@breakside/jskit 2023.20.0 → 2023.22.0

package/Root/Frameworks/NotificationKit/NKUserNotificationCenter.js

@@ -36,6 +36,9 @@ JSClass("NKUserNotificationCenter", JSObject, {
     registerForRemoteNotifications: function(completion, target){
     },
 
+    unregisterForRemoteNotifications: function(completion, target){
+    },
+
     addNotification: function(notification, date){
     },
 
@@ -44,6 +47,8 @@ JSClass("NKUserNotificationCenter", JSObject, {
 
     defaultIcon: null,
 
+    webPushApplicationServerJWK: null,
+
 });
 
 NKUserNotificationCenter.AuthorizationStatus = {

package/Root/Frameworks/NotificationKit/NKWebPushService.js

@@ -15,91 +15,198 @@
 
 // #import Foundation
 // #import SecurityKit
-// jshint browser: true
+// #import "NKUserNotification.js"
+/* global NKWebPushService */
 "use strict";
 
 (function(){
 
 var logger = JSLog("notify", "webpush");
 
-JSObject("NKWebPushService", JSObject, {
+JSClass("NKWebPushService", JSObject, {
 
-    url: null,
     urlSession: null,
-    signingJWK: null,
+    keystore: null,
     contactURL: null, 
 
-    initWithURL: function(url, urlSession){
-        this.url = url;
+    initWithKeystore: function(keystore, urlSession){
+        this.keystore = keystore;
         this.urlSession = urlSession || JSURLSession.shared;
     },
 
-    pushNotification: function(notification, completion, target){
+    pushNotification: function(notification, registration, completion, target){
         if (!completion){
-            completion = Promise.completion(Promise.resolveNonNull);
+            completion = Promise.completion(Promise.resolveNull);
         }
-        this.createPushRequest(function(request){
-            if (request === null){
-                completion.call(target, false);
+        this.createPushRequest(notification, registration, function(request, error){
+            if (error !== null){
+                completion.call(target, error);
                 return;
             }
             var task = this.urlSession.dataTaskWithRequest(request, function(error){
                 if (error !== null){
                     logger.error("Push request failed: %{error}", error);
-                    completion.call(target, false);
+                    completion.call(target, error);
                     return;
                 }
                 if (task.response.statusCode !== JSURLResponse.StatusCode.created){
                     logger.error("Push request failed with %d", task.response.statusCode);
-                    completion.call(target, false);
+                    completion.call(target, JSURLResponseError(task.response));
                     return;
                 }
-                completion.call(target, true);
+                completion.call(target, null);
             });
+            task.resume();
         }, this);
         return completion.promise;
     },
 
-    createPushRequest: function(completion, target){
-        var request = JSURLRequest.initWithURL(this.url);
+    createPushRequest: function(notification, registration, completion, target){
+        var url = JSURL.initWithString(registration.subscription.endpoint);
+        var request = JSURLRequest.initWithURL(url);
         request.method = JSURLRequest.Method.post;
-        request.data = null; // TODO
-        this.authorizePushRequest(request, function(authorized){
-            if (authorized){
-                completion.call(target, request);
-            }else{
-                completion.call(target, null);
+        if (notification.identifier !== null){
+            var hash = JSSHA1Hash(notification.identifier.utf8());
+            request.headerMap.add("Topic", hash.base64URLStringRepresentation());
+        }
+        request.headerMap.add("TTL", notification.timeToLive);
+        request.headerMap.add("Urgency", this.urgencyForNotificationPriority(notification.priority));
+        this.authorizePushRequest(request, notification, registration, function(error){
+            if (error !== null){
+                completion.call(target, request, error);
+                return;
             }
+            this.encodePushRequest(request, notification, registration, function(error){
+                completion.call(target, request, error);
+            }, this);
         }, this);
     },
 
