@graygate/bot-sdk 0.1.0

package/dist/signature.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Webhook signature verification — **the same computation the server performs** when it signs.
+ *
+ * The key is derived with HKDF from the sha256 of the token's secret part. The server stores only
+ * that hash and never the secret itself, so the hash is the one value both sides can arrive at.
+ *
+ * A request that fails verification is **discarded without being read.** A webhook address is a
+ * public HTTPS endpoint that anyone can POST to; without the check, a stranger's "message" would
+ * walk straight into the bot's handlers.
+ */
+export declare function webhookSigningKey(tokenSecret: string): Buffer;
+/**
+ * True when the header reads `t=<unix seconds>,v1=<hex>` and the HMAC matches this body. A
+ * timestamp outside the tolerance is treated as a replay.
+ */
+export declare function verifyWebhookSignature(tokenSecret: string, header: string | undefined, rawBody: string, nowS?: number): boolean;
+/** The secret part of a `gg1.<botId>.<secret>` token — the material the signing key comes from. */
+export declare function tokenSecret(token: string): string;

package/dist/signature.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webhookSigningKey = webhookSigningKey;
+exports.verifyWebhookSignature = verifyWebhookSignature;
+exports.tokenSecret = tokenSecret;
+const node_crypto_1 = require("node:crypto");
+const wire_1 = require("./wire");
+/**
+ * Webhook signature verification — **the same computation the server performs** when it signs.
+ *
+ * The key is derived with HKDF from the sha256 of the token's secret part. The server stores only
+ * that hash and never the secret itself, so the hash is the one value both sides can arrive at.
+ *
+ * A request that fails verification is **discarded without being read.** A webhook address is a
+ * public HTTPS endpoint that anyone can POST to; without the check, a stranger's "message" would
+ * walk straight into the bot's handlers.
+ */
+function webhookSigningKey(tokenSecret) {
+    const tokenHash = (0, node_crypto_1.createHash)('sha256').update(tokenSecret).digest('hex');
+    return Buffer.from((0, node_crypto_1.hkdfSync)('sha256', Buffer.from(tokenHash, 'hex'), Buffer.alloc(0), 'graygate:bot-webhook-v1', 32));
+}
+/**
+ * True when the header reads `t=<unix seconds>,v1=<hex>` and the HMAC matches this body. A
+ * timestamp outside the tolerance is treated as a replay.
+ */
+function verifyWebhookSignature(tokenSecret, header, rawBody, nowS = Math.floor(Date.now() / 1000)) {
+    if (!header)
+        return false;
+    const parts = Object.fromEntries(header.split(',').map((piece) => {
+        const [k, v] = piece.split('=');
+        return [k?.trim() ?? '', v?.trim() ?? ''];
+    }));
+    const t = Number(parts.t);
+    const v1 = parts.v1;
+    if (!Number.isFinite(t) || !v1)
+        return false;
+    if (Math.abs(nowS - t) > wire_1.BOT_WEBHOOK_SIGNATURE_TOLERANCE_S)
+        return false;
+    const expected = (0, node_crypto_1.createHmac)('sha256', webhookSigningKey(tokenSecret)).update(`${t}.${rawBody}`).digest();
+    const given = Buffer.from(v1, 'hex');
+    return given.length === expected.length && (0, node_crypto_1.timingSafeEqual)(given, expected);
+}
+/** The secret part of a `gg1.<botId>.<secret>` token — the material the signing key comes from. */
+function tokenSecret(token) {
+    const parts = token.split('.');
+    return parts.length === 3 ? parts[2] : '';
+}

package/dist/state.d.ts

@@ -0,0 +1,21 @@
+export declare class BotState {
+    private readonly dir;
+    private readonly keyPath;
+    private readonly statePath;
+    private state;
+    private seenSet;
+    constructor(dir: string);
+    readPrivateKey(): string | null;
+    writePrivateKey(pem: string): void;
+    roomKey(roomId: string, keyVersion: number): string | null;
+    /** The newest key version and its key — what sending uses. */
+    latestRoomKey(roomId: string): {
+        keyVersion: number;
+        roomKey: string;
+    } | null;
+    putRoomKey(roomId: string, keyVersion: number, roomKey: string): void;
+    forgetRoom(roomId: string): void;
+    /** Whether this item was already handled; a first sighting is recorded and returns false. */
+    markSeen(id: string): boolean;
+    private persist;
+}

