@meshline/sdk 0.0.0-stage → 0.1.0-alpha.1

package/dist/groups/state.js

@@ -0,0 +1,201 @@
+import { groupManagementHash } from '../crypto/groups.js';
+import { ProtocolError } from '../errors.js';
+import { deriveResourceId } from '../identity/identifiers.js';
+import { groupEventCodec, groupManagementPayloadCodec, validateGroupEvent, verifyGroupManagementPayload } from '../models/group-management.js';
+import { groupMessageEnvelopeCodec, validateGroupRef, verifyGroupMessageEnvelope } from '../models/groups.js';
+import { certificateId, validateCertificate } from '../models/identity.js';
+import { equalBytes } from '../protocol/encoding.js';
+import { requireObject } from '../protocol/json.js';
+export const groupChangeKinds = ['properties', 'members', 'roles', 'bans', 'nickname', 'status'];
+const managementChanges = {
+    create: ['properties', 'members', 'roles', 'status'], update: ['properties'], applicationApproval: ['members'], roleUpdate: ['roles'], ownerTransfer: ['roles'],
+    memberLeave: ['members'], memberRemoval: ['members'], memberBan: ['members', 'bans'], memberUnban: ['bans'], memberRecoveryApproval: ['members'], secretRotation: ['members'], close: ['status'],
+};
+/** Applies one timeline event without mutating the preceding projection. Invalid administration stops the chain; invalid ordinary messages retain an explicit rejection. */
+export function applyGroupEvent(previous, source, certificate, group, context) {
+    validateGroupRef(group);
+    const entry = groupEventCodec.decode(groupEventCodec.encode(source));
+    validateGroupEvent(entry);
+    if (previous && (previous.groupId !== group.groupId || previous.relayId !== group.relayId))
+        throw new ProtocolError('invalid_binding', 'Verified group state belongs to another group or relay.');
+    if (entry.sequence <= (previous?.sequence ?? -1))
+        throw new ProtocolError('invalid_sequence', 'A group event must advance the verified sequence.');
+    if (previous?.state.status === 'closed')
+        throw new ProtocolError('group_closed', 'A closed group cannot append events.');
+    if (entry.signerDeviceId !== undefined) {
+        if (!certificate)
+            throw new ProtocolError('missing_certificate', 'Group event signing certificate is missing.');
+        validateCertificate(certificate, context);
+        if (certificateId(certificate, context) !== entry.signerDeviceId)
+            throw new ProtocolError('invalid_identity', 'Group event signing certificate belongs to another device.');
+    }
+    if (entry.payload.$type === 'meshline.group.key.rotated') {
+        if (!previous || certificate !== undefined || entry.epoch <= previous.epoch)
+            throw new ProtocolError('invalid_epoch', 'Relay key rotation requires an established group and a newer epoch.');
+        return { projection: { ...previous, sequence: entry.sequence, epoch: entry.epoch } };
+    }
+    if (entry.payload.$type === 'meshline.group.message') {
+        if (!previous || entry.epoch !== previous.epoch)
+            throw new ProtocolError('invalid_epoch', 'Group message must use the verified current epoch.');
+        const projection = { ...previous, sequence: entry.sequence };
+        try {
+            const member = previous.members.find(value => value.account === certificate.account);
+            if (!member || previous.bans.includes(certificate.account))
+                throw new ProtocolError('unauthorized_member', 'Group message sender is not a current unbanned member.');
+            const envelope = groupMessageEnvelopeCodec.decode(entry.payload);
+            if (envelope.groupId !== group.groupId || envelope.epoch !== entry.epoch)
+                throw new ProtocolError('invalid_binding', 'Group envelope and event have inconsistent group or epoch bindings.');
+            verifyGroupMessageEnvelope(envelope, certificate, entry.signerDeviceId, context);
+            return { projection, message: { envelope, sender: certificate, signerDeviceId: entry.signerDeviceId, joinedAtSequence: member.joinedAtSequence } };
+        }
+        catch (error) {
+            if (!(error instanceof ProtocolError))
+                throw error;
+            return { projection, rejection: error };
+        }
+    }
+    const payload = groupManagementPayloadCodec.decode(entry.payload);
+    verifyGroupManagementPayload(payload, certificate, context);
+    const actor = certificate.account;
+    if (payload.kind === 'create') {
+        const value = payload.value;
+        if (previous || entry.sequence !== 0 || entry.epoch !== 0 || value.owner.account !== actor || value.groupId !== group.groupId
+            || deriveResourceId('group', actor, group.relayId, value.nonce, context) !== group.groupId)
+            throw new ProtocolError('invalid_creation', 'Group creation does not establish the expected owner, group and hosting relay.');
+        return { changeKinds: managementChanges.create, projection: { ...group, sequence: 0, epoch: 0, managementHash: groupManagementHash(requireObject(groupManagementPayloadCodec.encode(payload)), context), clientSecretCommitment: value.clientSecretCommitment,
+                state: { groupId: group.groupId, name: value.name, ...(value.description === undefined ? {} : { description: value.description }), status: 'active', owner: actor, memberCapacity: value.memberCapacity, memberCount: 1, invitePolicy: value.invitePolicy },
+                members: [{ account: actor, role: 'owner', memberEncryptionPublicKey: value.owner.memberEncryptionPublicKey.slice(), joinedAtSequence: 0 }], bans: [], departures: {} } };
+    }
+    if (!previous || payload.value.groupId !== group.groupId || payload.value.prevHash !== previous.managementHash)
+        throw new ProtocolError('invalid_management_chain', 'Group management predecessor does not match the verified head.');
+    const members = new Map(previous.members.map(value => [value.account, { ...value, memberEncryptionPublicKey: value.memberEncryptionPublicKey.slice() }]));
+    const bans = new Set(previous.bans);
+    const departures = { ...previous.departures };
+    const author = members.get(actor);
+    if (!author || bans.has(actor))
+        throw new ProtocolError('unauthorized_member', 'Group administrator is not a current unbanned member.');
+    const owner = author.role === 'owner';
+    const administrator = owner || author.role === 'administrator';
+    let state = { ...previous.state };
+    let commitment = previous.clientSecretCommitment;
