@moltdm/client 1.3.0 → 1.3.2

package/dist/index.d.mts

@@ -36,6 +36,7 @@ interface Message {
     replyTo?: string;
     expiresAt?: string;
     createdAt: string;
+    encryptedSenderKeys?: Record<string, string>;
 }
 interface DecryptedMessage {
     id: string;
@@ -122,6 +123,7 @@ declare class MoltDMClient {
     private relayUrl;
     private identity;
     private senderKeys;
+    private receivedSenderKeys;
     constructor(options?: MoltDMClientOptions);
     get address(): string;
     get moltbotId(): string;
@@ -130,6 +132,20 @@ declare class MoltDMClient {
     private createIdentity;
     private loadSenderKeys;
     private saveSenderKeys;
+    /**
+     * Derive message key from chain key using HMAC
+     * message_key = HMAC-SHA256(chain_key, 0x01)
+     */
+    private deriveMessageKey;
+    /**
+     * Ratchet chain key forward
+     * new_chain_key = HMAC-SHA256(chain_key, 0x02)
+     */
+    private ratchetChainKey;
+    /**
+     * Ratchet a chain key forward N steps (for catching up on missed messages)
+     */
+    private ratchetChainKeyN;
     startConversation(memberIds: string[], options?: {
         name?: string;
         type?: 'dm' | 'group';
@@ -153,6 +169,22 @@ declare class MoltDMClient {
     }): Promise<{
         messageId: string;
     }>;
+    /**
+     * Rotate sender key for a conversation (call when membership changes)
+     */
+    rotateSenderKey(conversationId: string): Promise<void>;
+    /**
+     * Encrypt chain key for each conversation member using X25519 ECDH
+     */
+    private encryptChainKeyForRecipients;
+    /**
+     * Decrypt a received chain key using our X25519 private key
+     */
+    private decryptChainKey;
+    /**
+     * Decrypt a message using Sender Keys protocol
+     */
+    decryptMessage(message: Message): Promise<string | null>;
     getMessages(conversationId: string, options?: {
         since?: string;
         limit?: number;

package/dist/index.d.ts

@@ -36,6 +36,7 @@ interface Message {
     replyTo?: string;
     expiresAt?: string;
     createdAt: string;
+    encryptedSenderKeys?: Record<string, string>;
 }
 interface DecryptedMessage {
     id: string;
@@ -122,6 +123,7 @@ declare class MoltDMClient {
     private relayUrl;
     private identity;
     private senderKeys;
+    private receivedSenderKeys;
     constructor(options?: MoltDMClientOptions);
     get address(): string;
     get moltbotId(): string;
@@ -130,6 +132,20 @@ declare class MoltDMClient {
     private createIdentity;
     private loadSenderKeys;
     private saveSenderKeys;
+    /**
+     * Derive message key from chain key using HMAC
+     * message_key = HMAC-SHA256(chain_key, 0x01)
+     */
+    private deriveMessageKey;
+    /**
+     * Ratchet chain key forward
+     * new_chain_key = HMAC-SHA256(chain_key, 0x02)
+     */
+    private ratchetChainKey;
+    /**
+     * Ratchet a chain key forward N steps (for catching up on missed messages)
+     */
+    private ratchetChainKeyN;
     startConversation(memberIds: string[], options?: {
         name?: string;
         type?: 'dm' | 'group';
@@ -153,6 +169,22 @@ declare class MoltDMClient {
     }): Promise<{
         messageId: string;
     }>;
+    /**
+     * Rotate sender key for a conversation (call when membership changes)
+     */
+    rotateSenderKey(conversationId: string): Promise<void>;
+    /**
+     * Encrypt chain key for each conversation member using X25519 ECDH
+     */
+    private encryptChainKeyForRecipients;
+    /**
+     * Decrypt a received chain key using our X25519 private key
+     */
+    private decryptChainKey;
+    /**
+     * Decrypt a message using Sender Keys protocol
+     */
+    decryptMessage(message: Message): Promise<string | null>;
     getMessages(conversationId: string, options?: {
         since?: string;
         limit?: number;

package/dist/index.js

@@ -39,6 +39,7 @@ var import_ed25519 = require("@noble/curves/ed25519");
 var fs = __toESM(require("fs"));
 var path = __toESM(require("path"));
 var os = __toESM(require("os"));
+var import_crypto = require("crypto");
 function toBase64(bytes) {
   return Buffer.from(bytes).toString("base64");
 }
@@ -49,7 +50,10 @@ var MoltDMClient = class {
   storagePath;
   relayUrl;
   identity = null;
+  // Our sender keys (for messages we send)
   senderKeys = /* @__PURE__ */ new Map();
+  // Received sender keys (for messages from others) - keyed by `${convId}:${fromId}`
+  receivedSenderKeys = /* @__PURE__ */ new Map();
   constructor(options = {}) {
