@mt-tl/server 0.1.0

package/dist/create-server.js

@@ -0,0 +1,109 @@
+import { bootstrap } from './lib.js';
+import { createLogger, } from '@mt-tl/tl';
+import { RpcRegistry, dispatchRpc, LoggingUpdateEmitter, } from './core/index.js';
+const noopEmitter = { async emit() { }, async emitToAuthKey() { } };
+/**
+ * Creates an MTProto server (Fastify-style). Pass the {@link MTProtoConfig},
+ * register routes with `.method()` / plugins with `.register()`, then
+ * `await app.listen()`. The framework owns the whole protocol — transport,
+ * handshake, crypto, sessions, TL (de)serialization, layered encoding,
+ * server-push — you write methods.
+ *
+ * Type it with your generated `RpcMethods` (`createServer<RpcMethods>(config)`)
+ * so every route's name, `params`, and `result` are checked.
+ *
+ * @param config - the server configuration (your app builds it from env).
+ * @param opts.registry - adopt an existing {@link RpcRegistry} instead of a fresh one (advanced/tests).
+ * @param opts.migrations - per-layer migration ladders applied on input/output.
+ * @param opts.logger - structured logger; defaults to `createLogger({ name: config.nodeId })`
+ *   (env-configured via `LOG_LEVEL`/`LOG_FORMAT`). Exposed as `app.log`; handlers get `ctx.log`.
+ *
+ * @example
+ * ```ts
+ * const app = createServer<RpcMethods>(config)
+ * app.method('help.getConfig', { auth: false }, async () => ({ _: 'config' }))
+ * await app.listen()   // opens the WS + raw-TCP carriers
+ * ```
+ */
+export function createServer(config, opts = {}) {
+    const registry = opts.registry ?? new RpcRegistry();
+    const logger = opts.logger ?? createLogger({ name: config.nodeId });
+    let gateway;
+    let emitter = noopEmitter;
+    const app = {
+        method(name, optsOrHandler, maybeHandler) {
+            const handler = (maybeHandler ?? optsOrHandler);
+            const methodOpts = maybeHandler ? optsOrHandler : {};
+            registry.add({
+                [name]: {
+                    auth: methodOpts.auth ?? true,
+                    preHandlers: methodOpts.preHandlers,
+                    handler,
+                },
+            });
+            return app;
+        },
+        register(plugin, deps) {
+            plugin(app, deps);
+            return app;
+        },
+        async listen() {
+            if (gateway)
+                throw new Error('server already listening');
+            gateway = await bootstrap({
+                config,
+                migrations: opts.migrations,
+                logger,
+                createForward: (publish, updateLog) => {
+                    // Handler-emitted updates (ctx.push / ctx.updates) flow to the push loop,
+                    // logged (for pts) via the shared update log bootstrap provides.
+                    emitter = new LoggingUpdateEmitter(updateLog, publish);
+                    return req => dispatchRpc(registry, req, { updates: emitter, logger });
+                },
+            });
+            await gateway.listen();
+        },
+        async close() {
+            await gateway?.close();
+        },
+        inject(req) {
+            return dispatchRpc(registry, req, { updates: emitter, logger });
+        },
+        get log() {
+            return logger;
+        },
+        get methods() {
+            return registry.methods();
+        },
+        get wsPort() {
+            return gateway?.wsServer?.port;
+        },
+        get tcpPort() {
+            return gateway?.tcpServer?.port;
+        },
+        get publicKey() {
+            return gateway?.publicKey;
+        },
+    };
+    return app;
+}
+/**
+ * Authoring helper for a typed plugin — a function that registers a group of
+ * related routes, taking its dependencies by value (Style-A DI, like
+ * `fastify.register`). Pin it to your `RpcMethods` once (see your app's
+ * `framework.ts`) so routes inside infer their types.
+ *
+ * @example
+ * ```ts
+ * export const walletsPlugin = definePlugin<RpcMethods, { wallets: WalletService }>(
+ *   (app, { wallets }) => {
+ *     app.method('wallets.getBalance', async (_p, ctx) => wallets.balanceOf(ctx.subject!))
+ *   },
+ * )
+ * app.register(walletsPlugin, { wallets: new WalletService() })
+ * ```
+ */
+export function definePlugin(fn) {
+    return fn;
+}
+//# sourceMappingURL=create-server.js.map