-    authorizePushRequest: function(request, completion, target){
-        if (this.signingJWK === null){
-            completion.call(target, true);
-        }else{
-            var identificationPayload = {
-                aud: this.url.origin,
-                exp: JSDate.initWithTimeIntervalSinceNow(JSTimeInterval.hours(24)).timeIntervalSince1970,
+    authorizePushRequest: function(request, notification, registration, completion, target){
+        // https://www.rfc-editor.org/rfc/rfc8292
+        var publicJWK = registration.options.applicationServerJWK;
+        var privateJWK = null;
+        if (publicJWK){
+            privateJWK = this.keystore.jwkForIdentifier(publicJWK.kid);
+            if (privateJWK === null){
+                completion.call(target, new Error("No key matching kid: %s".sprintf(publicJWK.kid)));
+                return;
+            }
+        }
+        if (privateJWK){
+            var url = JSURL.initWithString(registration.subscription.endpoint);
+            var claims = {
+                aud: url.origin,
+                exp: Math.floor(JSDate.initWithTimeIntervalSinceNow(JSTimeInterval.hours(24)).timeIntervalSince1970),
             };
             if (this.contactURL !== null){
-                identificationPayload.sub = this.contactURL.encodedString;
+                claims.sub = this.contactURL.encodedString;
             }
-            var identificationToken = SECJSONWebToken.initWithPayload(identificationPayload);
-            identificationToken.sign(this.signingJWK, function(identificationTokenString){
-                var keyString = JSData.initWithChunks([
+            var token = SECJSONWebToken.initWithPayload(claims);
+            token.sign(privateJWK, function(tokenString){
+                var encodedPublicKey = JSData.initWithChunks([
                     JSData.initWithArray([0x04]),
-                    this.signingJWK.x.dataByDecodingBase64URL(),
-                    this.signingJWK.y.dataByDecodingBase64URL()
+                    privateJWK.x.dataByDecodingBase64URL(),
+                    privateJWK.y.dataByDecodingBase64URL()
                 ]).base64URLStringRepresentation();
-                request.headerMap.add("Authorization", "vapid t=%s,k=%s".sprintf(identificationTokenString, keyString));
-                completion.call(target, true);
+                request.headerMap.add("Authorization", "vapid t=%s, k=%s".sprintf(tokenString, encodedPublicKey));
+                completion.call(target, null);
             }, function(error){
                 logger.error("Failed to sign push request: %{error}", error);
-                completion.call(target, false);
+                completion.call(target, error);
             });
+        }else{
+            completion.call(target, null);
+        }
+    },
+
+    encodePushRequest: function(request, notification, registration, completion, target){
+        // https://www.rfc-editor.org/rfc/rfc8188
+        // https://www.rfc-editor.org/rfc/rfc8291
+        var encodedClientPublicKey = registration.subscription.keys.p256dh;
+        var encodedClientAuthSecret = registration.subscription.keys.auth;
+        var plaintext = JSON.stringify({
+            type: "notification",
+            title: notification.title,
+            body: notification.body
+        }).utf8();
+        if (encodedClientPublicKey && encodedClientAuthSecret){
+            if (plaintext.length > NKWebPushService.maximumRecordSize - 17){
+                completion.call(target, new Error("Message too long for web push"));
+                return;
+            }
+            var clientPublicKeyData = encodedClientPublicKey.dataByDecodingBase64URL();
+            var clientAuthSecretData = encodedClientAuthSecret.dataByDecodingBase64URL();
+            var salt = SECCipher.getRandomData(16);
+            var caughtError = null;
+            // TODO: abstract ECDH calls so they're not node-specific
+            var crypto = require("crypto");
+            var ecdh = crypto.createECDH('prime256v1');
+            ecdh.generateKeys();
+            var serverPublicKeyData = JSData.initWithNodeBuffer(ecdh.getPublicKey());
+            var sharedKeyData = JSData.initWithNodeBuffer(ecdh.computeSecret(clientPublicKeyData));
+            SECHMAC.digest(SECHMAC.Algorithm.sha256, clientAuthSecretData, sharedKeyData).then(function(prk){
+                return SECHMAC.digest(SECHMAC.Algorithm.sha256, prk, JSData.initWithChunks([
+                    "WebPush: info\x00".utf8(),
+                    clientPublicKeyData,
+                    serverPublicKeyData,
+                    JSData.initWithArray([0x01])
+                ]));
+            }).then(function(ikm){
+                return SECHMAC.digest(SECHMAC.Algorithm.sha256, salt, ikm);
+            }).then(function(prk){
+                return Promise.all([
+                    SECHMAC.digest(SECHMAC.Algorithm.sha256, prk, "Content-Encoding: aes128gcm\x00\x01".utf8()),
+                    SECHMAC.digest(SECHMAC.Algorithm.sha256, prk, "Content-Encoding: nonce\x00\x01".utf8())
+                ]);
+            }).then(function(keyAndNonce){
+                var keyData = keyAndNonce[0].subdataInRange(JSRange(0, 16));
+                var nonceData = keyAndNonce[1].subdataInRange(JSRange(0, 12));
+                var cipher = SECCipher.initWithAlgorithm(SECCipher.Algorithm.aesGCM, 128);
+                return cipher.createKeyWithData(keyData).then(function(key){
+                    if (key === null){
+                        return;
+                    }
+                    return cipher.encryptWithNonce(nonceData, JSData.initWithChunks([plaintext, JSData.initWithArray([0x02])]), key);
+                });
+            }).then(function(encrypted){
+                var ciphertext = encrypted.subdataInRange(JSRange(12, encrypted.length - 12));
+                var header = JSData.initWithLength(5);
+                header.dataView().setUint32(0, NKWebPushService.maximumRecordSize);
+                header[4] = serverPublicKeyData.length;
+                request.headerMap.add("Content-Encoding", "aes128gcm");
+                request.data = JSData.initWithChunks([
+                    salt,
+                    header,
+                    serverPublicKeyData,
+                    ciphertext
+                ]);
+            }).catch(function(error){
+                caughtError = error;
+            }).finally(function(){
+                completion.call(target, caughtError);
+            });
+        }else{
+            if (plaintext.length > NKWebPushService.maximumRecordSize - 17){
+                completion.call(target, new Error("Message too long for web push"));
+                return;
+            }
+            request.data = plaintext;
+            completion.call(target, null);
+        }
+    },
+
+    urgencyForNotificationPriority: function(priority){
+        switch (priority){
+            case NKUserNotification.Priority.veryLow: return "very-low";
+            case NKUserNotification.Priority.low: return "low";
+            case NKUserNotification.Priority.high: return "high";
+            default: return "normal";
         }
     }
 