+    let advances = false;
+    const member = (account) => { const value = members.get(account); if (!value)
+        throw new ProtocolError('missing_member', 'Group management target is not a current member.'); return value; };
+    const authorize = (allowed) => { if (!allowed)
+        throw new ProtocolError('unauthorized_role', 'Group actor is not authorized for this operation.'); };
+    const add = (value) => { members.set(value.account, { account: value.account, role: 'member', memberEncryptionPublicKey: value.memberEncryptionPublicKey.slice(), joinedAtSequence: entry.sequence }); delete departures[value.account]; };
+    const remove = (account, departure) => { members.delete(account); departures[account] = departure; };
+    switch (payload.kind) {
+        case 'update': {
+            authorize(owner);
+            const value = payload.value;
+            if (value.name !== undefined)
+                state = { ...state, name: value.name };
+            if (value.description === null)
+                delete state.description;
+            else if (value.description !== undefined)
+                state = { ...state, description: value.description };
+            if (value.memberCapacity !== undefined)
+                state = { ...state, memberCapacity: value.memberCapacity };
+            if (value.invitePolicy !== undefined)
+                state = { ...state, invitePolicy: value.invitePolicy };
+            break;
+        }
+        case 'applicationApproval':
+            authorize(administrator);
+            if (members.size + payload.value.members.length > state.memberCapacity)
+                throw new ProtocolError('group_capacity', 'Group admission exceeds the current capacity.');
+            for (const value of payload.value.members) {
+                if (members.has(value.account) || bans.has(value.account))
+                    throw new ProtocolError('invalid_admission', 'An existing or banned account cannot be admitted.');
+                add(value);
+            }
+            advances = true;
+            break;
+        case 'roleUpdate': {
+            authorize(owner);
+            const target = member(payload.value.account);
+            authorize(target.role !== 'owner');
+            members.set(target.account, { ...target, role: payload.value.role });
+            break;
+        }
+        case 'ownerTransfer': {
+            authorize(owner);
+            const target = member(payload.value.newOwnerAccount);
+            authorize(target.account !== actor && !bans.has(target.account));
+            members.set(actor, { ...author, role: 'member' });
+            members.set(target.account, { ...target, role: 'owner' });
+            state = { ...state, owner: target.account };
+            break;
+        }
+        case 'memberLeave':
+            authorize(!owner && payload.value.account === actor);
+            remove(actor, 'left');
+            advances = true;
+            break;
+        case 'memberRemoval':
+            authorize(administrator);
+            for (const account of payload.value.accounts) {
+                const target = member(account);
+                authorize(account !== actor && target.role !== 'owner' && (owner || target.role === 'member'));
+                remove(account, 'removed');
+            }
+            advances = true;
+            break;
+        case 'memberBan':
+            authorize(administrator);
+            for (const account of payload.value.accounts) {
+                const target = members.get(account);
+                authorize(account !== actor && (!target || target.role !== 'owner' && (owner || target.role === 'member')));
+                if (target) {
+                    remove(account, 'banned');
+                    advances = true;
+                }
+                else
+                    departures[account] = 'banned';
+                bans.add(account);
+            }
+            break;
+        case 'memberUnban':
+            authorize(administrator);
+            for (const account of payload.value.accounts) {
+                bans.delete(account);
+                if (departures[account] === 'banned')
+                    departures[account] = 'not_member';
+            }
+            break;
+        case 'memberRecoveryApproval':
+            authorize(administrator);
+            for (const value of payload.value.members) {
+                const target = member(value.account);
+                authorize(owner || target.role === 'member' && target.account !== actor);
+                if (equalBytes(target.memberEncryptionPublicKey, value.memberEncryptionPublicKey))
+                    throw new ProtocolError('unchanged_key', 'Recovered member public key must change.');
+                members.set(target.account, { ...target, memberEncryptionPublicKey: value.memberEncryptionPublicKey.slice() });
+            }
+            advances = true;
+            break;
+        case 'secretRotation':
+            authorize(owner);
+            if (payload.value.clientSecretCommitment === commitment)
+                throw new ProtocolError('unchanged_secret', 'Client secret rotation must change its commitment.');
+            commitment = payload.value.clientSecretCommitment;
+            if (payload.value.ownerEncryptionPublicKey) {
+                if (equalBytes(author.memberEncryptionPublicKey, payload.value.ownerEncryptionPublicKey))
+                    throw new ProtocolError('unchanged_key', 'Specified owner public key must change.');
+                members.set(actor, { ...author, memberEncryptionPublicKey: payload.value.ownerEncryptionPublicKey.slice() });
+            }
+            advances = true;
+            break;
+        case 'close':
+            authorize(owner);
+            state = { ...state, status: 'closed' };
+            break;
+    }
+    if (advances ? entry.epoch <= previous.epoch : entry.epoch !== previous.epoch)
+        throw new ProtocolError('invalid_epoch', 'Group management event has an invalid epoch transition.');
+    state = { ...state, memberCount: members.size };
+    return { changeKinds: managementChanges[payload.kind], projection: { ...group, sequence: entry.sequence, epoch: entry.epoch, state, members: [...members.values()], bans: [...bans], departures,
+            clientSecretCommitment: commitment, managementHash: groupManagementHash(requireObject(groupManagementPayloadCodec.encode(payload)), context) } };
+}
+//# sourceMappingURL=state.js.map