package/dist/create-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-server.js","sourceRoot":"","sources":["../src/create-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAwD,MAAM,UAAU,CAAA;AAC1F,OAAO,EACH,YAAY,GAKf,MAAM,WAAW,CAAA;AAClB,OAAO,EACH,WAAW,EACX,WAAW,EACX,oBAAoB,GAKvB,MAAM,iBAAiB,CAAA;AA+CxB,MAAM,WAAW,GAAkB,EAAE,KAAK,CAAC,IAAI,KAAI,CAAC,EAAE,KAAK,CAAC,aAAa,KAAI,CAAC,EAAE,CAAA;AAEhF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,YAAY,CACxB,MAAqB,EACrB,OAAoF,EAAE;IAEtF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,WAAW,EAAE,CAAA;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IACnE,IAAI,OAA4B,CAAA;IAChC,IAAI,OAAO,GAAkB,WAAW,CAAA;IAExC,MAAM,GAAG,GAAsB;QAC3B,MAAM,CACF,IAAc,EACd,aAAoC,EACpC,YAAuB;YAEvB,MAAM,OAAO,GAAG,CAAC,YAAY,IAAI,aAAa,CAGzB,CAAA;YACrB,MAAM,UAAU,GAAe,YAAY,CAAC,CAAC,CAAE,aAA4B,CAAC,CAAC,CAAC,EAAE,CAAA;YAChF,QAAQ,CAAC,GAAG,CAAC;gBACT,CAAC,IAAc,CAAC,EAAE;oBACd,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,IAAI;oBAC7B,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,OAAO;iBACV;aACJ,CAAC,CAAA;YACF,OAAO,GAAG,CAAA;QACd,CAAC;QACD,QAAQ,CAAW,MAAqB,EAAE,IAAQ;YAC9C,MAAM,CAAC,GAAG,EAAE,IAAS,CAAC,CAAA;YACtB,OAAO,GAAG,CAAA;QACd,CAAC;QACD,KAAK,CAAC,MAAM;YACR,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;YACxD,OAAO,GAAG,MAAM,SAAS,CAAC;gBACtB,MAAM;gBACN,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM;gBACN,aAAa,EAAE,CAAC,OAAsB,EAAE,SAAS,EAAE,EAAE;oBACjD,0EAA0E;oBAC1E,iEAAiE;oBACjE,OAAO,GAAG,IAAI,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;oBACtD,OAAO,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;gBAC1E,CAAC;aACJ,CAAC,CAAA;YACF,MAAM,OAAO,CAAC,MAAM,EAAE,CAAA;QAC1B,CAAC;QACD,KAAK,CAAC,KAAK;YACP,MAAM,OAAO,EAAE,KAAK,EAAE,CAAA;QAC1B,CAAC;QACD,MAAM,CAAC,GAAe;YAClB,OAAO,WAAW,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,IAAI,GAAG;YACH,OAAO,MAAM,CAAA;QACjB,CAAC;QACD,IAAI,OAAO;YACP,OAAO,QAAQ,CAAC,OAAO,EAAE,CAAA;QAC7B,CAAC;QACD,IAAI,MAAM;YACN,OAAO,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAA;QAClC,CAAC;QACD,IAAI,OAAO;YACP,OAAO,OAAO,EAAE,SAAS,EAAE,IAAI,CAAA;QACnC,CAAC;QACD,IAAI,SAAS;YACT,OAAO,OAAO,EAAE,SAAS,CAAA;QAC7B,CAAC;KACJ,CAAA;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAA+C,EAAiB;IACxF,OAAO,EAAE,CAAA;AACb,CAAC"}

package/dist/crypto/aes-ige.d.ts

@@ -0,0 +1,3 @@
+export declare function igeEncrypt(data: Buffer, key: Buffer, iv: Buffer): Buffer;
+export declare function igeDecrypt(data: Buffer, key: Buffer, iv: Buffer): Buffer;
+//# sourceMappingURL=aes-ige.d.ts.map

package/dist/crypto/aes-ige.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes-ige.d.ts","sourceRoot":"","sources":["../../src/crypto/aes-ige.ts"],"names":[],"mappings":"AAgBA,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAmBxE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAmBxE"}