 });
 
+NKWebPushService.maximumRecordSize = 4096;
+
 })();

package/Root/Frameworks/NotificationKit/NotificationKit+Node.js

@@ -0,0 +1,19 @@
+// Copyright 2021 Breakside Inc.
+//
+// Licensed under the Breakside Public License, Version 1.0 (the "License");
+// you may not use this file except in compliance with the License.
+// If a copy of the License was not distributed with this file, you may
+// obtain a copy at
+//
+//     http://breakside.io/licenses/LICENSE-1.0.txt
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// #import "NotificationKit.js"
+"use strict";
+
+// #import "NKWebPushService.js"

package/Root/Frameworks/PDFKit/Info.yaml

@@ -1,6 +1,6 @@
 JSBundleType: framework
 JSBundleIdentifier: io.breakside.JSKit.PDFKit
-JSBundleVersion: 2023.20.0
+JSBundleVersion: 2023.22.0
 JSDevelopmentLanguage: en
 JSCopyright: Copyright © 2020 Breakside Inc.
 JSLicenseNotice: |

package/Root/Frameworks/QRKit/Info.yaml

@@ -1,6 +1,6 @@
 JSBundleType: framework
 JSBundleIdentifier: io.breakside.JSKit.QRKit
-JSBundleVersion: 2023.20.0
+JSBundleVersion: 2023.22.0
 JSDevelopmentLanguage: en
 JSCopyright: Copyright © 2020 Breakside Inc.
 JSLicenseNotice: |

package/Root/Frameworks/SearchKit/Info.yaml

@@ -1,6 +1,6 @@
 JSBundleType: framework
 JSBundleIdentifier: io.breakside.JSKit.SearchKit
-JSBundleVersion: 2023.20.0
+JSBundleVersion: 2023.22.0
 JSDevelopmentLanguage: en
 JSCopyright: Copyright © 2020 Breakside Inc.
 JSLicenseNotice: |