package/dist/groups/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/groups/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,4BAA4B,EAClB,MAAM,+BAA+B,CAAC;AAC3H,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,0BAA0B,EAAiE,MAAM,qBAAqB,CAAC;AAC7K,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAA0B,MAAM,uBAAuB,CAAC;AAEnG,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAWpD,MAAM,CAAC,MAAM,gBAAgB,GAA+B,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAC7H,MAAM,iBAAiB,GAAiF;IACpG,MAAM,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,mBAAmB,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC,OAAO,CAAC;IAC/J,WAAW,EAAE,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,sBAAsB,EAAE,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC;CACnM,CAAC;AAGF,4KAA4K;AAC5K,MAAM,UAAU,eAAe,CAAC,QAAqC,EAAE,MAAkB,EAAE,WAA0C,EAAE,KAAe,EAAE,OAAuB;IAC3K,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAAC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzH,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;IAClM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,mDAAmD,CAAC,CAAC;IACnJ,IAAI,QAAQ,EAAE,KAAK,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;IACzH,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,6CAA6C,CAAC,CAAC;QAChH,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAAC,IAAI,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC,cAAc;YAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,4DAA4D,CAAC,CAAC;IAC3N,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,4BAA4B,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,IAAI,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,qEAAqE,CAAC,CAAC;QAC7L,OAAO,EAAE,UAAU,EAAE,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,wBAAwB,EAAE,CAAC;QACnD,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,oDAAoD,CAAC,CAAC;QAChJ,MAAM,UAAU,GAAG,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7D,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,WAAY,CAAC,OAAO,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAY,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,wDAAwD,CAAC,CAAC;YACtK,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACjE,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;gBAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,qEAAqE,CAAC,CAAC;YAC5L,0BAA0B,CAAC,QAAQ,EAAE,WAAY,EAAE,KAAK,CAAC,cAAe,EAAE,OAAO,CAAC,CAAC;YACnF,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAY,EAAE,cAAc,EAAE,KAAK,CAAC,cAAe,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;QACzJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,KAAK,YAAY,aAAa,CAAC;gBAAE,MAAM,KAAK,CAAC;YACnD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,2BAA2B,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,4BAA4B,CAAC,OAAO,EAAE,WAAY,EAAE,OAAO,CAAC,CAAC;IAChI,MAAM,KAAK,GAAG,WAAY,CAAC,OAAO,CAAC;IACnC,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,QAAQ,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eACtH,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,gFAAgF,CAAC,CAAC;QAC9N,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,mBAAmB,CAAC,aAAa,CAAC,2BAA2B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;gBACzP,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE;gBAC3P,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC;IAClL,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,cAAc;QAAE,MAAM,IAAI,aAAa,CAAC,0BAA0B,EAAE,gEAAgE,CAAC,CAAC;IACtO,MAAM,OAAO,GAAG,IAAI,GAAG,CAA+B,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,yBAAyB,EAAE,KAAK,CAAC,yBAAyB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACxL,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,UAAU,GAAG,EAAE,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,qBAAqB,EAAE,uDAAuD,CAAC,CAAC;IAC3K,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;IAAC,MAAM,aAAa,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,CAAC;IACtG,IAAI,KAAK,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;IAAC,IAAI,UAAU,GAAG,QAAQ,CAAC,sBAAsB,CAAC;IAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAC1G,MAAM,MAAM,GAAG,CAAC,OAAe,EAAwB,EAAE,GAAG,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,kDAAkD,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3N,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAQ,EAAE,GAAG,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,mDAAmD,CAAC,CAAC,CAAC,CAAC,CAAC;IACnK,MAAM,GAAG,GAAG,CAAC,KAAqB,EAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,yBAAyB,EAAE,KAAK,CAAC,yBAAyB,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACjQ,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,SAAyB,EAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACnI,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,EAAE,CAAC;YACZ,SAAS,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC9C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC,WAAW,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;gBAAE,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YACzJ,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;gBAAE,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;YACnG,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;gBAAE,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7F,MAAM;QACV,CAAC;QACD,KAAK,qBAAqB;YACtB,SAAS,CAAC,aAAa,CAAC,CAAC;YACzB,IAAI,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,cAAc;gBAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,+CAA+C,CAAC,CAAC;YACnK,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,aAAa,CAAC,mBAAmB,EAAE,mDAAmD,CAAC,CAAC;gBAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;YACxN,QAAQ,GAAG,IAAI,CAAC;YAAC,MAAM;QAC3B,KAAK,YAAY,EAAE,CAAC;YAChB,SAAS,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAAC,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM;QACpL,CAAC;QACD,KAAK,eAAe,EAAE,CAAC;YACnB,SAAS,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAAC,SAAS,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YACzI,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM;QACrK,CAAC;QACD,KAAK,aAAa;YAAE,SAAS,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;YAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC;YAAC,MAAM;QACxH,KAAK,eAAe;YAChB,SAAS,CAAC,aAAa,CAAC,CAAC;YACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAAC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAC,SAAS,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;gBAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAAC,CAAC;YAC7M,QAAQ,GAAG,IAAI,CAAC;YAAC,MAAM;QAC3B,KAAK,WAAW;YACZ,SAAS,CAAC,aAAa,CAAC,CAAC;YACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAAC,SAAS,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACjJ,IAAI,MAAM,EAAE,CAAC;oBAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;oBAAC,QAAQ,GAAG,IAAI,CAAC;gBAAC,CAAC;;oBAAM,UAAU,CAAC,OAAO,CAAC,GAAG,QAAQ,CAAC;gBAChG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC;YACD,MAAM;QACV,KAAK,aAAa;YACd,SAAS,CAAC,aAAa,CAAC,CAAC;YACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAC,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,QAAQ;oBAAE,UAAU,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC;YAAC,CAAC;YACjJ,MAAM;QACV,KAAK,wBAAwB;YACzB,SAAS,CAAC,aAAa,CAAC,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAAC,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC;gBAC/G,IAAI,UAAU,CAAC,MAAM,CAAC,yBAAyB,EAAE,KAAK,CAAC,yBAAyB,CAAC;oBAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,0CAA0C,CAAC,CAAC;gBACxK,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,yBAAyB,EAAE,KAAK,CAAC,yBAAyB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAAC,MAAM;QAC3B,KAAK,gBAAgB;YACjB,SAAS,CAAC,KAAK,CAAC,CAAC;YACjB,IAAI,OAAO,CAAC,KAAK,CAAC,sBAAsB,KAAK,UAAU;gBAAE,MAAM,IAAI,aAAa,CAAC,kBAAkB,EAAE,oDAAoD,CAAC,CAAC;YAC3J,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,sBAAsB,CAAC;YAClD,IAAI,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC;gBACzC,IAAI,UAAU,CAAC,MAAM,CAAC,yBAAyB,EAAE,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC;oBAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,yCAAyC,CAAC,CAAC;gBAC9K,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,yBAAyB,EAAE,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAAC,MAAM;QAC3B,KAAK,OAAO;YAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAAC,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAAC,MAAM;IAClF,CAAC;IACD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,yDAAyD,CAAC,CAAC;IACnL,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,EAAE,WAAW,EAAE,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,UAAU;YAC3L,sBAAsB,EAAE,UAAU,EAAE,cAAc,EAAE,mBAAmB,CAAC,aAAa,CAAC,2BAA2B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;AACzJ,CAAC"}