package/dist/crypto/aes-ige.js

@@ -0,0 +1,55 @@
+import { createCipheriv, createDecipheriv } from 'node:crypto';
+/**
+ * AES-256 in IGE (Infinite Garble Extension) mode, as used by MTProto.
+ *
+ * Reimplemented on Node's `aes-256-ecb` (the existing server used CryptoJS's
+ * IGE). Verified byte-identical against the old lib via a known-answer test.
+ * Input length must be a multiple of 16; IV is 32 bytes (two blocks).
+ */
+function xor16(a, b) {
+    const out = Buffer.allocUnsafe(16);
+    for (let i = 0; i < 16; i++)
+        out[i] = a[i] ^ b[i];
+    return out;
+}
+export function igeEncrypt(data, key, iv) {
+    if (data.length % 16 !== 0)
+        throw new Error('IGE: data length must be a multiple of 16');
+    if (iv.length !== 32)
+        throw new Error('IGE: iv must be 32 bytes');
+    const cipher = createCipheriv('aes-256-ecb', key, null);
+    cipher.setAutoPadding(false);
+    let prevCipher = iv.subarray(0, 16);
+    let prevPlain = iv.subarray(16, 32);
+    const out = Buffer.allocUnsafe(data.length);
+    for (let i = 0; i < data.length; i += 16) {
+        const block = data.subarray(i, i + 16);
+        const enc = cipher.update(xor16(block, prevCipher));
+        const c = xor16(enc, prevPlain);
+        c.copy(out, i);
+        prevCipher = c;
+        prevPlain = Buffer.from(block);
+    }
+    return out;
+}
+export function igeDecrypt(data, key, iv) {
+    if (data.length % 16 !== 0)
+        throw new Error('IGE: data length must be a multiple of 16');
+    if (iv.length !== 32)
+        throw new Error('IGE: iv must be 32 bytes');
+    const decipher = createDecipheriv('aes-256-ecb', key, null);
+    decipher.setAutoPadding(false);
+    let prevCipher = iv.subarray(0, 16);
+    let prevPlain = iv.subarray(16, 32);
+    const out = Buffer.allocUnsafe(data.length);
+    for (let i = 0; i < data.length; i += 16) {
+        const block = Buffer.from(data.subarray(i, i + 16));
+        const dec = decipher.update(xor16(block, prevPlain));
+        const p = xor16(dec, prevCipher);
+        p.copy(out, i);
+        prevCipher = block;
+        prevPlain = p;
+    }
+    return out;
+}
+//# sourceMappingURL=aes-ige.js.map

package/dist/crypto/aes-ige.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aes-ige.js","sourceRoot":"","sources":["../../src/crypto/aes-ige.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9D;;;;;;GAMG;AAEH,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;IACnD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,EAAU;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IACxF,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACjE,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IACvD,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IAE5B,IAAI,UAAU,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACnC,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAA;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAA;QACnD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAC/B,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACd,UAAU,GAAG,CAAC,CAAA;QACd,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,GAAW,EAAE,EAAU;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IACxF,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAC3D,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;IAE9B,IAAI,UAAU,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACnC,IAAI,SAAS,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAA;QACpD,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QAChC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QACd,UAAU,GAAG,KAAK,CAAA;QAClB,SAAS,GAAG,CAAC,CAAA;IACjB,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC"}

package/dist/crypto/dh.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Diffie-Hellman parameters and helpers for the auth-key exchange.
+ * The 2048-bit prime and generator are the exact values the existing server
+ * uses (`libs/mtproto-tools`), required for wire-compatibility.
+ */
+export declare const DH_PRIME: Buffer<ArrayBuffer>;
+export declare const DH_PRIME_BIGINT: bigint;
+export declare const DH_G = 3;
+export declare function modPow(base: bigint, exp: bigint, mod: bigint): bigint;
+/** MTProto padding: smallest r >= 0 with (a + r) divisible by b. */
+export declare function calculatePadding(a: number, b: number, min?: number): number;
+/**
+ * Returns [p, q, pq] where p < q are ~31-bit primes and pq = p*q fits in a
+ * signed 64-bit long. Mirrors the existing server's `makePQ`.
+ */
+export declare function makePQ(): {
+    p: bigint;
+    q: bigint;
+    pq: Buffer;
+};
+//# sourceMappingURL=dh.d.ts.map

package/dist/crypto/dh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dh.d.ts","sourceRoot":"","sources":["../../src/crypto/dh.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,eAAO,MAAM,QAAQ,qBAUpB,CAAA;AACD,eAAO,MAAM,eAAe,QAAuB,CAAA;AACnD,eAAO,MAAM,IAAI,IAAI,CAAA;AAErB,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAUrE;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,SAAI,GAAG,MAAM,CAItE;AA6CD;;;GAGG;AACH,wBAAgB,MAAM,IAAI;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAY7D"}

