@erfan_bahramali/tping 1.0.0 → 1.1.0

package/dist/mtproto/messages.js

@@ -1,104 +1,78 @@
+import { randomBytes } from 'crypto';
+const REQ_PQ_MULTI = 0xbe7e8ef1;
+const RES_PQ = 0x05162463;
 /**
- * Generate MTProto message_id.
- * Format: time.time() * 2^32, must be divisible by 4
- * Client message IDs must be divisible by 4
+ * Client message_id: unixtime * 2^32, divisible by 4.
  */
-export function generateMessageId() {
-    // Get current time in seconds (with milliseconds as decimal)
-    const now = Date.now() / 1000; // seconds with decimal
-    // Multiply by 2^32
-    let msgId = BigInt(Math.floor(now * 2 ** 32));
-    // Must be divisible by 4 (client messages)
-    msgId = (msgId / 4n) * 4n;
-    return msgId;
-}
+export const generateMessageId = (nowMs = Date.now()) => {
+    const seconds = BigInt(Math.floor(nowMs / 1000));
+    const fraction = BigInt(Math.floor(((nowMs % 1000) / 1000) * 2 ** 32));
+    return ((seconds << 32n) | fraction) & ~3n;
+};
 /**
- * Build req_pq_multi message.
- * TL Schema: req_pq_multi#be7e8ef1 nonce:int128 = ResPQ;
- *
- * @param nonce - 16-byte random nonce
- * @returns TL-serialized message
+ * Unencrypted message: auth_key_id (0) + message_id + length + body.
  */
-export function buildReqPqMulti(nonce) {
-    // Constructor ID: 0xbe7e8ef1 (little-endian)
-    const constructor = Buffer.from([0xf1, 0x8e, 0x7e, 0xbe]);
-    return Buffer.concat([constructor, nonce]);
-}
+export const buildUnencryptedMessage = (body, messageId = generateMessageId()) => {
+    const header = Buffer.alloc(20);
+    header.writeBigInt64LE(messageId, 8);
+    header.writeUInt32LE(body.length, 16);
+    return Buffer.concat([header, body]);
+};
 /**
- * Build unencrypted MTProto message wrapper.
- *
- * Format:
- * - auth_key_id: 8 bytes (all zeros for unencrypted)
- * - message_id: 8 bytes
- * - message_length: 4 bytes
- * - message: N bytes
- *
- * @param tlMessage - TL-serialized message
- * @param messageId - Message ID
- * @returns Unencrypted message
+ * req_pq_multi#be7e8ef1 nonce:int128 = ResPQ;
  */
-export function buildUnencryptedMessage(tlMessage, messageId) {
-    const authKeyId = Buffer.alloc(8, 0); // All zeros
-    const msgIdBuf = Buffer.alloc(8);
-    msgIdBuf.writeBigInt64LE(messageId, 0);
-    const msgLen = Buffer.alloc(4);
-    msgLen.writeUInt32LE(tlMessage.length, 0);
-    return Buffer.concat([authKeyId, msgIdBuf, msgLen, tlMessage]);
-}
+export const buildReqPqMulti = (nonce = randomBytes(16)) => {
+    const body = Buffer.alloc(20);
+    body.writeUInt32LE(REQ_PQ_MULTI, 0);
+    nonce.copy(body, 4);
+    return { message: buildUnencryptedMessage(body), nonce };
+};
 /**
- * Add Intermediate protocol length prefix.
+ * Parse an unencrypted resPQ message (transport framing already removed;
+ * trailing transport padding is allowed).
  *
- * @param payload - Message payload
- * @returns Payload with length prefix
+ * resPQ#05162463 nonce:int128 server_nonce:int128 pq:string server_public_key_fingerprints:Vector<long> = ResPQ;
  */
-export function addLengthPrefix(payload) {
-    const length = Buffer.alloc(4);
-    length.writeUInt32LE(payload.length, 0);
-    return Buffer.concat([length, payload]);