package/dist/identity/identifiers.d.ts

@@ -0,0 +1,9 @@
+import { type RandomSource } from '../crypto/primitives.js';
+import { NetworkContext } from '../protocol/context.js';
+export type IdentifierKind = 'device' | 'message' | 'channel' | 'group' | 'invite';
+/** Checks canonical representation only, not existence or authorization. */
+export declare function validateIdentifier(kind: IdentifierKind, value: string): void;
+export declare function createIdentifier(kind: 'message' | 'invite', random?: RandomSource): string;
+export declare function deriveDeviceId(account: string, signingPublicKey: Uint8Array, encryptionPublicKey: Uint8Array, context: NetworkContext): string;
+export declare function deriveResourceId(kind: 'channel' | 'group', creator: string, relayId: string, nonce: Uint8Array, context: NetworkContext): string;
+//# sourceMappingURL=identifiers.d.ts.map

package/dist/identity/identifiers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.d.ts","sourceRoot":"","sources":["../../src/identity/identifiers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuC,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEjG,OAAO,EAAE,cAAc,EAAgB,MAAM,wBAAwB,CAAC;AAItE,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAGnF,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAI5E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,QAAQ,EAAE,MAAM,GAAE,YAA2B,GAAG,MAAM,CAIxG;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,mBAAmB,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAU9I;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,cAAc,GAAG,MAAM,CAMhJ"}

