@haven-chat-org/core 1.0.0

package/dist/crypto/sender-keys.js

@@ -0,0 +1,170 @@
+/**
+ * Signal-style Sender Keys protocol for group E2EE.
+ *
+ * Each member generates a sender key per channel. Messages are encrypted O(1)
+ * using a symmetric chain ratchet. Distribution uses crypto_box_seal to each
+ * recipient's X25519 identity key.
+ *
+ * Wire format (type 0x03):
+ *   [0x03][distributionId:16][chainIndex:4 LE][nonce:24][ciphertext+tag]
+ *   Overhead: 45 bytes + ciphertext
+ *
+ * References:
+ *   - https://signal.org/docs/specifications/group-v2/
+ */
+import { getSodium, kdfCK, randomBytes } from "./utils.js";
+import { ed25519PkToX25519, ed25519SkToX25519 } from "./keys.js";
+// ─── Constants ─────────────────────────────────────────
+const NONCE_LEN = 24; // XChaCha20-Poly1305
+const UUID_LEN = 16; // UUID as bytes
+const CHAIN_IDX_LEN = 4; // uint32 LE
+const MAX_SKIP = 256;
+export const GROUP_MSG_TYPE = 0x03;
+// ─── Sender Key Generation ─────────────────────────────
+/**
+ * Generate a fresh sender key for a channel.
+ * Called when first joining a channel or after a re-key event.
+ */
+export function generateSenderKey() {
+    return {
+        distributionId: randomBytes(UUID_LEN),
+        chainKey: randomBytes(32),
+        chainIndex: 0,
+    };
+}
+// ─── SKDM Payload Serialization ────────────────────────
+/**
+ * Serialize an SKDM payload for distribution.
+ * Format: [distributionId:16][chainIndex:4 LE][chainKey:32] = 52 bytes
+ */
+export function createSkdmPayload(state) {
+    const buf = new Uint8Array(16 + 4 + 32);
+    const view = new DataView(buf.buffer);
+    buf.set(state.distributionId, 0);
+    view.setUint32(16, state.chainIndex, true);
+    buf.set(state.chainKey, 20);
+    return buf;
+}
+/**
+ * Parse an SKDM payload back into structured data.
+ */
+export function parseSkdmPayload(buf) {
+    if (buf.length < 52)
+        throw new Error("SKDM payload too short");
+    const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+    return {
+        distributionId: buf.slice(0, 16),
+        chainIndex: view.getUint32(16, true),
+        chainKey: buf.slice(20, 52),
+    };
+}
+// ─── SKDM Encryption / Decryption ─────────────────────
+/**
+ * Encrypt an SKDM for a single recipient using crypto_box_seal.
+ * The recipient's Ed25519 identity key is converted to X25519 for sealing.
+ */
+export function encryptSkdm(skdmPayload, recipientIdentityKeyEd25519) {
+    const sodium = getSodium();
+    const recipientX25519 = ed25519PkToX25519(recipientIdentityKeyEd25519);
+    return sodium.crypto_box_seal(skdmPayload, recipientX25519);
+}
+/**
+ * Decrypt an SKDM received for us.
+ */
+export function decryptSkdm(encrypted, ourIdentityKeyPair) {
+    const sodium = getSodium();
+    const ourX25519Pk = ed25519PkToX25519(ourIdentityKeyPair.publicKey);
+    const ourX25519Sk = ed25519SkToX25519(ourIdentityKeyPair.privateKey);
+    return sodium.crypto_box_seal_open(encrypted, ourX25519Pk, ourX25519Sk);
+}
+// ─── Group Message Encryption ──────────────────────────
+/**
+ * Encrypt a message using the sender's key for a channel.
+ * Ratchets the chain forward. Returns the full wire-format bytes.