-}
+export const parseResPQ = (data) => {
+    if (data.length < 20 + 4 + 32) {
+        return null;
+    }
+    if (data.readBigUInt64LE(0) !== 0n) {
+        return null;
+    }
+    const bodyLength = data.readUInt32LE(16);
+    if (bodyLength < 36 || 20 + bodyLength > data.length) {
+        return null;
+    }
+    if (data.readUInt32LE(20) !== RES_PQ) {
+        return null;
+    }
+    return {
+        nonce: Buffer.from(data.subarray(24, 40)),
+        serverNonce: Buffer.from(data.subarray(40, 56)),
+    };
+};
 /**
- * Parse ResPQ response.
- * TL Schema: resPQ#05162463 nonce:int128 server_nonce:int128 pq:string server_public_key_fingerprints:Vector<long> = ResPQ;
- *
- * @param data - Decrypted response data
- * @returns Parsed response or null if invalid
+ * Parse a req_pq_multi message (used by tests and mock servers).
  */
-export function parseResPQ(data) {
-    try {
-        let offset = 0;
-        // Intermediate frame: 4-byte LE length prefix, then the unencrypted
-        // MTProto envelope: auth_key_id(8) + message_id(8) + body_length(4) + body.
-        if (data.length < 4)
-            return null;
-        const length = data.readUInt32LE(offset);
-        offset += 4;
-        if (data.length < 4 + length)
-            return null;
-        // Parse auth_key_id (8 bytes) - should be all zeros
-        const authKeyId = data.slice(offset, offset + 8);
-        offset += 8;
-        if (!authKeyId.equals(Buffer.alloc(8, 0)))
-            return null;
-        // Parse message_id (8 bytes) - skip
-        offset += 8;
-        // Parse message_length (4 bytes) - skip
-        offset += 4;
-        // Parse constructor (4 bytes)
-        const constructor = data.readUInt32LE(offset);
-        offset += 4;
-        // Valid constructors: 0x05162463 or 0x83c95aec
-        if (constructor !== 0x05162463 && constructor !== 0x83c95aec) {
-            return null;
-        }
-        // Parse nonce (16 bytes)
-        const nonce = data.slice(offset, offset + 16);
-        offset += 16;
-        // Parse server_nonce (16 bytes)
-        const serverNonce = data.slice(offset, offset + 16);
-        return { nonce, serverNonce, constructor };
-    }
-    catch (err) {
+export const parseReqPqMulti = (data) => {
+    if (data.length < 40 || data.readBigUInt64LE(0) !== 0n || data.readUInt32LE(20) !== REQ_PQ_MULTI) {
         return null;
     }
-}
+    return Buffer.from(data.subarray(24, 40));
+};
+/**
+ * Build a resPQ reply for the given nonce (used by tests and mock servers).
+ */
+export const buildResPQ = (nonce) => {
+    const pq = Buffer.from([0x08, 0x17, 0xed, 0x48, 0x94, 0x1a, 0x08, 0xf9, 0x81, 0x00, 0x00, 0x00]);
+    const fingerprints = Buffer.alloc(16);
+    fingerprints.writeUInt32LE(0x1cb5c415, 0); // vector constructor
+    fingerprints.writeUInt32LE(1, 4);
+    fingerprints.writeBigUInt64LE(0xc3b42b026ce86b21n, 8);
+    const body = Buffer.concat([Buffer.alloc(4), nonce, randomBytes(16), pq, fingerprints]);
+    body.writeUInt32LE(RES_PQ, 0);
+    const message = buildUnencryptedMessage(body, (generateMessageId() | 1n));
+    return message;
+};
 //# sourceMappingURL=messages.js.map