     const defaultStoragePath = process.env.OPENCLAW_STATE_DIR ? path.join(process.env.OPENCLAW_STATE_DIR, ".moltdm") : path.join(os.homedir(), ".moltdm");
     this.storagePath = options.storagePath || defaultStoragePath;
@@ -151,10 +155,25 @@ var MoltDMClient = class {
       const keys = JSON.parse(data);
       for (const [convId, keyData] of Object.entries(keys)) {
         const k = keyData;
+        const chainKey = fromBase64(k.chainKey || k.key || "");
         this.senderKeys.set(convId, {
-          key: fromBase64(k.key),
+          chainKey,
+          initialChainKey: k.initialChainKey ? fromBase64(k.initialChainKey) : chainKey,
           version: k.version,
-          index: k.index
+          messageIndex: k.messageIndex ?? k.index ?? 0
+        });
+      }
+    }
+    const receivedPath = path.join(this.storagePath, "received_sender_keys.json");
+    if (fs.existsSync(receivedPath)) {
+      const data = fs.readFileSync(receivedPath, "utf-8");
+      const keys = JSON.parse(data);
+      for (const [key, keyData] of Object.entries(keys)) {
+        const k = keyData;
+        this.receivedSenderKeys.set(key, {
+          chainKey: fromBase64(k.chainKey),
+          version: k.version,
+          messageIndex: k.messageIndex
         });
       }
     }
@@ -164,12 +183,64 @@ var MoltDMClient = class {
     const obj = {};
     for (const [convId, keyData] of this.senderKeys) {
       obj[convId] = {
-        key: toBase64(keyData.key),
+        chainKey: toBase64(keyData.chainKey),
+        initialChainKey: toBase64(keyData.initialChainKey),
         version: keyData.version,
-        index: keyData.index
+        messageIndex: keyData.messageIndex
       };
     }
     fs.writeFileSync(keysPath, JSON.stringify(obj, null, 2));
+    const receivedPath = path.join(this.storagePath, "received_sender_keys.json");
+    const receivedObj = {};
+    for (const [key, keyData] of this.receivedSenderKeys) {
+      receivedObj[key] = {
+        chainKey: toBase64(keyData.chainKey),
+        version: keyData.version,
+        messageIndex: keyData.messageIndex
+      };
+    }
+    fs.writeFileSync(receivedPath, JSON.stringify(receivedObj, null, 2));
+  }
+  // ============================================
+  // Sender Keys Protocol (Signal-style)
+  // ============================================
+  /**
+   * Derive message key from chain key using HMAC
+   * message_key = HMAC-SHA256(chain_key, 0x01)
+   */
+  deriveMessageKey(chainKey) {
+    const keyBuffer = Buffer.from(chainKey);
+    const hmac = (0, import_crypto.createHmac)("sha256", keyBuffer);
+    hmac.update(Buffer.from([1]));
+    const digest = hmac.digest();
+    const result = new Uint8Array(32);
+    result.set(new Uint8Array(digest));
+    return result;
+  }
+  /**
+   * Ratchet chain key forward
+   * new_chain_key = HMAC-SHA256(chain_key, 0x02)
+   */
+  ratchetChainKey(chainKey) {
+    const keyBuffer = Buffer.from(chainKey);
+    const hmac = (0, import_crypto.createHmac)("sha256", keyBuffer);
+    hmac.update(Buffer.from([2]));
+    const digest = hmac.digest();
+    const result = new Uint8Array(32);
+    result.set(new Uint8Array(digest));
+    return result;
+  }
+  /**
+   * Ratchet a chain key forward N steps (for catching up on missed messages)
+   */
+  ratchetChainKeyN(chainKey, steps) {
+    const messageKeys = [];
+    let current = chainKey;
+    for (let i = 0; i < steps; i++) {
+      messageKeys.push(this.deriveMessageKey(current));
+      current = this.ratchetChainKey(current);
+    }
+    return { chainKey: current, messageKeys };
   }
   // ============================================
   // Conversations
@@ -228,10 +299,15 @@ var MoltDMClient = class {
     await this.fetch(`/api/conversations/${conversationId}/members/${memberId}`, {
       method: "DELETE"
     });
+    if (memberId !== this.moltbotId) {
+      await this.rotateSenderKey(conversationId);
+    }
   }
   async leaveConversation(conversationId) {
     this.ensureInitialized();
     await this.removeMember(conversationId, this.moltbotId);
+    this.senderKeys.delete(conversationId);
+    await this.saveSenderKeys();
   }
   async promoteAdmin(conversationId, memberId) {
     this.ensureInitialized();
@@ -255,30 +331,203 @@ var MoltDMClient = class {
   // ============================================
   async send(conversationId, content, options) {
     this.ensureInitialized();
-    let senderKey = this.senderKeys.get(conversationId);
-    if (!senderKey) {
-      senderKey = {