package/dist/crypto/dh.js

@@ -0,0 +1,99 @@
+import { randomBytes } from 'node:crypto';
+import { toBigIntBE } from '../util/bytes.js';
+/**
+ * Diffie-Hellman parameters and helpers for the auth-key exchange.
+ * The 2048-bit prime and generator are the exact values the existing server
+ * uses (`libs/mtproto-tools`), required for wire-compatibility.
+ */
+export const DH_PRIME = Buffer.from('C71CAEB9C6B1C9048E6C522F70F13F73980D40238E3E21C14934D037563D930F' +
+    '48198A0AA7C14058229493D22530F4DBFA336F6E0AC925139543AED44CCE7C37' +
+    '20FD51F69458705AC68CD4FE6B6B13ABDC9746512969328454F18FAF8C595F64' +
+    '2477FE96BB2A941D5BCD1D4AC8CC49880708FA9B378E3C4F3A9060BEE67CF9A4' +
+    'A4A695811051907E162753B56B0F6B410DBA74D8A84B2A14B3144E0EF1284754' +
+    'FD17ED950D5965B4B9DD46582DB1178D169C6BC465B0D6FF9CA3928FEF5B9AE4' +
+    'E418FC15E83EBEA0F87FA9FF5EED70050DED2849F47BF959D956850CE929851F' +
+    '0D8115F635B105EE2E4E15D04B2454BF6F4FADF034B10403119CD8E3B92FCC5B', 'hex');
+export const DH_PRIME_BIGINT = toBigIntBE(DH_PRIME);
+export const DH_G = 3;
+export function modPow(base, exp, mod) {
+    let result = 1n;
+    let b = base % mod;
+    let e = exp;
+    while (e > 0n) {
+        if (e & 1n)
+            result = (result * b) % mod;
+        e >>= 1n;
+        b = (b * b) % mod;
+    }
+    return result;
+}
+/** MTProto padding: smallest r >= 0 with (a + r) divisible by b. */
+export function calculatePadding(a, b, min = 0) {
+    let r = -a % b;
+    while (r < 0 || (min && r < min))
+        r += b;
+    return r + 0; // normalize -0 -> 0
+}
+// --- p, q factorization proof-of-work --------------------------------------
+const MAX_INT = 0x7fffffffn;
+const MAX_LONG = 0x7fffffffffffffffn;
+const MR_WITNESSES = [2n, 3n, 5n, 7n, 11n, 13n, 17n, 19n, 23n, 29n, 31n, 37n];
+function isProbablePrime(n) {
+    if (n < 2n)
+        return false;
+    for (const p of MR_WITNESSES) {
+        if (n === p)
+            return true;
+        if (n % p === 0n)
+            return false;
+    }
+    let d = n - 1n;
+    let r = 0n;
+    while ((d & 1n) === 0n) {
+        d >>= 1n;
+        r++;
+    }
+    for (const a of MR_WITNESSES) {
+        let x = modPow(a, d, n);
+        if (x === 1n || x === n - 1n)
+            continue;
+        let composite = true;
+        for (let i = 0n; i < r - 1n; i++) {
+            x = (x * x) % n;
+            if (x === n - 1n) {
+                composite = false;
+                break;
+            }
+        }
+        if (composite)
+            return false;
+    }
+    return true;
+}
+function randomPrime31() {
+    for (;;) {
+        let n = BigInt(randomBytes(4).readUInt32BE(0) & 0x7fffffff);
+        n |= 1n;
+        if (n < 3n || n > MAX_INT)
+            continue;
+        if (isProbablePrime(n))
+            return n;
+    }
+}
+/**
+ * Returns [p, q, pq] where p < q are ~31-bit primes and pq = p*q fits in a
+ * signed 64-bit long. Mirrors the existing server's `makePQ`.
+ */
+export function makePQ() {
+    let a;
+    let b;
+    let ab;
+    do {
+        a = randomPrime31();
+        b = randomPrime31();
+        ab = a * b;
+    } while (a > MAX_INT || b > MAX_INT || ab > MAX_LONG);
+    const pq = Buffer.from(ab.toString(16).padStart(16, '0'), 'hex');
+    return a < b ? { p: a, q: b, pq } : { p: b, q: a, pq };
+}
+//# sourceMappingURL=dh.js.map