package/dist/mtproto/messages.js.map

@@ -1 +1 @@
-{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/mtproto/messages.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,6DAA6D;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,uBAAuB;IAEtD,mBAAmB;IACnB,IAAI,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE9C,2CAA2C;IAC3C,KAAK,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;IAE1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,6CAA6C;IAC7C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,SAAiB;IAEjB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAElD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,QAAQ,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAEvC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE1C,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAExC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY;IAEZ,IAAI,CAAC;QACH,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,oEAAoE;QACpE,4EAA4E;QAC5E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,CAAC;QACZ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC;QAE1C,oDAAoD;QACpD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvD,oCAAoC;QACpC,MAAM,IAAI,CAAC,CAAC;QAEZ,wCAAwC;QACxC,MAAM,IAAI,CAAC,CAAC;QAEZ,8BAA8B;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,CAAC;QAEZ,+CAA+C;QAC/C,IAAI,WAAW,KAAK,UAAU,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,yBAAyB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;QAC9C,MAAM,IAAI,EAAE,CAAC;QAEb,gCAAgC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC;QAEpD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/mtproto/messages.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAErC,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,QAAgB,IAAI,CAAC,GAAG,EAAE,EAAU,EAAE;IACtE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7C,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAY,EAAE,YAAoB,iBAAiB,EAAE,EAAU,EAAE;IACvG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAgB,WAAW,CAAC,EAAE,CAAC,EAAwD,EAAE;IACvH,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9B,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,EAAE,OAAO,EAAE,uBAAuB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;AAC3D,CAAC,CAAC;AAOF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAgB,EAAE;IACvD,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACzC,IAAI,UAAU,GAAG,EAAE,IAAI,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;KAChD,CAAC;AACJ,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAiB,EAAE;IAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,YAAY,EAAE,CAAC;QACjG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE;IAClD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtC,YAAY,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB;IAChE,YAAY,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,YAAY,CAAC,gBAAgB,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,uBAAuB,CAAC,IAAI,EAAE,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}

package/dist/mtproto/obfuscation.d.ts

@@ -1,26 +1,29 @@
 import { AESCTR } from '../crypto/aes-ctr.js';
-/**
- * Protocol tags for MTProto transports.
- */
-export declare const PROTO_TAG: {
-    ABRIDGED: Buffer<ArrayBuffer>;
-    INTERMEDIATE: Buffer<ArrayBuffer>;
-    SECURE: Buffer<ArrayBuffer>;
-};
-interface ObfuscationKeys {
-    header: Buffer;
-    encryptor: AESCTR;
-    decryptor: AESCTR;
+import type { Pipe } from '../net/stream.js';
+import { type TransportMode } from './transport.js';
+export interface Obfuscation {
+    readonly header: Buffer;
+    readonly encryptor: AESCTR;
+    readonly decryptor: AESCTR;
 }
 /**
- * Initialize MTProto obfuscation layer.
- * Generates random 64-byte header and derives encryption keys.
+ * Build the obfuscated2 init header (MTProto transport obfuscation).
  *
- * @param secret - 16-byte secret from proxy
- * @param dcId - Telegram datacenter ID
- * @param protocolTag - Transport protocol tag (default: INTERMEDIATE)
- * @returns Header buffer and encryptor/decryptor ciphers
+ * @param dcId - DC id written at offset 60 (signed 16-bit LE); negative for media DCs
+ * @param mode - transport framing, selects the protocol tag at offset 56
+ * @param secret - 16-byte proxy key; omitted for direct connections to a DC
  */
-export declare function initObfuscation(secret: Buffer, dcId: number, protocolTag?: Buffer): ObfuscationKeys;
-export {};
+export declare const createObfuscation: (dcId: number, mode: TransportMode, secret?: Buffer) => Obfuscation;
+/**
+ * Pipe that prepends the init header to the first write and AES-CTR
+ * encrypts/decrypts everything else.
+ */
+export declare class ObfuscatedPipe implements Pipe {
+    private readonly inner;
+    private readonly obfuscation;
+    private headerSent;
+    constructor(inner: Pipe, obfuscation: Obfuscation);
+    write(data: Buffer): void;
+    read(length: number): Promise<Buffer>;
+}
 //# sourceMappingURL=obfuscation.d.ts.map