package/Root/Frameworks/SecurityKit/Info.yaml

@@ -1,6 +1,6 @@
 JSBundleType: framework
 JSBundleIdentifier: io.breakside.JSKit.SecurityKit
-JSBundleVersion: 2023.20.0
+JSBundleVersion: 2023.22.0
 JSDevelopmentLanguage: en
 JSCopyright: Copyright © 2020 Breakside Inc.
 JSBundleEnvironments:

package/Root/Frameworks/SecurityKit/SECCipher+HTML.js

@@ -195,14 +195,6 @@ SECCipherAESCounter.definePropertiesFromExtensions({
             counter: JSData.initWithLength(16),
             length: 64
         };
-        this.decryptedMessageId =
-              (nonce[6] << 48)
-            | (nonce[5] << 40)
-            | (nonce[4] << 32)
-            | (nonce[3] << 24)
-            | (nonce[2] << 16)
-            | (nonce[1] << 8)
-            | (nonce[0]);
         nonce.copyTo(algorithm.counter, 0);
         return algorithm;
     },
@@ -282,55 +274,41 @@ SECCipherAESGaloisCounterMode.definePropertiesFromExtensions({
 
     htmlAlgorithmName: HTMLCryptoAlgorithmNames.aesGCM,
 
-    _getHTMLEncryptAlgorithm: function(){
-        var nonce = JSData.initWithArray([
-            1,
-            ((this.encryptedMessageId / 0x100000000) >> 16) & 0xFF,
-            ((this.encryptedMessageId / 0x100000000) >> 8) & 0xFF,
-            (this.encryptedMessageId / 0x100000000) & 0xFF,
-            (this.encryptedMessageId >> 24) & 0xFF,
-            (this.encryptedMessageId >> 16) & 0xFF,
-            (this.encryptedMessageId >> 8) & 0xFF,
-            this.encryptedMessageId & 0xF
-        ]);
+    _getHTMLEncryptAlgorithm: function(nonce, _ivLength){
+        if (_ivLength === undefined){
+            _ivLength = nonce.length;
+        }
         var algorithm = {
             name: HTMLCryptoAlgorithmNames.aesGCM,
-            iv: JSData.initWithLength(16),
+            iv: JSData.initWithLength(_ivLength),
             tagLength: 128
         };
         nonce.copyTo(algorithm.iv, 0);
         return algorithm;
     },
 
-    _getHTMLDecryptAlgorithm: function(prefixedData){
-        var nonce = prefixedData.subdataInRange(JSRange(0, 8));
+    _getHTMLDecryptAlgorithm: function(prefixedData, nonceLength, _ivLength){
+        if (nonceLength === undefined){
+            nonceLength = 8;
+        }
+        if (_ivLength === undefined){
+            _ivLength = nonceLength;
+        }
+        var nonce = prefixedData.subdataInRange(JSRange(0, nonceLength));
         var algorithm = {
             name: HTMLCryptoAlgorithmNames.aesGCM,
-            iv: JSData.initWithLength(16),
+            iv: JSData.initWithLength(_ivLength),
             tagLength: 128
         };
-        this.decryptedMessageId =
-              (nonce[6] << 48)
-            | (nonce[5] << 40)
-            | (nonce[4] << 32)
-            | (nonce[3] << 24)
-            | (nonce[2] << 16)
-            | (nonce[1] << 8)
-            | (nonce[0]);
         nonce.copyTo(algorithm.iv, 0);
         return algorithm;
     },
 
-    encrypt: function(data, key, completion, target){
+    encryptWithNonce: function(nonce, data, key, completion, target, _ivLength){
         if (!completion){
             completion = Promise.completion(Promise.resolveNonNull);
         }
-        if (!this.ensureUniqueMessageID()){
-            JSRunLoop.main.schedule(completion, target, null);
-            return completion.promise;
-        }
-        var algorithm = this._getHTMLEncryptAlgorithm();
-        var nonce = algorithm.iv.truncatedToLength(8);
+        var algorithm = this._getHTMLEncryptAlgorithm(nonce, _ivLength);
         crypto.subtle.encrypt(algorithm, key.htmlKey, data).then(function(encrypted){
             var noncePrefixed = JSData.initWithChunks([nonce, JSData.initWithBuffer(encrypted)]);
             completion.call(target, noncePrefixed);
@@ -340,12 +318,12 @@ SECCipherAESGaloisCounterMode.definePropertiesFromExtensions({
         return completion.promise;
     },
 
