wire-mesh-core 3.6.1 → 3.7.0

package/dist/domain/mesh-session.cjs

@@ -780,8 +780,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		}
 	};
 }
-function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert) {
-	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses);
+function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame) {
+	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame);
 	return session;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */

package/dist/domain/mesh-session.d.cts

@@ -113,7 +113,9 @@ export declare function createMeshSession(transport: Readonly<Transport>, identi
 /** This node's own directly-reachable "host:port" candidates (wire-mesh#38), advertised in this session's self-advert so other peers can attempt a direct connection instead of always falling back to a relay. Omit (or pass none) for a caller with nothing to offer, e.g. a browser client. */
 addresses?: readonly string[],
 /** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- the hook a gossip-expansion consumer (wire-mesh#187, gossip-expansion.ts's own createGossipExpansion) uses to observe newly-gossiped peers without becoming a second, competing consumer of this session's own single-reader events stream (each emitted SessionEvent wakes at most one waiter, so a second for-await loop over events would silently steal events from whichever consumer already reads it). Omit for a caller with no use for it, exactly today's behaviour. */
-onPeerAdvert?: (advert: PeerAdvert) => void): MeshSession;
+onPeerAdvert?: (advert: PeerAdvert) => void,
+/** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
+onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.d.mts

@@ -113,7 +113,9 @@ export declare function createMeshSession(transport: Readonly<Transport>, identi
 /** This node's own directly-reachable "host:port" candidates (wire-mesh#38), advertised in this session's self-advert so other peers can attempt a direct connection instead of always falling back to a relay. Omit (or pass none) for a caller with nothing to offer, e.g. a browser client. */
 addresses?: readonly string[],
 /** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- the hook a gossip-expansion consumer (wire-mesh#187, gossip-expansion.ts's own createGossipExpansion) uses to observe newly-gossiped peers without becoming a second, competing consumer of this session's own single-reader events stream (each emitted SessionEvent wakes at most one waiter, so a second for-await loop over events would silently steal events from whichever consumer already reads it). Omit for a caller with no use for it, exactly today's behaviour. */
-onPeerAdvert?: (advert: PeerAdvert) => void): MeshSession;
+onPeerAdvert?: (advert: PeerAdvert) => void,
+/** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
+onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.mjs

@@ -779,8 +779,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		}
 	};
 }
-function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert) {
-	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses);
+function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame) {
+	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame);
 	return session;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */

package/dist/domain/notice-board.cjs

@@ -56,13 +56,13 @@ function createNoticeBoard(options) {
 			entries: [entry]
 		})).ok) throw new Error(`gap rejecting entry for peer log (head ${String(fromSeq)})`);
 	}
-	async function readLog(peer, room) {
+	async function readLog(peer, room, dmRootPolicy) {
 		const entries = await require_domain_data_sync.readEntries(storage, peer, 0);
 		const out = [];
-		for (const entry of entries) out.push(await readOne(entry, room));
+		for (const entry of entries) out.push(await readOne(entry, room, dmRootPolicy));
 		return out;
 	}
-	async function readOne(entry, room) {
+	async function readOne(entry, room, dmRootPolicy) {
 		const notice = decodeNotice(entry);
 		if (notice === void 0) return {
 			verified: false,
@@ -72,7 +72,8 @@ function createNoticeBoard(options) {
 			identity,
 			clock,
 			revocation,
-			expectedRoom: room
+			expectedRoom: room,
+			dmRootPolicy
 		});
 		if (!verdict.ok) return {
 			verified: false,
@@ -119,8 +120,8 @@ function createNoticeBoard(options) {
 	return {
 		postEncryptedNotice,
 		ingestPeerEntry,
-		readOwnNotices: async (room) => readLog(identity.deviceId, room),
-		readPeerNotices: async (peer, room) => readLog(peer, room)
+		readOwnNotices: async (room) => readLog(identity.deviceId, room, "either-participant"),
+		readPeerNotices: async (peer, room) => readLog(peer, room, "self")
 	};
 }
 //#endregion