package/dist/state.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BotState = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const SEEN_MAX = 5000;
+class BotState {
+    dir;
+    keyPath;
+    statePath;
+    state = { roomKeys: {}, seen: [] };
+    seenSet = new Set();
+    constructor(dir) {
+        this.dir = dir;
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true, mode: 0o700 });
+        this.keyPath = (0, node_path_1.join)(dir, 'private-key.pem');
+        this.statePath = (0, node_path_1.join)(dir, 'state.json');
+        try {
+            this.state = JSON.parse((0, node_fs_1.readFileSync)(this.statePath, 'utf8'));
+            this.state.roomKeys ??= {};
+            this.state.seen ??= [];
+            this.seenSet = new Set(this.state.seen);
+        }
+        catch {
+            // First run — start empty.
+        }
+    }
+    readPrivateKey() {
+        try {
+            return (0, node_fs_1.readFileSync)(this.keyPath, 'utf8');
+        }
+        catch {
+            return null;
+        }
+    }
+    writePrivateKey(pem) {
+        writeAtomic(this.keyPath, pem);
+    }
+    roomKey(roomId, keyVersion) {
+        return this.state.roomKeys[roomId]?.[String(keyVersion)] ?? null;
+    }
+    /** The newest key version and its key — what sending uses. */
+    latestRoomKey(roomId) {
+        const versions = this.state.roomKeys[roomId];
+        if (!versions)
+            return null;
+        let best = 0;
+        for (const v of Object.keys(versions))
+            best = Math.max(best, Number(v));
+        const roomKey = versions[String(best)];
+        return best > 0 && roomKey ? { keyVersion: best, roomKey } : null;
+    }
+    putRoomKey(roomId, keyVersion, roomKey) {
+        (this.state.roomKeys[roomId] ??= {})[String(keyVersion)] = roomKey;
+        this.persist();
+    }
+    forgetRoom(roomId) {
+        delete this.state.roomKeys[roomId];
+        this.persist();
+    }
+    /** Whether this item was already handled; a first sighting is recorded and returns false. */
+    markSeen(id) {
+        if (this.seenSet.has(id))
+            return true;
+        this.seenSet.add(id);
+        this.state.seen.push(id);
+        if (this.state.seen.length > SEEN_MAX) {
+            const dropped = this.state.seen.splice(0, this.state.seen.length - SEEN_MAX);
+            for (const old of dropped)
+                this.seenSet.delete(old);
+        }
+        this.persist();
+        return false;
+    }
+    persist() {
+        writeAtomic(this.statePath, JSON.stringify(this.state));
+    }
+}
+exports.BotState = BotState;
+/** Write to a temporary file, then rename — dying mid-write cannot leave half a state file. */
+function writeAtomic(path, contents) {
+    const tmp = `${path}.tmp`;
+    (0, node_fs_1.writeFileSync)(tmp, contents, { mode: 0o600 });
+    (0, node_fs_1.renameSync)(tmp, path);
+}

