@agora-sdk/secure-chat-crypto 0.4.0 → 0.5.0

package/dist/esm/mock-crypto.js

@@ -1,3 +1,4 @@
+import { SecureChatDecryptError } from "./interface.js";
 const enc = new TextEncoder();
 const dec = new TextDecoder();
 const BACKUP_MAGIC = "AGORA_MOCK_BACKUP_V1";
@@ -75,13 +76,15 @@ export class MockSecureChatCrypto {
             bytesFrom(`grp:${did}:${opts.initialMembers.map((m) => m.deviceId).join(",")}`, 16);
         const idHex = toHex(mlsGroupId);
         const secret = bytesFrom(`secret:${idHex}:${did}`, 32);
-        this.groups.set(idHex, { secret, epoch: 0n });
+        const members = [did, ...opts.initialMembers.map((m) => m.deviceId)];
+        this.groups.set(idHex, { secret, epoch: 0n, members });
         const welcomes = opts.initialMembers.map((m) => ({
             targetDeviceId: m.deviceId,
             payload: jsonBytes({
                 groupId: idHex,
                 secret: toHex(secret),
                 epoch: "0",
+                members,
             }),
         }));
         return { group: { mlsGroupId, epoch: 0n }, welcomes };
@@ -93,6 +96,8 @@ export class MockSecureChatCrypto {
             throw new Error("mock: unknown group");
         st.epoch += 1n;
         const epoch = st.epoch;
+        if (!st.members.includes(newDevice.deviceId))
+            st.members.push(newDevice.deviceId);
         return {
             commit: jsonBytes({ type: "commit", groupId: idHex, epoch: epoch.toString() }),
             welcomes: [
@@ -102,18 +107,20 @@ export class MockSecureChatCrypto {
                         groupId: idHex,
                         secret: toHex(st.secret),
                         epoch: epoch.toString(),
+                        members: st.members,
                     }),
                 },
             ],
             epoch,
         };
     }
-    async removeMember(group, _leafDeviceId) {
+    async removeMember(group, leafDeviceId) {
         const idHex = toHex(group.mlsGroupId);
         const st = this.groups.get(idHex);
         if (!st)
             throw new Error("mock: unknown group");
         st.epoch += 1n;
+        st.members = st.members.filter((m) => m !== leafDeviceId);
         return {
             commit: jsonBytes({ type: "commit", groupId: idHex, epoch: st.epoch.toString() }),
             welcomes: [],
@@ -138,7 +145,7 @@ export class MockSecureChatCrypto {
         const idHex = toHex(group.mlsGroupId);
         const st = this.groups.get(idHex);
         if (!st)
-            throw new Error("mock: unknown group");
+            throw new SecureChatDecryptError("unknown", "mock: unknown group");
         // header = "<deviceId>|<epoch>|" — split on the SECOND pipe.
         let pipes = 0;
         let cut = -1;
@@ -152,7 +159,7 @@ export class MockSecureChatCrypto {
             }
         }
         if (cut < 0)
-            throw new Error("mock: malformed ciphertext");
+            throw new SecureChatDecryptError("malformed", "mock: malformed ciphertext");
         const [senderDeviceId, epochStr] = dec.decode(ciphertext.slice(0, cut - 1)).split("|");
         const body = ciphertext.slice(cut);
         const ks = keystream(st.secret, body.length);
@@ -164,9 +171,25 @@ export class MockSecureChatCrypto {
     }
     async processWelcome(welcome) {
         const w = parseJson(welcome);
-        this.groups.set(w.groupId, { secret: fromHex(w.secret), epoch: BigInt(w.epoch) });
+        this.groups.set(w.groupId, {
+            secret: fromHex(w.secret),
+            epoch: BigInt(w.epoch),
+            members: w.members ?? [],
+        });
         return { mlsGroupId: fromHex(w.groupId), epoch: BigInt(w.epoch) };
     }
+    async exportGroupIdentities(group) {
+        const idHex = toHex(group.mlsGroupId);
+        const st = this.groups.get(idHex);
+        if (!st)
+            throw new Error("mock: unknown group");
+        // The mock derives each device's signature key deterministically from its id (see
+        // generateDeviceIdentity), so the roster of device ids is enough to reconstruct every member's key.
