@mt-tl/server 0.1.0

package/dist/dispatch/types.d.ts

@@ -0,0 +1,32 @@
+import type { Connection } from '../transport/connection.js';
+import type { TlObject } from '@mt-tl/tl';
+import type { AcceptResult } from '../session/inbound-tracker.js';
+/** Per-message context extracted from the encrypted envelope. */
+export interface MessageContext {
+    msgId: bigint;
+    seqNo: number;
+    sessionId: bigint;
+    authKeyId: bigint;
+    salt: bigint;
+}
+export interface SendOptions {
+    /** Notification (msg_id ends in 3), not a direct response. */
+    isNotification?: boolean;
+    /** Consumes a seqno slot and gets an odd seqno (default true). */
+    contentRelated?: boolean;
+}
+/** Sends an encrypted message back to a connected client. */
+export interface Responder {
+    sendEncrypted(conn: Connection, body: TlObject, opts?: SendOptions): void;
+}
+/**
+ * Reply to a rejected inbound message (the non-`ok` result of
+ * `InboundTracker.accept`): `bad_msg_notification` for a coded violation,
+ * `msg_detailed_info` for a duplicate whose answer is cached, or nothing for a
+ * benign silent drop. Shared by the pipeline (outer envelope) and the dispatcher
+ * (container-inner messages).
+ */
+export declare function replyToBadAccept(responder: Responder, conn: Connection, result: Exclude<AcceptResult, {
+    ok: true;
+}>, msgId: bigint, seqNo: number): void;
+//# sourceMappingURL=types.d.ts.map

package/dist/dispatch/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/dispatch/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAEjE,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,WAAW;IACxB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,kEAAkE;IAClE,cAAc,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACtB,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;CAC5E;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC5B,SAAS,EAAE,SAAS,EACpB,IAAI,EAAE,UAAU,EAChB,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,EAC3C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACd,IAAI,CAqBN"}

package/dist/dispatch/types.js

@@ -0,0 +1,23 @@
+/**
+ * Reply to a rejected inbound message (the non-`ok` result of
+ * `InboundTracker.accept`): `bad_msg_notification` for a coded violation,
+ * `msg_detailed_info` for a duplicate whose answer is cached, or nothing for a
+ * benign silent drop. Shared by the pipeline (outer envelope) and the dispatcher
+ * (container-inner messages).
+ */
+export function replyToBadAccept(responder, conn, result, msgId, seqNo) {
+    if ('code' in result) {
+        responder.sendEncrypted(conn, { _: 'bad_msg_notification', bad_msg_id: msgId, bad_msg_seqno: seqNo, error_code: result.code }, { contentRelated: false });
+    }
+    else if ('detailed' in result) {
+        responder.sendEncrypted(conn, {
+            _: 'msg_detailed_info',
+            msg_id: msgId,
+            answer_msg_id: result.detailed.answerMsgId,
+            bytes: result.detailed.bytes,
+            status: 0,
+        }, { contentRelated: false });
+    }
+    // { drop: true } → no reply.
+}
+//# sourceMappingURL=types.js.map

package/dist/dispatch/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/dispatch/types.ts"],"names":[],"mappings":"AAyBA;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAC5B,SAAoB,EACpB,IAAgB,EAChB,MAA2C,EAC3C,KAAa,EACb,KAAa;IAEb,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACnB,SAAS,CAAC,aAAa,CACnB,IAAI,EACJ,EAAE,CAAC,EAAE,sBAAsB,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,EAC/F,EAAE,cAAc,EAAE,KAAK,EAAE,CAC5B,CAAA;IACL,CAAC;SAAM,IAAI,UAAU,IAAI,MAAM,EAAE,CAAC;QAC9B,SAAS,CAAC,aAAa,CACnB,IAAI,EACJ;YACI,CAAC,EAAE,mBAAmB;YACtB,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW;YAC1C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YAC5B,MAAM,EAAE,CAAC;SACZ,EACD,EAAE,cAAc,EAAE,KAAK,EAAE,CAC5B,CAAA;IACL,CAAC;IACD,6BAA6B;AACjC,CAAC"}