package/dist/wire/body.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Generated from protocol/src/body.ts in the graygate monorepo — do not edit by hand.
+ * Only the declarations the bot SDK needs are here; the rest of that module stays private.
+ */
+import { z } from 'zod';
+export declare const messageBodySchema: z.ZodDiscriminatedUnion<"t", [z.ZodObject<{
+    t: z.ZodLiteral<"text">;
+    text: z.ZodString;
+    parentId: z.ZodOptional<z.ZodString>;
+    replyTo: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    t: "text";
+    text: string;
+    parentId?: string | undefined;
+    replyTo?: string | undefined;
+}, {
+    t: "text";
+    text: string;
+    parentId?: string | undefined;
+    replyTo?: string | undefined;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"media">;
+    fileName: z.ZodString;
+    mime: z.ZodString;
+    size: z.ZodNumber;
+    /**
+     * Text sent along with the attachment, up to the same 8,000 characters as a text message.
+     *
+     * It rides in the same message rather than a second one because in a channel one message is one
+     * post: split them and a picture and its caption become **two separate posts** (and the caption
+     * cannot be a comment either — the parent id only exists once the first one is stored).
+     *
+     * Nothing changes for the server; this is inside the ciphertext. A client too old to know the
+     * field has it stripped by the schema and renders the attachment alone.
+     */
+    caption: z.ZodOptional<z.ZodString>;
+    /**
+     * Ties together several pictures chosen at once. Messages sharing a `groupId` are drawn as one
+     * bubble, and tapping opens them in a swipeable viewer — but each picture is still **its own
+     * message**, with its own key, upload and acknowledgement. The server sees none of this. A
+     * client too old to know the field has it stripped and draws the pictures one by one, which
+     * loses the grouping and nothing else. `groupCount` is how many the sender sent, so the
+     * receiver can tell that some have not arrived yet.
+     */
+    groupId: z.ZodOptional<z.ZodString>;
+    groupCount: z.ZodOptional<z.ZodNumber>;
+    parentId: z.ZodOptional<z.ZodString>;
+    replyTo: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    t: "media";
+    fileName: string;
+    mime: string;
+    size: number;
+    parentId?: string | undefined;
+    replyTo?: string | undefined;
+    caption?: string | undefined;
+    groupId?: string | undefined;
+    groupCount?: number | undefined;
+}, {
+    t: "media";
+    fileName: string;
+    mime: string;
+    size: number;
+    parentId?: string | undefined;
+    replyTo?: string | undefined;
+    caption?: string | undefined;
+    groupId?: string | undefined;
+    groupCount?: number | undefined;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"location">;
+    lat: z.ZodNumber;
+    lng: z.ZodNumber;
+    accuracy: z.ZodOptional<z.ZodNumber>;
+    parentId: z.ZodOptional<z.ZodString>;
+    replyTo: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    t: "location";
+    lat: number;
+    lng: number;
+    parentId?: string | undefined;
+    replyTo?: string | undefined;
+    accuracy?: number | undefined;
+}, {
+    t: "location";
+    lat: number;
+    lng: number;
+    parentId?: string | undefined;
+    replyTo?: string | undefined;
+    accuracy?: number | undefined;
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"sys.screenshot">;
+}, "strip", z.ZodTypeAny, {
+    t: "sys.screenshot";
+}, {
+    t: "sys.screenshot";
+}>, z.ZodObject<{
+    t: z.ZodLiteral<"sys.pin">;
+    messageId: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    t: "sys.pin";
+    messageId?: string | undefined;
+}, {
+    t: "sys.pin";
+    messageId?: string | undefined;
+}>]>;
+export type MessageBody = z.infer<typeof messageBodySchema>;
+/**
+ * How an encrypted message travels — the same shape the crypto layer produces. The size limits here
+ * are the ones the server enforces.
+ */
+export declare const encryptedPayloadSchema: z.ZodObject<{
+    ciphertext: z.ZodString;
+    iv: z.ZodString;
+    mac: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    ciphertext: string;
+    iv: string;
+    mac: string;
+}, {
+    ciphertext: string;
+    iv: string;
+    mac: string;
+}>;
+export type EncryptedPayload = z.infer<typeof encryptedPayloadSchema>;