package/dist/crypto/dh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dh.js","sourceRoot":"","sources":["../../src/crypto/dh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC/B,kEAAkE;IAC9D,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE;IAClE,kEAAkE,EACtE,KAAK,CACR,CAAA;AACD,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;AACnD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,CAAA;AAErB,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IACzD,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC,GAAG,IAAI,GAAG,GAAG,CAAA;IAClB,IAAI,CAAC,GAAG,GAAG,CAAA;IACX,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,GAAG,EAAE;YAAE,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAA;QACvC,CAAC,KAAK,EAAE,CAAA;QACR,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAA;IACrB,CAAC;IACD,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,CAAS,EAAE,CAAS,EAAE,GAAG,GAAG,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;IACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO,CAAC,GAAG,CAAC,CAAA,CAAC,oBAAoB;AACrC,CAAC;AAED,8EAA8E;AAE9E,MAAM,OAAO,GAAG,WAAW,CAAA;AAC3B,MAAM,QAAQ,GAAG,mBAAmB,CAAA;AACpC,MAAM,YAAY,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAE7E,SAAS,eAAe,CAAC,CAAS;IAC9B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;IAClC,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAA;IACd,IAAI,CAAC,GAAG,EAAE,CAAA;IACV,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACrB,CAAC,KAAK,EAAE,CAAA;QACR,CAAC,EAAE,CAAA;IACP,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACvB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YAAE,SAAQ;QACtC,IAAI,SAAS,GAAG,IAAI,CAAA;QACpB,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/B,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;YACf,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAA;gBACjB,MAAK;YACT,CAAC;QACL,CAAC;QACD,IAAI,SAAS;YAAE,OAAO,KAAK,CAAA;IAC/B,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC;AAED,SAAS,aAAa;IAClB,SAAS,CAAC;QACN,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAA;QAC3D,CAAC,IAAI,EAAE,CAAA;QACP,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,OAAO;YAAE,SAAQ;QACnC,IAAI,eAAe,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAA;IACpC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM;IAClB,IAAI,CAAS,CAAA;IACb,IAAI,CAAS,CAAA;IACb,IAAI,EAAU,CAAA;IACd,GAAG,CAAC;QACA,CAAC,GAAG,aAAa,EAAE,CAAA;QACnB,CAAC,GAAG,aAAa,EAAE,CAAA;QACnB,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;IACd,CAAC,QAAQ,CAAC,GAAG,OAAO,IAAI,CAAC,GAAG,OAAO,IAAI,EAAE,GAAG,QAAQ,EAAC;IAErD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IAChE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAA;AAC1D,CAAC"}

package/dist/crypto/hashes.d.ts

@@ -0,0 +1,6 @@
+export { xorBuffers } from '../util/bytes.js';
+export declare function sha1(buf: Buffer): Buffer;
+export declare function sha256(buf: Buffer): Buffer;
+/** Cryptographically-random bigint of the given bit width (multiple of 8). */
+export declare function randomBigInt(bits: number): bigint;
+//# sourceMappingURL=hashes.d.ts.map

package/dist/crypto/hashes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashes.d.ts","sourceRoot":"","sources":["../../src/crypto/hashes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExC;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD"}

package/dist/crypto/hashes.js

@@ -0,0 +1,14 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { toBigIntBE } from '../util/bytes.js';
+export { xorBuffers } from '../util/bytes.js';
+export function sha1(buf) {
+    return createHash('sha1').update(buf).digest();
+}
+export function sha256(buf) {
+    return createHash('sha256').update(buf).digest();
+}
+/** Cryptographically-random bigint of the given bit width (multiple of 8). */
+export function randomBigInt(bits) {
+    return toBigIntBE(randomBytes(bits / 8));
+}
+//# sourceMappingURL=hashes.js.map

package/dist/crypto/hashes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashes.js","sourceRoot":"","sources":["../../src/crypto/hashes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,MAAM,UAAU,IAAI,CAAC,GAAW;IAC5B,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW;IAC9B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAA;AACpD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,OAAO,UAAU,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAA;AAC5C,CAAC"}

