Sign read receipts: add prepare_mark_conversation_read

[santiagomed]

Summary

The SDK verifies read receipts (a MarkConversationReadEvent decrypts to Event::ReadReceipt and, under the default policy, is rejected when unverified) but had no way to produce one. Callers that mark a conversation read had no means to sign the receipt, so recipients receive it unsigned.

Stacked on #47.

prepare_mark_conversation_read(MarkConversationReadParams)

A read receipt is a plaintext signed event, like a message delete. This builds the thrift MarkConversationReadEvent (seen_until_sequence_id + seen_at_millis), signs

MarkConversationReadEvent,{msg_id},{sender_id},{conv_id},{seen_until_sequence_id},{seen_at_msec}

and returns an ActionSignature carrying the encoded event detail. That is the payload the existing MarkConversationReadEvent arm of the verifier reconstructs, so the receipt round-trips through decrypt_event as a verified ReadReceipt.

• seen_at_msec is optional and defaults to the current time. The WASM wrapper fills an omitted seenAtMsec from Date.now(), so the core never reads the system clock on wasm32-unknown-unknown.
• sender_id / signing_key_version resolve from the session identity (set_identity) when unset, as for every other producer, so the receipt carries the registered signing key version.
• One-to-one conversation ids are signed in canonical colon form.
• An empty conversation_id or seen_until_sequence_id fails with an error naming the field.

Binding parity

Per AGENTS.md §2, every surface moves together:

• Rust core: ChatCore::prepare_mark_conversation_read / Chat::prepare_mark_conversation_read, MarkConversationReadParams
• JS/WASM: prepareMarkConversationRead + MarkConversationReadParams in index.d.ts
• Python: prepare_mark_conversation_read(MarkConversationReadParams), with MarkConversationReadParams(conversation_id, seen_until_sequence_id, *, seen_at_msec=None, sender_id=None, signing_key_version=None) as a params class like the other Python params calls, + .pyi stub
• Go: PrepareMarkConversationRead, SeenAtMsec *int64 with omitempty
• .NET: PrepareMarkConversationRead, long? SeenAtMsec
• JVM: prepareMarkConversationRead, Long seenAtMsec omitted when null

The Go header (go/chatxdk/include/chat_xdk.h) and .NET NativeMethods.g.cs are regenerated. docs/API.md gains row 32 (later rows renumbered) and a "Read receipts are signed, not encrypted" paragraph; docs/CRYPTO.md records the signed payload; CHANGELOG.md gains an Added entry.

Testing

• Core: exact payload pin (canonical colon-form id from a hyphen-form input), action-signature round trip through the verifier, a full MessageEvent → decrypt_event round trip asserting a verified ReadReceipt with the read point and time, the current-time default, and empty-field rejection.
• Every binding suite has matching tests: the payload pin plus a signature check through the binding's own verify, the session-identity and current-time defaults, and the invalid-input error.
• On the stack, locally green: fmt, clippy -D warnings, cargo-deny, workspace tests, WASM build, Python, JS (Node 20 and 18), JVM, .NET, Go, and the example suites.

Notes

• Additive, with no wire-format change: the payload is the form the verifier already accepts, at the current signature version. Independent of Drop version and generate_version from the key registration payload #48, which is stacked on this branch.
• The SDK only produces the signature; the mark-read request has to carry the returned ActionSignature for recipients to see a signed receipt.
• Go prebuilt archives (go/chatxdk/libs/) are not regenerated here; the prebuilt sync workflow rebuilds them on push.

  

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ santiagomed
❌ github-actions[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}