-    decrypt: function(data, key, completion, target){
+    decryptWithNonceLength: function(nonceLength, data, key, completion, target, _ivLength){
         if (!completion){
             completion = Promise.completion(Promise.resolveNonNull);
         }
-        var algorithm = this._getHTMLDecryptAlgorithm(data);
-        var encrypted = data.subdataInRange(JSRange(8, data.length - 8));
+        var algorithm = this._getHTMLDecryptAlgorithm(data, nonceLength, _ivLength);
+        var encrypted = data.subdataInRange(JSRange(nonceLength, data.length - nonceLength));
         crypto.subtle.decrypt(algorithm, key.htmlKey, encrypted).then(function(decrypted){
             var decryptedData = JSData.initWithBuffer(decrypted);
             completion.call(target, decryptedData);
@@ -363,8 +341,17 @@ SECCipherAESGaloisCounterMode.definePropertiesFromExtensions({
             JSRunLoop.main.schedule(completion, target, null);
             return completion.promise;
         }
-        var algorithm = this._getHTMLEncryptAlgorithm();
-        var nonce = algorithm.iv.truncatedToLength(8);
+        var nonce = JSData.initWithArray([
+            1,
+            ((this.encryptedMessageId / 0x100000000) >> 16) & 0xFF,
+            ((this.encryptedMessageId / 0x100000000) >> 8) & 0xFF,
+            (this.encryptedMessageId / 0x100000000) & 0xFF,
+            (this.encryptedMessageId >> 24) & 0xFF,
+            (this.encryptedMessageId >> 16) & 0xFF,
+            (this.encryptedMessageId >> 8) & 0xFF,
+            this.encryptedMessageId & 0xF
+        ]);
+        var algorithm = this._getHTMLEncryptAlgorithm(nonce, 16);
         crypto.subtle.wrapKey("raw", key.htmlKey, wrappingKey.htmlKey, algorithm).then(function(bytes){
             var noncePrefixed = JSData.initWithChunks([nonce, JSData.initWithBuffer(bytes)]);
             completion.call(target, noncePrefixed);
@@ -378,7 +365,7 @@ SECCipherAESGaloisCounterMode.definePropertiesFromExtensions({
         if (!completion){
             completion = Promise.completion(Promise.resolveNonNull);
         }
-        var algorithm = this._getHTMLDecryptAlgorithm(wrappedKeyData);
+        var algorithm = this._getHTMLDecryptAlgorithm(wrappedKeyData, 8, 16);
         var unwrappedKeyHTMLAlgorithm = HTMLCryptoAlgorithmNames.fromAlgorithm(unwrappedKeyAlgorithm);
         wrappedKeyData = wrappedKeyData.subdataInRange(JSRange(8, wrappedKeyData.length - 8));
         crypto.subtle.unwrapKey("raw", wrappedKeyData, wrappingKey.htmlKey, algorithm, unwrappedKeyHTMLAlgorithm, true, ["encrypt", "decrypt"]).then(function(key){

package/Root/Frameworks/SecurityKit/SECCipher+Node.js

@@ -182,14 +182,6 @@ SECCipherAESCounter.definePropertiesFromExtensions({
                 return completion.promise;
             }
             var nonce = data.subdataInRange(JSRange(0, 8));
-            this.decryptedMessageId =
-                  (nonce[6] << 48)
-                | (nonce[5] << 40)
-                | (nonce[4] << 32)
-                | (nonce[3] << 24)
-                | (nonce[2] << 16)
-                | (nonce[1] << 8)
-                | (nonce[0]);
             var iv = JSData.initWithLength(16);
             nonce.copyTo(iv, 0);
             var cipher = crypto.createDecipheriv(name, key.keyData, iv);
@@ -217,41 +209,31 @@ SECCipherAESGaloisCounterMode.definePropertiesFromExtensions({
         return null;
     },
 