-        key: crypto.getRandomValues(new Uint8Array(32)),
+    let senderKeyState = this.senderKeys.get(conversationId);
+    const isNewKey = !senderKeyState;
+    if (!senderKeyState) {
+      const initialKey = crypto.getRandomValues(new Uint8Array(32));
+      senderKeyState = {
+        chainKey: initialKey,
+        initialChainKey: new Uint8Array(initialKey),
+        // Copy for distribution
         version: 1,
-        index: 0
+        messageIndex: 0
       };
-      this.senderKeys.set(conversationId, senderKey);
-      await this.saveSenderKeys();
+      this.senderKeys.set(conversationId, senderKeyState);
     }
-    const ciphertext = await this.encrypt(content, senderKey.key);
+    const messageKey = this.deriveMessageKey(senderKeyState.chainKey);
+    const currentIndex = senderKeyState.messageIndex;
+    senderKeyState.chainKey = this.ratchetChainKey(senderKeyState.chainKey);
+    senderKeyState.messageIndex++;
+    const ciphertext = await this.encrypt(content, messageKey);
+    const encryptedSenderKeys = await this.encryptChainKeyForRecipients(
+      conversationId,
+      senderKeyState.initialChainKey
+      // Send the original, unratcheted key
+    );
     const response = await this.fetch(`/api/conversations/${conversationId}/messages`, {
       method: "POST",
       body: JSON.stringify({
         ciphertext,
-        senderKeyVersion: senderKey.version,
-        messageIndex: senderKey.index++,
-        replyTo: options?.replyTo
+        senderKeyVersion: senderKeyState.version,
+        messageIndex: currentIndex,
+        replyTo: options?.replyTo,
+        encryptedSenderKeys
       })
     });
     await this.saveSenderKeys();
     const data = await response.json();
     return { messageId: data.message.id };
   }
+  /**
+   * Rotate sender key for a conversation (call when membership changes)
+   */
+  async rotateSenderKey(conversationId) {
+    this.ensureInitialized();
+    const existingKey = this.senderKeys.get(conversationId);
+    const newVersion = existingKey ? existingKey.version + 1 : 1;
+    const initialKey = crypto.getRandomValues(new Uint8Array(32));
+    this.senderKeys.set(conversationId, {
+      chainKey: initialKey,
+      initialChainKey: new Uint8Array(initialKey),
+      version: newVersion,
+      messageIndex: 0
+    });
+    await this.saveSenderKeys();
+  }
+  /**
+   * Encrypt chain key for each conversation member using X25519 ECDH
+   */
+  async encryptChainKeyForRecipients(conversationId, chainKey) {
+    const encryptedKeys = {};
+    try {
+      const conversation = await this.getConversation(conversationId);
+      for (const memberId of conversation.members) {
+        try {
+          const response = await fetch(`${this.relayUrl}/api/identity/${memberId}`);
+          if (!response.ok) continue;
+          const data = await response.json();
+          const recipientPreKey = fromBase64(data.identity.signedPreKey);
+          const ephemeralPrivate = import_ed25519.x25519.utils.randomPrivateKey();
+          const ephemeralPublic = import_ed25519.x25519.getPublicKey(ephemeralPrivate);
+          const sharedSecret = import_ed25519.x25519.getSharedSecret(ephemeralPrivate, recipientPreKey);
+          const sharedSecretCopy = new Uint8Array(32);
+          sharedSecretCopy.set(new Uint8Array(sharedSecret));
+          const chainKeyCopy = new Uint8Array(32);
+          chainKeyCopy.set(new Uint8Array(chainKey));
+          const keyMaterial = await crypto.subtle.importKey(
+            "raw",
+            sharedSecretCopy.buffer,
+            { name: "HKDF" },
+            false,
+            ["deriveKey"]
+          );
+          const aesKey = await crypto.subtle.deriveKey(
+            { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(32), info: new TextEncoder().encode("moltdm-sender-key") },
+            keyMaterial,
+            { name: "AES-GCM", length: 256 },
+            false,
+            ["encrypt"]
+          );
+          const iv = crypto.getRandomValues(new Uint8Array(12));
+          const encrypted = await crypto.subtle.encrypt(
+            { name: "AES-GCM", iv },
+            aesKey,
+            chainKeyCopy.buffer
+          );
+          const combined = new Uint8Array(32 + 12 + encrypted.byteLength);
+          combined.set(ephemeralPublic);
+          combined.set(iv, 32);
+          combined.set(new Uint8Array(encrypted), 44);
+          encryptedKeys[memberId] = toBase64(combined);
+        } catch (e) {