+ *
+ * Wire format:
+ *   [0x03][distributionId:16][chainIndex:4 LE][nonce:24][ciphertext+tag]
+ *
+ * @param senderKey  The sender's key state (mutated: chain ratchets forward)
+ * @param plaintext  The message plaintext bytes
+ */
+export function senderKeyEncrypt(senderKey, plaintext) {
+    const sodium = getSodium();
+    // Ratchet the chain
+    const [newChainKey, messageKey] = kdfCK(senderKey.chainKey);
+    const currentIndex = senderKey.chainIndex;
+    // Update sender state
+    senderKey.chainKey = newChainKey;
+    senderKey.chainIndex = currentIndex + 1;
+    // Encrypt with AAD bound to the distribution ID
+    const nonce = randomBytes(NONCE_LEN);
+    const ciphertext = sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, senderKey.distributionId, // AAD
+    null, nonce, messageKey);
+    // Build wire format
+    const headerLen = 1 + UUID_LEN + CHAIN_IDX_LEN + NONCE_LEN;
+    const buf = new Uint8Array(headerLen + ciphertext.length);
+    const view = new DataView(buf.buffer);
+    buf[0] = GROUP_MSG_TYPE;
+    buf.set(senderKey.distributionId, 1);
+    view.setUint32(1 + UUID_LEN, currentIndex, true);
+    buf.set(nonce, 1 + UUID_LEN + CHAIN_IDX_LEN);
+    buf.set(ciphertext, headerLen);
+    return buf;
+}
+/**
+ * Decrypt a group message using a received sender key.
+ * Ratchets the received key forward to match the message's chain index.
+ *
+ * @param wireBytes   Full wire-format bytes (including type byte 0x03)
+ * @param receivedKey The sender's key (mutated: ratchets forward)
+ */
+export function senderKeyDecrypt(wireBytes, receivedKey) {
+    const sodium = getSodium();
+    if (wireBytes[0] !== GROUP_MSG_TYPE) {
+        throw new Error(`Expected group message type 0x03, got 0x${wireBytes[0].toString(16)}`);
+    }
+    const view = new DataView(wireBytes.buffer, wireBytes.byteOffset, wireBytes.byteLength);
+    const distributionId = wireBytes.slice(1, 1 + UUID_LEN);
+    const chainIndex = view.getUint32(1 + UUID_LEN, true);
+    const nonce = wireBytes.slice(1 + UUID_LEN + CHAIN_IDX_LEN, 1 + UUID_LEN + CHAIN_IDX_LEN + NONCE_LEN);
+    const ciphertext = wireBytes.slice(1 + UUID_LEN + CHAIN_IDX_LEN + NONCE_LEN);
+    // Verify distribution ID matches
+    if (!uint8Eq(distributionId, receivedKey.distributionId)) {
+        throw new Error("Distribution ID mismatch");
+    }
+    // Advance the chain to the required index
+    const stepsNeeded = chainIndex - receivedKey.chainIndex;
+    if (stepsNeeded < 0) {
+        throw new Error("Message chain index is before our current state (already consumed)");
+    }
+    if (stepsNeeded > MAX_SKIP) {
+        throw new Error(`Too many skipped messages: ${stepsNeeded}`);
+    }
+    // Ratchet forward to derive the correct message key
+    let currentChainKey = receivedKey.chainKey;
+    let messageKey = new Uint8Array(32);
+    for (let i = 0; i <= stepsNeeded; i++) {
+        const [newCK, mk] = kdfCK(currentChainKey);
+        if (i === stepsNeeded) {
+            messageKey = mk;
+            // Update received key to one past the message we just decrypted
+            receivedKey.chainKey = newCK;
+            receivedKey.chainIndex = chainIndex + 1;
+        }
+        currentChainKey = newCK;
+    }
+    // Decrypt
+    return sodium.crypto_aead_xchacha20poly1305_ietf_decrypt(null, ciphertext, distributionId, // AAD
+    nonce, messageKey);
+}
+// ─── Helpers ───────────────────────────────────────────
+function uint8Eq(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++) {
+        if (a[i] !== b[i])
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=sender-keys.js.map

package/dist/crypto/sender-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-keys.js","sourceRoot":"","sources":["../../src/crypto/sender-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAwB,MAAM,YAAY,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAwB,MAAM,WAAW,CAAC;AAEvF,0DAA0D;AAE1D,MAAM,SAAS,GAAG,EAAE,CAAC,CAAI,qBAAqB;AAC9C,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAK,gBAAgB;AACzC,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,YAAY;AACrC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAyBnC,0DAA0D;AAE1D;;;GAGG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,cAAc,EAAE,WAAW,CAAC,QAAQ,CAAC;QACrC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QACzB,UAAU,EAAE,CAAC;KACd,CAAC;AACJ,CAAC;AAED,0DAA0D;AAE1D;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAqB;IACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACjC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC3C,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAe;IAC9C,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IACtE,OAAO;QACL,cAAc,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC;QACpC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,yDAAyD;AAEzD;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,WAAuB,EACvB,2BAAuC;IAEvC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,eAAe,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,SAAqB,EACrB,kBAAmC;IAEnC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,WAAW,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,oBAAoB,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAC1E,CAAC;AAED,0DAA0D;AAE1D;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAyB,EACzB,SAAqB;IAErB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,oBAAoB;IACpB,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC;IAE1C,sBAAsB;IACtB,SAAS,CAAC,QAAQ,GAAG,WAAW,CAAC;IACjC,SAAS,CAAC,UAAU,GAAG,YAAY,GAAG,CAAC,CAAC;IAExC,gDAAgD;IAChD,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,CAAC,0CAA0C,CAClE,SAAS,EACT,SAAS,CAAC,cAAc,EAAE,MAAM;IAChC,IAAI,EACJ,KAAK,EACL,UAAU,CACX,CAAC;IAEF,oBAAoB;IACpB,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,GAAG,aAAa,GAAG,SAAS,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEtC,GAAG,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,QAAQ,GAAG,aAAa,CAAC,CAAC;IAC7C,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAqB,EACrB,WAA8B;IAE9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAE3B,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,2CAA2C,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IACxF,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAC3B,CAAC,GAAG,QAAQ,GAAG,aAAa,EAC5B,CAAC,GAAG,QAAQ,GAAG,aAAa,GAAG,SAAS,CACzC,CAAC;IACF,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,QAAQ,GAAG,aAAa,GAAG,SAAS,CAAC,CAAC;IAE7E,iCAAiC;IACjC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,cAAc,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,0CAA0C;IAC1C,MAAM,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;IACxD,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,WAAW,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,oDAAoD;IACpD,IAAI,eAAe,GAAG,WAAW,CAAC,QAAQ,CAAC;IAC3C,IAAI,UAAU,GAAe,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAEhD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACtB,UAAU,GAAG,EAAE,CAAC;YAChB,gEAAgE;YAChE,WAAW,CAAC,QAAQ,GAAG,KAAK,CAAC;YAC7B,WAAW,CAAC,UAAU,GAAG,UAAU,GAAG,CAAC,CAAC;QAC1C,CAAC;QACD,eAAe,GAAG,KAAK,CAAC;IAC1B,CAAC;IAED,UAAU;IACV,OAAO,MAAM,CAAC,0CAA0C,CACtD,IAAI,EACJ,UAAU,EACV,cAAc,EAAE,MAAM;IACtB,KAAK,EACL,UAAU,CACX,CAAC;AACJ,CAAC;AAED,0DAA0D;AAE1D,SAAS,OAAO,CAAC,CAAa,EAAE,CAAa;IAC3C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/crypto/sender-keys.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/crypto/sender-keys.test.js

@@ -0,0 +1,272 @@
+import { describe, it, expect, beforeAll } from "vitest";
+import { initSodium, randomBytes } from "./utils.js";
+import { generateIdentityKeyPair } from "./keys.js";
+import { generateSenderKey, createSkdmPayload, parseSkdmPayload, encryptSkdm, decryptSkdm, senderKeyEncrypt, senderKeyDecrypt, GROUP_MSG_TYPE, } from "./sender-keys.js";
+beforeAll(async () => {
+    await initSodium();
+});
+// ─── Helper ────────────────────────────────────────────
+/** Deep-clone a SenderKeyState so mutations don't cross-contaminate. */
+function cloneSenderKey(sk) {
+    return {
+        distributionId: new Uint8Array(sk.distributionId),
+        chainKey: new Uint8Array(sk.chainKey),
+        chainIndex: sk.chainIndex,
+    };
+}
+const plaintext = () => new TextEncoder().encode("hello group");
+// ─── generateSenderKey ─────────────────────────────────
+describe("generateSenderKey", () => {
+    it("returns a valid sender key with 16-byte distributionId, 32-byte chainKey, and index 0", () => {
+        const sk = generateSenderKey();
+        expect(sk.distributionId).toBeInstanceOf(Uint8Array);
+        expect(sk.distributionId.length).toBe(16);
+        expect(sk.chainKey).toBeInstanceOf(Uint8Array);
+        expect(sk.chainKey.length).toBe(32);
+        expect(sk.chainIndex).toBe(0);
+    });
+    it("generates unique keys on each call", () => {
+        const a = generateSenderKey();
+        const b = generateSenderKey();
+        expect(a.distributionId).not.toEqual(b.distributionId);
+        expect(a.chainKey).not.toEqual(b.chainKey);
+    });
+});
+// ─── SKDM payload serialization ────────────────────────
+describe("SKDM payload round-trip", () => {