package/dist/crypto/msg-key.d.ts

@@ -0,0 +1,15 @@
+/**
+ * MTProto 2.0 message-key derivation. `outgoing` selects the key half
+ * (server->client uses x=8). Ported from the existing `messageEncryption.js`;
+ * pinned by a known-answer test.
+ */
+export declare function generateMessageKey(authKey: Buffer, msgKey: Buffer, outgoing: boolean): {
+    aesKey: Buffer;
+    aesIv: Buffer;
+};
+/**
+ * msg_key = SHA256(authKey[88+x : 88+x+32] ‖ plaintext)[8:24] (MTProto 2.0),
+ * where x = 8 for server->client (outgoing) and x = 0 for client->server.
+ */
+export declare function computeMsgKey(authKey: Buffer, plaintext: Buffer, outgoing: boolean): Buffer;
+//# sourceMappingURL=msg-key.d.ts.map

package/dist/crypto/msg-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"msg-key.d.ts","sourceRoot":"","sources":["../../src/crypto/msg-key.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,wBAAgB,kBAAkB,CAC9B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,GAClB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAQnC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,MAAM,CAG3F"}

package/dist/crypto/msg-key.js

@@ -0,0 +1,24 @@
+import { sha256 } from './hashes.js';
+/**
+ * MTProto 2.0 message-key derivation. `outgoing` selects the key half
+ * (server->client uses x=8). Ported from the existing `messageEncryption.js`;
+ * pinned by a known-answer test.
+ */
+export function generateMessageKey(authKey, msgKey, outgoing) {
+    const x = outgoing ? 8 : 0;
+    const a = sha256(Buffer.concat([msgKey, authKey.subarray(x, x + 36)]));
+    const b = sha256(Buffer.concat([authKey.subarray(x + 40, x + 76), msgKey]));
+    return {
+        aesKey: Buffer.concat([a.subarray(0, 8), b.subarray(8, 24), a.subarray(24, 32)]),
+        aesIv: Buffer.concat([b.subarray(0, 8), a.subarray(8, 24), b.subarray(24, 32)]),
+    };
+}
+/**
+ * msg_key = SHA256(authKey[88+x : 88+x+32] ‖ plaintext)[8:24] (MTProto 2.0),
+ * where x = 8 for server->client (outgoing) and x = 0 for client->server.
+ */
+export function computeMsgKey(authKey, plaintext, outgoing) {
+    const x = outgoing ? 8 : 0;
+    return sha256(Buffer.concat([authKey.subarray(88 + x, 88 + x + 32), plaintext])).subarray(8, 24);
+}
+//# sourceMappingURL=msg-key.js.map

package/dist/crypto/msg-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"msg-key.js","sourceRoot":"","sources":["../../src/crypto/msg-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAC9B,OAAe,EACf,MAAc,EACd,QAAiB;IAEjB,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACtE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IAC3E,OAAO;QACH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAChF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;KAClF,CAAA;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,SAAiB,EAAE,QAAiB;IAC/E,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACpG,CAAC"}

package/dist/crypto/rsa.d.ts

@@ -0,0 +1,27 @@
+import { type KeyObject } from 'node:crypto';
+export interface RsaKeyPair {
+    privateKey: KeyObject;
+    publicKey: KeyObject;
+    /** Lower-64-bit key fingerprint advertised to clients in resPQ. */
+    fingerprint: bigint;
+    fingerprintBuf: Buffer;
+}
+/**
+ * Telegram RSA fingerprint: take the bare TL serialization of the public key
+ * (modulus `n` and exponent `e` as `bytes`), SHA1 it, and use the last 8 bytes.
+ */
+export declare function computeFingerprint(publicKey: KeyObject): {
+    fingerprint: bigint;
+    buf: Buffer;
+};
+/**
+ * Loads the gateway's RSA key pair. With `pemPath` set, the operator-provided
+ * production key is used (its fingerprint must match what clients have pinned).
+ * Without it, an ephemeral 2048-bit key is generated for local dev/testing.
+ */
+export declare function loadRsaKeyPair(pemPath?: string): RsaKeyPair;
+/** RSA decrypt of the client's `encrypted_data` with no padding (raw 256 bytes). */
+export declare function rsaDecryptNoPadding(privateKey: KeyObject, encryptedData: Buffer): Buffer;
+/** RSA encrypt with no padding — used only by the test client. */
+export declare function rsaEncryptNoPadding(publicKey: KeyObject, data: Buffer): Buffer;
+//# sourceMappingURL=rsa.d.ts.map