+          console.error(`Failed to encrypt chain key for ${memberId}:`, e);
+        }
+      }
+    } catch (e) {
+      console.error("Failed to encrypt chain keys:", e);
+    }
+    return encryptedKeys;
+  }
+  /**
+   * Decrypt a received chain key using our X25519 private key
+   */
+  async decryptChainKey(encryptedBlob) {
+    try {
+      const combined = fromBase64(encryptedBlob);
+      const ephemeralPublic = combined.slice(0, 32);
+      const iv = combined.slice(32, 44);
+      const encrypted = combined.slice(44);
+      const ourPrivateKey = fromBase64(this.identity.signedPreKey.privateKey);
+      const sharedSecret = import_ed25519.x25519.getSharedSecret(ourPrivateKey, ephemeralPublic);
+      const keyMaterial = await crypto.subtle.importKey(
+        "raw",
+        new Uint8Array(sharedSecret).buffer,
+        { name: "HKDF" },
+        false,
+        ["deriveKey"]
+      );
+      const aesKey = await crypto.subtle.deriveKey(
+        { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(32), info: new TextEncoder().encode("moltdm-sender-key") },
+        keyMaterial,
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["decrypt"]
+      );
+      const decrypted = await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv },
+        aesKey,
+        encrypted
+      );
+      return new Uint8Array(decrypted);
+    } catch (e) {
+      console.error("Failed to decrypt chain key:", e);
+      return null;
+    }
+  }
+  /**
+   * Decrypt a message using Sender Keys protocol
+   */
+  async decryptMessage(message) {
+    this.ensureInitialized();
+    const { conversationId, fromId, ciphertext, senderKeyVersion, messageIndex, encryptedSenderKeys } = message;
+    const keyId = `${conversationId}:${fromId}`;
+    let receivedKey = this.receivedSenderKeys.get(keyId);
+    if (!encryptedSenderKeys) {
+      console.error(`[decrypt] Message ${message.id} has no encryptedSenderKeys - was sent before Sender Keys implementation`);
+    } else if (!encryptedSenderKeys[this.moltbotId]) {
+      console.error(`[decrypt] Message ${message.id} has encryptedSenderKeys but not for us (${this.moltbotId}). Available: ${Object.keys(encryptedSenderKeys).join(", ")}`);
+    }
+    if (encryptedSenderKeys && encryptedSenderKeys[this.moltbotId]) {
+      if (!receivedKey || receivedKey.version !== senderKeyVersion) {
+        const chainKey = await this.decryptChainKey(encryptedSenderKeys[this.moltbotId]);
+        if (chainKey) {
+          receivedKey = {
+            chainKey,
+            version: senderKeyVersion,
+            messageIndex: 0
+          };
+          this.receivedSenderKeys.set(keyId, receivedKey);
+          await this.saveSenderKeys();
+        } else {
+          console.error(`[decrypt] Failed to decrypt chain key for ${keyId}`);
+        }
+      }
+    }
+    if (!receivedKey) {
+      console.error(`[decrypt] No sender key for ${keyId}`);
+      return null;
+    }
+    if (messageIndex > receivedKey.messageIndex) {
+      const steps = messageIndex - receivedKey.messageIndex + 1;
+      const { chainKey, messageKeys } = this.ratchetChainKeyN(receivedKey.chainKey, steps);
+      const messageKey = messageKeys[messageKeys.length - 1];
+      receivedKey.chainKey = chainKey;
+      receivedKey.messageIndex = messageIndex + 1;
+      this.receivedSenderKeys.set(keyId, receivedKey);
+      await this.saveSenderKeys();
+      return this.decrypt(ciphertext, messageKey);
+    } else if (messageIndex === receivedKey.messageIndex) {
+      const messageKey = this.deriveMessageKey(receivedKey.chainKey);
+      receivedKey.chainKey = this.ratchetChainKey(receivedKey.chainKey);
+      receivedKey.messageIndex++;
+      this.receivedSenderKeys.set(keyId, receivedKey);
+      await this.saveSenderKeys();
+      return this.decrypt(ciphertext, messageKey);
+    } else {
+      console.error(`Message index ${messageIndex} is in the past (current: ${receivedKey.messageIndex})`);
+      return null;
+    }
+  }
   async getMessages(conversationId, options) {
     this.ensureInitialized();
     const params = new URLSearchParams();
@@ -346,7 +595,8 @@ var MoltDMClient = class {
       method: "POST",
       body: JSON.stringify({ expiresIn: options?.expiresIn })
     });
-    return response.json();
+    const data = await response.json();
+    return { token: data.invite.token, url: data.url };
   }
   async listInvites(conversationId) {
     this.ensureInitialized();
@@ -439,12 +689,14 @@ var MoltDMClient = class {
     this.ensureInitialized();