package/dist/identity/identifiers.js

@@ -0,0 +1,37 @@
+import { sha256, requireLength, systemRandom } from '../crypto/primitives.js';
+import { ProtocolError } from '../errors.js';
+import { NetworkContext, signingInput } from '../protocol/context.js';
+import { decodeBase64Url, encodeBase64Url } from '../protocol/encoding.js';
+import { validateAccountId, validateRelayId } from './neo.js';
+const prefixes = { device: 'dev_', message: 'msg_', channel: 'chan_', group: 'grp_', invite: 'inv_' };
+/** Checks canonical representation only, not existence or authorization. */
+export function validateIdentifier(kind, value) {
+    const prefix = prefixes[kind];
+    if (!value.startsWith(prefix))
+        throw new ProtocolError('invalid_identifier', `Expected ${prefix} identifier.`);
+    decodeBase64Url(value.slice(prefix.length), 16);
+}
+export function createIdentifier(kind, random = systemRandom) {
+    const bytes = random.bytes(16);
+    requireLength(bytes, 16, 'Identifier randomness');
+    return prefixes[kind] + encodeBase64Url(bytes);
+}
+export function deriveDeviceId(account, signingPublicKey, encryptionPublicKey, context) {
+    validateAccountId(account);
+    requireLength(signingPublicKey, 32, 'Signing public key');
+    requireLength(encryptionPublicKey, 32, 'Encryption public key');
+    const input = signingInput({
+        $type: 'meshline.device.identity', account,
+        signing_public_key: encodeBase64Url(signingPublicKey),
+        encryption_public_key: encodeBase64Url(encryptionPublicKey),
+    }, context);
+    return 'dev_' + encodeBase64Url(sha256(input).subarray(0, 16));
+}
+export function deriveResourceId(kind, creator, relayId, nonce, context) {
+    validateAccountId(creator);
+    validateRelayId(relayId);
+    requireLength(nonce, 16, 'Resource nonce');
+    const input = signingInput({ $type: `meshline.${kind}.identity`, creator, relay_id: relayId, nonce: encodeBase64Url(nonce) }, context);
+    return prefixes[kind] + encodeBase64Url(sha256(input).subarray(0, 16));
+}
+//# sourceMappingURL=identifiers.js.map

package/dist/identity/identifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identifiers.js","sourceRoot":"","sources":["../../src/identity/identifiers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAqB,MAAM,yBAAyB,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG9D,MAAM,QAAQ,GAAmC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAEtI,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAAC,IAAoB,EAAE,KAAa;IAClE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,YAAY,MAAM,cAAc,CAAC,CAAC;IAC/G,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAA0B,EAAE,MAAM,GAAiB,YAAY;IAC5F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,gBAA4B,EAAE,mBAA+B,EAAE,OAAuB;IAClI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,aAAa,CAAC,gBAAgB,EAAE,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC1D,aAAa,CAAC,mBAAmB,EAAE,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,YAAY,CAAC;QACvB,KAAK,EAAE,0BAA0B,EAAE,OAAO;QAC1C,kBAAkB,EAAE,eAAe,CAAC,gBAAgB,CAAC;QACrD,qBAAqB,EAAE,eAAe,CAAC,mBAAmB,CAAC;KAC9D,EAAE,OAAO,CAAC,CAAC;IACZ,OAAO,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAyB,EAAE,OAAe,EAAE,OAAe,EAAE,KAAiB,EAAE,OAAuB;IACpI,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,YAAY,IAAI,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACvI,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/identity/neo.d.ts

@@ -0,0 +1,11 @@
+/** Derives a canonical CAIP-10 Neo N3 account identifier. */
+export declare function getAccountId(chainId: string, publicKey: Uint8Array): string;
+/** Checks account format and address checksum without normalizing the input. */
+export declare function validateAccountId(accountId: string): void;
+/** Verifies that the public key identifies the account, including its chain reference. */
+export declare function matchesAccount(accountId: string, publicKey: Uint8Array): boolean;
+/** Derives a lowercase display-order Neo script hash for a relay. */
+export declare function getRelayId(publicKey: Uint8Array): string;
+export declare function validateRelayId(relayId: string): void;
+export declare function verifyRelay(relayId: string, publicKey: Uint8Array, input: Uint8Array, signature: Uint8Array): boolean;
+//# sourceMappingURL=neo.d.ts.map

package/dist/identity/neo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"neo.d.ts","sourceRoot":"","sources":["../../src/identity/neo.ts"],"names":[],"mappings":"AAsBA,6DAA6D;AAC7D,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,MAAM,CAS3E;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAezD;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAGhF;AAED,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,SAAS,EAAE,UAAU,GAAG,MAAM,CAExD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAGrD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAGrH"}