package/dist/mtproto/obfuscation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"obfuscation.d.ts","sourceRoot":"","sources":["../../src/mtproto/obfuscation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C;;GAEG;AACH,eAAO,MAAM,SAAS;;;;CAIrB,CAAC;AAYF,UAAU,eAAe;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,WAAW,GAAE,MAA+B,GAC3C,eAAe,CA+DjB"}
+{"version":3,"file":"obfuscation.d.ts","sourceRoot":"","sources":["../../src/mtproto/obfuscation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAgBnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAeD;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,EAAE,MAAM,aAAa,EAAE,SAAS,MAAM,KAAG,WAoBtF,CAAC;AAEF;;;GAGG;AACH,qBAAa,cAAe,YAAW,IAAI;IAG7B,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAQ,OAAO,CAAC,QAAQ,CAAC,WAAW;IAFtE,OAAO,CAAC,UAAU,CAAS;gBAEE,KAAK,EAAE,IAAI,EAAmB,WAAW,EAAE,WAAW;IAEnF,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAUnB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAG5C"}

package/dist/mtproto/obfuscation.js

@@ -1,78 +1,78 @@
 import { randomBytes, createHash } from 'crypto';
 import { AESCTR } from '../crypto/aes-ctr.js';
+import { PROTOCOL_TAGS } from './transport.js';
 /**
- * Protocol tags for MTProto transports.
+ * First-int values the 64-byte init header must not start with: they would make
+ * the connection look like HTTP (HEAD/POST/GET /OPTIONS), TLS, or a plain transport tag.
  */
-export const PROTO_TAG = {
-    ABRIDGED: Buffer.from([0xef, 0xef, 0xef, 0xef]),
-    INTERMEDIATE: Buffer.from([0xee, 0xee, 0xee, 0xee]),
-    SECURE: Buffer.from([0xdd, 0xdd, 0xdd, 0xdd]),
-};
-/**
- * Reserved byte sequences that must be avoided in random nonce.
- */
-const RESERVED_KEYWORDS = [
-    Buffer.from([0x50, 0x56, 0x72, 0x47]), // PVrG
-    Buffer.from([0x47, 0x45, 0x54, 0x20]), // GET
-    Buffer.from([0x50, 0x4f, 0x53, 0x54]), // POST
-    Buffer.from([0xee, 0xee, 0xee, 0xee]), // eeee
+const FORBIDDEN_FIRST_INTS = [
+    0x44414548, // HEAD
+    0x54534f50, // POST
+    0x20544547, // GET
+    0x4954504f, // OPTI
+    0x02010316, // TLS handshake
+    0xdddddddd,
+    0xeeeeeeee,
 ];
-/**
- * Initialize MTProto obfuscation layer.
- * Generates random 64-byte header and derives encryption keys.
- *
- * @param secret - 16-byte secret from proxy
- * @param dcId - Telegram datacenter ID
- * @param protocolTag - Transport protocol tag (default: INTERMEDIATE)
- * @returns Header buffer and encryptor/decryptor ciphers
- */
-export function initObfuscation(secret, dcId, protocolTag = PROTO_TAG.INTERMEDIATE) {
-    if (secret.length !== 16) {
-        throw new Error('Secret must be 16 bytes');
-    }
-    // Generate 64 random bytes, avoiding reserved patterns
-    let random;
-    while (true) {
-        random = randomBytes(64);
-        // Check if first byte is not 0xef
+const generateRandomHeader = () => {
+    for (;;) {
+        const random = randomBytes(64);
         if (random[0] === 0xef)
             continue;
-        // Check if bytes 4-8 are not all zeros
-        if (random.slice(4, 8).equals(Buffer.alloc(4)))
+        if (FORBIDDEN_FIRST_INTS.includes(random.readUInt32LE(0)))
             continue;
-        // Check if first 4 bytes don't match reserved keywords
-        const isReserved = RESERVED_KEYWORDS.some((keyword) => keyword.equals(random.slice(0, 4)));
-        if (isReserved)
+        if (random.readUInt32LE(4) === 0)
             continue;
-        break;
+        return random;
+    }
+};