package/dist/gateway.d.ts

@@ -0,0 +1,57 @@
+import { type Storage } from './storage/index.js';
+import type { RpcForwarder } from './dispatch/rpc-forwarder.js';
+import { MessagePipeline } from './server/message-pipeline.js';
+import { MtprotoWsServer } from './transport/ws-server.js';
+import { MtprotoTcpServer } from './transport/tcp-server.js';
+import { ConnectionRegistry } from './transport/connection-registry.js';
+import type { Presence } from './updates/presence.js';
+import type { UpdateBus } from './updates/update-bus.js';
+import type { UpdateLog } from './core/updates.js';
+import type { MTProtoConfig } from './config.js';
+import { type Logger } from '@mt-tl/tl';
+import type { MigrationRegistry } from '@mt-tl/tl';
+import type { KeyObject } from 'node:crypto';
+export interface Gateway {
+    /** Present when `config.wsPort` is set. */
+    wsServer?: MtprotoWsServer;
+    /** Present when `config.tcpPort` is set. */
+    tcpServer?: MtprotoTcpServer;
+    pipeline: MessagePipeline;
+    storage: Storage;
+    registry: ConnectionRegistry;
+    nodeId: string;
+    fingerprint: bigint;
+    /** Gateway's RSA public key (clients encrypt pq_inner_data with it). */
+    publicKey: KeyObject;
+    stats: {
+        constructors: number;
+        methods: number;
+        crcMismatches: number;
+        layers: number[];
+    };
+    /** Start every configured carrier. */
+    listen(): Promise<void>;
+    close(): Promise<void>;
+}
+export interface BuildOptions {
+    forwarder?: RpcForwarder;
+    /** Structured logger for observability; defaults to env-configured. */
+    logger?: Logger;
+    /** Enables server-push: presence map (Redis in prod, in-memory for tests). */
+    presence?: Presence;
+    /** Update bus this node consumes routed deliveries from (Redis pub/sub in prod). */
+    bus?: UpdateBus;
+    /** Per-predicate migration ladders (input up / output down). */
+    migrations?: MigrationRegistry;
+    /** Durable pts log read by the engine to answer getState/getDifference when managed. */
+    updateLog?: UpdateLog;
+    /** When true, the engine answers `updates.getState`/`getDifference` from `updateLog`. */
+    managedUpdates?: boolean;
+}
+/**
+ * Wires the gateway from config: load schema -> codec, RSA key, storage,
+ * handshake, dispatcher, pipeline, and the WS carrier. Returns the assembled
+ * gateway; call `wsServer.listen()` to start accepting clients.
+ */
+export declare function buildGateway(config: MTProtoConfig, opts?: BuildOptions): Promise<Gateway>;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAKA,OAAO,EAAiB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAMhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAA;AAGvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAE5C,MAAM,WAAW,OAAO;IACpB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,eAAe,CAAA;IAC1B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,gBAAgB,CAAA;IAC5B,QAAQ,EAAE,eAAe,CAAA;IACzB,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,wEAAwE;IACxE,SAAS,EAAE,SAAS,CAAA;IACpB,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACzF,sCAAsC;IACtC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAED,MAAM,WAAW,YAAY;IACzB,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,oFAAoF;IACpF,GAAG,CAAC,EAAE,SAAS,CAAA;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,wFAAwF;IACxF,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,yFAAyF;IACzF,cAAc,CAAC,EAAE,OAAO,CAAA;CAC3B;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAmJnG"}