+        return st.members.map((deviceId) => ({
+            deviceId,
+            signaturePublicKey: bytesFrom(`sig:${deviceId}`, 32),
+        }));
+    }
     async processCommit(group, commit) {
         const c = parseJson(commit);
         const idHex = toHex(group.mlsGroupId);
@@ -207,11 +230,20 @@ export class MockSecureChatCrypto {
         const st = this.groups.get(idHex);
         if (!st)
             throw new Error("mock: unknown group");
-        return jsonBytes({ groupId: idHex, secret: toHex(st.secret), epoch: st.epoch.toString() });
+        return jsonBytes({
+            groupId: idHex,
+            secret: toHex(st.secret),
+            epoch: st.epoch.toString(),
+            members: st.members,
+        });
     }
     async importGroupState(state) {
         const s = parseJson(state);
-        this.groups.set(s.groupId, { secret: fromHex(s.secret), epoch: BigInt(s.epoch) });
+        this.groups.set(s.groupId, {
+            secret: fromHex(s.secret),
+            epoch: BigInt(s.epoch),
+            members: s.members ?? [],
+        });
         return { mlsGroupId: fromHex(s.groupId), epoch: BigInt(s.epoch) };
     }
     async exportBackup(passphrase) {
@@ -219,11 +251,13 @@ export class MockSecureChatCrypto {
             id,
             secret: toHex(st.secret),
             epoch: st.epoch.toString(),
+            members: st.members,
         }));
         const plain = jsonBytes({
             magic: BACKUP_MAGIC,
             identityPriv: this.privateState ? toHex(this.privateState) : null,
             deviceId: this.identity?.deviceId ?? null,
+            ciphersuite: this.identity?.ciphersuite ?? 1,
             groups,
         });
         const salt = bytesFrom(`salt:${passphrase}`, 16);
@@ -248,14 +282,25 @@ export class MockSecureChatCrypto {
         catch {
             throw new Error("mock: backup decrypt failed (wrong passphrase?)");
         }
-        if (parsed.magic !== BACKUP_MAGIC) {
+        if (parsed.magic !== BACKUP_MAGIC || !parsed.deviceId) {
             throw new Error("mock: backup decrypt failed (wrong passphrase?)");
         }
         if (parsed.identityPriv)
             this.privateState = fromHex(parsed.identityPriv);
         for (const g of parsed.groups) {
-            this.groups.set(g.id, { secret: fromHex(g.secret), epoch: BigInt(g.epoch) });
+            this.groups.set(g.id, { secret: fromHex(g.secret), epoch: BigInt(g.epoch), members: g.members ?? [] });
         }
+        // Rebuild the (deterministic) identity so the restored mock is usable, and return it — symmetric
+        // with importDeviceState, so the restore flow can re-assert the device server-side.
+        const ciphersuite = parsed.ciphersuite ?? 1;
+        const identity = {
+            deviceId: parsed.deviceId,
+            signaturePublicKey: bytesFrom(`sig:${parsed.deviceId}`, 32),
+            credential: enc.encode(parsed.deviceId),
+            ciphersuite,
+        };
+        this.identity = identity;
+        return identity;
     }
 }
 //# sourceMappingURL=mock-crypto.js.map

package/dist/esm/mock-crypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"mock-crypto.js","sourceRoot":"","sources":["../../src/mock-crypto.ts"],"names":[],"mappings":"AA0BA,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C,SAAS,KAAK,CAAC,CAAa;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,SAAS,SAAS,CAAC,IAAgB,EAAE,GAAW;IAC9C,IAAI,KAAK,GAAG,UAAU,KAAK,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACvD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QAC/B,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,SAAS,CAAC,CAAS,EAAE,GAAW;IACvC,OAAO,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,GAAG,CAAC,IAAgB,EAAE,GAAe;IAC5C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAE,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,SAAS,CAAI,CAAa;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAM,CAAC;AACxC,CAAC;AAYD,MAAM,OAAO,oBAAoB;IAAjC;QAGU,WAAM,GAAG,IAAI,GAAG,EAAsB,CAAC,CAAC,sBAAsB;QAC9D,cAAS,GAAG,CAAC,CAAC;IAmPxB,CAAC;IAjPC,KAAK,CAAC,sBAAsB,CAAC,IAAgD;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAmB;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,SAAS,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;YACzD,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,kCAAkC;YACzE,WAAW;SACZ,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,SAAS,CAAC;QACjD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,IAAI,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAuB,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,GAAG,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAGjB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,SAAS,CAAC;QACjD,MAAM,UAAU,GACd,IAAI,CAAC,UAAU;YACf,SAAS,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,KAAK,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,cAAc,EAAE,CAAC,CAAC,QAAQ;YAC1B,OAAO,EAAE,SAAS,CAAC;gBACjB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;gBACrB,KAAK,EAAE,GAAG;aACc,CAAC;SAC5B,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAkB,EAClB,SAAuD;QAEvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChD,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC9E,QAAQ,EAAE;gBACR;oBACE,cAAc,EAAE,SAAS,CAAC,QAAQ;oBAClC,OAAO,EAAE,SAAS,CAAC;wBACjB,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC;wBACxB,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;qBACC,CAAC;iBAC5B;aACF;YACD,KAAK;SACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAkB,EAAE,aAAqB;QAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChD,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjF,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,EAAE,CAAC,KAAK;SAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAkB,EAClB,SAAqB;QAErB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,SAAS,CAAC;QACpD,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1B,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAkB,EAClB,UAAsB;QAEtB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChD,6DAA6D;QAC7D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAChB,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAC3D,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,cAAc,EAAE,cAAc,IAAI,EAAE;YACpC,KAAK,EAAE,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAmB;QACtC,MAAM,CAAC,GAAG,SAAS,CAAiB,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAkB,EAAE,MAAkB;QACxD,MAAM,CAAC,GAAG,SAAS,CAAoB,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,EAAE;YAAE,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAmB,EAAE,SAAqB;QAC9D,2DAA2D;IAC7D,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,SAAS,CAAC;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;YACtC,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC3D,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC3C,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAiB;QACvC,MAAM,CAAC,GAAG,SAAS,CAMhB,KAAK,CAAC,CAAC;QACV,MAAM,QAAQ,GAAmB;YAC/B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACjD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;SAClC,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAkB;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChD,OAAO,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAiB;QACtC,MAAM,CAAC,GAAG,SAAS,CAAqD,KAAK,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClF,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,EAAE;YACF,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE;SAC3B,CAAC,CAAC,CAAC;QACJ,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,KAAK,EAAE,YAAY;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YACjE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI;YACzC,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC;YACrB,GAAG,EAAE,UAAU;YACf,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;YACtD,MAAM,EAAE,mBAAmB;YAC3B,KAAK,EAAE,SAAS,CAAC,SAAS,UAAU,EAAE,EAAE,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,MAAwB;QAC7D,MAAM,IAAI,GACP,MAAM,CAAC,SAA+B,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,MAKH,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"mock-crypto.js","sourceRoot":"","sources":["../../src/mock-crypto.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C,SAAS,KAAK,CAAC,CAAa;IAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,CAAC;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC;AACX,CAAC;AACD,SAAS,OAAO,CAAC,CAAS;IACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mGAAmG;AACnG,SAAS,SAAS,CAAC,IAAgB,EAAE,GAAW;IAC9C,IAAI,KAAK,GAAG,UAAU,KAAK,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACvD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;QAC/B,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,SAAS,CAAC,CAAS,EAAE,GAAW;IACvC,OAAO,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,GAAG,CAAC,IAAgB,EAAE,GAAe;IAC5C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAE,CAAC;IAC/E,OAAO,GAAG,CAAC;AACb,CAAC;AACD,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AACD,SAAS,SAAS,CAAI,CAAa;IACjC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAM,CAAC;AACxC,CAAC;AAcD,MAAM,OAAO,oBAAoB;IAAjC;QAGU,WAAM,GAAG,IAAI,GAAG,EAAsB,CAAC,CAAC,sBAAsB;QAC9D,cAAS,GAAG,CAAC,CAAC;IA+RxB,CAAC;IA7RC,KAAK,CAAC,sBAAsB,CAAC,IAAgD;QAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAmB;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,kBAAkB,EAAE,SAAS,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;YACzD,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,kCAAkC;YACzE,WAAW;SACZ,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,SAAS,CAAC;QACjD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,IAAI,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAuB,EAAE,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,GAAG,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAGjB;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,SAAS,CAAC;QACjD,MAAM,UAAU,GACd,IAAI,CAAC,UAAU;YACf,SAAS,CAAC,OAAO,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,KAAK,IAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,cAAc,EAAE,CAAC,CAAC,QAAQ;YAC1B,OAAO,EAAE,SAAS,CAAC;gBACjB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;gBACrB,KAAK,EAAE,GAAG;gBACV,OAAO;aACiB,CAAC;SAC5B,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAkB,EAClB,SAAuD;QAEvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChD,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC;YAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClF,OAAO;YACL,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC9E,QAAQ,EAAE;gBACR;oBACE,cAAc,EAAE,SAAS,CAAC,QAAQ;oBAClC,OAAO,EAAE,SAAS,CAAC;wBACjB,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC;wBACxB,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE;wBACvB,OAAO,EAAE,EAAE,CAAC,OAAO;qBACK,CAAC;iBAC5B;aACF;YACD,KAAK;SACN,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAkB,EAAE,YAAoB;QACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChD,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,EAAE,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC;QAC1D,OAAO;YACL,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjF,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,EAAE,CAAC,KAAK;SAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAkB,EAClB,SAAqB;QAErB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,SAAS,CAAC;QACpD,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1B,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,KAAkB,EAClB,UAAsB;QAEtB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,sBAAsB,CAAC,SAAS,EAAE,qBAAqB,CAAC,CAAC;QAC5E,6DAA6D;QAC7D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACnC,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAChB,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;QACzF,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACxB,cAAc,EAAE,cAAc,IAAI,EAAE;YACpC,KAAK,EAAE,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC;SAC/B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAmB;QACtC,MAAM,CAAC,GAAG,SAAS,CAAiB,OAAO,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;SACzB,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAAkB;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChD,kFAAkF;QAClF,oGAAoG;QACpG,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACnC,QAAQ;YACR,kBAAkB,EAAE,SAAS,CAAC,OAAO,QAAQ,EAAE,EAAE,EAAE,CAAC;SACrD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAkB,EAAE,MAAkB;QACxD,MAAM,CAAC,GAAG,SAAS,CAAoB,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,EAAE;YAAE,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAmB,EAAE,SAAqB;QAC9D,2DAA2D;IAC7D,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,SAAS,CAAC;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAChC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;YACtC,kBAAkB,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAC3D,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC3C,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAiB;QACvC,MAAM,CAAC,GAAG,SAAS,CAMhB,KAAK,CAAC,CAAC;QACV,MAAM,QAAQ,GAAmB;YAC/B,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACjD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;SAClC,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAkB;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChD,OAAO,SAAS,CAAC;YACf,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC1B,OAAO,EAAE,EAAE,CAAC,OAAO;SACpB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAiB;QACtC,MAAM,CAAC,GAAG,SAAS,CAAyE,KAAK,CAAC,CAAC;QACnG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE;SACzB,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB;QACnC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,EAAE;YACF,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC;YACxB,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE;YAC1B,OAAO,EAAE,EAAE,CAAC,OAAO;SACpB,CAAC,CAAC,CAAC;QACJ,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,KAAK,EAAE,YAAY;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;YACjE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI;YACzC,WAAW,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,IAAI,CAAC;YAC5C,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChF,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC;YACrB,GAAG,EAAE,UAAU;YACf,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;YACtD,MAAM,EAAE,mBAAmB;YAC3B,KAAK,EAAE,SAAS,CAAC,SAAS,UAAU,EAAE,EAAE,EAAE,CAAC;YAC3C,OAAO,EAAE,CAAC;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,UAAkB,EAAE,MAAwB;QAC7D,MAAM,IAAI,GACP,MAAM,CAAC,SAA+B,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,MAMH,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,iGAAiG;QACjG,oFAAoF;QACpF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAmB;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,kBAAkB,EAAE,SAAS,CAAC,OAAO,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC3D,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACvC,WAAW;SACZ,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/esm/ts-mls/backup.d.ts

@@ -0,0 +1,30 @@
+import type { PassphraseBackup } from "../interface.js";
+/**
+ * argon2id parameters — RFC 9106 "FIRST RECOMMENDED" high-memory profile (m=64 MiB, t=3, p=1),
+ * 32-byte derived key. Backup/restore is rare, so the ~0.5–1s cost is acceptable and buys strong
+ * resistance to offline brute-force of the passphrase if the server's blob store is exfiltrated.
+ */
+export declare const ARGON2_PARAMS: {
+    readonly m: 65536;
+    readonly t: 3;
+    readonly p: 1;
+    readonly dkLen: 32;
+};
+/**
+ * Seal plaintext key material into a passphrase-encrypted {@link PassphraseBackup}.
+ *
+ * @param plaintext - The serialized key material to protect.
+ * @param passphrase - The user's backup passphrase.
+ * @returns The encrypted envelope (random salt in `kdfParams`, random `nonce`, argon2id + xchacha20poly1305).
+ */
+export declare function sealBackup(plaintext: Uint8Array, passphrase: string): Promise<PassphraseBackup>;
+/**
+ * Open a {@link PassphraseBackup} sealed by {@link sealBackup}.
+ *
+ * @param backup - The encrypted envelope.
+ * @param passphrase - The user's backup passphrase.
+ * @returns The decrypted plaintext key material.
+ * @throws {Error} On an unknown `kdf`/`cipher`/`version`, a missing salt, or AEAD authentication
+ *   failure (wrong passphrase, or a tampered blob/nonce/metadata) — always fails closed.
+ */
+export declare function openBackup(backup: PassphraseBackup, passphrase: string): Promise<Uint8Array>;

package/dist/esm/ts-mls/backup.js

@@ -0,0 +1,105 @@
+// Passphrase backup envelope codec — the REAL at-rest crypto for key-material backups.
+//
+// Where it sits in the blind-server model: the Agora server stores the resulting `blob` verbatim and
+// can never decrypt it (it never sees the passphrase; the KDF params alone are useless). So this is
+// the one place the backup's secrecy is decided. Per CLAUDE.md #1 we use a real memory-hard KDF
+// (argon2id, RFC 9106 high-memory profile) so a weak passphrase is expensive to brute-force on a DB
+// exfil, and an AEAD (xchacha20poly1305) so a tampered blob/nonce/metadata fails closed.
+//
+// Binary is `Uint8Array` in memory; the wire/transport layer base64-encodes `blob`/`nonce` and the
+// KDF params (incl. the hex salt) are non-secret metadata stored alongside.
+import { argon2idAsync } from "@noble/hashes/argon2.js";
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { zeroOutUint8Array } from "ts-mls";
+import { toHex, fromHex } from "./hex.js";
+const utf8 = (s) => new TextEncoder().encode(s);
+/** The only KDF this codec emits/accepts. */
+const KDF = "argon2id";
+/** The only AEAD this codec emits/accepts. */
+const CIPHER = "xchacha20poly1305";
+/** The only envelope version this codec emits/accepts. */
+const VERSION = 1;
+const SALT_BYTES = 16;
+const NONCE_BYTES = 24; // xchacha20poly1305 extended nonce — safe with random nonces
+/**
+ * argon2id parameters — RFC 9106 "FIRST RECOMMENDED" high-memory profile (m=64 MiB, t=3, p=1),
+ * 32-byte derived key. Backup/restore is rare, so the ~0.5–1s cost is acceptable and buys strong
+ * resistance to offline brute-force of the passphrase if the server's blob store is exfiltrated.
+ */
+export const ARGON2_PARAMS = { m: 65536, t: 3, p: 1, dkLen: 32 };
+/**
+ * The associated data bound into the AEAD: the STABLE scalar envelope descriptors. Binding them means
+ * an attacker can't swap the stored `kdf`/`cipher`/`version` (e.g. downgrade the KDF) without the open
+ * failing closed.