+const deriveKey = (material, secret) => secret ? createHash('sha256').update(material).update(secret).digest() : Buffer.from(material);
+/**
+ * Build the obfuscated2 init header (MTProto transport obfuscation).
+ *
+ * @param dcId - DC id written at offset 60 (signed 16-bit LE); negative for media DCs
+ * @param mode - transport framing, selects the protocol tag at offset 56
+ * @param secret - 16-byte proxy key; omitted for direct connections to a DC
+ */
+export const createObfuscation = (dcId, mode, secret) => {
+    if (secret && secret.length !== 16) {
+        throw new Error('Proxy secret key must be 16 bytes');
     }
-    // Convert to mutable buffer
-    const header = Buffer.from(random);
-    // Reverse bytes 8-56 for decryption key derivation
-    const reversed = Buffer.from(header.slice(8, 56)).reverse();
-    // Derive encryption key and IV
-    const encryptKey = createHash('sha256')
-        .update(Buffer.concat([header.slice(8, 40), secret]))
-        .digest(); // 32 bytes
-    const encryptIv = header.slice(40, 56); // 16 bytes
-    // Derive decryption key and IV
-    const decryptKey = createHash('sha256')
-        .update(Buffer.concat([reversed.slice(0, 32), secret]))
-        .digest();
-    const decryptIv = reversed.slice(32, 48);
-    // Create AES-256-CTR ciphers
-    const encryptor = new AESCTR(encryptKey, encryptIv);
-    const decryptor = new AESCTR(decryptKey, decryptIv);
-    // Encode protocol tag and DC ID at positions 56-62
-    protocolTag.copy(header, 56);
-    // DC ID as signed 16-bit little-endian
+    const header = generateRandomHeader();
+    const reversed = Buffer.from(header.subarray(8, 56)).reverse();
+    const encryptor = new AESCTR(deriveKey(header.subarray(8, 40), secret), Buffer.from(header.subarray(40, 56)));
+    const decryptor = new AESCTR(deriveKey(reversed.subarray(0, 32), secret), Buffer.from(reversed.subarray(32, 48)));
+    header.writeUInt32LE(PROTOCOL_TAGS[mode], 56);
     header.writeInt16LE(dcId, 60);
-    // Encrypt the tail (tag + dc ID) in place. The cipher stream position must
-    // be 56 here: the proxy decrypts the whole 64-byte frame from position 0 and
-    // expects the tag to appear at bytes 56-60. Encrypting the whole header and
-    // taking the tail (as official clients do) yields exactly that.
-    const encryptedTail = encryptor.encrypt(header).subarray(56);
-    encryptedTail.copy(header, 56);
+    // Encrypt the full header to advance the keystream by 64 bytes, but only
+    // the tail (protocol tag, DC id, 2 random bytes) goes out encrypted.
+    const encrypted = encryptor.encrypt(header);
+    encrypted.copy(header, 56, 56);
     return { header, encryptor, decryptor };
+};
+/**
+ * Pipe that prepends the init header to the first write and AES-CTR
+ * encrypts/decrypts everything else.
+ */
+export class ObfuscatedPipe {
+    inner;
+    obfuscation;
+    headerSent = false;
+    constructor(inner, obfuscation) {
+        this.inner = inner;
+        this.obfuscation = obfuscation;
+    }
+    write(data) {
+        const encrypted = this.obfuscation.encryptor.encrypt(data);
+        if (this.headerSent) {
+            this.inner.write(encrypted);
+            return;
+        }
+        this.headerSent = true;
+        this.inner.write(Buffer.concat([this.obfuscation.header, encrypted]));
+    }
+    async read(length) {
+        return this.obfuscation.decryptor.encrypt(await this.inner.read(length));
+    }
 }
 //# sourceMappingURL=obfuscation.js.map