package/dist/gateway.js

@@ -0,0 +1,150 @@
+import { protocolSchemaDir } from '@mt-tl/tl';
+import { loadSchema } from './tl/registry.js';
+import { TlCodec } from './tl/codec.js';
+import { loadLayeredRegistry } from './tl/layered-registry.js';
+import { loadRsaKeyPair } from './crypto/rsa.js';
+import { createStorage } from './storage/index.js';
+import { NonceStore } from './auth/nonce-store.js';
+import { Handshake } from './auth/handshake.js';
+import { SaltService } from './session/salts.js';
+import { Dispatcher } from './dispatch/dispatcher.js';
+import { PrintForwarder } from './dispatch/forwarders/print.js';
+import { MessagePipeline } from './server/message-pipeline.js';
+import { MtprotoWsServer } from './transport/ws-server.js';
+import { MtprotoTcpServer } from './transport/tcp-server.js';
+import { ConnectionRegistry } from './transport/connection-registry.js';
+import { NodePresenceBinder, NoopPresenceBinder } from './updates/presence-binder.js';
+import { PushService } from './updates/push.js';
+import { createLogger } from '@mt-tl/tl';
+/**
+ * Wires the gateway from config: load schema -> codec, RSA key, storage,
+ * handshake, dispatcher, pipeline, and the WS carrier. Returns the assembled
+ * gateway; call `wsServer.listen()` to start accepting clients.
+ */
+export async function buildGateway(config, opts = {}) {
+    const logger = opts.logger ?? createLogger({ name: config.nodeId });
+    // Merge the framework's protocol schema with the app's business schema — the
+    // consumer ships only business `.tl`; the protocol layer lives in @mt-tl/tl.
+    const { registry, constructors, methods, crcMismatches } = loadSchema([
+        protocolSchemaDir,
+        config.schemaDir,
+    ]);
+    const layeredAll = loadLayeredRegistry(config.schemaLayersDir);
+    const layered = layeredAll.hasLayers() ? layeredAll : undefined;
+    // Decode-union: register every layer's constructor ids so older-layer clients
+    // decode by id (the name index keeps the newest, so encode is unaffected).
+    for (const def of layeredAll.allDefs())
+        registry.register(def);
+    const codec = new TlCodec(registry, layered);
+    const rsa = loadRsaKeyPair(config.rsaKeyPath);
+    const storage = await createStorage(config.storage);
+    const saltService = new SaltService(storage.salts);
+    const nonceStore = new NonceStore();
+    const handshake = new Handshake({
+        codec,
+        rsa,
+        storage,
+        saltService,
+        nonceStore,
+        defaultLayer: config.defaultLayer,
+        logger: logger.child({ scope: 'handshake' }),
+    });
+    const forwarder = opts.forwarder ?? new PrintForwarder(logger.child({ scope: 'rpc' }));
+    // Presence / server-push wiring (no-op unless a presence map is supplied).
+    const connRegistry = new ConnectionRegistry();
+    const binder = opts.presence
+        ? new NodePresenceBinder(config.nodeId, connRegistry, opts.presence)
+        : new NoopPresenceBinder();
+    const migrations = opts.migrations;
+    const pipeline = new MessagePipeline({
+        codec,
+        storage,
+        handshake,
+        saltService,
+        defaultLayer: config.defaultLayer,
+        binder,