package/dist/identity/neo.js

@@ -0,0 +1,77 @@
+import { p256 } from '@noble/curves/nist.js';
+import { hash160, sha256, verifyAccount } from '../crypto/primitives.js';
+import { concatBytes, equalBytes } from '../protocol/encoding.js';
+import { ProtocolError } from '../errors.js';
+const base58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+function scriptHash(publicKey) {
+    if (publicKey.length !== 33 || (publicKey[0] !== 2 && publicKey[0] !== 3))
+        throw new ProtocolError('invalid_key', 'Expected a compressed P-256 key.');
+    try {
+        p256.Point.fromBytes(publicKey).assertValidity();
+    }
+    catch (cause) {
+        throw new ProtocolError('invalid_key', 'The account key is not a valid P-256 point.', { cause });
+    }
+    return hash160(concatBytes(new Uint8Array([0x0c, 0x21]), publicKey, new Uint8Array([0x41, 0x56, 0xe7, 0xb3, 0x27])));
+}
+function chainReference(chainId) {
+    const match = /^neo:(0|[1-9][0-9]{0,9})$/.exec(chainId);
+    if (!match || match[0] !== chainId || Number(match[1]) > 0xffff_ffff)
+        throw new ProtocolError('invalid_account', 'Expected a canonical Neo chain identifier.');
+    return Number(match[1]);
+}
+/** Derives a canonical CAIP-10 Neo N3 account identifier. */
+export function getAccountId(chainId, publicKey) {
+    chainReference(chainId);
+    const payload = concatBytes(new Uint8Array([0x35]), scriptHash(publicKey));
+    const encoded = concatBytes(payload, sha256(sha256(payload)).subarray(0, 4));
+    let integer = 0n;
+    for (const byte of encoded)
+        integer = (integer << 8n) | BigInt(byte);
+    let address = '';
+    while (integer > 0n) {
+        address = base58[Number(integer % 58n)] + address;
+        integer /= 58n;
+    }
+    return `${chainId}:${address}`;
+}
+/** Checks account format and address checksum without normalizing the input. */
+export function validateAccountId(accountId) {
+    const split = accountId.lastIndexOf(':');
+    chainReference(accountId.slice(0, split));
+    const address = accountId.slice(split + 1);
+    if (address.length !== 34)
+        throw new ProtocolError('invalid_account', 'A Neo N3 address contains 34 characters.');
+    let integer = 0n;
+    for (const character of address) {
+        const digit = base58.indexOf(character);
+        if (digit < 0)
+            throw new ProtocolError('invalid_account', 'Invalid Base58 address character.');
+        integer = integer * 58n + BigInt(digit);
+    }
+    const payload = new Uint8Array(25);
+    for (let index = 24; index >= 0; index--) {
+        payload[index] = Number(integer & 255n);
+        integer >>= 8n;
+    }
+    if (integer !== 0n || payload[0] !== 0x35 || !equalBytes(payload.subarray(21), sha256(sha256(payload.subarray(0, 21))).subarray(0, 4)))
+        throw new ProtocolError('invalid_account', 'Invalid Neo address version, length, or checksum.');
+}
+/** Verifies that the public key identifies the account, including its chain reference. */
+export function matchesAccount(accountId, publicKey) {
+    validateAccountId(accountId);
+    return getAccountId(accountId.slice(0, accountId.lastIndexOf(':')), publicKey) === accountId;
+}
+/** Derives a lowercase display-order Neo script hash for a relay. */
+export function getRelayId(publicKey) {
+    return '0x' + Array.from(scriptHash(publicKey).reverse(), byte => byte.toString(16).padStart(2, '0')).join('');
+}
+export function validateRelayId(relayId) {
+    if (!/^0x[0-9a-f]{40}$/.test(relayId) || relayId.length !== 42)
+        throw new ProtocolError('invalid_relay', 'Expected a canonical lowercase Neo script hash.');
+}
+export function verifyRelay(relayId, publicKey, input, signature) {
+    validateRelayId(relayId);
+    return verifyAccount(input, signature, publicKey) && getRelayId(publicKey) === relayId;
+}
+//# sourceMappingURL=neo.js.map