package/dist/domain/notice-board.mjs

@@ -55,13 +55,13 @@ function createNoticeBoard(options) {
 			entries: [entry]
 		})).ok) throw new Error(`gap rejecting entry for peer log (head ${String(fromSeq)})`);
 	}
-	async function readLog(peer, room) {
+	async function readLog(peer, room, dmRootPolicy) {
 		const entries = await readEntries(storage, peer, 0);
 		const out = [];
-		for (const entry of entries) out.push(await readOne(entry, room));
+		for (const entry of entries) out.push(await readOne(entry, room, dmRootPolicy));
 		return out;
 	}
-	async function readOne(entry, room) {
+	async function readOne(entry, room, dmRootPolicy) {
 		const notice = decodeNotice(entry);
 		if (notice === void 0) return {
 			verified: false,
@@ -71,7 +71,8 @@ function createNoticeBoard(options) {
 			identity,
 			clock,
 			revocation,
-			expectedRoom: room
+			expectedRoom: room,
+			dmRootPolicy
 		});
 		if (!verdict.ok) return {
 			verified: false,
@@ -118,8 +119,8 @@ function createNoticeBoard(options) {
 	return {
 		postEncryptedNotice,
 		ingestPeerEntry,
-		readOwnNotices: async (room) => readLog(identity.deviceId, room),
-		readPeerNotices: async (peer, room) => readLog(peer, room)
+		readOwnNotices: async (room) => readLog(identity.deviceId, room, "either-participant"),
+		readPeerNotices: async (peer, room) => readLog(peer, room, "self")
 	};
 }
 //#endregion

package/dist/domain/room-rekey.d.cts

@@ -9,7 +9,7 @@ import { a as RevocationCheck } from "../tokens-DqFu7iMX.cjs";
  */
 export declare function buildRoomRekeyCommand(keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[]): ManageCommand;
 /** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
-export declare function sendRoomRekey(session: Readonly<MeshSession>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
+export declare function sendRoomRekey(session: Readonly<Pick<MeshSession, "sendManageRequest">>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
 /** One incoming, fully-verified and unwrapped room.rekey, surfaced for the domain to store (index content keys by epoch for later room-notice decryption). */
 export interface RoomRekeyEvent {
   room: string;

package/dist/domain/room-rekey.d.mts

@@ -9,7 +9,7 @@ import { a as RevocationCheck } from "../tokens-CBiSYuzp.mjs";
  */
 export declare function buildRoomRekeyCommand(keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[]): ManageCommand;
 /** Sends a room.rekey for roomPath. targetDevice/token forward directly to MeshSession.sendManageRequest's own identically-named parameters, exactly as sendRoomMessage's own doc comment already describes. */
-export declare function sendRoomRekey(session: Readonly<MeshSession>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
+export declare function sendRoomRekey(session: Readonly<Pick<MeshSession, "sendManageRequest">>, roomPath: string, keyEpoch: number, wrappedKey: Uint8Array | readonly Uint8Array[], targetDevice?: DeviceId, token?: CapabilityToken): Promise<ManageOutcome>;
 /** One incoming, fully-verified and unwrapped room.rekey, surfaced for the domain to store (index content keys by epoch for later room-notice decryption). */
 export interface RoomRekeyEvent {
   room: string;

package/dist/domain/room.cjs

@@ -102,7 +102,8 @@ async function verifyRoomNotice(notice, options) {
 		clock: options.clock,
 		revocation: options.revocation,
 		expectedBearer: claims.poster,
-		roomPath: claims.room
+		roomPath: claims.room,
+		...options.dmRootPolicy !== void 0 ? { dmRootPolicy: options.dmRootPolicy } : {}
 	});
 	if (!tokenVerdict.ok) return {
 		ok: false,