+        disableMsgKeyCheck: config.disableMsgKeyCheck,
+        disableSeqNoCheck: config.disableSeqNoCheck,
+        logger: logger.child({ scope: 'mtproto' }),
+    });
+    pipeline.dispatcher = new Dispatcher({
+        codec,
+        registry,
+        storage,
+        saltService,
+        responder: pipeline,
+        forwarder,
+        binder,
+        migrations,
+        logger: logger.child({ scope: 'rpc' }),
+        disableSeqNoCheck: config.disableSeqNoCheck,
+        updateLog: opts.updateLog,
+        managedUpdates: opts.managedUpdates,
+        allowedApiIds: config.allowedApiIds,
+    });
+    // Consume routed updates addressed to this node and push to local sockets.
+    if (opts.bus && opts.presence) {
+        const push = new PushService(connRegistry, pipeline, layered, migrations, logger.child({ scope: 'push' }));
+        opts.bus.subscribeNode(config.nodeId, msg => {
+            if (msg.authKeyId !== undefined)
+                push.deliverToAuthKey(msg.authKeyId, msg.update);
+            else if (msg.subject !== undefined)
+                push.deliver(msg.subject, msg.update);
+        });
+    }
+    // Refresh presence TTL for locally-connected users + auth keys (heartbeat).
+    let heartbeat;
+    if (opts.presence) {
+        const presence = opts.presence;
+        heartbeat = setInterval(() => {
+            for (const subject of connRegistry.subjects())
+                void presence.add(subject, config.nodeId).catch(() => { });
+            for (const authKeyId of connRegistry.authKeys())
+                void presence.addAuthKey(authKeyId, config.nodeId).catch(() => { });
+        }, Math.max(5_000, Math.floor(config.updates.presenceTtlMs / 3)));
+        if (typeof heartbeat.unref === 'function')
+            heartbeat.unref();
+    }
+    const handlers = {
+        onPacket: (packet, conn) => pipeline.handlePacket(packet, conn),
+        onClose: (conn) => binder.unbind(conn),
+    };
+    const wsServer = config.wsPort !== undefined
+        ? new MtprotoWsServer({
+            port: config.wsPort,
+            defaultLayer: config.defaultLayer,
+            trustProxy: config.trustProxy,
+            logger,
+        }, handlers)
+        : undefined;
+    const tcpServer = config.tcpPort !== undefined
+        ? new MtprotoTcpServer({
+            port: config.tcpPort,
+            defaultLayer: config.defaultLayer,
+            trustProxy: config.trustProxy,
+            logger,
+        }, handlers)
+        : undefined;
+    return {
+        wsServer,
+        tcpServer,
+        pipeline,
+        storage,
+        registry: connRegistry,
+        nodeId: config.nodeId,
+        fingerprint: rsa.fingerprint,
+        publicKey: rsa.publicKey,
+        stats: { constructors, methods, crcMismatches, layers: layeredAll.layerNumbers() },
+        async listen() {
+            await Promise.all([wsServer?.listen(), tcpServer?.listen()]);
+        },
+        async close() {
+            if (heartbeat)
+                clearInterval(heartbeat);
+            wsServer?.close();
+            tcpServer?.close();
+            await storage.close();
+        },
+    };
+}
+//# sourceMappingURL=gateway.js.map

