always stamped from the injected clock, never caller-supplied, matching obligation 4's own requirement that a poster's own log stay non-decreasing: a caller backdating its own posted-at would be indistinguishable from a clock bug at mint time, so this function simply doesn't expose the field to override.
+ */
+export declare function createRoomNotice(options: Readonly<CreateRoomNoticeOptions>): Promise<RoomNotice>;
 //#endregion

package/dist/domain/room.d.mts

@@ -1,4 +1,4 @@
-import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice } from "../protocol-sW8d6Og-.mjs";
+import { Dt as RoomPath, Et as RoomNoticeClaims, Tt as RoomNotice, p as CapabilityToken, q as MessageRef } from "../protocol-sW8d6Og-.mjs";
 import { t as IdentityPort } from "../identity-C5N86BPz.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { a as RevocationCheck } from "../tokens-CpLDI5Fo.mjs";
@@ -33,4 +33,21 @@ export declare function verifyRoomNotice(notice: RoomNotice, options: Readonly<V
  * Deterministic display ordering for room-notice entries from possibly several different posters (spec/room.cddl obligation 4): sorts by (posted-at, poster, notice-id), the exact tiebreak idiom the CDDL comment specifies -- the same "lowest wins" idea coordinator-frame's own lowest-device-id rule already uses for equal-term claims elsewhere in this spec. Takes already-verified claims (the output of verifyRoomNotice) -- this is purely a merge-order comparator, never a validity check, so it is kept structurally separate from verifyRoomNotice's own pass/fail verdict.
  */
 export declare function compareRoomNotices(a: Readonly<RoomNoticeClaims>, b: Readonly<RoomNoticeClaims>): number;
+export interface CreateRoomNoticeOptions {
+  identity: IdentityPort;
+  clock: Clock;
+  room: RoomPath;
+  /** The poster's own room:member token, embedded in full -- a reader checks token-claims.bearer against this notice's own signed poster field (see verifyRoomNotice's own obligation 2), so there is no live connection for the bearer binding to ride on the way a real room.send has. */
+  token: CapabilityToken;
+  /** Caller-supplied, matching mintCapabilityToken's own tokenId/mintRevocationEntry's own tokenId convention -- this module has no opinion on how a noticeId is generated (random bytes, a counter, anything else), only that it is unique enough for compareRoomNotices' own cross-author tiebreak to work. */
+  noticeId: Uint8Array<ArrayBuffer>;
+  contentType: string;
+  content: Uint8Array<ArrayBuffer>;
+  refs?: readonly MessageRef[];
+  validUntil?: number;
+}
+/**
+ * Mints one self-certifying room-notice as `identity` -- the counterpart to verifyRoomNotice above, producing exactly what it accepts. `posted-at` is always stamped from the injected clock, never caller-supplied, matching obligation 4's own requirement that a poster's own log stay non-decreasing: a caller backdating its own posted-at would be indistinguishable from a clock bug at mint time, so this function simply doesn't expose the field to override.
+ */
+export declare function createRoomNotice(options: Readonly<CreateRoomNoticeOptions>): Promise<RoomNotice>;
 //#endregion

package/dist/domain/room.mjs

@@ -5,6 +5,19 @@ import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
 /**
 * Room-notice verification (spec/room.cddl's own noticeboard extension of core/room). A room-notice is self-certifying the same way a capability-token or revocation-entry already is: a bare cose-sign1 whose payload carries its own signer's key, so a reader verifies posting authority from the entry alone, with no prior contact with the poster and no central gatekeeper. This module is the first TypeScript verifier for it -- no `room.ts` domain module existed anywhere before this, despite the CDDL claim (including `valid-until`) having shipped already.
 */
+function buf(bytes) {
+	return Uint8Array.from(bytes);
+}
+function encodeBuf(value) {
+	return buf(encode(value, cdeEncodeOptions));
+}
+/** The COSE protected header a room-notice signs over: label 1 (alg) and label 4 (kid, the poster's own device-id) -- the identical shape tokens.ts's own protectedHeaderFor uses for capability-token/revocation-entry envelopes, reimplemented here rather than imported since tokens.ts does not export it (matching sig1ToBeSigned's own precedent below). verifyRoomNotice never inspects this header's own decoded content -- it only needs the same bytes fed back into its own signature check -- but a real, kid-bearing header keeps a room-notice's wire shape consistent with every other signed envelope in this spec, rather than the empty header a merely-self-consistent test fixture can get away with. */
+function protectedHeaderFor(identity) {
+	return encodeBuf({
+		1: identity.identityKey.alg,
+		4: identity.deviceId
+	});
+}
 /**
 * RFC 9052 §4.4 Sig_structure for a COSE_Sign1 with no external AAD -- identical in shape to tokens.ts's own private helper of the same name, but reimplemented here rather than imported, since tokens.ts does not export it. Worth consolidating into a shared cose.ts once a third caller needs the identical helper, but two independent five-line copies is not yet a real duplication problem on its own.
 */
@@ -102,5 +115,29 @@ function compareRoomNotices(a, b) {
 	if (posterOrder !== 0) return posterOrder;
 	return compareBytes(a["notice-id"], b["notice-id"]);
 }
+/**
+* Mints one self-certifying room-notice as `identity` -- the counterpart to verifyRoomNotice above, producing exactly what it accepts. `posted-at` is always stamped from the injected clock, never caller-supplied, matching obligation 4's own requirement that a poster's own log stay non-decreasing: a caller backdating its own posted-at would be indistinguishable from a clock bug at mint time, so this function simply doesn't expose the field to override.
+*/
+async function createRoomNotice(options) {
+	const payload = encodeBuf({
+		room: options.room,
+		poster: options.identity.deviceId,
+		"poster-key": options.identity.identityKey,
+		token: options.token,
+		"notice-id": options.noticeId,
+		"posted-at": options.clock.now(),
+		"content-type": options.contentType,
+		content: options.content,
+		...options.refs !== void 0 ? { refs: [...options.refs] } : {},
+		...options.validUntil !== void 0 ? { "valid-until": options.validUntil } : {}
+	});
+	const protectedHeader = protectedHeaderFor(options.identity);
+	return [
+		protectedHeader,
+		{},
+		payload,
+		await options.identity.sign(sig1ToBeSigned(protectedHeader, payload))
+	];
+}
 //#endregion
-export { compareRoomNotices, verifyRoomNotice };
+export { compareRoomNotices, createRoomNotice, verifyRoomNotice };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "type": "module",
   "packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
   "repository": {