package/dist/wire/body.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Generated from protocol/src/body.ts in the graygate monorepo — do not edit by hand.
+ * Only the declarations the bot SDK needs are here; the rest of that module stays private.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptedPayloadSchema = exports.messageBodySchema = void 0;
+const constants_1 = require("./constants");
+const zod_1 = require("zod");
+/**
+ * Channel post or comment — **no `parentId` means a post, a `parentId` means a first-level comment
+ * on that post.**
+ *
+ * The parent reference sits inside the ciphertext so the server never learns the shape of a
+ * conversation. The price is that the server cannot enforce who may post; that is enforced twice on
+ * the client instead, once by hiding the composer and once by checking on receipt.
+ *
+ * Outside a channel the field is ignored — out of spec, absorbed harmlessly. Replies to replies do
+ * not exist: if the parent is already a comment, the receiving client refuses it.
+ */
+const parentId = zod_1.z.string().uuid().optional();
+/**
+ * The message being replied to — **the id alone, never a copy of what it said.**
+ *
+ * Leaving out the quoted snapshot is the whole design of the feature:
+ *
+ * 1. A device without the original **has no business learning it.** Someone who joined late, whose
+ *    copy expired under auto-delete, or who deleted it locally only needs to know "this is a
+ *    reply". They had no path to the original in the first place.
+ * 2. A snapshot would be **a copy that outlives both auto-delete and local deletion**: a sentence
+ *    that should have expired lives on inside somebody else's reply, out of reach of the deletion
+ *    that was supposed to remove it.
+ *
+ * So the quote card is drawn **only when the receiving device finds the original in its own
+ * storage.** Otherwise the message just shows as a reply. It is a separate field from `parentId`
+ * because it means something else: `parentId` is the post/comment hierarchy of a channel, this is a
+ * reference between messages at the same level.
+ *
+ * A client too old to know this field has it stripped by the schema and renders the text alone.
+ */
+const replyTo = zod_1.z.string().uuid().optional();
+exports.messageBodySchema = zod_1.z.discriminatedUnion('t', [
+    zod_1.z.object({
+        t: zod_1.z.literal('text'),
+        text: zod_1.z.string().min(1).max(8000),
+        parentId,
+        replyTo,
+    }),
+    zod_1.z.object({
+        t: zod_1.z.literal('media'),
+        fileName: zod_1.z.string().min(1).max(255),
+        mime: zod_1.z.string().min(1).max(100),
+        size: zod_1.z.number().int().positive().max(constants_1.MEDIA_MAX_BYTES),
+        /**
+         * Text sent along with the attachment, up to the same 8,000 characters as a text message.
+         *
+         * It rides in the same message rather than a second one because in a channel one message is one
+         * post: split them and a picture and its caption become **two separate posts** (and the caption
+         * cannot be a comment either — the parent id only exists once the first one is stored).
+         *
+         * Nothing changes for the server; this is inside the ciphertext. A client too old to know the
+         * field has it stripped by the schema and renders the attachment alone.
+         */
+        caption: zod_1.z.string().min(1).max(8000).optional(),
+        /**
+         * Ties together several pictures chosen at once. Messages sharing a `groupId` are drawn as one
+         * bubble, and tapping opens them in a swipeable viewer — but each picture is still **its own
+         * message**, with its own key, upload and acknowledgement. The server sees none of this. A
+         * client too old to know the field has it stripped and draws the pictures one by one, which
+         * loses the grouping and nothing else. `groupCount` is how many the sender sent, so the
+         * receiver can tell that some have not arrived yet.
+         */
+        groupId: zod_1.z.string().uuid().optional(),
+        groupCount: zod_1.z.number().int().min(2).max(50).optional(),
+        parentId,
+        replyTo,
+    }),
+    /**
+     * A shared location: **two numbers and nothing else.** No map image, no street address, no place
+     * name — a map tile is an outbound request, and an address or place name means handing the
+     * coordinates to a geocoding service first.
+     *
+     * The receiver draws a card from these numbers and only opens the system map app after the person
+     * confirms, building the URL itself from the validated numbers. A string supplied by the sender
+     * is never opened.
+     *
+     * `accuracy` is the radius in metres, when known. A client too old to know this type fails the
+     * discriminated union and leaves an "integrity check failed" line, which is better than
+     * disguising the message as text — that would put coordinates in a body where they render as a
+     * tappable link.
+     */
+    zod_1.z.object({
+        t: zod_1.z.literal('location'),
+        lat: zod_1.z.number().min(-90).max(90),
+        lng: zod_1.z.number().min(-180).max(180),
+        accuracy: zod_1.z.number().nonnegative().max(100_000).optional(),
+        parentId,
+        replyTo,
+    }),
+    // System events sent by clients — this path is for things the server must not learn.
+    zod_1.z.object({
+        t: zod_1.z.literal('sys.screenshot'),
+    }),
+    /**
+     * Pins a channel post. With a `messageId` the post is pinned; **without one the pin is cleared.**
+     *
+     * The pin is not server state for the same reason posting rights are not: the server cannot tell
+     * which ciphertext is a post, so it could not act on "pin that one" without being told, in the
+     * clear, which message belongs to which room. So a pin travels exactly like a post — one message
+     * encrypted with the room key — and every device records it locally.
+     *
+     * Authority works the same way. The control is shown only to the admin, and a receiving client
+     * applies the pin only when the sender created the room. Outside a channel it is ignored.
+     *
+     * **A channel has one pin.** Pinning again replaces it, ordered by the message's `createdAt` so
+     * that an old event arriving late cannot overwrite a newer pin.
+     *
+     * A client too old to know this type fails the discriminated union and leaves an "integrity check
+     * failed" line.
+     */
+    zod_1.z.object({
+        t: zod_1.z.literal('sys.pin'),
+        messageId: zod_1.z.string().uuid().optional(),
+    }),
+]);
+/**
+ * How an encrypted message travels — the same shape the crypto layer produces. The size limits here
+ * are the ones the server enforces.
+ */
+exports.encryptedPayloadSchema = zod_1.z.object({
+    ciphertext: zod_1.z.string().min(1).max(constants_1.TEXT_CIPHERTEXT_MAX),
+    iv: zod_1.z.string().min(1).max(64), // 16-byte AES-CBC IV, base64 = 24 chars
+    mac: zod_1.z.string().min(1).max(128), // HMAC-SHA256 in hex = 64 chars
+});