package/dist/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../src/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,aAAa,EAAgB,MAAM,oBAAoB,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAE/D,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAuB,MAAM,8BAA8B,CAAA;AAC1G,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAK/C,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAA;AAsCrD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAqB,EAAE,OAAqB,EAAE;IAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;IAEnE,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,UAAU,CAAC;QAClE,iBAAiB;QACjB,MAAM,CAAC,SAAS;KACnB,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/D,8EAA8E;IAC9E,2EAA2E;IAC3E,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9D,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC7C,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACnD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAElD,MAAM,UAAU,GAAG,IAAI,UAAU,EAAE,CAAA;IACnC,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC;QAC5B,KAAK;QACL,GAAG;QACH,OAAO;QACP,WAAW;QACX,UAAU;QACV,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;KAC/C,CAAC,CAAA;IAEF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAEtF,2EAA2E;IAC3E,MAAM,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAA;IAC7C,MAAM,MAAM,GAAmB,IAAI,CAAC,QAAQ;QACxC,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC;QACpE,CAAC,CAAC,IAAI,kBAAkB,EAAE,CAAA;IAE9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;IAClC,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;QACjC,KAAK;QACL,OAAO;QACP,SAAS;QACT,WAAW;QACX,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,MAAM;QACN,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;KAC7C,CAAC,CAAA;IACF,QAAQ,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC;QACjC,KAAK;QACL,QAAQ;QACR,OAAO;QACP,WAAW;QACX,SAAS,EAAE,QAAQ;QACnB,SAAS;QACT,MAAM;QACN,UAAU;QACV,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACtC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,MAAM,CAAC,aAAa;KACtC,CAAC,CAAA;IAEF,2EAA2E;IAC3E,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,WAAW,CACxB,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,UAAU,EACV,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAClC,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;YACxC,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;iBAC5E,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC7E,CAAC,CAAC,CAAA;IACN,CAAC;IAED,4EAA4E;IAC5E,IAAI,SAAqD,CAAA;IACzD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC9B,SAAS,GAAG,WAAW,CACnB,GAAG,EAAE;YACD,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,QAAQ,EAAE;gBACzC,KAAK,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YAC7D,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,QAAQ,EAAE;gBAC3C,KAAK,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC1E,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAChE,CAAA;QACD,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU;YAAE,SAAS,CAAC,KAAK,EAAE,CAAA;IAChE,CAAC;IAED,MAAM,QAAQ,GAAG;QACb,QAAQ,EAAE,CAAC,MAAc,EAAE,IAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC;QACnF,OAAO,EAAE,CAAC,IAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;KACrD,CAAA;IAED,MAAM,QAAQ,GACV,MAAM,CAAC,MAAM,KAAK,SAAS;QACvB,CAAC,CAAC,IAAI,eAAe,CACf;YACI,IAAI,EAAE,MAAM,CAAC,MAAM;YACnB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM;SACT,EACD,QAAQ,CACX;QACH,CAAC,CAAC,SAAS,CAAA;IACnB,MAAM,SAAS,GACX,MAAM,CAAC,OAAO,KAAK,SAAS;QACxB,CAAC,CAAC,IAAI,gBAAgB,CAChB;YACI,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM;SACT,EACD,QAAQ,CACX;QACH,CAAC,CAAC,SAAS,CAAA;IAEnB,OAAO;QACH,QAAQ;QACR,SAAS;QACT,QAAQ;QACR,OAAO;QACP,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,KAAK,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC,YAAY,EAAE,EAAE;QAClF,KAAK,CAAC,MAAM;YACR,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;QAChE,CAAC;QACD,KAAK,CAAC,KAAK;YACP,IAAI,SAAS;gBAAE,aAAa,CAAC,SAAS,CAAC,CAAA;YACvC,QAAQ,EAAE,KAAK,EAAE,CAAA;YACjB,SAAS,EAAE,KAAK,EAAE,CAAA;YAClB,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;QACzB,CAAC;KACJ,CAAA;AACL,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from './create-server.js';
+export * from './update-publisher.js';
+export { AppError, BadRequestError, AuthRequiredError, NotFoundError, FloodWaitError, InternalError, defineHook, type Hook, RpcRegistry, dispatchRpc, type DispatchDeps, type HandlerCtx, type RpcMethodSpec, type RpcMethodMap, type RpcModule, type UpdateEmitter, } from './core/index.js';
+export type { MTProtoConfig } from './lib.js';
+export { createLogger, noopLogger, type Logger, type LogLevel, type LoggerOptions, type Fields, } from './lib.js';
+export { MigrationRegistry, type MigrationRung } from '@mt-tl/tl';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AAGrC,OAAO,EAEH,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,aAAa,EAEb,UAAU,EACV,KAAK,IAAI,EAET,WAAW,EACX,WAAW,EACX,KAAK,YAAY,EAEjB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,aAAa,GACrB,MAAM,iBAAiB,CAAA;AAGxB,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAM7C,OAAO,EACH,YAAY,EACZ,UAAU,EACV,KAAK,MAAM,EACX,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,MAAM,GACd,MAAM,UAAU,CAAA;AAIjB,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,WAAW,CAAA"}