+ *
+ * `kdfParams` is deliberately NOT bound here: the server stores it as Postgres jsonb, which does not
+ * preserve object key order, so a `JSON.stringify(kdfParams)`-based AAD would differ between seal and
+ * open and break a perfectly valid backup. It needs no AAD anyway — the `salt` is bound implicitly
+ * (it's a KDF input: any change yields the wrong key and the AEAD fails), and the cost params are
+ * pinned to {@link ARGON2_PARAMS} on open, so tampering them is inert.
+ */
+function aad(kdf, cipher, version) {
+    return utf8(JSON.stringify({ v: version, kdf, cipher }));
+}
+/**
+ * Derive a 32-byte key from the passphrase + salt with argon2id at {@link ARGON2_PARAMS}.
+ *
+ * @param passphrase - The user's backup passphrase.
+ * @param salt - The 16-byte random salt.
+ * @returns The 32-byte derived symmetric key (caller must zeroize after use).
+ */
+async function deriveKey(passphrase, salt) {
+    return argon2idAsync(utf8(passphrase), salt, ARGON2_PARAMS);
+}
+/**
+ * Seal plaintext key material into a passphrase-encrypted {@link PassphraseBackup}.
+ *
+ * @param plaintext - The serialized key material to protect.
+ * @param passphrase - The user's backup passphrase.
+ * @returns The encrypted envelope (random salt in `kdfParams`, random `nonce`, argon2id + xchacha20poly1305).
+ */
+export async function sealBackup(plaintext, passphrase) {
+    const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+    const nonce = crypto.getRandomValues(new Uint8Array(NONCE_BYTES));
+    const kdfParams = { salt: toHex(salt), m: ARGON2_PARAMS.m, t: ARGON2_PARAMS.t, p: ARGON2_PARAMS.p };
+    const key = await deriveKey(passphrase, salt);
+    try {
+        const blob = xchacha20poly1305(key, nonce, aad(KDF, CIPHER, VERSION)).encrypt(plaintext);
+        return { blob, kdf: KDF, kdfParams, cipher: CIPHER, nonce, version: VERSION };
+    }
+    finally {
+        zeroOutUint8Array(key);
+    }
+}
+/**
+ * Open a {@link PassphraseBackup} sealed by {@link sealBackup}.
+ *
+ * @param backup - The encrypted envelope.
+ * @param passphrase - The user's backup passphrase.
+ * @returns The decrypted plaintext key material.
+ * @throws {Error} On an unknown `kdf`/`cipher`/`version`, a missing salt, or AEAD authentication
+ *   failure (wrong passphrase, or a tampered blob/nonce/metadata) — always fails closed.
+ */
+export async function openBackup(backup, passphrase) {
+    if (backup.kdf !== KDF)
+        throw new Error(`secure-chat: unsupported backup kdf "${backup.kdf}"`);
+    if (backup.cipher !== CIPHER)
+        throw new Error(`secure-chat: unsupported backup cipher "${backup.cipher}"`);
+    if (backup.version !== VERSION)
+        throw new Error(`secure-chat: unsupported backup version ${backup.version}`);
+    const saltHex = backup.kdfParams.salt;
+    if (!saltHex)
+        throw new Error("secure-chat: backup is missing its KDF salt");
+    const key = await deriveKey(passphrase, fromHex(saltHex));
+    try {
+        return xchacha20poly1305(key, backup.nonce, aad(backup.kdf, backup.cipher, backup.version)).decrypt(backup.blob);
+    }
+    catch {
+        // Don't leak which check failed; a wrong passphrase and a tampered blob are indistinguishable here.
+        throw new Error("secure-chat: backup decrypt failed (wrong passphrase or corrupt backup)");
+    }
+    finally {
+        zeroOutUint8Array(key);
+    }
+}
+//# sourceMappingURL=backup.js.map

package/dist/esm/ts-mls/backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../../src/ts-mls/backup.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,gGAAgG;AAChG,oGAAoG;AACpG,yFAAyF;AACzF,EAAE;AACF,mGAAmG;AACnG,4EAA4E;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,QAAQ,CAAC;AAE3C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAE1C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAExD,6CAA6C;AAC7C,MAAM,GAAG,GAAG,UAAmB,CAAC;AAChC,8CAA8C;AAC9C,MAAM,MAAM,GAAG,mBAA4B,CAAC;AAC5C,0DAA0D;AAC1D,MAAM,OAAO,GAAG,CAAU,CAAC;AAE3B,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,6DAA6D;AAErF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAW,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,SAAS,GAAG,CAAC,GAAW,EAAE,MAAc,EAAE,OAAe;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,IAAgB;IAC3D,OAAO,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAqB,EAAE,UAAkB;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAA4B,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;IAC7H,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzF,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAChF,CAAC;YAAS,CAAC;QACT,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAwB,EAAE,UAAkB;IAC3E,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3G,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAI,MAAM,CAAC,SAA+B,CAAC,IAAI,CAAC;IAC7D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,oGAAoG;QACpG,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;YAAS,CAAC;QACT,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;AACH,CAAC"}

package/dist/esm/ts-mls/crypto.d.ts

@@ -1,5 +1,5 @@
 import { type CiphersuiteImpl, type KeyPackage, type PrivateKeyPackage, type ClientState } from "ts-mls";
-import type { SecureChatCrypto, DeviceIdentity, KeyPackageBundle, GroupHandle, CommitResult, TargetedWelcome, PassphraseBackup } from "../interface.js";
+import type { SecureChatCrypto, DeviceIdentity, KeyPackageBundle, GroupHandle, GroupMemberIdentity, CommitResult, TargetedWelcome, PassphraseBackup } from "../interface.js";
 interface DeviceState {
     deviceId: string;
     ciphersuite: number;
@@ -11,10 +11,29 @@ interface PendingKeyPackage {
     publicPackage: KeyPackage;
     privatePackage: PrivateKeyPackage;
 }
+/**
+ * Tuning for the MLS secret-tree ratchet that backs replay/gap enforcement (RFC 9420). These are the
+ * legitimate dials — they tighten or loosen the window, they never disable enforcement. Omitted fields
+ * fall back to ts-mls's conservative defaults.