package/dist/wire/constants.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Generated from protocol/src/constants.ts in the graygate monorepo — do not edit by hand.
+ * Only the declarations the bot SDK needs are here; the rest of that module stays private.
+ */
+/** Largest ciphertext a text message may carry (bytes, after base64 encoding). */
+export declare const TEXT_CIPHERTEXT_MAX: number;
+/** Largest media file (bytes). Uploaded straight to object storage, never through the server. */
+export declare const MEDIA_MAX_BYTES: number;
+/**
+ * Longest comment on a channel post (a post itself may run to 8,000 characters — see body.ts).
+ * **Only the sending client enforces this**: the limit lives inside the ciphertext, where the
+ * server cannot see it.
+ */
+export declare const COMMENT_TEXT_MAX = 2000;
+/**
+ * The client header (`x-graygate-client`) a bot runtime sends — **not a secret.**
+ *
+ * The edge in front of the server keeps out traffic that never came from a graygate client at all;
+ * it is not a security boundary, so bots get their own value alongside the app's and both are
+ * accepted. The edge worker and the server hold copies of both.
+ */
+export declare const BOT_CLIENT_TOKEN = "Qb7dK2mXhs1TfLpA9wEzR4vNc0uGyJ6i";
+/** Bot access-token lifetime (minutes), same as a person's. No refresh token: the bot token is the long-lived credential. */
+export declare const BOT_ACCESS_TOKEN_TTL_MIN = 15;
+/** Most items one webhook request may carry. */
+export declare const BOT_WEBHOOK_BATCH_MAX = 100;
+/** How far a signature timestamp may be from now (seconds). Anything further is treated as a replay and dropped. */
+export declare const BOT_WEBHOOK_SIGNATURE_TOLERANCE_S = 300;