-    encrypt: function(data, key, completion, target){
+    encryptWithNonce: function(nonce, data, key, completion, target, _ivLength){
         if (!completion){
             completion = Promise.completion(Promise.resolveNonNull);
         }
-        if (!this.ensureUniqueMessageID()){
-            JSRunLoop.main.schedule(completion, target, null);
-            return completion.promise;
-        }
         var name = this._cipherNameForKey(key);
         if (name === null){
             JSRunLoop.main.schedule(completion, target, null);
             return completion.promise;
         }
-        var nonce = JSData.initWithArray([
-            1,
-            ((this.encryptedMessageId / 0x100000000) >> 16) & 0xFF,
-            ((this.encryptedMessageId / 0x100000000) >> 8) & 0xFF,
-            (this.encryptedMessageId / 0x100000000) & 0xFF,
-            (this.encryptedMessageId >> 24) & 0xFF,
-            (this.encryptedMessageId >> 16) & 0xFF,
-            (this.encryptedMessageId >> 8) & 0xFF,
-            this.encryptedMessageId & 0xF
-        ]);
-        var iv = JSData.initWithLength(16);
+        if (_ivLength === undefined){
+            _ivLength = nonce.length;
+        }
+        var iv = JSData.initWithLength(_ivLength);
         nonce.copyTo(iv, 0);
         var cipher = crypto.createCipheriv(name, key.keyData, iv);
         var chunks = [nonce, cipher.update(data), cipher.final()];
-        var tag = JSData.initWithLength(16);
+        var tagLength = 16;
+        var tag = JSData.initWithLength(tagLength);
         cipher.getAuthTag().copyTo(tag, 0);
         chunks.push(tag);
         JSRunLoop.main.schedule(completion, target, JSData.initWithChunks(chunks));
         return completion.promise;
     },
 
-    decrypt: function(data, key, completion, target){
+    decryptWithNonceLength: function(nonceLength, data, key, completion, target, _ivLength){
         if (!completion){
             completion = Promise.completion(Promise.resolveNonNull);
         }
@@ -261,21 +243,17 @@ SECCipherAESGaloisCounterMode.definePropertiesFromExtensions({
                 JSRunLoop.main.schedule(completion, target, null);
                 return completion.promise;
             }
-            var nonce = data.subdataInRange(JSRange(0, 8));
-            this.decryptedMessageId =
-                  (nonce[6] << 48)
-                | (nonce[5] << 40)
-                | (nonce[4] << 32)
-                | (nonce[3] << 24)
-                | (nonce[2] << 16)
-                | (nonce[1] << 8)
-                | (nonce[0]);
-            var iv = JSData.initWithLength(16);
+            var nonce = data.subdataInRange(JSRange(0, nonceLength));
+            if (_ivLength === undefined){
+                _ivLength = nonceLength;
+            }
+            var iv = JSData.initWithLength(_ivLength);
             nonce.copyTo(iv, 0);
             var cipher = crypto.createDecipheriv(name, key.keyData, iv);
-            var tag = data.subdataInRange(JSRange(data.length - 16, 16));
+            var tagLength = 16;
+            var tag = data.subdataInRange(JSRange(data.length - tagLength, tagLength));
             cipher.setAuthTag(tag);
-            var chunks = [cipher.update(data.subdataInRange(JSRange(8, data.length - 8 - 16))), cipher.final()];
+            var chunks = [cipher.update(data.subdataInRange(JSRange(nonceLength, data.length - nonceLength - tagLength))), cipher.final()];
             JSRunLoop.main.schedule(completion, target, JSData.initWithChunks(chunks));
         }catch(e){
             JSRunLoop.main.schedule(completion, target, null);

package/Root/Frameworks/SecurityKit/SECCipher.js

@@ -190,7 +190,6 @@ JSClass("SECCipherAESCipherBlockChaining", SECCipher, {
 JSClass("SECCipherAESCounter", SECCipher, {
 
     encryptedMessageId: 0,
-    decryptedMessageId: 0,
 
     ensureUniqueMessageID: function(){
         if (this.encryptedMessageId == 9007199254740991){
@@ -205,7 +204,6 @@ JSClass("SECCipherAESCounter", SECCipher, {
 JSClass("SECCipherAESGaloisCounterMode", SECCipher, {
 
