@meshline/sdk 0.0.0-stage → 0.1.0-alpha.1

package/src/groups/state.ts

@@ -0,0 +1,138 @@
+import { groupManagementHash } from '../crypto/groups.js';
+import { ProtocolError } from '../errors.js';
+import { deriveResourceId } from '../identity/identifiers.js';
+import { groupEventCodec, groupManagementPayloadCodec, validateGroupEvent, verifyGroupManagementPayload,
+    type GroupEvent, type GroupManagementPayload, type GroupMember, type GroupState } from '../models/group-management.js';
+import { groupMessageEnvelopeCodec, validateGroupRef, verifyGroupMessageEnvelope, type GroupMemberKey, type GroupMessageEnvelope, type GroupRef } from '../models/groups.js';
+import { certificateId, validateCertificate, type DeviceCertificate } from '../models/identity.js';
+import type { NetworkContext } from '../protocol/context.js';
+import { equalBytes } from '../protocol/encoding.js';
+import { requireObject } from '../protocol/json.js';
+
+export interface GroupProjectedMember extends GroupMember { readonly joinedAtSequence: number; readonly nickname?: string; readonly nicknameSequence?: number }
+export type GroupDeparture = 'left' | 'removed' | 'banned' | 'not_member';
+/** Local verified state. Relay previews must never be deserialized into this type. */
+export interface GroupProjection extends GroupRef {
+    readonly sequence: number; readonly epoch: number; readonly managementHash: string; readonly clientSecretCommitment: string;
+    readonly state: GroupState; readonly members: readonly GroupProjectedMember[]; readonly bans: readonly string[]; readonly departures: Readonly<Record<string, GroupDeparture>>;
+}
+export interface VerifiedGroupMessage { readonly envelope: GroupMessageEnvelope; readonly sender: DeviceCertificate; readonly signerDeviceId: string; readonly joinedAtSequence: number }
+export type GroupChangeKind = 'properties' | 'members' | 'roles' | 'bans' | 'nickname' | 'status';
+export const groupChangeKinds: readonly GroupChangeKind[] = ['properties', 'members', 'roles', 'bans', 'nickname', 'status'];
+const managementChanges: Readonly<Record<GroupManagementPayload['kind'], readonly GroupChangeKind[]>> = {
+    create: ['properties', 'members', 'roles', 'status'], update: ['properties'], applicationApproval: ['members'], roleUpdate: ['roles'], ownerTransfer: ['roles'],
+    memberLeave: ['members'], memberRemoval: ['members'], memberBan: ['members', 'bans'], memberUnban: ['bans'], memberRecoveryApproval: ['members'], secretRotation: ['members'], close: ['status'],
+};
+export interface GroupEventResult { readonly projection: GroupProjection; readonly message?: VerifiedGroupMessage; readonly rejection?: ProtocolError; readonly changeKinds?: readonly GroupChangeKind[] }
+
+/** Applies one timeline event without mutating the preceding projection. Invalid administration stops the chain; invalid ordinary messages retain an explicit rejection. */
+export function applyGroupEvent(previous: GroupProjection | undefined, source: GroupEvent, certificate: DeviceCertificate | undefined, group: GroupRef, context: NetworkContext): GroupEventResult {
+    validateGroupRef(group); const entry = groupEventCodec.decode(groupEventCodec.encode(source)); validateGroupEvent(entry);
+    if (previous && (previous.groupId !== group.groupId || previous.relayId !== group.relayId)) throw new ProtocolError('invalid_binding', 'Verified group state belongs to another group or relay.');
+    if (entry.sequence <= (previous?.sequence ?? -1)) throw new ProtocolError('invalid_sequence', 'A group event must advance the verified sequence.');
+    if (previous?.state.status === 'closed') throw new ProtocolError('group_closed', 'A closed group cannot append events.');
+    if (entry.signerDeviceId !== undefined) {
+        if (!certificate) throw new ProtocolError('missing_certificate', 'Group event signing certificate is missing.');
+        validateCertificate(certificate, context); if (certificateId(certificate, context) !== entry.signerDeviceId) throw new ProtocolError('invalid_identity', 'Group event signing certificate belongs to another device.');
+    }
+    if (entry.payload.$type === 'meshline.group.key.rotated') {
+        if (!previous || certificate !== undefined || entry.epoch <= previous.epoch) throw new ProtocolError('invalid_epoch', 'Relay key rotation requires an established group and a newer epoch.');
+        return { projection: { ...previous, sequence: entry.sequence, epoch: entry.epoch } };
+    }
+    if (entry.payload.$type === 'meshline.group.message') {