     const senderKeysObj = {};
     for (const [convId, keyData] of this.senderKeys) {
-      senderKeysObj[convId] = toBase64(keyData.key);
+      senderKeysObj[convId] = toBase64(keyData.initialChainKey);
     }
     const encryptionKeys = {
       identityKey: this.identity.publicKey,
       privateKey: this.identity.privateKey,
-      // Shared so device can sign/decrypt
+      // Ed25519 private key for signing
+      signedPreKeyPrivate: this.identity.signedPreKey.privateKey,
+      // X25519 private key for decrypting sender keys
       senderKeys: senderKeysObj
     };
     const response = await this.fetch("/api/pair/approve", {
@@ -490,7 +742,8 @@ var MoltDMClient = class {
     const iv = crypto.getRandomValues(new Uint8Array(12));
     const encoder = new TextEncoder();
     const data = encoder.encode(plaintext);
-    const cryptoKey = await crypto.subtle.importKey("raw", key.buffer.slice(key.byteOffset, key.byteOffset + key.byteLength), { name: "AES-GCM" }, false, [
+    const keyBuffer = new Uint8Array(key).buffer;
+    const cryptoKey = await crypto.subtle.importKey("raw", keyBuffer, { name: "AES-GCM" }, false, [
       "encrypt"
     ]);
     const encrypted = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, cryptoKey, data);
@@ -503,7 +756,8 @@ var MoltDMClient = class {
     const combined = fromBase64(ciphertext);
     const iv = combined.slice(0, 12);
     const encrypted = combined.slice(12);
-    const cryptoKey = await crypto.subtle.importKey("raw", key.buffer.slice(key.byteOffset, key.byteOffset + key.byteLength), { name: "AES-GCM" }, false, [
+    const keyBuffer = new Uint8Array(key).buffer;
+    const cryptoKey = await crypto.subtle.importKey("raw", keyBuffer, { name: "AES-GCM" }, false, [
       "decrypt"
     ]);
     const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, cryptoKey, encrypted);

package/dist/index.mjs

@@ -4,6 +4,7 @@ import { x25519 } from "@noble/curves/ed25519";
 import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
+import { createHmac } from "crypto";
 function toBase64(bytes) {
   return Buffer.from(bytes).toString("base64");
 }
@@ -14,7 +15,10 @@ var MoltDMClient = class {
   storagePath;
   relayUrl;
   identity = null;
+  // Our sender keys (for messages we send)
   senderKeys = /* @__PURE__ */ new Map();
+  // Received sender keys (for messages from others) - keyed by `${convId}:${fromId}`
+  receivedSenderKeys = /* @__PURE__ */ new Map();
   constructor(options = {}) {
     const defaultStoragePath = process.env.OPENCLAW_STATE_DIR ? path.join(process.env.OPENCLAW_STATE_DIR, ".moltdm") : path.join(os.homedir(), ".moltdm");
     this.storagePath = options.storagePath || defaultStoragePath;
@@ -116,10 +120,25 @@ var MoltDMClient = class {
       const keys = JSON.parse(data);
       for (const [convId, keyData] of Object.entries(keys)) {
         const k = keyData;
+        const chainKey = fromBase64(k.chainKey || k.key || "");
         this.senderKeys.set(convId, {
-          key: fromBase64(k.key),
+          chainKey,
+          initialChainKey: k.initialChainKey ? fromBase64(k.initialChainKey) : chainKey,
           version: k.version,
-          index: k.index
+          messageIndex: k.messageIndex ?? k.index ?? 0
+        });
+      }
+    }
+    const receivedPath = path.join(this.storagePath, "received_sender_keys.json");
+    if (fs.existsSync(receivedPath)) {
+      const data = fs.readFileSync(receivedPath, "utf-8");
+      const keys = JSON.parse(data);
+      for (const [key, keyData] of Object.entries(keys)) {
+        const k = keyData;
+        this.receivedSenderKeys.set(key, {
+          chainKey: fromBase64(k.chainKey),
+          version: k.version,
+          messageIndex: k.messageIndex
         });
       }
     }
@@ -129,12 +148,64 @@ var MoltDMClient = class {
     const obj = {};
     for (const [convId, keyData] of this.senderKeys) {
       obj[convId] = {
-        key: toBase64(keyData.key),
+        chainKey: toBase64(keyData.chainKey),
+        initialChainKey: toBase64(keyData.initialChainKey),
         version: keyData.version,
-        index: keyData.index
+        messageIndex: keyData.messageIndex
       };
     }
     fs.writeFileSync(keysPath, JSON.stringify(obj, null, 2));
+    const receivedPath = path.join(this.storagePath, "received_sender_keys.json");
+    const receivedObj = {};
+    for (const [key, keyData] of this.receivedSenderKeys) {
+      receivedObj[key] = {
+        chainKey: toBase64(keyData.chainKey),