+ */
+export interface KeyRetentionOptions {
+    /** Max generations the ratchet will skip forward before rejecting (`gap-too-large`). ts-mls default 200. */
+    maximumForwardRatchetSteps?: number;
+    /** How many skipped per-sender message keys to retain (the out-of-order/reorder window). ts-mls default 10. */
+    retainKeysForGenerations?: number;
+    /** How many past epochs of receiver keys to retain (late delivery across a Commit). ts-mls default 4. */
+    retainKeysForEpochs?: number;
+}
 /** Options for {@link TsMlsSecureChatCrypto}. */
 export interface TsMlsSecureChatCryptoOptions {
     /** Numeric MLS ciphersuite id (RFC 9420). Defaults to 1 (the MTI baseline). */
     ciphersuite?: number;
+    /**
+     * Override the ts-mls key-retention window (replay/gap tolerance). Defaults to ts-mls's conservative
+     * values. Tightening (e.g. a smaller `maximumForwardRatchetSteps`) narrows the accepted gap; it cannot
+     * turn enforcement off. Applied consistently to created, joined, imported, and restored groups.
+     */
+    keyRetention?: KeyRetentionOptions;
 }
 /**
  * Real RFC 9420 MLS implementation of {@link SecureChatCrypto}, built on ts-mls. Construct via
@@ -27,6 +46,7 @@ export declare class TsMlsSecureChatCrypto implements SecureChatCrypto {
     private credential?;
     protected readonly pending: Map<string, PendingKeyPackage>;
     protected readonly groups: Map<string, ClientState>;
+    private readonly clientConfig;
     constructor(options?: TsMlsSecureChatCryptoOptions);
     /** Lazily load + memoize the ciphersuite primitives. */
     protected cs(): Promise<CiphersuiteImpl>;
@@ -63,6 +83,7 @@ export declare class TsMlsSecureChatCrypto implements SecureChatCrypto {
         senderDeviceId: string;
         epoch: bigint;
     }>;
+    exportGroupIdentities(group: GroupHandle): Promise<GroupMemberIdentity[]>;
     processWelcome(welcomePayload: Uint8Array): Promise<GroupHandle>;
     processCommit(group: GroupHandle, commit: Uint8Array): Promise<GroupHandle>;
     processProposal(group: GroupHandle, proposal: Uint8Array): Promise<void>;
@@ -70,8 +91,8 @@ export declare class TsMlsSecureChatCrypto implements SecureChatCrypto {
     importGroupState(state: Uint8Array): Promise<GroupHandle>;
     exportDeviceState(): Promise<Uint8Array>;
     importDeviceState(state: Uint8Array): Promise<DeviceIdentity>;
-    exportBackup(_passphrase: string): Promise<PassphraseBackup>;
-    importBackup(_passphrase: string, _backup: PassphraseBackup): Promise<void>;
+    exportBackup(passphrase: string): Promise<PassphraseBackup>;
+    importBackup(passphrase: string, backup: PassphraseBackup): Promise<DeviceIdentity>;
     /** Serialize identity (incl. signature private key) + the pending KeyPackage store to an opaque blob. */
     protected serializeDeviceState(): Uint8Array;
     private peerDeviceId;

package/dist/esm/ts-mls/crypto.js

@@ -7,16 +7,39 @@
 //
 // Security (CLAUDE.md #1): randomness is the platform CSPRNG (crypto.getRandomValues) + ts-mls/@noble;
 // failed decode/decrypt/join fail closed (throw, drop); consumed key material is zeroized.