package/dist/identity/neo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"neo.js","sourceRoot":"","sources":["../../src/identity/neo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,MAAM,GAAG,4DAA4D,CAAC;AAE5E,SAAS,UAAU,CAAC,SAAqB;IACrC,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,kCAAkC,CAAC,CAAC;IAC/E,IAAI,CAAC;QAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC;IAAC,CAAC;IACzD,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,aAAa,CAAC,aAAa,EAAE,6CAA6C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;IACnH,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACzH,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW;QAChE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,SAAqB;IAC/D,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,OAAO,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,OAAO,OAAO,GAAG,EAAE,EAAE,CAAC;QAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,CAAE,GAAG,OAAO,CAAC;QAAC,OAAO,IAAI,GAAG,CAAC;IAAC,CAAC;IAC5F,OAAO,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACzC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,0CAA0C,CAAC,CAAC;IAClH,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,mCAAmC,CAAC,CAAC;QAC/F,OAAO,GAAG,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACnC,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;IAAC,CAAC;IACtG,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAClI,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAAC;AACxG,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,SAAqB;IACnE,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC7B,OAAO,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,SAAS,CAAC;AACjG,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,UAAU,CAAC,SAAqB;IAC5C,OAAO,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAe;IAC3C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;QAC1D,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,iDAAiD,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,SAAqB,EAAE,KAAiB,EAAE,SAAqB;IACxG,eAAe,CAAC,OAAO,CAAC,CAAC;IACzB,OAAO,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC;AAC3F,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,53 @@
+export * from './errors.js';
+export * from './protocol/encoding.js';
+export * from './protocol/json.js';
+export * from './protocol/context.js';
+export * from './crypto/primitives.js';
+export * from './identity/neo.js';
+export * from './identity/identifiers.js';
+export type { ExtensibleModel, ProtocolCodec } from './protocol/codec.js';
+export * from './models/identity.js';
+export * from './storage/store.js';
+export * from './runtime/async-gate.js';
+export * from './runtime/clock.js';
+export * from './models/authentication.js';
+export * from './transport/endpoint.js';
+export * from './transport/relay-error.js';
+export * from './transport/http.js';
+export * from './interactions.js';
+export * from './transport/session.js';
+export * from './transport/rpc.js';
+export * from './transport/socket.js';
+export * from './models/relay.js';
+export * from './transport/discovery.js';
+export * from './runtime/events.js';
+export * from './transport/client.js';
+export type { RelaySubscription, RelaySubscriptionOptions, SubscriptionMethod } from './transport/subscription.js';
+export * from './transport/pool.js';
+export * from './components/component.js';
+export * from './components/account.js';
+export * from './models/content.js';
+export * from './models/profile.js';
+export * from './components/profile.js';
+export * from './models/device-state.js';
+export * from './components/device.js';
+export * from './models/contacts.js';
+export * from './protocol/validation.js';
+export * from './models/messages.js';
+export * from './models/channels.js';
+export * from './crypto/messages.js';
+export * from './models/groups.js';
+export * from './models/group-management.js';
+export * from './models/group-keys.js';
+export * from './models/group-admission.js';
+export * from './crypto/groups.js';
+export * from './components/message.js';
+export * from './components/channel.js';
+export type { ChannelInfo, ChannelPostInfo, ChannelPostChange } from './channels/repository.js';
+export type { MessageKey, MessageInfo, AccountMessage } from './messages/repository.js';
+export type { MessageSendState, MessageSendStatus } from './messages/outbox.js';
+export type { ContactInfo, ContactGrantState, ContactRequestInfo, ContactRequestDirection, ContactChange, ContactChangeKind, ContactRequestChange, ContactRequestChangeKind } from './messages/contacts.js';
+export * from './components/group.js';
+export type { GroupMessageInfo } from './groups/messages.js';
+export * from './client.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC1E,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACnH,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAChG,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACxF,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAChF,YAAY,EAAE,WAAW,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,aAAa,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAC5M,cAAc,uBAAuB,CAAC;AACtC,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,46 @@
+export * from './errors.js';
+export * from './protocol/encoding.js';
+export * from './protocol/json.js';
+export * from './protocol/context.js';
+export * from './crypto/primitives.js';
+export * from './identity/neo.js';
+export * from './identity/identifiers.js';
+export * from './models/identity.js';
+export * from './storage/store.js';
+export * from './runtime/async-gate.js';
+export * from './runtime/clock.js';
+export * from './models/authentication.js';
+export * from './transport/endpoint.js';
+export * from './transport/relay-error.js';
+export * from './transport/http.js';
+export * from './interactions.js';
+export * from './transport/session.js';
+export * from './transport/rpc.js';
+export * from './transport/socket.js';
+export * from './models/relay.js';
+export * from './transport/discovery.js';
+export * from './runtime/events.js';
+export * from './transport/client.js';
+export * from './transport/pool.js';
+export * from './components/component.js';
+export * from './components/account.js';
+export * from './models/content.js';
+export * from './models/profile.js';
+export * from './components/profile.js';
+export * from './models/device-state.js';
+export * from './components/device.js';
+export * from './models/contacts.js';
+export * from './protocol/validation.js';
+export * from './models/messages.js';
+export * from './models/channels.js';
+export * from './crypto/messages.js';
+export * from './models/groups.js';
+export * from './models/group-management.js';
+export * from './models/group-keys.js';
+export * from './models/group-admission.js';
+export * from './crypto/groups.js';
+export * from './components/message.js';
+export * from './components/channel.js';
+export * from './components/group.js';
+export * from './client.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAE1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,oBAAoB,CAAC;AACnC,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AAEtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,yBAAyB,CAAC;AACxC,cAAc,qBAAqB,CAAC;AACpC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,oBAAoB,CAAC;AACnC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AAKxC,cAAc,uBAAuB,CAAC;AAEtC,cAAc,aAAa,CAAC"}

package/dist/interactions.d.ts

@@ -0,0 +1,31 @@
+import type { DeviceCertificate } from './models/identity.js';
+import type { NetworkContext } from './protocol/context.js';
+/** The application retains its account private key and signs the exact input using Neo P-256/SHA-256. */
+export interface AccountSigner {
+    readonly accountId: string;
+    readonly publicKey: Uint8Array;
+    sign(input: Uint8Array, signal?: AbortSignal): Promise<Uint8Array>;
+}
+/** Device signatures are Ed25519 over the exact supplied bytes. */
+export interface DeviceSigner {
+    readonly certificate: DeviceCertificate;
+    sign(input: Uint8Array, signal?: AbortSignal): Promise<Uint8Array>;
+}
+export interface RelayEntry {
+    readonly relayId: string;
+    readonly endpoint: string;
+    readonly status: 'active' | 'disabled' | 'suspended';
+    /** Registry UInt64 timestamp, in Unix milliseconds; this is not a protocol JSON number. */
+    readonly updatedAt: bigint;
+}
+export interface RelayRegistry {
+    readonly context: NetworkContext;
+    getRelay(relayId: string, signal?: AbortSignal): Promise<RelayEntry | undefined>;
+    getRelays(signal?: AbortSignal): AsyncIterable<RelayEntry>;
+}
+/** Use OS-backed protection in the application adapter; never persist unprotected device secrets. */
+export interface SecretProtector {
+    protect(plaintext: Uint8Array, purpose: string, signal?: AbortSignal): Promise<Uint8Array>;
+    unprotect(protectedData: Uint8Array, purpose: string, signal?: AbortSignal): Promise<Uint8Array>;
+}
+//# sourceMappingURL=interactions.d.ts.map