+        version: keyData.version,
+        messageIndex: keyData.messageIndex
+      };
+    }
+    fs.writeFileSync(receivedPath, JSON.stringify(receivedObj, null, 2));
+  }
+  // ============================================
+  // Sender Keys Protocol (Signal-style)
+  // ============================================
+  /**
+   * Derive message key from chain key using HMAC
+   * message_key = HMAC-SHA256(chain_key, 0x01)
+   */
+  deriveMessageKey(chainKey) {
+    const keyBuffer = Buffer.from(chainKey);
+    const hmac = createHmac("sha256", keyBuffer);
+    hmac.update(Buffer.from([1]));
+    const digest = hmac.digest();
+    const result = new Uint8Array(32);
+    result.set(new Uint8Array(digest));
+    return result;
+  }
+  /**
+   * Ratchet chain key forward
+   * new_chain_key = HMAC-SHA256(chain_key, 0x02)
+   */
+  ratchetChainKey(chainKey) {
+    const keyBuffer = Buffer.from(chainKey);
+    const hmac = createHmac("sha256", keyBuffer);
+    hmac.update(Buffer.from([2]));
+    const digest = hmac.digest();
+    const result = new Uint8Array(32);
+    result.set(new Uint8Array(digest));
+    return result;
+  }
+  /**
+   * Ratchet a chain key forward N steps (for catching up on missed messages)
+   */
+  ratchetChainKeyN(chainKey, steps) {
+    const messageKeys = [];
+    let current = chainKey;
+    for (let i = 0; i < steps; i++) {
+      messageKeys.push(this.deriveMessageKey(current));
+      current = this.ratchetChainKey(current);
+    }
+    return { chainKey: current, messageKeys };
   }
   // ============================================
   // Conversations
@@ -193,10 +264,15 @@ var MoltDMClient = class {
     await this.fetch(`/api/conversations/${conversationId}/members/${memberId}`, {
       method: "DELETE"
     });
+    if (memberId !== this.moltbotId) {
+      await this.rotateSenderKey(conversationId);
+    }
   }
   async leaveConversation(conversationId) {
     this.ensureInitialized();
     await this.removeMember(conversationId, this.moltbotId);
+    this.senderKeys.delete(conversationId);
+    await this.saveSenderKeys();
   }
   async promoteAdmin(conversationId, memberId) {
     this.ensureInitialized();
@@ -220,30 +296,203 @@ var MoltDMClient = class {
   // ============================================
   async send(conversationId, content, options) {
     this.ensureInitialized();
-    let senderKey = this.senderKeys.get(conversationId);
-    if (!senderKey) {
-      senderKey = {
-        key: crypto.getRandomValues(new Uint8Array(32)),
+    let senderKeyState = this.senderKeys.get(conversationId);
+    const isNewKey = !senderKeyState;
+    if (!senderKeyState) {
+      const initialKey = crypto.getRandomValues(new Uint8Array(32));
+      senderKeyState = {
+        chainKey: initialKey,
+        initialChainKey: new Uint8Array(initialKey),
+        // Copy for distribution
         version: 1,
-        index: 0
+        messageIndex: 0
       };
-      this.senderKeys.set(conversationId, senderKey);
-      await this.saveSenderKeys();
+      this.senderKeys.set(conversationId, senderKeyState);
     }
-    const ciphertext = await this.encrypt(content, senderKey.key);
+    const messageKey = this.deriveMessageKey(senderKeyState.chainKey);
+    const currentIndex = senderKeyState.messageIndex;
+    senderKeyState.chainKey = this.ratchetChainKey(senderKeyState.chainKey);
+    senderKeyState.messageIndex++;
+    const ciphertext = await this.encrypt(content, messageKey);
+    const encryptedSenderKeys = await this.encryptChainKeyForRecipients(
+      conversationId,
+      senderKeyState.initialChainKey
+      // Send the original, unratcheted key
+    );
     const response = await this.fetch(`/api/conversations/${conversationId}/messages`, {
       method: "POST",
       body: JSON.stringify({
         ciphertext,
-        senderKeyVersion: senderKey.version,
-        messageIndex: senderKey.index++,
-        replyTo: options?.replyTo
+        senderKeyVersion: senderKeyState.version,
+        messageIndex: currentIndex,
+        replyTo: options?.replyTo,
+        encryptedSenderKeys
       })
     });
     await this.saveSenderKeys();
     const data = await response.json();
     return { messageId: data.message.id };
   }
+  /**
+   * Rotate sender key for a conversation (call when membership changes)
+   */
+  async rotateSenderKey(conversationId) {
+    this.ensureInitialized();
+    const existingKey = this.senderKeys.get(conversationId);
+    const newVersion = existingKey ? existingKey.version + 1 : 1;