+        if (!previous || entry.epoch !== previous.epoch) throw new ProtocolError('invalid_epoch', 'Group message must use the verified current epoch.');
+        const projection = { ...previous, sequence: entry.sequence };
+        try {
+            const member = previous.members.find(value => value.account === certificate!.account);
+            if (!member || previous.bans.includes(certificate!.account)) throw new ProtocolError('unauthorized_member', 'Group message sender is not a current unbanned member.');
+            const envelope = groupMessageEnvelopeCodec.decode(entry.payload);
+            if (envelope.groupId !== group.groupId || envelope.epoch !== entry.epoch) throw new ProtocolError('invalid_binding', 'Group envelope and event have inconsistent group or epoch bindings.');
+            verifyGroupMessageEnvelope(envelope, certificate!, entry.signerDeviceId!, context);
+            return { projection, message: { envelope, sender: certificate!, signerDeviceId: entry.signerDeviceId!, joinedAtSequence: member.joinedAtSequence } };
+        } catch (error) {
+            if (!(error instanceof ProtocolError)) throw error;
+            return { projection, rejection: error };
+        }
+    }
+    const payload = groupManagementPayloadCodec.decode(entry.payload); verifyGroupManagementPayload(payload, certificate!, context);
+    const actor = certificate!.account;
+    if (payload.kind === 'create') {
+        const value = payload.value;
+        if (previous || entry.sequence !== 0 || entry.epoch !== 0 || value.owner.account !== actor || value.groupId !== group.groupId
+            || deriveResourceId('group', actor, group.relayId, value.nonce, context) !== group.groupId) throw new ProtocolError('invalid_creation', 'Group creation does not establish the expected owner, group and hosting relay.');
+        return { changeKinds: managementChanges.create, projection: { ...group, sequence: 0, epoch: 0, managementHash: groupManagementHash(requireObject(groupManagementPayloadCodec.encode(payload)), context), clientSecretCommitment: value.clientSecretCommitment,
+            state: { groupId: group.groupId, name: value.name, ...(value.description === undefined ? {} : { description: value.description }), status: 'active', owner: actor, memberCapacity: value.memberCapacity, memberCount: 1, invitePolicy: value.invitePolicy },
+            members: [{ account: actor, role: 'owner', memberEncryptionPublicKey: value.owner.memberEncryptionPublicKey.slice(), joinedAtSequence: 0 }], bans: [], departures: {} } };
+    }
+    if (!previous || payload.value.groupId !== group.groupId || payload.value.prevHash !== previous.managementHash) throw new ProtocolError('invalid_management_chain', 'Group management predecessor does not match the verified head.');
+    const members = new Map<string, GroupProjectedMember>(previous.members.map(value => [value.account, { ...value, memberEncryptionPublicKey: value.memberEncryptionPublicKey.slice() }]));
+    const bans = new Set(previous.bans); const departures = { ...previous.departures };
+    const author = members.get(actor); if (!author || bans.has(actor)) throw new ProtocolError('unauthorized_member', 'Group administrator is not a current unbanned member.');
+    const owner = author.role === 'owner'; const administrator = owner || author.role === 'administrator';
+    let state = { ...previous.state }; let commitment = previous.clientSecretCommitment; let advances = false;
+    const member = (account: string): GroupProjectedMember => { const value = members.get(account); if (!value) throw new ProtocolError('missing_member', 'Group management target is not a current member.'); return value; };
+    const authorize = (allowed: boolean): void => { if (!allowed) throw new ProtocolError('unauthorized_role', 'Group actor is not authorized for this operation.'); };
+    const add = (value: GroupMemberKey): void => { members.set(value.account, { account: value.account, role: 'member', memberEncryptionPublicKey: value.memberEncryptionPublicKey.slice(), joinedAtSequence: entry.sequence }); delete departures[value.account]; };
+    const remove = (account: string, departure: GroupDeparture): void => { members.delete(account); departures[account] = departure; };
+    switch (payload.kind) {
+        case 'update': {
+            authorize(owner); const value = payload.value;
+            if (value.name !== undefined) state = { ...state, name: value.name };
+            if (value.description === null) delete state.description; else if (value.description !== undefined) state = { ...state, description: value.description };