+    it("createSkdmPayload → parseSkdmPayload preserves all fields", () => {
+        const sk = generateSenderKey();
+        const buf = createSkdmPayload(sk);
+        expect(buf.length).toBe(52);
+        const parsed = parseSkdmPayload(buf);
+        expect(parsed.distributionId).toEqual(sk.distributionId);
+        expect(parsed.chainKey).toEqual(sk.chainKey);
+        expect(parsed.chainIndex).toBe(sk.chainIndex);
+    });
+    it("preserves non-zero chainIndex", () => {
+        const sk = generateSenderKey();
+        sk.chainIndex = 42;
+        const parsed = parseSkdmPayload(createSkdmPayload(sk));
+        expect(parsed.chainIndex).toBe(42);
+    });
+    it("rejects payloads shorter than 52 bytes", () => {
+        expect(() => parseSkdmPayload(new Uint8Array(51))).toThrow("too short");
+    });
+});
+// ─── SKDM encryption / decryption ──────────────────────
+describe("SKDM encrypt / decrypt", () => {
+    it("round-trips through crypto_box_seal", () => {
+        const identity = generateIdentityKeyPair();
+        const sk = generateSenderKey();
+        const payload = createSkdmPayload(sk);
+        const encrypted = encryptSkdm(payload, identity.publicKey);
+        expect(encrypted.length).toBeGreaterThan(payload.length); // seal overhead
+        const decrypted = decryptSkdm(encrypted, identity);
+        const parsed = parseSkdmPayload(decrypted);
+        expect(parsed.distributionId).toEqual(sk.distributionId);
+        expect(parsed.chainKey).toEqual(sk.chainKey);
+        expect(parsed.chainIndex).toBe(sk.chainIndex);
+    });
+    it("fails to decrypt with a different identity key", () => {
+        const sender = generateIdentityKeyPair();
+        const stranger = generateIdentityKeyPair();
+        const sk = generateSenderKey();
+        const encrypted = encryptSkdm(createSkdmPayload(sk), sender.publicKey);
+        expect(() => decryptSkdm(encrypted, stranger)).toThrow();
+    });
+});
+// ─── Basic encrypt / decrypt ───────────────────────────
+describe("senderKeyEncrypt / senderKeyDecrypt", () => {
+    it("encrypts and decrypts a single message", () => {
+        const sk = generateSenderKey();
+        const received = cloneSenderKey(sk);
+        const msg = plaintext();
+        const wire = senderKeyEncrypt(sk, msg);
+        expect(wire[0]).toBe(GROUP_MSG_TYPE);
+        const decrypted = senderKeyDecrypt(wire, received);
+        expect(decrypted).toEqual(msg);
+    });
+    it("encrypts and decrypts multiple sequential messages", () => {
+        const sk = generateSenderKey();
+        const received = cloneSenderKey(sk);
+        for (let i = 0; i < 10; i++) {
+            const msg = new TextEncoder().encode(`message ${i}`);
+            const wire = senderKeyEncrypt(sk, msg);
+            const dec = senderKeyDecrypt(wire, received);
+            expect(new TextDecoder().decode(dec)).toBe(`message ${i}`);
+        }
+        // After 10 messages, both sides should be at chainIndex 10
+        expect(sk.chainIndex).toBe(10);
+        expect(received.chainIndex).toBe(10);
+    });
+    it("advances chainIndex and chainKey on the sender after encryption", () => {
+        const sk = generateSenderKey();
+        const origChainKey = new Uint8Array(sk.chainKey);
+        expect(sk.chainIndex).toBe(0);
+        senderKeyEncrypt(sk, plaintext());
+        expect(sk.chainIndex).toBe(1);
+        expect(sk.chainKey).not.toEqual(origChainKey);
+    });
+    it("rejects a message with wrong distribution ID", () => {
+        const sk = generateSenderKey();
+        const wire = senderKeyEncrypt(sk, plaintext());
+        // Create a received key with a different distribution ID
+        const wrongReceived = {
+            distributionId: randomBytes(16),
+            chainKey: randomBytes(32),
+            chainIndex: 0,
+        };
+        expect(() => senderKeyDecrypt(wire, wrongReceived)).toThrow("Distribution ID mismatch");
+    });
+    it("rejects a message with wrong type byte", () => {
+        const sk = generateSenderKey();
+        const wire = senderKeyEncrypt(sk, plaintext());
+        wire[0] = 0x01; // DM type, not group
+        const received = cloneSenderKey(sk);
+        received.chainIndex = 0;
+        expect(() => senderKeyDecrypt(wire, received)).toThrow("Expected group message type");
+    });
+});
+// ─── Self-decryption (the critical bug fix) ────────────
+describe("self-decryption: sender decrypts own messages via cloned key", () => {
+    it("decrypts own message using a clone made at generation time", () => {
+        const sk = generateSenderKey();
+        // Clone at generation time (chainIndex 0) — this is what the client does
+        const selfCopy = cloneSenderKey(sk);
+        const msg = new TextEncoder().encode("my own message");
+        const wire = senderKeyEncrypt(sk, msg);
+        // The self-copy should be able to decrypt by ratcheting forward
+        const decrypted = senderKeyDecrypt(wire, selfCopy);
+        expect(decrypted).toEqual(msg);
+    });
+    it("decrypts multiple own messages using the same clone", () => {
+        const sk = generateSenderKey();
+        const selfCopy = cloneSenderKey(sk);
+        const messages = ["first", "second", "third", "fourth", "fifth"];
+        const wires = messages.map((m) => senderKeyEncrypt(sk, new TextEncoder().encode(m)));
+        // Decrypt all in order using the self-copy
+        for (let i = 0; i < wires.length; i++) {
+            const dec = senderKeyDecrypt(wires[i], selfCopy);
+            expect(new TextDecoder().decode(dec)).toBe(messages[i]);
+        }
+    });
+    it("clone is independent — encrypting does not mutate the clone", () => {
+        const sk = generateSenderKey();
+        const selfCopy = cloneSenderKey(sk);
+        const origCloneChainKey = new Uint8Array(selfCopy.chainKey);
+        const origCloneIndex = selfCopy.chainIndex;
+        // Encrypt 5 messages — this should only mutate sk, not selfCopy
+        for (let i = 0; i < 5; i++) {
+            senderKeyEncrypt(sk, plaintext());
+        }
+        // Clone should be untouched
+        expect(selfCopy.chainKey).toEqual(origCloneChainKey);
+        expect(selfCopy.chainIndex).toBe(origCloneIndex);
+    });
+    it("self-copy can catch up after many skipped encryptions", () => {
+        const sk = generateSenderKey();
+        const selfCopy = cloneSenderKey(sk);
+        // Encrypt 100 messages but only try to decrypt the last one
+        let lastWire = new Uint8Array(0);
+        for (let i = 0; i < 100; i++) {
+            lastWire = senderKeyEncrypt(sk, new TextEncoder().encode(`msg-${i}`));
+        }
+        // Self-copy is at index 0, message is at index 99 — needs to ratchet 100 steps
+        const dec = senderKeyDecrypt(lastWire, selfCopy);
+        expect(new TextDecoder().decode(dec)).toBe("msg-99");
+        // Self-copy should now be at index 100
+        expect(selfCopy.chainIndex).toBe(100);
+    });
+});
+// ─── Chain ratcheting edge cases ───────────────────────
+describe("chain ratcheting", () => {
+    it("skipped messages: can decrypt message N without decrypting 0..N-1 first", () => {
+        const sk = generateSenderKey();
+        const received = cloneSenderKey(sk);
+        // Encrypt 5 messages, keep only the 5th (index 4)
+        let fifthWire = new Uint8Array(0);
+        for (let i = 0; i < 5; i++) {
+            const wire = senderKeyEncrypt(sk, new TextEncoder().encode(`msg-${i}`));
+            if (i === 4)
+                fifthWire = wire;
+        }
+        // Decrypt only the 5th message — receiver ratchets from 0 to 4
+        const dec = senderKeyDecrypt(fifthWire, received);
+        expect(new TextDecoder().decode(dec)).toBe("msg-4");
+        expect(received.chainIndex).toBe(5);
+    });
+    it("rejects messages with chain index before current state", () => {
+        const sk = generateSenderKey();
+        const received = cloneSenderKey(sk);
+        // Encrypt 3 messages
+        const wires = [0, 1, 2].map((i) => senderKeyEncrypt(sk, new TextEncoder().encode(`msg-${i}`)));
+        // Decrypt message at index 2, advancing received to index 3
+        senderKeyDecrypt(wires[2], received);
+        expect(received.chainIndex).toBe(3);
+        // Trying to decrypt message at index 0 should fail (already consumed)
+        expect(() => senderKeyDecrypt(wires[0], received)).toThrow("already consumed");
+    });
+    it("rejects messages that skip more than MAX_SKIP (256)", () => {
+        const sk = generateSenderKey();
+        const received = cloneSenderKey(sk);
+        // Encrypt 258 messages, try to decrypt only the last one
+        let lastWire = new Uint8Array(0);
+        for (let i = 0; i < 258; i++) {
+            lastWire = senderKeyEncrypt(sk, new TextEncoder().encode(`msg-${i}`));
+        }
+        // Receiver is at index 0, message at index 257 — skip of 258 > MAX_SKIP (256)
+        expect(() => senderKeyDecrypt(lastWire, received)).toThrow("Too many skipped");
+    });
+    it("exactly MAX_SKIP (256) skipped messages is allowed", () => {