package/dist/index.js

@@ -0,0 +1,25 @@
+// @mt-tl/server — the consumer-facing framework facade. Install this (plus
+// @mt-tl/tl for codegen) to build an MTProto server: define routes, listen.
+// The protocol engine (transport/crypto/session/dispatch) and the handler layer
+// (registry/dispatch/hooks/context/errors, under ./core) live in this same
+// package; this file re-exports just the consumer surface — not the internal
+// event/job/runner machinery.
+export * from './create-server.js'; // createServer, definePlugin, MtprotoServer, Plugin, MethodOpts/Handler
+export * from './update-publisher.js'; // createUpdatePublisher
+// Handler surface (curated from ./core).
+export { 
+// errors → rpc_error
+AppError, BadRequestError, AuthRequiredError, NotFoundError, FloodWaitError, InternalError, 
+// hooks
+defineHook, 
+// dispatch + registry (for tests / advanced wiring)
+RpcRegistry, dispatchRpc, } from './core/index.js';
+// Structured logger (re-exported from @mt-tl/tl) — build one with createLogger
+// and pass it to createServer, or use the same factory in your app code for a
+// unified log style. Handlers get a per-request child via `ctx.log`; the server
+// exposes its root logger as `app.log`. See docs/guide/observability.md.
+export { createLogger, noopLogger, } from './lib.js';
+// Schema-version migration ladders (input `up` / output `down`) — pass via
+// createServer(config, { migrations }). See docs/guide/releasing-a-version.md.
+export { MigrationRegistry } from '@mt-tl/tl';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,4EAA4E;AAC5E,gFAAgF;AAChF,2EAA2E;AAC3E,6EAA6E;AAC7E,8BAA8B;AAE9B,cAAc,oBAAoB,CAAA,CAAC,wEAAwE;AAC3G,cAAc,uBAAuB,CAAA,CAAC,wBAAwB;AAE9D,yCAAyC;AACzC,OAAO;AACH,qBAAqB;AACrB,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,aAAa;AACb,QAAQ;AACR,UAAU;AAEV,oDAAoD;AACpD,WAAW,EACX,WAAW,GAQd,MAAM,iBAAiB,CAAA;AAKxB,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,yEAAyE;AACzE,OAAO,EACH,YAAY,EACZ,UAAU,GAKb,MAAM,UAAU,CAAA;AAEjB,2EAA2E;AAC3E,+EAA+E;AAC/E,OAAO,EAAE,iBAAiB,EAAsB,MAAM,WAAW,CAAA"}

package/dist/lib.d.ts

@@ -0,0 +1,12 @@
+export { bootstrap, type BootstrapOptions, type ForwardHandler, type UpdatePublish } from './bootstrap.js';
+export { buildGateway, type Gateway, type BuildOptions } from './gateway.js';
+export { type MTProtoConfig } from './config.js';
+export { InProcessForwarder } from './dispatch/forwarders/in-process.js';
+export { createLogger, noopLogger, type Logger, type LogLevel, type LoggerOptions, type Fields, } from '@mt-tl/tl';
+export type { RpcForwarder } from './dispatch/rpc-forwarder.js';
+export type { RpcContext, RpcRequest, RpcResponse, SessionEffect } from '@mt-tl/tl';
+export type { UpdateMessage, NodeDelivery } from './updates/types.js';
+export { createRedisPresence, type RedisPresenceHandle } from './updates/redis-presence.js';
+export { createRedisUpdateBus, type RedisBusHandle } from './updates/redis-bus.js';
+export { UpdateRouter, type RouterOptions } from './updates/router.js';
+//# sourceMappingURL=lib.d.ts.map

package/dist/lib.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lib.d.ts","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC1G,OAAO,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAA;AAC5E,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EACH,YAAY,EACZ,UAAU,EACV,KAAK,MAAM,EACX,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,MAAM,GACd,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC/D,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AACnF,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAIrE,OAAO,EAAE,mBAAmB,EAAE,KAAK,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAC3F,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/lib.js

@@ -0,0 +1,13 @@
+// The protocol ENGINE's internal API (transport/crypto/session/dispatch wiring).
+// Consumers don't import this directly; they use `createServer()` (./create-server),
+// which wraps it. Env-free and side-effect-free: the caller builds an MTProtoConfig.
+export { bootstrap } from './bootstrap.js';
+export { buildGateway } from './gateway.js';
+export { InProcessForwarder } from './dispatch/forwarders/in-process.js';
+export { createLogger, noopLogger, } from '@mt-tl/tl';
+// Update-delivery adapters — the Redis pub/sub bus + presence behind the
+// in-process push loop (multi-instance), and the router that fans updates to nodes.
+export { createRedisPresence } from './updates/redis-presence.js';
+export { createRedisUpdateBus } from './updates/redis-bus.js';
+export { UpdateRouter } from './updates/router.js';
+//# sourceMappingURL=lib.js.map

package/dist/lib.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,qFAAqF;AACrF,qFAAqF;AACrF,OAAO,EAAE,SAAS,EAAkE,MAAM,gBAAgB,CAAA;AAC1G,OAAO,EAAE,YAAY,EAAmC,MAAM,cAAc,CAAA;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EACH,YAAY,EACZ,UAAU,GAKb,MAAM,WAAW,CAAA;AAKlB,yEAAyE;AACzE,oFAAoF;AACpF,OAAO,EAAE,mBAAmB,EAA4B,MAAM,6BAA6B,CAAA;AAC3F,OAAO,EAAE,oBAAoB,EAAuB,MAAM,wBAAwB,CAAA;AAClF,OAAO,EAAE,YAAY,EAAsB,MAAM,qBAAqB,CAAA"}