package/dist/interactions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactions.d.ts","sourceRoot":"","sources":["../src/interactions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,yGAAyG;AACzG,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACtE;AAED,mEAAmE;AACnE,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAC;IACrD,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACjF,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;CAC9D;AAED,qGAAqG;AACrG,MAAM,WAAW,eAAe;IAC5B,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3F,SAAS,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACpG"}

package/dist/interactions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=interactions.js.map

package/dist/interactions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactions.js","sourceRoot":"","sources":["../src/interactions.ts"],"names":[],"mappings":""}

package/dist/messages/account-sender.d.ts

@@ -0,0 +1,9 @@
+import type { MessageManager } from '../components/message.js';
+import type { JsonObject } from '../protocol/json.js';
+import type { MessageEffects } from './repository.js';
+type AccountSender = (payload: JsonObject, devices: readonly string[] | undefined, signal?: AbortSignal, effects?: MessageEffects) => Promise<void>;
+/** Internal capability: managers can enqueue only recognized self-account group payloads. */
+export declare function registerAccountSender(manager: MessageManager, sender: AccountSender): void;
+export declare function sendGroupAccountPayload(manager: MessageManager, source: JsonObject, devices?: readonly string[], signal?: AbortSignal, effects?: MessageEffects): Promise<void>;
+export {};
+//# sourceMappingURL=account-sender.d.ts.map

package/dist/messages/account-sender.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-sender.d.ts","sourceRoot":"","sources":["../../src/messages/account-sender.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAI/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,KAAK,aAAa,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAGpJ,6FAA6F;AAC7F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAAkC;AAC7H,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAoB/K"}

package/dist/messages/account-sender.js

@@ -0,0 +1,46 @@
+import { ProtocolError } from '../errors.js';
+import { accountGroupHistorySecretSyncCodec, accountGroupPrivateStateRequestCodec, accountGroupPrivateStateSyncCodec, validateAccountGroupHistorySecretSync, validateAccountGroupPrivateStateRequest, validateAccountGroupPrivateStateSync } from '../models/groups.js';
+const senders = new WeakMap();
+/** Internal capability: managers can enqueue only recognized self-account group payloads. */
+export function registerAccountSender(manager, sender) { senders.set(manager, sender); }
+export function sendGroupAccountPayload(manager, source, devices, signal, effects) {
+    const sender = senders.get(manager);
+    if (!sender)
+        throw new ProtocolError('not_initialized', 'Message manager has no account sender.');
+    let payload;
+    switch (source['$type']) {
+        case 'meshline.account.group.state.request': {
+            const value = accountGroupPrivateStateRequestCodec.decode(source);
+            validateAccountGroupPrivateStateRequest(value);
+            payload = accountGroupPrivateStateRequestCodec.encode(value);
+            break;
+        }
+        case 'meshline.account.group.state.sync': {
+            const value = accountGroupPrivateStateSyncCodec.decode(source);
+            try {
+                validateAccountGroupPrivateStateSync(value);
+                payload = accountGroupPrivateStateSyncCodec.encode(value);
+            }
+            finally {
+                for (const item of value.states)
+                    item.memberEncryptionPrivateKey.fill(0);
+            }
+            break;
+        }
+        case 'meshline.account.group.history_secret.sync': {
+            const value = accountGroupHistorySecretSyncCodec.decode(source);
+            try {
+                validateAccountGroupHistorySecretSync(value);
+                payload = accountGroupHistorySecretSyncCodec.encode(value);
+            }
+            finally {
+                for (const item of value.secrets)
+                    item.applicationSecret.fill(0);
+            }
+            break;
+        }
+        default: throw new ProtocolError('invalid_payload', 'Unsupported group account payload.');
+    }
+    return sender(payload, devices && [...devices], signal, effects);
+}
+//# sourceMappingURL=account-sender.js.map

package/dist/messages/account-sender.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-sender.js","sourceRoot":"","sources":["../../src/messages/account-sender.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,kCAAkC,EAAE,oCAAoC,EAAE,iCAAiC,EAChH,qCAAqC,EAAE,uCAAuC,EAAE,oCAAoC,EAAE,MAAM,qBAAqB,CAAC;AAKtJ,MAAM,OAAO,GAAG,IAAI,OAAO,EAAiC,CAAC;AAE7D,6FAA6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,OAAuB,EAAE,MAAqB,IAAU,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAC7H,MAAM,UAAU,uBAAuB,CAAC,OAAuB,EAAE,MAAkB,EAAE,OAA2B,EAAE,MAAoB,EAAE,OAAwB;IAC5J,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;IACvI,IAAI,OAAmB,CAAC;IACxB,QAAQ,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,KAAK,sCAAsC,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,oCAAoC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAC,uCAAuC,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,GAAG,oCAAoC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM;QAC3L,CAAC;QACD,KAAK,mCAAmC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,iCAAiC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/D,IAAI,CAAC;gBAAC,oCAAoC,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,GAAG,iCAAiC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;oBACvG,CAAC;gBAAC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM;oBAAE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM;QAChG,CAAC;QACD,KAAK,4CAA4C,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,kCAAkC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,CAAC;gBAAC,qCAAqC,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,GAAG,kCAAkC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;oBACzG,CAAC;gBAAC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;oBAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM;QACxF,CAAC;QACD,SAAS,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC"}