+            if (value.memberCapacity !== undefined) state = { ...state, memberCapacity: value.memberCapacity };
+            if (value.invitePolicy !== undefined) state = { ...state, invitePolicy: value.invitePolicy };
+            break;
+        }
+        case 'applicationApproval':
+            authorize(administrator);
+            if (members.size + payload.value.members.length > state.memberCapacity) throw new ProtocolError('group_capacity', 'Group admission exceeds the current capacity.');
+            for (const value of payload.value.members) { if (members.has(value.account) || bans.has(value.account)) throw new ProtocolError('invalid_admission', 'An existing or banned account cannot be admitted.'); add(value); }
+            advances = true; break;
+        case 'roleUpdate': {
+            authorize(owner); const target = member(payload.value.account); authorize(target.role !== 'owner'); members.set(target.account, { ...target, role: payload.value.role }); break;
+        }
+        case 'ownerTransfer': {
+            authorize(owner); const target = member(payload.value.newOwnerAccount); authorize(target.account !== actor && !bans.has(target.account));
+            members.set(actor, { ...author, role: 'member' }); members.set(target.account, { ...target, role: 'owner' }); state = { ...state, owner: target.account }; break;
+        }
+        case 'memberLeave': authorize(!owner && payload.value.account === actor); remove(actor, 'left'); advances = true; break;
+        case 'memberRemoval':
+            authorize(administrator);
+            for (const account of payload.value.accounts) { const target = member(account); authorize(account !== actor && target.role !== 'owner' && (owner || target.role === 'member')); remove(account, 'removed'); }
+            advances = true; break;
+        case 'memberBan':
+            authorize(administrator);
+            for (const account of payload.value.accounts) {
+                const target = members.get(account); authorize(account !== actor && (!target || target.role !== 'owner' && (owner || target.role === 'member')));
+                if (target) { remove(account, 'banned'); advances = true; } else departures[account] = 'banned';
+                bans.add(account);
+            }
+            break;
+        case 'memberUnban':
+            authorize(administrator);
+            for (const account of payload.value.accounts) { bans.delete(account); if (departures[account] === 'banned') departures[account] = 'not_member'; }
+            break;
+        case 'memberRecoveryApproval':
+            authorize(administrator);
+            for (const value of payload.value.members) {
+                const target = member(value.account); authorize(owner || target.role === 'member' && target.account !== actor);
+                if (equalBytes(target.memberEncryptionPublicKey, value.memberEncryptionPublicKey)) throw new ProtocolError('unchanged_key', 'Recovered member public key must change.');
+                members.set(target.account, { ...target, memberEncryptionPublicKey: value.memberEncryptionPublicKey.slice() });
+            }
+            advances = true; break;
+        case 'secretRotation':
+            authorize(owner);
+            if (payload.value.clientSecretCommitment === commitment) throw new ProtocolError('unchanged_secret', 'Client secret rotation must change its commitment.');
+            commitment = payload.value.clientSecretCommitment;
+            if (payload.value.ownerEncryptionPublicKey) {
+                if (equalBytes(author.memberEncryptionPublicKey, payload.value.ownerEncryptionPublicKey)) throw new ProtocolError('unchanged_key', 'Specified owner public key must change.');
+                members.set(actor, { ...author, memberEncryptionPublicKey: payload.value.ownerEncryptionPublicKey.slice() });
+            }
+            advances = true; break;
+        case 'close': authorize(owner); state = { ...state, status: 'closed' }; break;
+    }
+    if (advances ? entry.epoch <= previous.epoch : entry.epoch !== previous.epoch) throw new ProtocolError('invalid_epoch', 'Group management event has an invalid epoch transition.');
+    state = { ...state, memberCount: members.size };
+    return { changeKinds: managementChanges[payload.kind], projection: { ...group, sequence: entry.sequence, epoch: entry.epoch, state, members: [...members.values()], bans: [...bans], departures,
+        clientSecretCommitment: commitment, managementHash: groupManagementHash(requireObject(groupManagementPayloadCodec.encode(payload)), context) } };
+}