-import { generateKeyPackageWithKey, defaultCapabilities, defaultLifetime, createGroup, createCommit, joinGroup, createApplicationMessage, processMessage, encodeMlsMessage, decodeMlsMessage, encodeGroupState, decodeGroupState, zeroOutUint8Array, acceptAll, emptyPskIndex, } from "ts-mls";
+import { generateKeyPackageWithKey, defaultCapabilities, defaultLifetime, createGroup, createCommit, joinGroup, createApplicationMessage, processMessage, encodeMlsMessage, decodeMlsMessage, encodeGroupState, decodeGroupState, zeroOutUint8Array, acceptAll, emptyPskIndex, defaultKeyRetentionConfig, } from "ts-mls";
 // makeKeyPackageRef + getGroupMembers + defaultClientConfig aren't re-exported from the package root;
 // ts-mls exposes every module via its "./*.js" export, so deep-import them.
 import { makeKeyPackageRef } from "ts-mls/keyPackage.js";
 import { getGroupMembers } from "ts-mls/clientState.js";
 import { defaultClientConfig } from "ts-mls/clientConfig.js";
+import { SecureChatDecryptError } from "../interface.js";
 import { DEFAULT_CIPHERSUITE_ID, loadCiphersuite } from "./ciphersuite.js";
+import { sealBackup, openBackup } from "./backup.js";
 import { toHex, fromHex } from "./hex.js";
 const utf8 = (s) => new TextEncoder().encode(s);
 const MLS_VERSION = "mls10";
+/**
+ * Map a ts-mls decrypt/process failure to a {@link SecureChatDecryptError} with a classified reason.
+ * Matches on ts-mls's error messages/names (its secret-tree ratchet is the actual enforcement). The
+ * returned message is generic-by-reason — we never echo internal bytes or plaintext into the error.
+ */
+function classifyDecryptError(err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const name = err instanceof Error ? err.name : "";
+    let reason = "unknown";
+    if (/desired gen(?:eration)? in the past/i.test(msg))
+        reason = "replay";
+    else if (/too far in the future/i.test(msg))
+        reason = "gap-too-large";
+    else if (/epoch too old|former epoch/i.test(msg))
+        reason = "epoch-too-old";
+    else if (name === "CryptoVerificationError" || /signature|verif|auth/i.test(msg))
+        reason = "unauthenticated";
+    else if (name === "CodecError" || /decode|malformed/i.test(msg))
+        reason = "malformed";
+    return new SecureChatDecryptError(reason, `secure-chat: message decrypt rejected (${reason})`);
+}
 /**
  * Real RFC 9420 MLS implementation of {@link SecureChatCrypto}, built on ts-mls. Construct via
  * `createTsMlsSecureChatCrypto`; inject into `<SecureChatProvider crypto={…}>`.
@@ -27,6 +50,10 @@ export class TsMlsSecureChatCrypto {
         this.pending = new Map(); // hex(ref) → kp
         this.groups = new Map(); // hex(groupId) → state
         this.ciphersuiteId = options.ciphersuite ?? DEFAULT_CIPHERSUITE_ID;
+        this.clientConfig = {
+            ...defaultClientConfig,
+            keyRetentionConfig: { ...defaultKeyRetentionConfig, ...options.keyRetention },
+        };
     }
     /** Lazily load + memoize the ciphersuite primitives. */
     async cs() {
@@ -77,7 +104,7 @@ export class TsMlsSecureChatCrypto {
         const groupId = opts.mlsGroupId ?? crypto.getRandomValues(new Uint8Array(32));
         // Seed the group with a fresh self KeyPackage (local-only; never published).
         const self = await generateKeyPackageWithKey(this.credential, defaultCapabilities(), defaultLifetime, [], { signKey: dev.signKey, publicKey: dev.publicKey }, cs);
-        let state = await createGroup(groupId, self.publicPackage, self.privatePackage, [], cs);
+        let state = await createGroup(groupId, self.publicPackage, self.privatePackage, [], cs, this.clientConfig);
         const adds = opts.initialMembers.map((m) => ({
             proposalType: "add", add: { keyPackage: this.decodeKeyPackage(m.keyPackage) },
         }));
@@ -124,16 +151,43 @@ export class TsMlsSecureChatCrypto {
     async decryptMessage(group, ciphertext) {
         const cs = await this.cs();
         const state = this.lookupGroup(group);
-        const decoded = decodeMlsMessage(ciphertext, 0);
-        if (!decoded)
-            throw new Error("secure-chat: malformed MLS message");
-        const res = await processMessage(decoded[0], state, emptyPskIndex, acceptAll, cs);
+        // ts-mls's secret-tree ratchet is the enforcement point: it throws on a replayed generation, an
+        // over-limit forward gap, a too-old epoch, or a failed authentication. We classify that throw (and
+        // decode failures) into a SecureChatDecryptError and re-raise it — and crucially we do NOT advance
+        // stored group state on failure (processMessage threw before returning newState), so a rejected
+        // message never ratchets us forward. Fail closed.
+        let res;
+        try {
+            const decoded = decodeMlsMessage(ciphertext, 0);
+            if (!decoded)
+                throw new SecureChatDecryptError("malformed", "secure-chat: malformed MLS message");
+            res = await processMessage(decoded[0], state, emptyPskIndex, acceptAll, cs);
+        }
+        catch (err) {
+            throw err instanceof SecureChatDecryptError ? err : classifyDecryptError(err);
+        }
         this.zeroize(res.consumed);
         this.groups.set(toHex(group.mlsGroupId), res.newState);
-        if (res.kind !== "applicationMessage")
-            throw new Error("secure-chat: expected an application message");
+        if (res.kind !== "applicationMessage") {
+            throw new SecureChatDecryptError("malformed", "secure-chat: expected an application message");
+        }
         return { plaintext: res.message, senderDeviceId: this.peerDeviceId(res.newState), epoch: res.newState.groupContext.epoch };
     }
+    async exportGroupIdentities(group) {
+        const state = this.lookupGroup(group);
+        const out = [];
+        // Read the roster from the MLS ratchet tree (same source peerDeviceId uses). Only basic-credential
+        // leaves carry a device-id identity; skip anything else rather than guess.