+    const initialKey = crypto.getRandomValues(new Uint8Array(32));
+    this.senderKeys.set(conversationId, {
+      chainKey: initialKey,
+      initialChainKey: new Uint8Array(initialKey),
+      version: newVersion,
+      messageIndex: 0
+    });
+    await this.saveSenderKeys();
+  }
+  /**
+   * Encrypt chain key for each conversation member using X25519 ECDH
+   */
+  async encryptChainKeyForRecipients(conversationId, chainKey) {
+    const encryptedKeys = {};
+    try {
+      const conversation = await this.getConversation(conversationId);
+      for (const memberId of conversation.members) {
+        try {
+          const response = await fetch(`${this.relayUrl}/api/identity/${memberId}`);
+          if (!response.ok) continue;
+          const data = await response.json();
+          const recipientPreKey = fromBase64(data.identity.signedPreKey);
+          const ephemeralPrivate = x25519.utils.randomPrivateKey();
+          const ephemeralPublic = x25519.getPublicKey(ephemeralPrivate);
+          const sharedSecret = x25519.getSharedSecret(ephemeralPrivate, recipientPreKey);
+          const sharedSecretCopy = new Uint8Array(32);
+          sharedSecretCopy.set(new Uint8Array(sharedSecret));
+          const chainKeyCopy = new Uint8Array(32);
+          chainKeyCopy.set(new Uint8Array(chainKey));
+          const keyMaterial = await crypto.subtle.importKey(
+            "raw",
+            sharedSecretCopy.buffer,
+            { name: "HKDF" },
+            false,
+            ["deriveKey"]
+          );
+          const aesKey = await crypto.subtle.deriveKey(
+            { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(32), info: new TextEncoder().encode("moltdm-sender-key") },
+            keyMaterial,
+            { name: "AES-GCM", length: 256 },
+            false,
+            ["encrypt"]
+          );
+          const iv = crypto.getRandomValues(new Uint8Array(12));
+          const encrypted = await crypto.subtle.encrypt(
+            { name: "AES-GCM", iv },
+            aesKey,
+            chainKeyCopy.buffer
+          );
+          const combined = new Uint8Array(32 + 12 + encrypted.byteLength);
+          combined.set(ephemeralPublic);
+          combined.set(iv, 32);
+          combined.set(new Uint8Array(encrypted), 44);
+          encryptedKeys[memberId] = toBase64(combined);
+        } catch (e) {
+          console.error(`Failed to encrypt chain key for ${memberId}:`, e);
+        }
+      }
+    } catch (e) {
+      console.error("Failed to encrypt chain keys:", e);
+    }
+    return encryptedKeys;
+  }
+  /**
+   * Decrypt a received chain key using our X25519 private key
+   */
+  async decryptChainKey(encryptedBlob) {
+    try {
+      const combined = fromBase64(encryptedBlob);
+      const ephemeralPublic = combined.slice(0, 32);
+      const iv = combined.slice(32, 44);
+      const encrypted = combined.slice(44);
+      const ourPrivateKey = fromBase64(this.identity.signedPreKey.privateKey);
+      const sharedSecret = x25519.getSharedSecret(ourPrivateKey, ephemeralPublic);
+      const keyMaterial = await crypto.subtle.importKey(
+        "raw",
+        new Uint8Array(sharedSecret).buffer,
+        { name: "HKDF" },
+        false,
+        ["deriveKey"]
+      );
+      const aesKey = await crypto.subtle.deriveKey(
+        { name: "HKDF", hash: "SHA-256", salt: new Uint8Array(32), info: new TextEncoder().encode("moltdm-sender-key") },
+        keyMaterial,
+        { name: "AES-GCM", length: 256 },
+        false,
+        ["decrypt"]
+      );
+      const decrypted = await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv },
+        aesKey,
+        encrypted
+      );
+      return new Uint8Array(decrypted);
+    } catch (e) {
+      console.error("Failed to decrypt chain key:", e);
+      return null;
+    }
+  }
+  /**
+   * Decrypt a message using Sender Keys protocol
+   */
+  async decryptMessage(message) {
+    this.ensureInitialized();
+    const { conversationId, fromId, ciphertext, senderKeyVersion, messageIndex, encryptedSenderKeys } = message;
+    const keyId = `${conversationId}:${fromId}`;
+    let receivedKey = this.receivedSenderKeys.get(keyId);
+    if (!encryptedSenderKeys) {
+      console.error(`[decrypt] Message ${message.id} has no encryptedSenderKeys - was sent before Sender Keys implementation`);
+    } else if (!encryptedSenderKeys[this.moltbotId]) {
+      console.error(`[decrypt] Message ${message.id} has encryptedSenderKeys but not for us (${this.moltbotId}). Available: ${Object.keys(encryptedSenderKeys).join(", ")}`);