package/src/identity/identifiers.ts

@@ -0,0 +1,41 @@
+import { sha256, requireLength, systemRandom, type RandomSource } from '../crypto/primitives.js';
+import { ProtocolError } from '../errors.js';
+import { NetworkContext, signingInput } from '../protocol/context.js';
+import { decodeBase64Url, encodeBase64Url } from '../protocol/encoding.js';
+import { validateAccountId, validateRelayId } from './neo.js';
+
+export type IdentifierKind = 'device' | 'message' | 'channel' | 'group' | 'invite';
+const prefixes: Record<IdentifierKind, string> = { device: 'dev_', message: 'msg_', channel: 'chan_', group: 'grp_', invite: 'inv_' };
+
+/** Checks canonical representation only, not existence or authorization. */
+export function validateIdentifier(kind: IdentifierKind, value: string): void {
+    const prefix = prefixes[kind];
+    if (!value.startsWith(prefix)) throw new ProtocolError('invalid_identifier', `Expected ${prefix} identifier.`);
+    decodeBase64Url(value.slice(prefix.length), 16);
+}
+
+export function createIdentifier(kind: 'message' | 'invite', random: RandomSource = systemRandom): string {
+    const bytes = random.bytes(16);
+    requireLength(bytes, 16, 'Identifier randomness');
+    return prefixes[kind] + encodeBase64Url(bytes);
+}
+
+export function deriveDeviceId(account: string, signingPublicKey: Uint8Array, encryptionPublicKey: Uint8Array, context: NetworkContext): string {
+    validateAccountId(account);
+    requireLength(signingPublicKey, 32, 'Signing public key');
+    requireLength(encryptionPublicKey, 32, 'Encryption public key');
+    const input = signingInput({
+        $type: 'meshline.device.identity', account,
+        signing_public_key: encodeBase64Url(signingPublicKey),
+        encryption_public_key: encodeBase64Url(encryptionPublicKey),
+    }, context);
+    return 'dev_' + encodeBase64Url(sha256(input).subarray(0, 16));
+}
+
+export function deriveResourceId(kind: 'channel' | 'group', creator: string, relayId: string, nonce: Uint8Array, context: NetworkContext): string {
+    validateAccountId(creator);
+    validateRelayId(relayId);
+    requireLength(nonce, 16, 'Resource nonce');
+    const input = signingInput({ $type: `meshline.${kind}.identity`, creator, relay_id: relayId, nonce: encodeBase64Url(nonce) }, context);
+    return prefixes[kind] + encodeBase64Url(sha256(input).subarray(0, 16));
+}