+        for (const leaf of getGroupMembers(state)) {
+            if (leaf.credential.credentialType !== "basic")
+                continue;
+            out.push({
+                deviceId: new TextDecoder().decode(leaf.credential.identity),
+                signaturePublicKey: leaf.signaturePublicKey,
+            });
+        }
+        return out;
+    }
     async processWelcome(welcomePayload) {
         const cs = await this.cs();
         const decoded = decodeMlsMessage(welcomePayload, 0);
@@ -154,8 +208,10 @@ export class TsMlsSecureChatCrypto {
         }
         if (!matched || !matchedRef)
             throw new Error("secure-chat: no matching KeyPackage for this Welcome");
-        // ratchetTree omitted — it rode in via the creator's ratchetTreeExtension.
-        const state = await joinGroup(welcome, matched.publicPackage, matched.privatePackage, emptyPskIndex, cs);
+        // ratchetTree omitted — it rode in via the creator's ratchetTreeExtension. Pass our clientConfig
+        // (positional args 6/7 — ratchetTree/resumingFromState — are unused here) so the joined group gets
+        // the configured key-retention window, not ts-mls's default.
+        const state = await joinGroup(welcome, matched.publicPackage, matched.privatePackage, emptyPskIndex, cs, undefined, undefined, this.clientConfig);
         this.pending.delete(matchedRef); // one-time: consumed
         this.groups.set(toHex(state.groupContext.groupId), state);
         return { mlsGroupId: state.groupContext.groupId, epoch: state.groupContext.epoch };
@@ -193,7 +249,9 @@ export class TsMlsSecureChatCrypto {
         const decoded = decodeGroupState(state, 0);
         if (!decoded)
             throw new Error("secure-chat: corrupt group state");
-        const clientState = { ...decoded[0], clientConfig: defaultClientConfig };
+        // Reattach OUR clientConfig (not ts-mls's default) so the configured key-retention window survives
+        // the persistence round-trip — encodeGroupState drops the (callback-bearing) config.
+        const clientState = { ...decoded[0], clientConfig: this.clientConfig };
         this.groups.set(toHex(clientState.groupContext.groupId), clientState);
         return { mlsGroupId: clientState.groupContext.groupId, epoch: clientState.groupContext.epoch };
     }
@@ -221,13 +279,34 @@ export class TsMlsSecureChatCrypto {
         }
         return { deviceId: p.deviceId, signaturePublicKey: this.device.publicKey, credential: utf8(p.deviceId), ciphersuite: p.ciphersuite };
     }
-    // Backup/restore UX (real argon2id KDF + AEAD) is Phase 2 task 5. async so callers get a rejected
-    // promise, not a synchronous throw.
-    async exportBackup(_passphrase) {
-        throw new Error("secure-chat: passphrase backup is not implemented in this core yet (Phase 2 task 5)");
+    // Passphrase backup of ALL local key material: the device identity (incl. the signature private
+    // key + pending KeyPackages, via serializeDeviceState) and every joined group's full MLS state.
+    // The argon2id KDF + AEAD live in ./backup.ts; here we just (de)serialize the payload. The blob is
+    // opaque to the blind server — only ciphertext crosses the wire.
+    async exportBackup(passphrase) {
+        const payload = {
+            v: 1,
+            device: toHex(this.serializeDeviceState()),
+            groups: [...this.groups.values()].map((st) => toHex(encodeGroupState(st))),
+        };
+        return sealBackup(utf8(JSON.stringify(payload)), passphrase);
     }
-    async importBackup(_passphrase, _backup) {
-        throw new Error("secure-chat: passphrase restore is not implemented in this core yet (Phase 2 task 5)");
+    async importBackup(passphrase, backup) {
+        const plain = await openBackup(backup, passphrase);
+        const payload = JSON.parse(new TextDecoder().decode(plain));
+        if (payload.v !== 1)
+            throw new Error(`secure-chat: unsupported backup payload version ${payload.v}`);
+        // Restore the device identity first (also clears + repopulates the pending KeyPackages).
+        const identity = await this.importDeviceState(fromHex(payload.device));
+        // Then every group's full state, keyed by its MLS group id (mirrors importGroupState).
+        for (const g of payload.groups) {
+            const decoded = decodeGroupState(fromHex(g), 0);
+            if (!decoded)
+                throw new Error("secure-chat: corrupt group state in backup");
+            const clientState = { ...decoded[0], clientConfig: this.clientConfig };
+            this.groups.set(toHex(clientState.groupContext.groupId), clientState);
+        }
+        return identity;
     }
     /** Serialize identity (incl. signature private key) + the pending KeyPackage store to an opaque blob. */
     serializeDeviceState() {