package/dist/crypto/rsa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsa.d.ts","sourceRoot":"","sources":["../../src/crypto/rsa.ts"],"names":[],"mappings":"AAAA,OAAO,EAOH,KAAK,SAAS,EACjB,MAAM,aAAa,CAAA;AAMpB,MAAM,WAAW,UAAU;IACvB,UAAU,EAAE,SAAS,CAAA;IACrB,SAAS,EAAE,SAAS,CAAA;IACpB,mEAAmE;IACnE,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;CACzB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAU7F;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,UAAU,CAgB3D;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9E"}

package/dist/crypto/rsa.js

@@ -0,0 +1,50 @@
+import { constants, createPrivateKey, createPublicKey, generateKeyPairSync, privateDecrypt, publicEncrypt, } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { TlWriter } from '../tl/writer.js';
+import { sha1 } from './hashes.js';
+import { toBigIntLE } from '../util/bytes.js';
+/**
+ * Telegram RSA fingerprint: take the bare TL serialization of the public key
+ * (modulus `n` and exponent `e` as `bytes`), SHA1 it, and use the last 8 bytes.
+ */
+export function computeFingerprint(publicKey) {
+    const jwk = publicKey.export({ format: 'jwk' });
+    const n = Buffer.from(jwk.n, 'base64url');
+    const e = Buffer.from(jwk.e, 'base64url');
+    const w = new TlWriter();
+    w.writeBytes(n);
+    w.writeBytes(e);
+    const digest = sha1(w.toBuffer());
+    const buf = digest.subarray(12, 20);
+    return { fingerprint: toBigIntLE(buf), buf: Buffer.from(buf) };
+}
+/**
+ * Loads the gateway's RSA key pair. With `pemPath` set, the operator-provided
+ * production key is used (its fingerprint must match what clients have pinned).
+ * Without it, an ephemeral 2048-bit key is generated for local dev/testing.
+ */
+export function loadRsaKeyPair(pemPath) {
+    let privateKey;
+    let publicKey;
+    if (pemPath) {
+        const pem = readFileSync(pemPath, 'utf-8');
+        privateKey = createPrivateKey(pem);
+        publicKey = createPublicKey(privateKey);
+    }
+    else {
+        const pair = generateKeyPairSync('rsa', { modulusLength: 2048 });
+        privateKey = pair.privateKey;
+        publicKey = pair.publicKey;
+    }
+    const { fingerprint, buf } = computeFingerprint(publicKey);
+    return { privateKey, publicKey, fingerprint, fingerprintBuf: buf };
+}
+/** RSA decrypt of the client's `encrypted_data` with no padding (raw 256 bytes). */
+export function rsaDecryptNoPadding(privateKey, encryptedData) {
+    return privateDecrypt({ key: privateKey, padding: constants.RSA_NO_PADDING }, encryptedData);
+}
+/** RSA encrypt with no padding — used only by the test client. */
+export function rsaEncryptNoPadding(publicKey, data) {
+    return publicEncrypt({ key: publicKey, padding: constants.RSA_NO_PADDING }, data);
+}
+//# sourceMappingURL=rsa.js.map

package/dist/crypto/rsa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rsa.js","sourceRoot":"","sources":["../../src/crypto/rsa.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,SAAS,EACT,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,aAAa,GAEhB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAU7C;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAoB;IACnD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAA6B,CAAA;IAC3E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IACzC,MAAM,CAAC,GAAG,IAAI,QAAQ,EAAE,CAAA;IACxB,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACf,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACf,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACnC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC3C,IAAI,UAAqB,CAAA;IACzB,IAAI,SAAoB,CAAA;IAExB,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC1C,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAClC,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC3C,CAAC;SAAM,CAAC;QACJ,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAChE,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAC5B,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;IAC9B,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC1D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,EAAE,CAAA;AACtE,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,UAAqB,EAAE,aAAqB;IAC5E,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,aAAa,CAAC,CAAA;AAChG,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,SAAoB,EAAE,IAAY;IAClE,OAAO,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,CAAA;AACrF,CAAC"}