package/dist/domain/room.d.cts

@@ -20,6 +20,10 @@ export interface VerifyRoomNoticeOptions {
    * When given, refuses any notice not claiming exactly this room -- "is this the room I actually asked to read", checked against the notice's own self-declared `room` field before any cryptographic work, so a caller scanning a mixed stream of notices can cheaply skip ones for other rooms. Independent of, and layered on top of, this function's own unconditional internal self-consistency check (the embedded token's scope.path MUST equal the notice's own `room` field regardless of whether expectedRoom is given at all) -- a notice can be internally self-consistent yet still be for a room other than the one a caller expected, and this is the option that catches that case. Mirrors verifyCapabilityToken's own optional expectedBearer for the same "also assert it matches what I expected" shape.
    */
   expectedRoom?: RoomPath;
+  /**
+   * How a DM's embedded token must be rooted, passed to verifyRoomToken (see its own `dmRootPolicy`). The default requires the root to be the verifying identity, which is right for a notice another device posted to me. A device reading its own notice holds a token rooted at the other participant, so only "either-participant" can pass there; it is safe because nothing about an own notice rests on the root rule, the device wrote it.
+   */
+  dmRootPolicy?: "self" | "either-participant";
 }
 /**
  * Verifies one room-notice (spec/room.cddl) against every obligation its own "Six verifier obligations" comment documents, including `valid-until` (obligation 6): the envelope is a well-formed COSE_Sign1 whose signature verifies against its own embedded poster-key, and poster-key is self-certifying (sha256(poster-key.public-key) equals poster); the embedded token independently passes every ordinary capability-token obligation (signature, expiry, not-before, revocation, delegations- remaining, and -- since the embedded token is itself room-scoped -- the chain-root and scope obligations spec/room.cddl's own six general verifier obligations require of any room:member token) with its bearer pinned to this notice's own `poster` field and its scope pinned to this notice's own `room` field; and, if present, `valid-until` has not yet elapsed as of the injected clock. Checks run cheapest-and-structural first, signature next, the recursive token-chain verification last, mirroring tokens.ts's own ordering discipline.

package/dist/domain/room.d.mts

@@ -20,6 +20,10 @@ export interface VerifyRoomNoticeOptions {
    * When given, refuses any notice not claiming exactly this room -- "is this the room I actually asked to read", checked against the notice's own self-declared `room` field before any cryptographic work, so a caller scanning a mixed stream of notices can cheaply skip ones for other rooms. Independent of, and layered on top of, this function's own unconditional internal self-consistency check (the embedded token's scope.path MUST equal the notice's own `room` field regardless of whether expectedRoom is given at all) -- a notice can be internally self-consistent yet still be for a room other than the one a caller expected, and this is the option that catches that case. Mirrors verifyCapabilityToken's own optional expectedBearer for the same "also assert it matches what I expected" shape.
    */
   expectedRoom?: RoomPath;
+  /**
+   * How a DM's embedded token must be rooted, passed to verifyRoomToken (see its own `dmRootPolicy`). The default requires the root to be the verifying identity, which is right for a notice another device posted to me. A device reading its own notice holds a token rooted at the other participant, so only "either-participant" can pass there; it is safe because nothing about an own notice rests on the root rule, the device wrote it.
+   */
+  dmRootPolicy?: "self" | "either-participant";
 }
 /**
  * Verifies one room-notice (spec/room.cddl) against every obligation its own "Six verifier obligations" comment documents, including `valid-until` (obligation 6): the envelope is a well-formed COSE_Sign1 whose signature verifies against its own embedded poster-key, and poster-key is self-certifying (sha256(poster-key.public-key) equals poster); the embedded token independently passes every ordinary capability-token obligation (signature, expiry, not-before, revocation, delegations- remaining, and -- since the embedded token is itself room-scoped -- the chain-root and scope obligations spec/room.cddl's own six general verifier obligations require of any room:member token) with its bearer pinned to this notice's own `poster` field and its scope pinned to this notice's own `room` field; and, if present, `valid-until` has not yet elapsed as of the injected clock. Checks run cheapest-and-structural first, signature next, the recursive token-chain verification last, mirroring tokens.ts's own ordering discipline.

package/dist/domain/room.mjs

@@ -101,7 +101,8 @@ async function verifyRoomNotice(notice, options) {
 		clock: options.clock,
 		revocation: options.revocation,
 		expectedBearer: claims.poster,
-		roomPath: claims.room
+		roomPath: claims.room,
+		...options.dmRootPolicy !== void 0 ? { dmRootPolicy: options.dmRootPolicy } : {}
 	});
 	if (!tokenVerdict.ok) return {
 		ok: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "3.6.1",
+  "version": "3.7.0",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",