     encryptedMessageId: 0,
-    decryptedMessageId: 0,
 
     ensureUniqueMessageID: function(){
         if (this.encryptedMessageId == 9007199254740991){
@@ -213,7 +211,39 @@ JSClass("SECCipherAESGaloisCounterMode", SECCipher, {
         }
         ++this.encryptedMessageId;
         return true;
-    }
+    },
+
+    encrypt: function(data, key, completion, target){
+        if (!completion){
+            completion = Promise.completion(Promise.resolveNonNull);
+        }
+        if (!this.ensureUniqueMessageID()){
+            JSRunLoop.main.schedule(completion, target, null);
+            return completion.promise;
+        }
+        var nonce = JSData.initWithArray([
+            1,
+            ((this.encryptedMessageId / 0x100000000) >> 16) & 0xFF,
+            ((this.encryptedMessageId / 0x100000000) >> 8) & 0xFF,
+            (this.encryptedMessageId / 0x100000000) & 0xFF,
+            (this.encryptedMessageId >> 24) & 0xFF,
+            (this.encryptedMessageId >> 16) & 0xFF,
+            (this.encryptedMessageId >> 8) & 0xFF,
+            this.encryptedMessageId & 0xF
+        ]);
+        this.encryptWithNonce(nonce, data, key, completion, target, 16);
+        return completion.promise;
+    },
+
+    decrypt: function(data, key, completion, target){
+        return this.decryptWithNonceLength(8, data, key, completion, target, 16);
+    },
+
+    encryptWithNonce: function(nonce, data, key, completion, target){
+    },
+
+    decryptWithNonceLength: function(nonceLength, data, key, completion, target){
+    },
 
 });
 

package/Root/Frameworks/SecurityKit/SECHMAC.js

@@ -64,4 +64,21 @@ SECHMAC.Algorithm = {
     sha256: "sha256",
     sha384: "sha384",
     sha512: "sha512"
+};
+
+SECHMAC.digest = function(algorithm, keyData, data, completion, target){
+    if (!completion){
+        completion = Promise.completion(Promise.resolveNonNull);
+    }
+    var hmac = SECHMAC.initWithAlgorithm(algorithm);
+    hmac.createKeyWithData(keyData, function(key){
+        if (key === null){
+            completion.call(target, null);
+            return;
+        }
+        hmac.key = key;
+        hmac.update(data);
+        hmac.sign(completion, target);
+    });
+    return completion.promise;
 };

package/Root/Frameworks/ServerKit/Info.yaml

@@ -1,6 +1,6 @@
 JSBundleType: framework
 JSBundleIdentifier: io.breakside.JSKit.ServerKit
-JSBundleVersion: 2023.20.0
+JSBundleVersion: 2023.22.0
 JSDevelopmentLanguage: en
 JSCopyright: Copyright © 2020 Breakside Inc.
 JSBundleEnvironments:

package/Root/Frameworks/ServerKitTesting/Info.yaml

@@ -1,6 +1,6 @@
 JSBundleType: framework
 JSBundleIdentifier: io.breakside.JSKit.ServerKitTesting
-JSBundleVersion: 2023.20.0
+JSBundleVersion: 2023.22.0
 JSDevelopmentLanguage: en
 JSCopyright: Copyright © 2020 Breakside Inc.
 JSLicenseNotice: |

package/Root/Frameworks/TestKit/Info.yaml

@@ -1,6 +1,6 @@
 JSBundleType: framework
 JSBundleIdentifier: io.breakside.JSKit.TestKit
-JSBundleVersion: 2023.20.0
+JSBundleVersion: 2023.22.0
 JSDevelopmentLanguage: en
 JSCopyright: Copyright © 2020 Breakside Inc.
 JSLicenseNotice: |

package/Root/Frameworks/UIKit/Info.yaml

@@ -1,6 +1,6 @@
 JSBundleType: framework
 JSBundleIdentifier: io.breakside.JSKit.UIKit
-JSBundleVersion: 2023.20.0
+JSBundleVersion: 2023.22.0
 JSDevelopmentLanguage: en
 JSCopyright: Copyright © 2020 Breakside Inc.
 JSBundleEnvironments: