@ixblix/sdk-js 0.2.0

package/dist/crypto.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Operator-side end-to-end encryption helpers for ixblix.
+ *
+ * The operator (desk/CRM) holds a persistent RSA-OAEP keypair. The private key
+ * never leaves the operator process; only the public key is registered with the
+ * ixblix backend at conversation creation so the customer can encrypt messages to
+ * the operator.
+ *
+ * Outgoing messages are encrypted to the customer's public key; incoming
+ * messages are decrypted with the operator's private key.
+ *
+ * The scheme is hybrid: each message is encrypted with a fresh AES-256-GCM key,
+ * and that AES key is wrapped (RSA-OAEP/SHA-256) both to the recipient
+ * (`encryptedKey`) and to the sender's own public key (`selfEncryptedKey`) so
+ * the sender can read back its own sent messages.
+ */
+import { type KeyObject } from "node:crypto";
+/** An RSA keypair plus its identifier, as used by the operator. */
+export interface OperatorKeyPair {
+    /** Identifier of the public key, sent in the message envelope. */
+    keyId: string;
+    /** Base64 SPKI DER of the public key, registered with ixblix. */
+    publicKeySpki: string;
+    /** The private key object. Never send this to ixblix. */
+    privateKey: KeyObject;
+}
+/** Options for generating an operator keypair. */
+export interface GenerateKeyPairOptions {
+    /** RSA modulus length in bits. Defaults to 2048. */
+    modulusLength?: number;
+}
+/**
+ * Generate a fresh RSA keypair for the operator. The private key stays on the
+ * operator's side; only `publicKeySpki` should be registered with ixblix.
+ */
+export declare function generateOperatorKeyPair(options?: GenerateKeyPairOptions): OperatorKeyPair;
+/** Import a base64 SPKI DER RSA public key (e.g. the customer's key). */
+export declare function importPublicKey(spkiBase64: string): KeyObject;
+/**
+ * Encrypt a plaintext message to the recipient's RSA public key.
+ *
+ * Returns the envelope fields expected by the ixblix backend. The AES key is
+ * wrapped both to the recipient (`encryptedKey`) and to the sender's own public
+ * key (`selfEncryptedKey`) so the sender can read back its own sent message.
+ */
+export declare function encryptToRecipient(plaintext: string, recipientPublicKeySpki: string, senderKeyId: string, senderPublicKeySpki: string): {
+    content: string;
+    iv: string;
+    authTag: string;
+    encryptedKey: string;
+    selfEncryptedKey: string;
+    keyId: string;
+};
+/**
+ * Decrypt a message envelope using the operator's private key. Tries the
+ * recipient-wrapped key (`encryptedKey`) first, then the sender-wrapped key
+ * (`selfEncryptedKey`), so the operator can read back its own sent messages
+ * too. Returns null when decryption fails.
+ */
+export declare function decryptEnvelope(envelope: {
+    content: string;
+    iv?: string;
+    authTag?: string;
+    encryptedKey?: string;
+    selfEncryptedKey?: string;
+}, privateKey: KeyObject): string | null;
+/**
+ * Encrypt a binary media file (image/audio/document) to the recipient's RSA
+ * public key. Uses a fresh AES-256-GCM key wrapped to both the recipient and
+ * the sender (for self-read). Returns the envelope fields plus the base64
+ * ciphertext of the file bytes.
+ */
+export declare function encryptMediaToRecipient(fileBytes: Uint8Array, recipientPublicKeySpki: string, senderKeyId: string, senderPublicKeySpki: string): {
+    content: string;
+    iv: string;
+    authTag: string;
+    encryptedKey: string;
+    selfEncryptedKey: string;
+    keyId: string;
+};
+/**
+ * Decrypt a media envelope using the operator's private key. Tries the
+ * recipient-wrapped key first, then the sender-wrapped key. Returns the
+ * plaintext file bytes, or null when decryption fails.
+ */
+export declare function decryptMediaEnvelope(envelope: {
+    content: string;
+    iv?: string;
+    authTag?: string;
+    encryptedKey?: string;
+    selfEncryptedKey?: string;
+}, privateKey: KeyObject): Uint8Array | null;

package/dist/crypto.js

@@ -0,0 +1,195 @@
+/**
+ * Operator-side end-to-end encryption helpers for ixblix.
+ *
+ * The operator (desk/CRM) holds a persistent RSA-OAEP keypair. The private key
+ * never leaves the operator process; only the public key is registered with the
+ * ixblix backend at conversation creation so the customer can encrypt messages to
+ * the operator.
+ *
+ * Outgoing messages are encrypted to the customer's public key; incoming
+ * messages are decrypted with the operator's private key.
+ *
+ * The scheme is hybrid: each message is encrypted with a fresh AES-256-GCM key,
+ * and that AES key is wrapped (RSA-OAEP/SHA-256) both to the recipient
+ * (`encryptedKey`) and to the sender's own public key (`selfEncryptedKey`) so
+ * the sender can read back its own sent messages.
+ */
+import { generateKeyPairSync, createPublicKey, createPrivateKey, publicEncrypt, privateDecrypt, randomBytes, createCipheriv, createDecipheriv, constants, } from "node:crypto";
+/** Encode a Buffer as a URL-safe base64 string (no padding). */
+function bytesToBase64(bytes) {
+    return Buffer.from(bytes).toString("base64url");
+}
+/** Decode a base64 string (URL-safe or standard) into a Buffer. */
+function base64ToBytes(value) {
+    return new Uint8Array(Buffer.from(value, "base64"));
+}
+/** Generate a random identifier for a public key. */
+function generateKeyId() {
+    return randomBytes(16).toString("base64url");
+}
+/**
+ * Generate a fresh RSA keypair for the operator. The private key stays on the
+ * operator's side; only `publicKeySpki` should be registered with ixblix.
+ */
+export function generateOperatorKeyPair(options = {}) {
+    const { publicKey, privateKey } = generateKeyPairSync("rsa", {
+        modulusLength: options.modulusLength ?? 2048,
+        publicExponent: 0x10001,
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+        publicKeyEncoding: { type: "spki", format: "pem" },
+    });
+    const publicSpki = createPublicKey(publicKey)
+        .export({ type: "spki", format: "der" })
+        .toString("base64");
+    const keyId = generateKeyId();
+    return {
+        keyId,
+        publicKeySpki: publicSpki,
+        privateKey: createPrivateKey(privateKey),
+    };
+}
+/** Import a base64 SPKI DER RSA public key (e.g. the customer's key). */
+export function importPublicKey(spkiBase64) {
+    const der = Buffer.from(spkiBase64, "base64");
+    return createPublicKey({ key: der, type: "spki", format: "der" });
+}
+/**
+ * Encrypt a plaintext message to the recipient's RSA public key.
+ *
+ * Returns the envelope fields expected by the ixblix backend. The AES key is
+ * wrapped both to the recipient (`encryptedKey`) and to the sender's own public
+ * key (`selfEncryptedKey`) so the sender can read back its own sent message.
+ */
+export function encryptToRecipient(plaintext, recipientPublicKeySpki, senderKeyId, senderPublicKeySpki) {
+    const recipientKey = importPublicKey(recipientPublicKeySpki);
+    const senderKey = importPublicKey(senderPublicKeySpki);
+    // Fresh AES-256-GCM key per message.
+    const aesKey = randomBytes(32);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", aesKey, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(plaintext, "utf8"),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    // Wrap the AES key with the recipient's RSA public key.
+    // `RSA_PKCS1_OAEP_PADDING` + `oaepHash: "sha256"` matches the Web Crypto
+    // RSA-OAEP/SHA-256 used by the customer browser. (Note: padding value 1 is
+    // PKCS#1 v1.5, NOT OAEP, and is incompatible with Web Crypto.)
+    const encryptedKey = publicEncrypt({
+        key: recipientKey,
+        padding: constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: "sha256",
+    }, aesKey);
+    // Also wrap the AES key with the sender's own public key, so the sender can
+    // read back its own sent message.
+    const selfEncryptedKey = publicEncrypt({
+        key: senderKey,
+        padding: constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: "sha256",
+    }, aesKey);
+    return {
+        content: bytesToBase64(new Uint8Array(ciphertext)),
+        iv: bytesToBase64(new Uint8Array(iv)),
+        authTag: bytesToBase64(new Uint8Array(authTag)),
+        encryptedKey: bytesToBase64(new Uint8Array(encryptedKey)),
+        selfEncryptedKey: bytesToBase64(new Uint8Array(selfEncryptedKey)),
+        keyId: senderKeyId,
+    };
+}
+/**
+ * Decrypt a message envelope using the operator's private key. Tries the
+ * recipient-wrapped key (`encryptedKey`) first, then the sender-wrapped key
+ * (`selfEncryptedKey`), so the operator can read back its own sent messages
+ * too. Returns null when decryption fails.
+ */
+export function decryptEnvelope(envelope, privateKey) {
+    const wrappedKeys = [envelope.encryptedKey, envelope.selfEncryptedKey].filter((key) => Boolean(key));
+    for (const wrappedKey of wrappedKeys) {
+        try {
+            if (!envelope.iv || !envelope.authTag) {
+                return null;
+            }
+            const aesKey = privateDecrypt({
+                key: privateKey,
+                padding: constants.RSA_PKCS1_OAEP_PADDING,
+                oaepHash: "sha256", // match Web Crypto RSA-OAEP/SHA-256
+            }, Buffer.from(base64ToBytes(wrappedKey)));
+            const decipher = createDecipheriv("aes-256-gcm", aesKey, Buffer.from(base64ToBytes(envelope.iv)));
+            decipher.setAuthTag(Buffer.from(base64ToBytes(envelope.authTag)));
+            const plaintext = Buffer.concat([
+                decipher.update(Buffer.from(base64ToBytes(envelope.content))),
+                decipher.final(),
+            ]);
+            return plaintext.toString("utf8");
+        }
+        catch {
+            // Try the next wrapped key.
+        }
+    }
+    return null;
+}
+/**
+ * Encrypt a binary media file (image/audio/document) to the recipient's RSA
+ * public key. Uses a fresh AES-256-GCM key wrapped to both the recipient and
+ * the sender (for self-read). Returns the envelope fields plus the base64
+ * ciphertext of the file bytes.
+ */
+export function encryptMediaToRecipient(fileBytes, recipientPublicKeySpki, senderKeyId, senderPublicKeySpki) {
+    const recipientKey = importPublicKey(recipientPublicKeySpki);
+    const senderKey = importPublicKey(senderPublicKeySpki);
+    const aesKey = randomBytes(32);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", aesKey, iv);
+    const ciphertext = Buffer.concat([cipher.update(fileBytes), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    const encryptedKey = publicEncrypt({
+        key: recipientKey,
+        padding: constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: "sha256",
+    }, aesKey);
+    const selfEncryptedKey = publicEncrypt({
+        key: senderKey,
+        padding: constants.RSA_PKCS1_OAEP_PADDING,
+        oaepHash: "sha256",
+    }, aesKey);
+    return {
+        content: bytesToBase64(new Uint8Array(ciphertext)),
+        iv: bytesToBase64(new Uint8Array(iv)),
+        authTag: bytesToBase64(new Uint8Array(authTag)),
+        encryptedKey: bytesToBase64(new Uint8Array(encryptedKey)),
+        selfEncryptedKey: bytesToBase64(new Uint8Array(selfEncryptedKey)),
+        keyId: senderKeyId,
+    };
+}
+/**
+ * Decrypt a media envelope using the operator's private key. Tries the
+ * recipient-wrapped key first, then the sender-wrapped key. Returns the
+ * plaintext file bytes, or null when decryption fails.
+ */
+export function decryptMediaEnvelope(envelope, privateKey) {
+    const wrappedKeys = [envelope.encryptedKey, envelope.selfEncryptedKey].filter((key) => Boolean(key));
+    for (const wrappedKey of wrappedKeys) {
+        try {
+            if (!envelope.iv || !envelope.authTag) {
+                return null;
+            }
+            const aesKey = privateDecrypt({
+                key: privateKey,
+                padding: constants.RSA_PKCS1_OAEP_PADDING,
+                oaepHash: "sha256",
+            }, Buffer.from(base64ToBytes(wrappedKey)));
+            const decipher = createDecipheriv("aes-256-gcm", aesKey, Buffer.from(base64ToBytes(envelope.iv)));
+            decipher.setAuthTag(Buffer.from(base64ToBytes(envelope.authTag)));
+            return Buffer.concat([
+                decipher.update(Buffer.from(base64ToBytes(envelope.content))),
+                decipher.final(),
+            ]);
+        }
+        catch {
+            // Try the next wrapped key.
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,SAAS,GAEV,MAAM,aAAa,CAAC;AAErB,gEAAgE;AAChE,SAAS,aAAa,CAAC,KAAiB;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAED,mEAAmE;AACnE,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,qDAAqD;AACrD,SAAS,aAAa;IACpB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAkBD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAkC,EAAE;IAEpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE;QAC3D,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;QAC5C,cAAc,EAAE,OAAO;QACvB,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;QACpD,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;KACnD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,eAAe,CAAC,SAAS,CAAC;SAC1C,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACvC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,OAAO;QACL,KAAK;QACL,aAAa,EAAE,UAAU;QACzB,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAAiB,EACjB,sBAA8B,EAC9B,WAAmB,EACnB,mBAA2B;IAS3B,MAAM,YAAY,GAAG,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,eAAe,CAAC,mBAAmB,CAAC,CAAC;IAEvD,qCAAqC;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAE3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;QAChC,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,wDAAwD;IACxD,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,YAAY,GAAG,aAAa,CAChC;QACE,GAAG,EAAE,YAAY;QACjB,OAAO,EAAE,SAAS,CAAC,sBAAsB;QACzC,QAAQ,EAAE,QAAQ;KACnB,EACD,MAAM,CACP,CAAC;IACF,4EAA4E;IAC5E,kCAAkC;IAClC,MAAM,gBAAgB,GAAG,aAAa,CACpC;QACE,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,SAAS,CAAC,sBAAsB;QACzC,QAAQ,EAAE,QAAQ;KACnB,EACD,MAAM,CACP,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,EAAE,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,YAAY,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;QACzD,gBAAgB,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACjE,KAAK,EAAE,WAAW;KACnB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,QAMC,EACD,UAAqB;IAErB,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAC3E,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,cAAc,CAC3B;gBACE,GAAG,EAAE,UAAU;gBACf,OAAO,EAAE,SAAS,CAAC,sBAAsB;gBACzC,QAAQ,EAAE,QAAQ,EAAE,oCAAoC;aACzD,EACD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CACvC,CAAC;YACF,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CACxC,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC7D,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAqB,EACrB,sBAA8B,EAC9B,WAAmB,EACnB,mBAA2B;IAS3B,MAAM,YAAY,GAAG,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,eAAe,CAAC,mBAAmB,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAE3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,MAAM,YAAY,GAAG,aAAa,CAChC;QACE,GAAG,EAAE,YAAY;QACjB,OAAO,EAAE,SAAS,CAAC,sBAAsB;QACzC,QAAQ,EAAE,QAAQ;KACnB,EACD,MAAM,CACP,CAAC;IACF,MAAM,gBAAgB,GAAG,aAAa,CACpC;QACE,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,SAAS,CAAC,sBAAsB;QACzC,QAAQ,EAAE,QAAQ;KACnB,EACD,MAAM,CACP,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;QAClD,EAAE,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QAC/C,YAAY,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC;QACzD,gBAAgB,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QACjE,KAAK,EAAE,WAAW;KACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAMC,EACD,UAAqB;IAErB,MAAM,WAAW,GAAG,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAC3E,CAAC,GAAG,EAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CACrC,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,MAAM,GAAG,cAAc,CAC3B;gBACE,GAAG,EAAE,UAAU;gBACf,OAAO,EAAE,SAAS,CAAC,sBAAsB;gBACzC,QAAQ,EAAE,QAAQ;aACnB,EACD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CACvC,CAAC;YACF,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,aAAa,EACb,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CACxC,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC7D,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,21 @@
+import type { IxblixErrorBody } from "./types.js";
+/**
+ * Error thrown by the ixblix SDK when the API returns a non-2xx response or when
+ * a request cannot be completed.
+ */
+export declare class IxblixError extends Error {
+    /** HTTP status code returned by the API (0 when the request never reached it). */
+    readonly status: number;
+    /** Machine-readable ixblix error code (e.g. `UNAUTHORIZED`, `NOT_FOUND`). */
+    readonly code: string;
+    /** Optional validation error details. */
+    readonly details?: Array<{
+        path: string;
+        message: string;
+    }>;
+    constructor(message: string, options?: {
+        status?: number;
+        code?: string;
+        details?: IxblixErrorBody["errors"];
+    });
+}

package/dist/errors.js

@@ -0,0 +1,20 @@
+/**
+ * Error thrown by the ixblix SDK when the API returns a non-2xx response or when
+ * a request cannot be completed.
+ */
+export class IxblixError extends Error {
+    /** HTTP status code returned by the API (0 when the request never reached it). */
+    status;
+    /** Machine-readable ixblix error code (e.g. `UNAUTHORIZED`, `NOT_FOUND`). */
+    code;
+    /** Optional validation error details. */
+    details;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = "IxblixError";
+        this.status = options.status ?? 0;
+        this.code = options.code ?? "UNKNOWN";
+        this.details = options.details;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,kFAAkF;IACzE,MAAM,CAAS;IACxB,6EAA6E;IACpE,IAAI,CAAS;IACtB,yCAAyC;IAChC,OAAO,CAA4C;IAE5D,YACE,OAAe,EACf,UAAmF,EAAE;QAErF,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+/**
+ * ixblix SDK — official client for desk/CRM integrations.
+ *
+ * Create overflow conversations, exchange end-to-end encrypted messages and
+ * media, and manage company onboarding.
+ *
+ * ```ts
+ * import { IxblixClient, generateOperatorKeyPair } from "ixblix-sdk-js";
+ *
+ * const ixblix = new IxblixClient({
+ *   baseUrl: "https://api.ixblix.app",
+ *   apiKey: process.env.IXBLIX_API_KEY,
+ * });
+ * ```
+ */
+export { IxblixClient } from "./client.js";
+export type { IxblixClientOptions, MediaUpload, MediaDownload, } from "./client.js";
+export { IxblixError } from "./errors.js";
+export { generateOperatorKeyPair, importPublicKey, encryptToRecipient, decryptEnvelope, encryptMediaToRecipient, decryptMediaEnvelope, } from "./crypto.js";
+export type { OperatorKeyPair, GenerateKeyPairOptions } from "./crypto.js";
+export { loadOrCreateOperatorKey } from "./keypair.js";
+export { parseWebhook, verifyWebhook } from "./webhooks.js";
+export type { ParsedWebhook } from "./webhooks.js";
+export { WEBHOOK_SIGNATURE_HEADER, WEBHOOK_ID_HEADER, WEBHOOK_EVENT_HEADER, } from "./webhooks.js";
+export type { SenderType, ConversationKeyStatus, ConversationStatus, ConsentStatus, Contact, ContactInput, Conversation, CompanyCustomization, CompanySummary, CreateConversationResult, ConversationKeys, RegisterCustomerKeyResult, EraseConversationResult, MessageEnvelope, Message, Media, Plan, RegisterCompanyInput, PaymentInstructions, RegisterCompanyResult, ActivateCompanyResult, CompanyBalance, CreditPurchase, PurchaseCreditsResult, PaymentProvidersResult, OriginalChannelMessageInput, WebhookEvent, CompanyActivatedEvent, MessageReceivedEvent, MessageReadEvent, CustomerJoinedEvent, ConversationClosedEvent, PresenceEvent, BalanceLowEvent, IxblixErrorBody, } from "./types.js";

package/dist/index.js

@@ -0,0 +1,22 @@
+/**
+ * ixblix SDK — official client for desk/CRM integrations.
+ *
+ * Create overflow conversations, exchange end-to-end encrypted messages and
+ * media, and manage company onboarding.
+ *
+ * ```ts
+ * import { IxblixClient, generateOperatorKeyPair } from "ixblix-sdk-js";
+ *
+ * const ixblix = new IxblixClient({
+ *   baseUrl: "https://api.ixblix.app",
+ *   apiKey: process.env.IXBLIX_API_KEY,
+ * });
+ * ```
+ */
+export { IxblixClient } from "./client.js";
+export { IxblixError } from "./errors.js";
+export { generateOperatorKeyPair, importPublicKey, encryptToRecipient, decryptEnvelope, encryptMediaToRecipient, decryptMediaEnvelope, } from "./crypto.js";
+export { loadOrCreateOperatorKey } from "./keypair.js";
+export { parseWebhook, verifyWebhook } from "./webhooks.js";
+export { WEBHOOK_SIGNATURE_HEADER, WEBHOOK_ID_HEADER, WEBHOOK_EVENT_HEADER, } from "./webhooks.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAO3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEvD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE5D,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,eAAe,CAAC"}

package/dist/keypair.d.ts

@@ -0,0 +1,8 @@
+import { type OperatorKeyPair } from "./crypto.js";
+/**
+ * Load the operator keypair from disk, generating and persisting it if absent.
+ *
+ * @param directory Directory where the keypair files are stored.
+ * @returns The loaded (or freshly generated) keypair.
+ */
+export declare function loadOrCreateOperatorKey(directory: string): OperatorKeyPair;

package/dist/keypair.js

@@ -0,0 +1,44 @@
+/**
+ * Persistence helpers for the operator RSA keypair.
+ *
+ * The operator's private key must be stored securely and never sent to ixblix.
+ * These helpers load-or-create a keypair on disk (private key written with mode
+ * `0600`). Integrations that use a secret manager or KMS should instead manage
+ * the keypair themselves and pass the resulting `OperatorKeyPair` to the SDK.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync, } from "node:fs";
+import path from "node:path";
+import { createPrivateKey } from "node:crypto";
+import { generateOperatorKeyPair, } from "./crypto.js";
+/**
+ * Load the operator keypair from disk, generating and persisting it if absent.
+ *
+ * @param directory Directory where the keypair files are stored.
+ * @returns The loaded (or freshly generated) keypair.
+ */
+export function loadOrCreateOperatorKey(directory) {
+    const privateKeyFile = path.join(directory, "operator-private.pem");
+    const publicKeyFile = path.join(directory, "operator-public.spki");
+    const keyIdFile = path.join(directory, "operator-key-id");
+    if (existsSync(privateKeyFile) &&
+        existsSync(publicKeyFile) &&
+        existsSync(keyIdFile)) {
+        const privatePem = readFileSync(privateKeyFile, "utf8");
+        const publicSpki = readFileSync(publicKeyFile, "utf8");
+        const keyId = readFileSync(keyIdFile, "utf8");
+        return {
+            keyId,
+            publicKeySpki: publicSpki,
+            privateKey: createPrivateKey(privatePem),
+        };
+    }
+    const keypair = generateOperatorKeyPair();
+    mkdirSync(directory, { recursive: true });
+    writeFileSync(privateKeyFile, keypair.privateKey.export({ type: "pkcs8", format: "pem" }), {
+        mode: 0o600,
+    });
+    writeFileSync(publicKeyFile, keypair.publicKeySpki);
+    writeFileSync(keyIdFile, keypair.keyId);
+    return keypair;
+}
+//# sourceMappingURL=keypair.js.map

package/dist/keypair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keypair.js","sourceRoot":"","sources":["../src/keypair.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,uBAAuB,GAExB,MAAM,aAAa,CAAC;AAErB;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACpE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAE1D,IACE,UAAU,CAAC,cAAc,CAAC;QAC1B,UAAU,CAAC,aAAa,CAAC;QACzB,UAAU,CAAC,SAAS,CAAC,EACrB,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO;YACL,KAAK;YACL,aAAa,EAAE,UAAU;YACzB,UAAU,EAAE,gBAAgB,CAAC,UAAU,CAAC;SACzC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAE1C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,aAAa,CAAC,cAAc,EAAE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE;QACzF,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACpD,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAExC,OAAO,OAAO,CAAC;AACjB,CAAC"}