package/src/identity/neo.ts

@@ -0,0 +1,72 @@
+import { p256 } from '@noble/curves/nist.js';
+import { hash160, sha256, verifyAccount } from '../crypto/primitives.js';
+import { concatBytes, equalBytes } from '../protocol/encoding.js';
+import { ProtocolError } from '../errors.js';
+
+const base58 = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+
+function scriptHash(publicKey: Uint8Array): Uint8Array {
+    if (publicKey.length !== 33 || (publicKey[0] !== 2 && publicKey[0] !== 3))
+        throw new ProtocolError('invalid_key', 'Expected a compressed P-256 key.');
+    try { p256.Point.fromBytes(publicKey).assertValidity(); }
+    catch (cause) { throw new ProtocolError('invalid_key', 'The account key is not a valid P-256 point.', { cause }); }
+    return hash160(concatBytes(new Uint8Array([0x0c, 0x21]), publicKey, new Uint8Array([0x41, 0x56, 0xe7, 0xb3, 0x27])));
+}
+
+function chainReference(chainId: string): number {
+    const match = /^neo:(0|[1-9][0-9]{0,9})$/.exec(chainId);
+    if (!match || match[0] !== chainId || Number(match[1]) > 0xffff_ffff)
+        throw new ProtocolError('invalid_account', 'Expected a canonical Neo chain identifier.');
+    return Number(match[1]);
+}
+
+/** Derives a canonical CAIP-10 Neo N3 account identifier. */
+export function getAccountId(chainId: string, publicKey: Uint8Array): string {
+    chainReference(chainId);
+    const payload = concatBytes(new Uint8Array([0x35]), scriptHash(publicKey));
+    const encoded = concatBytes(payload, sha256(sha256(payload)).subarray(0, 4));
+    let integer = 0n;
+    for (const byte of encoded) integer = (integer << 8n) | BigInt(byte);
+    let address = '';
+    while (integer > 0n) { address = base58[Number(integer % 58n)]! + address; integer /= 58n; }
+    return `${chainId}:${address}`;
+}
+
+/** Checks account format and address checksum without normalizing the input. */
+export function validateAccountId(accountId: string): void {
+    const split = accountId.lastIndexOf(':');
+    chainReference(accountId.slice(0, split));
+    const address = accountId.slice(split + 1);
+    if (address.length !== 34) throw new ProtocolError('invalid_account', 'A Neo N3 address contains 34 characters.');
+    let integer = 0n;
+    for (const character of address) {
+        const digit = base58.indexOf(character);
+        if (digit < 0) throw new ProtocolError('invalid_account', 'Invalid Base58 address character.');
+        integer = integer * 58n + BigInt(digit);
+    }
+    const payload = new Uint8Array(25);
+    for (let index = 24; index >= 0; index--) { payload[index] = Number(integer & 255n); integer >>= 8n; }
+    if (integer !== 0n || payload[0] !== 0x35 || !equalBytes(payload.subarray(21), sha256(sha256(payload.subarray(0, 21))).subarray(0, 4)))
+        throw new ProtocolError('invalid_account', 'Invalid Neo address version, length, or checksum.');
+}
+
+/** Verifies that the public key identifies the account, including its chain reference. */
+export function matchesAccount(accountId: string, publicKey: Uint8Array): boolean {
+    validateAccountId(accountId);
+    return getAccountId(accountId.slice(0, accountId.lastIndexOf(':')), publicKey) === accountId;
+}
+
+/** Derives a lowercase display-order Neo script hash for a relay. */
+export function getRelayId(publicKey: Uint8Array): string {
+    return '0x' + Array.from(scriptHash(publicKey).reverse(), byte => byte.toString(16).padStart(2, '0')).join('');
+}
+
+export function validateRelayId(relayId: string): void {
+    if (!/^0x[0-9a-f]{40}$/.test(relayId) || relayId.length !== 42)
+        throw new ProtocolError('invalid_relay', 'Expected a canonical lowercase Neo script hash.');
+}
+
+export function verifyRelay(relayId: string, publicKey: Uint8Array, input: Uint8Array, signature: Uint8Array): boolean {
+    validateRelayId(relayId);
+    return verifyAccount(input, signature, publicKey) && getRelayId(publicKey) === relayId;
+}

package/src/index.ts

@@ -0,0 +1,52 @@
+export * from './errors.js';
+export * from './protocol/encoding.js';
+export * from './protocol/json.js';
+export * from './protocol/context.js';
+export * from './crypto/primitives.js';
+export * from './identity/neo.js';
+export * from './identity/identifiers.js';
+export type { ExtensibleModel, ProtocolCodec } from './protocol/codec.js';
+export * from './models/identity.js';
+export * from './storage/store.js';
+export * from './runtime/async-gate.js';
+export * from './runtime/clock.js';
+export * from './models/authentication.js';
+export * from './transport/endpoint.js';
+export * from './transport/relay-error.js';
+export * from './transport/http.js';
+export * from './interactions.js';
+export * from './transport/session.js';
+export * from './transport/rpc.js';
+export * from './transport/socket.js';
+export * from './models/relay.js';
+export * from './transport/discovery.js';
+export * from './runtime/events.js';
+export * from './transport/client.js';
+export type { RelaySubscription, RelaySubscriptionOptions, SubscriptionMethod } from './transport/subscription.js';
+export * from './transport/pool.js';
+export * from './components/component.js';
+export * from './components/account.js';
+export * from './models/content.js';
+export * from './models/profile.js';
+export * from './components/profile.js';
+export * from './models/device-state.js';
+export * from './components/device.js';
+export * from './models/contacts.js';
+export * from './protocol/validation.js';
+export * from './models/messages.js';
+export * from './models/channels.js';
+export * from './crypto/messages.js';
+export * from './models/groups.js';
+export * from './models/group-management.js';
+export * from './models/group-keys.js';
+export * from './models/group-admission.js';
+export * from './crypto/groups.js';
+export * from './components/message.js';
+export * from './components/channel.js';
+export type { ChannelInfo, ChannelPostInfo, ChannelPostChange } from './channels/repository.js';
+export type { MessageKey, MessageInfo, AccountMessage } from './messages/repository.js';
+export type { MessageSendState, MessageSendStatus } from './messages/outbox.js';
+export type { ContactInfo, ContactGrantState, ContactRequestInfo, ContactRequestDirection, ContactChange, ContactChangeKind, ContactRequestChange, ContactRequestChangeKind } from './messages/contacts.js';
+export * from './components/group.js';
+export type { GroupMessageInfo } from './groups/messages.js';
+export * from './client.js';