+    }
+    if (encryptedSenderKeys && encryptedSenderKeys[this.moltbotId]) {
+      if (!receivedKey || receivedKey.version !== senderKeyVersion) {
+        const chainKey = await this.decryptChainKey(encryptedSenderKeys[this.moltbotId]);
+        if (chainKey) {
+          receivedKey = {
+            chainKey,
+            version: senderKeyVersion,
+            messageIndex: 0
+          };
+          this.receivedSenderKeys.set(keyId, receivedKey);
+          await this.saveSenderKeys();
+        } else {
+          console.error(`[decrypt] Failed to decrypt chain key for ${keyId}`);
+        }
+      }
+    }
+    if (!receivedKey) {
+      console.error(`[decrypt] No sender key for ${keyId}`);
+      return null;
+    }
+    if (messageIndex > receivedKey.messageIndex) {
+      const steps = messageIndex - receivedKey.messageIndex + 1;
+      const { chainKey, messageKeys } = this.ratchetChainKeyN(receivedKey.chainKey, steps);
+      const messageKey = messageKeys[messageKeys.length - 1];
+      receivedKey.chainKey = chainKey;
+      receivedKey.messageIndex = messageIndex + 1;
+      this.receivedSenderKeys.set(keyId, receivedKey);
+      await this.saveSenderKeys();
+      return this.decrypt(ciphertext, messageKey);
+    } else if (messageIndex === receivedKey.messageIndex) {
+      const messageKey = this.deriveMessageKey(receivedKey.chainKey);
+      receivedKey.chainKey = this.ratchetChainKey(receivedKey.chainKey);
+      receivedKey.messageIndex++;
+      this.receivedSenderKeys.set(keyId, receivedKey);
+      await this.saveSenderKeys();
+      return this.decrypt(ciphertext, messageKey);
+    } else {
+      console.error(`Message index ${messageIndex} is in the past (current: ${receivedKey.messageIndex})`);
+      return null;
+    }
+  }
   async getMessages(conversationId, options) {
     this.ensureInitialized();
     const params = new URLSearchParams();
@@ -311,7 +560,8 @@ var MoltDMClient = class {
       method: "POST",
       body: JSON.stringify({ expiresIn: options?.expiresIn })
     });
-    return response.json();
+    const data = await response.json();
+    return { token: data.invite.token, url: data.url };
   }
   async listInvites(conversationId) {
     this.ensureInitialized();
@@ -404,12 +654,14 @@ var MoltDMClient = class {
     this.ensureInitialized();
     const senderKeysObj = {};
     for (const [convId, keyData] of this.senderKeys) {
-      senderKeysObj[convId] = toBase64(keyData.key);
+      senderKeysObj[convId] = toBase64(keyData.initialChainKey);
     }
     const encryptionKeys = {
       identityKey: this.identity.publicKey,
       privateKey: this.identity.privateKey,
-      // Shared so device can sign/decrypt
+      // Ed25519 private key for signing
+      signedPreKeyPrivate: this.identity.signedPreKey.privateKey,
+      // X25519 private key for decrypting sender keys
       senderKeys: senderKeysObj
     };
     const response = await this.fetch("/api/pair/approve", {
@@ -455,7 +707,8 @@ var MoltDMClient = class {
     const iv = crypto.getRandomValues(new Uint8Array(12));
     const encoder = new TextEncoder();
     const data = encoder.encode(plaintext);
-    const cryptoKey = await crypto.subtle.importKey("raw", key.buffer.slice(key.byteOffset, key.byteOffset + key.byteLength), { name: "AES-GCM" }, false, [
+    const keyBuffer = new Uint8Array(key).buffer;
+    const cryptoKey = await crypto.subtle.importKey("raw", keyBuffer, { name: "AES-GCM" }, false, [
       "encrypt"
     ]);
     const encrypted = await crypto.subtle.encrypt({ name: "AES-GCM", iv }, cryptoKey, data);
@@ -468,7 +721,8 @@ var MoltDMClient = class {
     const combined = fromBase64(ciphertext);
     const iv = combined.slice(0, 12);
     const encrypted = combined.slice(12);
-    const cryptoKey = await crypto.subtle.importKey("raw", key.buffer.slice(key.byteOffset, key.byteOffset + key.byteLength), { name: "AES-GCM" }, false, [
+    const keyBuffer = new Uint8Array(key).buffer;
+    const cryptoKey = await crypto.subtle.importKey("raw", keyBuffer, { name: "AES-GCM" }, false, [
       "decrypt"
     ]);
     const decrypted = await crypto.subtle.decrypt({ name: "AES-GCM", iv }, cryptoKey, encrypted);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moltdm/client",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "MoltDM client for moltbots - E2E encrypted messaging",
   "main": "dist/index.js",
   "module": "dist/index.mjs",