package/dist/wire/constants.js

@@ -0,0 +1,31 @@
+"use strict";
+/**
+ * Generated from protocol/src/constants.ts in the graygate monorepo — do not edit by hand.
+ * Only the declarations the bot SDK needs are here; the rest of that module stays private.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BOT_WEBHOOK_SIGNATURE_TOLERANCE_S = exports.BOT_WEBHOOK_BATCH_MAX = exports.BOT_ACCESS_TOKEN_TTL_MIN = exports.BOT_CLIENT_TOKEN = exports.COMMENT_TEXT_MAX = exports.MEDIA_MAX_BYTES = exports.TEXT_CIPHERTEXT_MAX = void 0;
+/** Largest ciphertext a text message may carry (bytes, after base64 encoding). */
+exports.TEXT_CIPHERTEXT_MAX = 64 * 1024;
+/** Largest media file (bytes). Uploaded straight to object storage, never through the server. */
+exports.MEDIA_MAX_BYTES = 50 * 1024 * 1024;
+/**
+ * Longest comment on a channel post (a post itself may run to 8,000 characters — see body.ts).
+ * **Only the sending client enforces this**: the limit lives inside the ciphertext, where the
+ * server cannot see it.
+ */
+exports.COMMENT_TEXT_MAX = 2000;
+/**
+ * The client header (`x-graygate-client`) a bot runtime sends — **not a secret.**
+ *
+ * The edge in front of the server keeps out traffic that never came from a graygate client at all;
+ * it is not a security boundary, so bots get their own value alongside the app's and both are
+ * accepted. The edge worker and the server hold copies of both.
+ */
+exports.BOT_CLIENT_TOKEN = 'Qb7dK2mXhs1TfLpA9wEzR4vNc0uGyJ6i';
+/** Bot access-token lifetime (minutes), same as a person's. No refresh token: the bot token is the long-lived credential. */
+exports.BOT_ACCESS_TOKEN_TTL_MIN = 15;
+/** Most items one webhook request may carry. */
+exports.BOT_WEBHOOK_BATCH_MAX = 100;
+/** How far a signature timestamp may be from now (seconds). Anything further is treated as a replay and dropped. */
+exports.BOT_WEBHOOK_SIGNATURE_TOLERANCE_S = 300;

package/dist/wire/crypto.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Generated from crypto/src/index.ts in the graygate monorepo — do not edit by hand.
+ * Only the declarations the bot SDK needs are here; the rest of that module stays private.
+ */
+export declare class IntegrityError extends Error {
+    constructor();
+}
+export declare class DecryptionError extends Error {
+    constructor();
+}
+export interface EncryptedMessage {
+    ciphertext: string;
+    iv: string;
+    mac: string;
+}
+export interface RsaKeyPair {
+    publicKeyPem: string;
+    privateKeyPem: string;
+}
+/**
+ * Generates a user's RSA key pair — at signup, and again when someone moves to a new device. It is
+ * pure JavaScript, so on a phone it can take tens of seconds.
+ *
+ * **Why the stepwise generator:** the callback form of `generateKeyPair` holds the JavaScript thread
+ * for the whole computation when there is no worker to run it on. The progress line set just before
+ * it ("generating keys") never reaches the screen, and the person watches the *previous* step's text
+ * sit there for half a minute. Stepping the generator in slices and yielding to the event loop in
+ * between keeps the progress honest — a slow security step should be **shown**, not hidden.
+ */
+export declare function generateRsaKeyPair(bits?: number): Promise<RsaKeyPair>;
+/** Encrypts a message body (any JSON-serialisable value) with the room key and signs it. */
+export declare function encryptMessage(roomKey: string, body: unknown): Promise<EncryptedMessage>;
+/**
+ * Verifies the HMAC, then decrypts. A mismatch throws `IntegrityError` and decryption is never
+ * attempted — this is the first stage of the content-validation pipeline, and it runs before any
+ * received bytes reach a parser.
+ */
+export declare function decryptMessage(roomKey: string, msg: EncryptedMessage): Promise<unknown>;
+/** Opens an envelope with this device's private key (PEM) and returns the room key. */
+export declare function unwrapRoomKey(wrapped: string, privateKeyPem: string): Promise<string>;

package/dist/wire/crypto.js

@@ -0,0 +1,125 @@
+"use strict";
+/**
+ * Generated from crypto/src/index.ts in the graygate monorepo — do not edit by hand.
+ * Only the declarations the bot SDK needs are here; the rest of that module stays private.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DecryptionError = exports.IntegrityError = void 0;
+exports.generateRsaKeyPair = generateRsaKeyPair;
+exports.encryptMessage = encryptMessage;
+exports.decryptMessage = decryptMessage;
+exports.unwrapRoomKey = unwrapRoomKey;
+const crypto_js_1 = __importDefault(require("crypto-js"));
+const node_forge_1 = __importDefault(require("node-forge"));
+const crypto_1 = require("graygate-cypher/dist/crypto");
+class IntegrityError extends Error {
+    constructor() {
+        super('message integrity check failed (HMAC mismatch)');
+        this.name = 'IntegrityError';
+    }
+}
+exports.IntegrityError = IntegrityError;
+class DecryptionError extends Error {
+    constructor() {
+        super('decryption failed');
+        this.name = 'DecryptionError';
+    }
+}
+exports.DecryptionError = DecryptionError;
+/** Domain separation — one password derives keys that are independent of each other. */
+const CTX = {
+    roomKey: 'graygate:v1:roomkey',
+    verifier: 'graygate:v1:verifier',
+    hmac: 'graygate:v1:hmac',
+    devicePin: 'graygate:v1:devicepin',
+    /** Recovery phrase to the verifier sent to the server. */
+    recovery: 'graygate:v1:recovery',
+    /** Recovery phrase to the verifier kept on this device. **Must differ** from the server's. */
+    recoveryLocal: 'graygate:v1:recoverylocal',
+};
+/**
+ * Generates a user's RSA key pair — at signup, and again when someone moves to a new device. It is
+ * pure JavaScript, so on a phone it can take tens of seconds.
+ *
+ * **Why the stepwise generator:** the callback form of `generateKeyPair` holds the JavaScript thread
+ * for the whole computation when there is no worker to run it on. The progress line set just before
+ * it ("generating keys") never reaches the screen, and the person watches the *previous* step's text
+ * sit there for half a minute. Stepping the generator in slices and yielding to the event loop in
+ * between keeps the progress honest — a slow security step should be **shown**, not hidden.
+ */
+function generateRsaKeyPair(bits = 2048) {
+    // The stepwise API exists at runtime but is missing from the type definitions, hence the cast.
+    const rsa = node_forge_1.default.pki.rsa;
+    return new Promise((resolve, reject) => {
+        const state = rsa.createKeyPairGenerationState(bits, 0x10001);
+        const run = () => {
+            try {
+                // 100ms of work at a time, then yield — enough that frames still get drawn.
+                if (!rsa.stepKeyPairGenerationState(state, 100)) {
+                    setTimeout(run, 0);
+                    return;
+                }
+                const keys = state.keys;
+                resolve({
+                    publicKeyPem: node_forge_1.default.pki.publicKeyToPem(keys.publicKey),
+                    privateKeyPem: node_forge_1.default.pki.privateKeyToPem(keys.privateKey),
+                });
+            }
+            catch (err) {
+                reject(err instanceof Error ? err : new Error(String(err)));
+            }
+        };
+        run();
+    });
+}
+async function deriveMacKey(roomKey) {
+    return crypto_1.CryptoUtils.deriveFileKey(roomKey, CTX.hmac);
+}
+/** Encrypts a message body (any JSON-serialisable value) with the room key and signs it. */
+async function encryptMessage(roomKey, body) {
+    const { encryptedData, iv } = await crypto_1.CryptoUtils.encrypt(JSON.stringify(body), roomKey);
+    const macKey = await deriveMacKey(roomKey);
+    const mac = crypto_js_1.default.HmacSHA256(`${encryptedData}.${iv}`, macKey).toString(crypto_js_1.default.enc.Hex);
+    return { ciphertext: encryptedData, iv, mac };
+}
+/**
+ * Verifies the HMAC, then decrypts. A mismatch throws `IntegrityError` and decryption is never
+ * attempted — this is the first stage of the content-validation pipeline, and it runs before any
+ * received bytes reach a parser.
+ */
+async function decryptMessage(roomKey, msg) {
+    const macKey = await deriveMacKey(roomKey);
+    const expected = crypto_js_1.default.HmacSHA256(`${msg.ciphertext}.${msg.iv}`, macKey).toString(crypto_js_1.default.enc.Hex);
+    if (!constantTimeEqual(expected, msg.mac))
+        throw new IntegrityError();
+    let plain;
+    try {
+        plain = await crypto_1.CryptoUtils.decrypt(msg.ciphertext, roomKey, msg.iv);
+    }
+    catch {
+        throw new DecryptionError();
+    }
+    if (!plain)
+        throw new DecryptionError();
+    try {
+        return JSON.parse(plain);
+    }
+    catch {
+        throw new DecryptionError();
+    }
+}
+/** Opens an envelope with this device's private key (PEM) and returns the room key. */
+function unwrapRoomKey(wrapped, privateKeyPem) {
+    return crypto_1.CryptoUtils.decryptFileKey(wrapped, new TextEncoder().encode(privateKeyPem));
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}