package/src/interactions.ts

@@ -0,0 +1,35 @@
+import type { DeviceCertificate } from './models/identity.js';
+import type { NetworkContext } from './protocol/context.js';
+
+/** The application retains its account private key and signs the exact input using Neo P-256/SHA-256. */
+export interface AccountSigner {
+    readonly accountId: string;
+    readonly publicKey: Uint8Array;
+    sign(input: Uint8Array, signal?: AbortSignal): Promise<Uint8Array>;
+}
+
+/** Device signatures are Ed25519 over the exact supplied bytes. */
+export interface DeviceSigner {
+    readonly certificate: DeviceCertificate;
+    sign(input: Uint8Array, signal?: AbortSignal): Promise<Uint8Array>;
+}
+
+export interface RelayEntry {
+    readonly relayId: string;
+    readonly endpoint: string;
+    readonly status: 'active' | 'disabled' | 'suspended';
+    /** Registry UInt64 timestamp, in Unix milliseconds; this is not a protocol JSON number. */
+    readonly updatedAt: bigint;
+}
+
+export interface RelayRegistry {
+    readonly context: NetworkContext;
+    getRelay(relayId: string, signal?: AbortSignal): Promise<RelayEntry | undefined>;
+    getRelays(signal?: AbortSignal): AsyncIterable<RelayEntry>;
+}
+
+/** Use OS-backed protection in the application adapter; never persist unprotected device secrets. */
+export interface SecretProtector {
+    protect(plaintext: Uint8Array, purpose: string, signal?: AbortSignal): Promise<Uint8Array>;
+    unprotect(protectedData: Uint8Array, purpose: string, signal?: AbortSignal): Promise<Uint8Array>;
+}

package/src/messages/account-sender.ts

@@ -0,0 +1,33 @@
+import type { MessageManager } from '../components/message.js';
+import { ProtocolError } from '../errors.js';
+import { accountGroupHistorySecretSyncCodec, accountGroupPrivateStateRequestCodec, accountGroupPrivateStateSyncCodec,
+    validateAccountGroupHistorySecretSync, validateAccountGroupPrivateStateRequest, validateAccountGroupPrivateStateSync } from '../models/groups.js';
+import type { JsonObject } from '../protocol/json.js';
+import type { MessageEffects } from './repository.js';
+
+type AccountSender = (payload: JsonObject, devices: readonly string[] | undefined, signal?: AbortSignal, effects?: MessageEffects) => Promise<void>;
+const senders = new WeakMap<MessageManager, AccountSender>();
+
+/** Internal capability: managers can enqueue only recognized self-account group payloads. */
+export function registerAccountSender(manager: MessageManager, sender: AccountSender): void { senders.set(manager, sender); }
+export function sendGroupAccountPayload(manager: MessageManager, source: JsonObject, devices?: readonly string[], signal?: AbortSignal, effects?: MessageEffects): Promise<void> {
+    const sender = senders.get(manager); if (!sender) throw new ProtocolError('not_initialized', 'Message manager has no account sender.');
+    let payload: JsonObject;
+    switch (source['$type']) {
+        case 'meshline.account.group.state.request': {
+            const value = accountGroupPrivateStateRequestCodec.decode(source); validateAccountGroupPrivateStateRequest(value); payload = accountGroupPrivateStateRequestCodec.encode(value); break;
+        }
+        case 'meshline.account.group.state.sync': {
+            const value = accountGroupPrivateStateSyncCodec.decode(source);
+            try { validateAccountGroupPrivateStateSync(value); payload = accountGroupPrivateStateSyncCodec.encode(value); }
+            finally { for (const item of value.states) item.memberEncryptionPrivateKey.fill(0); } break;
+        }
+        case 'meshline.account.group.history_secret.sync': {
+            const value = accountGroupHistorySecretSyncCodec.decode(source);
+            try { validateAccountGroupHistorySecretSync(value); payload = accountGroupHistorySecretSyncCodec.encode(value); }
+            finally { for (const item of value.secrets) item.applicationSecret.fill(0); } break;
+        }
+        default: throw new ProtocolError('invalid_payload', 'Unsupported group account payload.');
+    }
+    return sender(payload, devices && [...devices], signal, effects);
+}