+        const sk = generateSenderKey();
+        const received = cloneSenderKey(sk);
+        // Encrypt 257 messages (indices 0-256), decrypt only the last (index 256)
+        // Skip = 256 - 0 = 256, which equals MAX_SKIP and should succeed
+        let lastWire = new Uint8Array(0);
+        for (let i = 0; i < 257; i++) {
+            lastWire = senderKeyEncrypt(sk, new TextEncoder().encode(`msg-${i}`));
+        }
+        const dec = senderKeyDecrypt(lastWire, received);
+        expect(new TextDecoder().decode(dec)).toBe("msg-256");
+    });
+});
+// ─── Wire format integrity ─────────────────────────────
+describe("wire format", () => {
+    it("first byte is GROUP_MSG_TYPE (0x03)", () => {
+        const sk = generateSenderKey();
+        const wire = senderKeyEncrypt(sk, plaintext());
+        expect(wire[0]).toBe(0x03);
+    });
+    it("embeds the distribution ID at bytes 1-16", () => {
+        const sk = generateSenderKey();
+        const distId = new Uint8Array(sk.distributionId);
+        const wire = senderKeyEncrypt(sk, plaintext());
+        expect(wire.slice(1, 17)).toEqual(distId);
+    });
+    it("embeds the chain index as uint32 LE at bytes 17-20", () => {
+        const sk = generateSenderKey();
+        // Encrypt 3 messages so index is 2 for the third
+        senderKeyEncrypt(sk, plaintext());
+        senderKeyEncrypt(sk, plaintext());
+        const wire = senderKeyEncrypt(sk, plaintext());
+        const view = new DataView(wire.buffer, wire.byteOffset, wire.byteLength);
+        expect(view.getUint32(17, true)).toBe(2);
+    });
+    it("tampered ciphertext fails decryption", () => {
+        const sk = generateSenderKey();
+        const received = cloneSenderKey(sk);
+        const wire = senderKeyEncrypt(sk, plaintext());
+        // Flip a byte in the ciphertext area (after the 45-byte header)
+        wire[50] ^= 0xff;
+        expect(() => senderKeyDecrypt(wire, received)).toThrow();
+    });
+    it("tampered nonce fails decryption", () => {
+        const sk = generateSenderKey();
+        const received = cloneSenderKey(sk);
+        const wire = senderKeyEncrypt(sk, plaintext());
+        // Flip a byte in the nonce area (bytes 21-44)
+        wire[25] ^= 0xff;
+        expect(() => senderKeyDecrypt(wire, received)).toThrow();
+    });
+});
+//# sourceMappingURL=sender-keys.test.js.map

package/dist/crypto/sender-keys.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-keys.test.js","sourceRoot":"","sources":["../../src/crypto/sender-keys.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,UAAU,EAAa,WAAW,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,GAGf,MAAM,kBAAkB,CAAC;AAE1B,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,UAAU,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,0DAA0D;AAE1D,wEAAwE;AACxE,SAAS,cAAc,CAAC,EAAkB;IACxC,OAAO;QACL,cAAc,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,cAAc,CAAC;QACjD,QAAQ,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC;QACrC,UAAU,EAAE,EAAE,CAAC,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AAEhE,0DAA0D;AAE1D,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACvD,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0DAA0D;AAE1D,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC;QACnB,MAAM,MAAM,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0DAA0D;AAE1D,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB;QAE1E,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvE,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0DAA0D;AAE1D,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;QAExB,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAErC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACvC,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC7C,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC7D,CAAC;QAED,2DAA2D;QAC3D,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE9B,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAElC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAE/C,yDAAyD;QACzD,MAAM,aAAa,GAAsB;YACvC,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC;YAC/B,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;YACzB,UAAU,EAAE,CAAC;SACd,CAAC;QAEF,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,qBAAqB;QAErC,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QACpC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0DAA0D;AAE1D,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;IAC5E,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,yEAAyE;QACzE,