package/dist/mtproto/obfuscation.js.map

@@ -1 +1 @@
-{"version":3,"file":"obfuscation.js","sourceRoot":"","sources":["../../src/mtproto/obfuscation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,iBAAiB,GAAG;IACxB,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO;IAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM;IAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO;IAC9C,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,OAAO;CAC/C,CAAC;AAQF;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,IAAY,EACZ,cAAsB,SAAS,CAAC,YAAY;IAE5C,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IAED,uDAAuD;IACvD,IAAI,MAAc,CAAC;IACnB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAEzB,kCAAkC;QAClC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,SAAS;QAEjC,uCAAuC;QACvC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAEzD,uDAAuD;QACvD,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACpD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CACnC,CAAC;QACF,IAAI,UAAU;YAAE,SAAS;QAEzB,MAAM;IACR,CAAC;IAED,4BAA4B;IAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEnC,mDAAmD;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAE5D,+BAA+B;IAC/B,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC;SACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;SACpD,MAAM,EAAE,CAAC,CAAC,WAAW;IAExB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW;IAEnD,+BAA+B;IAC/B,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC;SACpC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;SACtD,MAAM,EAAE,CAAC;IAEZ,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IAEzC,6BAA6B;IAC7B,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAEpD,mDAAmD;IACnD,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE7B,uCAAuC;IACvC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAE9B,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7D,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE/B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"obfuscation.js","sourceRoot":"","sources":["../../src/mtproto/obfuscation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAsB,MAAM,gBAAgB,CAAC;AAEnE;;;GAGG;AACH,MAAM,oBAAoB,GAAsB;IAC9C,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,MAAM;IAClB,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,gBAAgB;IAC5B,UAAU;IACV,UAAU;CACX,CAAC;AAQF,MAAM,oBAAoB,GAAG,GAAW,EAAE;IACxC,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,SAAS;QACjC,IAAI,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACpE,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,SAAS;QAC3C,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,QAAgB,EAAE,MAAe,EAAU,EAAE,CAC9D,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAEjG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,IAAmB,EAAE,MAAe,EAAe,EAAE;IACnG,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAE/D,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9G,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAElH,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAE9B,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAE/B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,cAAc;IAGI;IAA8B;IAFnD,UAAU,GAAG,KAAK,CAAC;IAE3B,YAA6B,KAAW,EAAmB,WAAwB;QAAtD,UAAK,GAAL,KAAK,CAAM;QAAmB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAEvF,KAAK,CAAC,IAAY;QAChB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,CAAC;CACF"}

package/dist/mtproto/secret.d.ts

@@ -0,0 +1,28 @@
+/**
+ * MTProto proxy secret handling, matching Telegram Android (tgnet) and Desktop.
+ *
+ * Accepted encodings: hex, or base64 / base64url (padding optional).
+ * Accepted layouts (raw bytes):
+ *   16 bytes                    -> simple obfuscation, intermediate transport (0xeeeeeeee)
+ *   0xdd + 16 bytes             -> secure, padded intermediate transport (0xdddddddd)
+ *   0xee + 16 bytes + domain    -> fake TLS, padded intermediate inside TLS records
+ */
+export type SecretKind = 'simple' | 'secure' | 'faketls';
+export interface ParsedSecret {
+    readonly kind: SecretKind;
+    /** 16-byte key used for obfuscation key derivation and fake TLS HMAC. */
+    readonly key: Buffer;
+    /** SNI domain (fake TLS only). */
+    readonly domain?: string;
+}
+export declare class SecretError extends Error {
+    constructor(message: string);
+}
+/**
+ * Decode a secret string the same way the official clients do:
+ * all-hex with even length is hex, anything else is base64url.
+ */
+export declare const decodeSecret: (value: string) => Buffer | null;
+export declare const parseSecret: (value: string) => ParsedSecret;
+export declare const describeSecretKind: (kind: SecretKind) => string;
+//# sourceMappingURL=secret.d.ts.map

package/dist/mtproto/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/mtproto/secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,MAAM,KAAG,MAAM,GAAG,IAcrD,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,KAAG,YA0B3C,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,MAAM,UAAU,KAAG,MASrD,CAAC"}