package/dist/dispatch/dispatcher.d.ts

@@ -0,0 +1,72 @@
+import type { TlCodec } from '../tl/codec.js';
+import type { TlRegistry } from '../tl/registry.js';
+import { MigrationRegistry } from '@mt-tl/tl';
+import type { Connection } from '../transport/connection.js';
+import type { Storage } from '../storage/index.js';
+import type { SaltService } from '../session/salts.js';
+import { type MessageContext, type Responder } from './types.js';
+import type { RpcForwarder } from './rpc-forwarder.js';
+import type { PresenceBinder } from '../updates/presence-binder.js';
+import type { UpdateLog } from '../core/updates.js';
+import { type Logger } from '@mt-tl/tl';
+export interface DispatcherDeps {
+    codec: TlCodec;
+    registry: TlRegistry;
+    storage: Storage;
+    saltService: SaltService;
+    responder: Responder;
+    forwarder: RpcForwarder;
+    /** Presence/registry binder; defaults to a no-op (push disabled). */
+    binder?: PresenceBinder;
+    /** Per-predicate migration ladders; defaults to empty (identity). */
+    migrations?: MigrationRegistry;
+    /** Observability sink; defaults to a no-op logger. */
+    logger?: Logger;
+    /** Disable inbound seqno validation for container-inner messages (mirrors the
+     *  pipeline's `disableSeqNoCheck`); default enforced. */
+    disableSeqNoCheck?: boolean;
+    /** Durable pts log for protocol-managed `updates.getState`/`getDifference`. */
+    updateLog?: UpdateLog;
+    /** When true (+ `updateLog`), answer getState/getDifference in-engine. */
+    managedUpdates?: boolean;
+    /** Whitelist of accepted `initConnection.api_id`s; omitted → any id is accepted. */
+    allowedApiIds?: Iterable<number>;
+}
+export declare class Dispatcher {
+    private readonly deps;
+    private readonly binder;
+    private readonly migrations;
+    private readonly logger;
+    private readonly checkSeqNo;
+    private readonly managedUpdates;
+    /** Built once from `deps.allowedApiIds`; undefined = whitelist disabled. */
+    private readonly allowedApiIds?;
+    constructor(deps: DispatcherDeps);
+    /** Entry point: a raw message body (after the encrypted envelope). */
+    dispatchPayload(payload: Buffer, ctx: MessageContext, conn: Connection): Promise<void>;
+    private dispatchObject;
+    /**
+     * Process an `initConnection` envelope: optionally enforce the `api_id`
+     * whitelist, then capture the device/app fields onto the connection and
+     * persist them to the auth key's meta (the per-device source of truth; an
+     * auth key is one app install, so this is stable per key, not per session).
+     * Returns `true` when the connection was rejected (caller must not dispatch
+     * the wrapped query).
+     */
+    private handleInitConnection;
+    /**
+     * Engine-owned `updates.getState` / `updates.getDifference` (when
+     * `config.updates.managed`). Common pts sequence only — qts/seq/channels are 0.
+     * Updates are returned in `other_updates`; the durable {@link UpdateLog}
+     * supplies pts. Auth-gated like a normal `auth: true` method.
+     */
+    private handleManagedUpdate;
+    private handleService;
+    private forwardBusiness;
+    /** Apply backend-requested mutations to gateway-owned auth/session state. */
+    private applyEffects;
+    private patchSession;
+    private sendRpcResult;
+    private sendRpcError;
+}
+//# sourceMappingURL=dispatcher.d.ts.map

package/dist/dispatch/dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/dispatch/dispatcher.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAoB,iBAAiB,EAA+C,MAAM,WAAW,CAAA;AAC5G,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAoB,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,YAAY,CAAA;AAElF,OAAO,KAAK,EAAE,YAAY,EAA6B,MAAM,oBAAoB,CAAA;AACjF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAEnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,WAAW,CAAA;AAsCnD,MAAM,WAAW,cAAc;IAC3B,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,UAAU,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,WAAW,CAAA;IACxB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,YAAY,CAAA;IACvB,qEAAqE;IACrE,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;6DACyD;IACzD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,+EAA+E;IAC/E,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,0EAA0E;IAC1E,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,oFAAoF;IACpF,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;CACnC;AAED,qBAAa,UAAU;IASP,OAAO,CAAC,QAAQ,CAAC,IAAI;IARjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAqB;gBAEvB,IAAI,EAAE,cAAc;IASjD,sEAAsE;IAChE,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAwE9E,cAAc;IAsC5B;;;;;;;OAOG;YACW,oBAAoB;IAmClC;;;;;OAKG;YACW,mBAAmB;YA+CnB,aAAa;YAoGb,eAAe;IAgF7B,6EAA6E;YAC/D,YAAY;YA6BZ,YAAY;IAS1B,OAAO,CAAC,aAAa;IAcrB,OAAO,CAAC,YAAY;CAOvB"}