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAEpC,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAEvC,gEAAgE;QAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAEpC,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAErF,2CAA2C;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YACjD,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAEpC,MAAM,iBAAiB,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC;QAE3C,gEAAgE;QAChE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACpC,CAAC;QAED,4BAA4B;QAC5B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACrD,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAEpC,4DAA4D;QAC5D,IAAI,QAAQ,GAAe,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,QAAQ,GAAG,gBAAgB,CAAC,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,+EAA+E;QAC/E,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErD,uCAAuC;QACvC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0DAA0D;AAE1D,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAEpC,kDAAkD;QAClD,IAAI,SAAS,GAAe,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC;QAChC,CAAC;QAED,+DAA+D;QAC/D,MAAM,GAAG,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAEpC,qBAAqB;QACrB,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChC,gBAAgB,CAAC,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAC3D,CAAC;QAEF,4DAA4D;QAC5D,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEpC,sEAAsE;QACtE,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAEpC,yDAAyD;QACzD,IAAI,QAAQ,GAAe,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,QAAQ,GAAG,gBAAgB,CAAC,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,8EAA8E;QAC9E,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAEpC,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,QAAQ,GAAe,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7B,QAAQ,GAAG,gBAAgB,CAAC,EAAE,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,0DAA0D;AAE1D,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,iDAAiD;QACjD,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAE/C,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAE/C,gEAAgE;QAChE,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QAEjB,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAE/C,8CAA8C;QAC9C,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;QAEjB,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/crypto/utils.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Initialize the libsodium runtime. Must be called once before any crypto operations.
+ */
+export declare function initSodium(): Promise<void>;
+/**
+ * Get the initialized sodium instance. Throws if initSodium() hasn't been called.
+ */
+export declare function getSodium(): any;
+export declare function toBase64(bytes: Uint8Array): string;
+export declare function fromBase64(b64: string): Uint8Array;
+export declare function toHex(bytes: Uint8Array): string;
+export declare function fromHex(hex: string): Uint8Array;
+export declare function randomBytes(n: number): Uint8Array;
+/**
+ * HMAC-SHA256 using libsodium's crypto_auth_hmacsha256.
+ * Key must be exactly 32 bytes.
+ */
+export declare function hmacSha256(key: Uint8Array, data: Uint8Array): Uint8Array;
+/**
+ * HKDF-Extract: PRK = HMAC-SHA256(salt, ikm)
+ */
+export declare function hkdfExtract(salt: Uint8Array, ikm: Uint8Array): Uint8Array;
+/**
+ * HKDF-Expand: derive `length` bytes from PRK + info.
+ * length must be <= 255 * 32 = 8160 bytes.
+ */
+export declare function hkdfExpand(prk: Uint8Array, info: Uint8Array, length: number): Uint8Array;
+/**
+ * Full HKDF: Extract then Expand.
+ */
+export declare function hkdf(salt: Uint8Array, ikm: Uint8Array, info: Uint8Array, length: number): Uint8Array;
+/**
+ * KDF_RK: Root key ratchet step.
+ * Returns [newRootKey, chainKey] (32 bytes each).
+ */
+export declare function kdfRK(rootKey: Uint8Array, dhOutput: Uint8Array): [Uint8Array, Uint8Array];
+/**
+ * KDF_CK: Chain key ratchet step.
+ * Returns [newChainKey, messageKey].
+ */
+export declare function kdfCK(chainKey: Uint8Array): [Uint8Array, Uint8Array];

package/dist/crypto/utils.js

@@ -0,0 +1,102 @@
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+let _sodium = null;
+/**
+ * Initialize the libsodium runtime. Must be called once before any crypto operations.
+ */
+export async function initSodium() {
+    if (_sodium)
+        return;
+    const mod = await import("libsodium-wrappers-sumo");
+    await mod.default.ready;
+    _sodium = mod.default;
+}
+/**
+ * Get the initialized sodium instance. Throws if initSodium() hasn't been called.