package/dist/mtproto/secret.js

@@ -0,0 +1,68 @@
+/**
+ * MTProto proxy secret handling, matching Telegram Android (tgnet) and Desktop.
+ *
+ * Accepted encodings: hex, or base64 / base64url (padding optional).
+ * Accepted layouts (raw bytes):
+ *   16 bytes                    -> simple obfuscation, intermediate transport (0xeeeeeeee)
+ *   0xdd + 16 bytes             -> secure, padded intermediate transport (0xdddddddd)
+ *   0xee + 16 bytes + domain    -> fake TLS, padded intermediate inside TLS records
+ */
+export class SecretError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SecretError';
+    }
+}
+/**
+ * Decode a secret string the same way the official clients do:
+ * all-hex with even length is hex, anything else is base64url.
+ */
+export const decodeSecret = (value) => {
+    const text = value.trim();
+    if (text.length === 0) {
+        return null;
+    }
+    if (text.length % 2 === 0 && /^[0-9a-fA-F]+$/.test(text)) {
+        return Buffer.from(text, 'hex');
+    }
+    if (/^[A-Za-z0-9+/_-]+={0,2}$/.test(text)) {
+        const standard = text.replace(/-/g, '+').replace(/_/g, '/').replace(/=+$/, '');
+        const decoded = Buffer.from(standard, 'base64');
+        return decoded.length > 0 ? decoded : null;
+    }
+    return null;
+};
+export const parseSecret = (value) => {
+    const bytes = decodeSecret(value);
+    if (!bytes) {
+        throw new SecretError('Secret is neither hex nor base64');
+    }
+    if (bytes.length === 16) {
+        return { kind: 'simple', key: bytes };
+    }
+    if (bytes[0] === 0xdd) {
+        if (bytes.length !== 17) {
+            throw new SecretError(`dd secret must be 17 bytes, got ${bytes.length}`);
+        }
+        return { kind: 'secure', key: bytes.subarray(1, 17) };
+    }
+    if (bytes[0] === 0xee) {
+        if (bytes.length <= 17) {
+            throw new SecretError(`Fake-TLS (ee) secret has no domain; Telegram rejects it (as dd it would be dd${bytes.subarray(1).toString('hex')})`);
+        }
+        const domain = bytes.subarray(17).toString('utf8');
+        return { kind: 'faketls', key: bytes.subarray(1, 17), domain };
+    }
+    throw new SecretError(`Unsupported secret format (${bytes.length} bytes, prefix 0x${bytes[0].toString(16).padStart(2, '0')})`);
+};
+export const describeSecretKind = (kind) => {
+    switch (kind) {
+        case 'faketls':
+            return 'Fake TLS';
+        case 'secure':
+            return 'dd';
+        default:
+            return 'simple';
+    }
+};
+//# sourceMappingURL=secret.js.map

package/dist/mtproto/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../../src/mtproto/secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAYH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAa,EAAiB,EAAE;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAgB,EAAE;IACzD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,WAAW,CAAC,kCAAkC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,WAAW,CAAC,mCAAmC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CAAC,gFAAgF,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9I,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,IAAI,WAAW,CAAC,8BAA8B,KAAK,CAAC,MAAM,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;AACjI,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,IAAgB,EAAU,EAAE;IAC7D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,UAAU,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC;QACd;YACE,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC,CAAC"}

package/dist/mtproto/transport.d.ts

@@ -0,0 +1,28 @@
+import type { Pipe } from '../net/stream.js';
+/**
+ * MTProto TCP transports (https://core.telegram.org/mtproto/mtproto-transports).
+ *
+ * The official clients pick the transport from the secret:
+ *   no secret (direct DC, SOCKS5, HTTP) -> abridged
+ *   16-byte secret                      -> intermediate
+ *   dd / ee secret                      -> padded intermediate
+ */
+export type TransportMode = 'abridged' | 'intermediate' | 'padded';
+export declare const PROTOCOL_TAGS: Readonly<Record<TransportMode, number>>;
+/**
+ * A 4-byte frame carrying a negative error code instead of a message.
+ */
+export declare class TransportError extends Error {
+    readonly code: number;
+    constructor(code: number);
+}
+export declare class FramingError extends Error {
+    constructor(message: string);
+}
+export declare const encodeFrame: (mode: TransportMode, payload: Buffer) => Buffer;
+/**
+ * Read one server frame. Quick-ack frames are skipped; 4-byte error frames throw TransportError.
+ * For the padded transport the returned payload may carry trailing padding.
+ */
+export declare const readFrame: (mode: TransportMode, pipe: Pipe) => Promise<Buffer>;
+//# sourceMappingURL=transport.d.ts.map

package/dist/mtproto/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/mtproto/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,cAAc,GAAG,QAAQ,CAAC;AAEnE,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAIjE,CAAC;AAUF;;GAEG;AACH,qBAAa,cAAe,SAAQ,KAAK;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;CAIlC;AAED,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED,eAAO,MAAM,WAAW,GAAI,MAAM,aAAa,EAAE,SAAS,MAAM,KAAG,MAiBlE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,SAAS,GAAU,MAAM,aAAa,EAAE,MAAM,IAAI,KAAG,OAAO,CAAC,MAAM,CA6B/E,CAAC"}

package/dist/mtproto/transport.js

@@ -0,0 +1,78 @@
+import { randomBytes, randomInt } from 'crypto';
+export const PROTOCOL_TAGS = {
+    abridged: 0xefefefef,
+    intermediate: 0xeeeeeeee,
+    padded: 0xdddddddd,
+};
+const MAX_FRAME = 1 << 24;
+const TRANSPORT_ERRORS = {
+    [-404]: 'not found',
+    [-429]: 'too many connections from this IP (flood)',
+    [-444]: 'invalid DC',
+};
+/**
+ * A 4-byte frame carrying a negative error code instead of a message.
+ */
+export class TransportError extends Error {
+    code;
+    constructor(code) {
+        super(`Telegram returned transport error ${code}${TRANSPORT_ERRORS[code] ? ` (${TRANSPORT_ERRORS[code]})` : ''}`);
+        this.code = code;
+        this.name = 'TransportError';
+    }
+}
+export class FramingError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'FramingError';
+    }
+}
+export const encodeFrame = (mode, payload) => {
+    if (payload.length % 4 !== 0) {
+        throw new Error('MTProto payload length must be a multiple of 4');
+    }
+    if (mode === 'abridged') {
+        const words = payload.length / 4;
+        const header = words < 0x7f
+            ? Buffer.from([words])
+            : Buffer.from([0x7f, words & 0xff, (words >> 8) & 0xff, (words >> 16) & 0xff]);
+        return Buffer.concat([header, payload]);
+    }
+    const padding = mode === 'padded' ? randomBytes(randomInt(16)) : Buffer.alloc(0);
+    const header = Buffer.alloc(4);
+    header.writeUInt32LE(payload.length + padding.length, 0);
+    return Buffer.concat([header, payload, padding]);
+};
+/**
+ * Read one server frame. Quick-ack frames are skipped; 4-byte error frames throw TransportError.
+ * For the padded transport the returned payload may carry trailing padding.
+ */
+export const readFrame = async (mode, pipe) => {
+    for (;;) {
+        let length;
+        if (mode === 'abridged') {
+            const first = (await pipe.read(1))[0];
+            if (first & 0x80) {
+                await pipe.read(3); // quick ack
+                continue;
+            }
+            length = first === 0x7f ? (await pipe.read(3)).readUIntLE(0, 3) * 4 : first * 4;
+        }
+        else {
+            const value = (await pipe.read(4)).readUInt32LE(0);
+            if (value & 0x80000000) {
+                continue; // quick ack
+            }
+            length = value;
+        }
+        if (length < 4 || length > MAX_FRAME) {
+            throw new FramingError(`Invalid frame length ${length} from server (wrong secret or not an MTProto proxy)`);
+        }
+        const payload = await pipe.read(length);
+        if (length === 4) {
+            throw new TransportError(payload.readInt32LE(0));
+        }
+        return payload;
+    }
+};
+//# sourceMappingURL=transport.js.map