+ */
+export function getSodium() {
+    if (!_sodium)
+        throw new Error("Call initSodium() before using crypto functions");
+    return _sodium;
+}
+// ─── Encoding ──────────────────────────────────────────
+export function toBase64(bytes) {
+    const s = getSodium();
+    return s.to_base64(bytes, s.base64_variants.ORIGINAL);
+}
+export function fromBase64(b64) {
+    const s = getSodium();
+    return s.from_base64(b64, s.base64_variants.ORIGINAL);
+}
+export function toHex(bytes) {
+    return getSodium().to_hex(bytes);
+}
+export function fromHex(hex) {
+    return getSodium().from_hex(hex);
+}
+export function randomBytes(n) {
+    return getSodium().randombytes_buf(n);
+}
+// ─── HKDF-SHA256 ───────────────────────────────────────
+// Used by both X3DH and the Double Ratchet.
+// Implements RFC 5869 using HMAC-SHA256.
+/**
+ * HMAC-SHA256 using libsodium's crypto_auth_hmacsha256.
+ * Key must be exactly 32 bytes.
+ */
+export function hmacSha256(key, data) {
+    return getSodium().crypto_auth_hmacsha256(data, key);
+}
+/**
+ * HKDF-Extract: PRK = HMAC-SHA256(salt, ikm)
+ */
+export function hkdfExtract(salt, ikm) {
+    return hmacSha256(salt, ikm);
+}
+/**
+ * HKDF-Expand: derive `length` bytes from PRK + info.
+ * length must be <= 255 * 32 = 8160 bytes.
+ */
+export function hkdfExpand(prk, info, length) {
+    const hashLen = 32;
+    const n = Math.ceil(length / hashLen);
+    const output = new Uint8Array(n * hashLen);
+    let prev = new Uint8Array(0);
+    for (let i = 1; i <= n; i++) {
+        const input = new Uint8Array(prev.length + info.length + 1);
+        input.set(prev, 0);
+        input.set(info, prev.length);
+        input[prev.length + info.length] = i;
+        prev = new Uint8Array(hmacSha256(prk, input));
+        output.set(prev, (i - 1) * hashLen);
+    }
+    return new Uint8Array(output.buffer, 0, length);
+}
+/**
+ * Full HKDF: Extract then Expand.
+ */
+export function hkdf(salt, ikm, info, length) {
+    const prk = hkdfExtract(salt, ikm);
+    return hkdfExpand(prk, info, length);
+}
+// ─── Ratchet KDFs (Signal spec) ────────────────────────
+const RATCHET_INFO = new TextEncoder().encode("haven_ratchet");
+const CHAIN_MSG_KEY = new Uint8Array([0x01]);
+const CHAIN_NEXT_KEY = new Uint8Array([0x02]);
+/**
+ * KDF_RK: Root key ratchet step.
+ * Returns [newRootKey, chainKey] (32 bytes each).
+ */
+export function kdfRK(rootKey, dhOutput) {
+    const derived = hkdf(rootKey, dhOutput, RATCHET_INFO, 64);
+    return [derived.slice(0, 32), derived.slice(32, 64)];
+}
+/**
+ * KDF_CK: Chain key ratchet step.
+ * Returns [newChainKey, messageKey].
+ */
+export function kdfCK(chainKey) {
+    const newChainKey = hmacSha256(chainKey, CHAIN_NEXT_KEY);
+    const messageKey = hmacSha256(chainKey, CHAIN_MSG_KEY);
+    return [newChainKey, messageKey];
+}
+//# sourceMappingURL=utils.js.map

package/dist/crypto/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/crypto/utils.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,IAAI,OAAO,GAAQ,IAAI,CAAC;AAExB;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,OAAO;QAAE,OAAO;IACpB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACpD,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;IACxB,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACjF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0DAA0D;AAE1D,MAAM,UAAU,QAAQ,CAAC,KAAiB;IACxC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,OAAO,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,KAAiB;IACrC,OAAO,SAAS,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,SAAS,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,OAAO,SAAS,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,0DAA0D;AAC1D,4CAA4C;AAC5C,yCAAyC;AAEzC;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAe,EAAE,IAAgB;IAC1D,OAAO,SAAS,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,GAAe;IAC3D,OAAO,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAe,EAAE,IAAgB,EAAE,MAAc;IAC1E,MAAM,OAAO,GAAG,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAe,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAEzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI,CAAC,IAAgB,EAAE,GAAe,EAAE,IAAgB,EAAE,MAAc;IACtF,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,0DAA0D;AAE1D,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;AAC/D,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7C,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAE9C;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,OAAmB,EAAE,QAAoB;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAC1D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK,CAAC,QAAoB;IACxC,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACvD,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;AACnC,CAAC"}