package/dist/server/message-pipeline.d.ts

@@ -0,0 +1,57 @@
+import { type Logger } from '@mt-tl/tl';
+import type { TlCodec } from '../tl/codec.js';
+import type { TlObject } from '@mt-tl/tl';
+import type { Connection } from '../transport/connection.js';
+import type { Storage } from '../storage/index.js';
+import type { SaltService } from '../session/salts.js';
+import { Handshake } from '../auth/handshake.js';
+import { Dispatcher } from '../dispatch/dispatcher.js';
+import { type Responder, type SendOptions } from '../dispatch/types.js';
+import type { PresenceBinder } from '../updates/presence-binder.js';
+export interface PipelineDeps {
+    codec: TlCodec;
+    storage: Storage;
+    handshake: Handshake;
+    saltService: SaltService;
+    defaultLayer: number;
+    /** Presence/registry binder; defaults to a no-op (push disabled). */
+    binder?: PresenceBinder;
+    /**
+     * Disable the inbound MTProto 2.0 `msg_key` integrity check.
+     *
+     * ⚠️ INSECURE — leave this `false` (the default). When `false`, every inbound
+     * encrypted message must carry a `msg_key` equal to the 2.0 recompute
+     * `SHA256(authKey[88:120] ‖ plaintext)[8:24]`, which authenticates the
+     * ciphertext (integrity + binding to the auth key). Setting it `true` makes the
+     * gateway accept any ciphertext that merely decrypts to a well-formed message,
+     * dropping that authentication — only enable it as a temporary interop shim for
+     * non-compliant clients (e.g. ones still on the MTProto 1.0 msg_key scheme; see
+     * docs/internals/msgkey-v1-quirk.md).
+     */
+    disableMsgKeyCheck?: boolean;
+    /** Disable inbound seqno validation (bad_msg codes 32/34/35); default enforced.
+     *  Interop shim for clients that don't set seqno to spec. */
+    disableSeqNoCheck?: boolean;
+    /** Observability sink; defaults to a no-op logger. */
+    logger?: Logger;
+}
+/**
+ * Central message pipeline. Routes plaintext (handshake) vs encrypted packets,
+ * performs MTProto 2.0 decrypt/encrypt, ensures the session, and hands decoded
+ * payloads to the dispatcher. Implements {@link Responder} so the dispatcher and
+ * session manager can send encrypted replies.
+ */
+export declare class MessagePipeline implements Responder {
+    private readonly deps;
+    /** Set once after construction (the dispatcher needs this pipeline as its Responder). */
+    dispatcher: Dispatcher;
+    private readonly binder;
+    private readonly log;
+    constructor(deps: PipelineDeps);
+    handlePacket(packet: Buffer, conn: Connection): Promise<void>;
+    private handlePlaintext;
+    private sendPlain;
+    private handleEncrypted;
+    sendEncrypted(conn: Connection, body: TlObject, opts?: SendOptions): void;
+}
+//# sourceMappingURL=message-pipeline.d.ts.map

package/dist/server/message-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-pipeline.d.ts","sourceRoot":"","sources":["../../src/server/message-pipeline.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,WAAW,CAAA;AAGnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,EAAyC,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAM9G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAGnE,MAAM,WAAW,YAAY;IACzB,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,WAAW,EAAE,WAAW,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,qEAAqE;IACrE,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB;;;;;;;;;;;OAWG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B;iEAC6D;IAC7D,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;GAKG;AACH,qBAAa,eAAgB,YAAW,SAAS;IAMjC,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,yFAAyF;IACzF,UAAU,EAAG,UAAU,CAAA;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;gBAEC,IAAI,EAAE,YAAY;IAYzC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAcrD,eAAe;IAmB7B,OAAO,CAAC,SAAS;YAYH,eAAe;IA2G7B,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAE,WAAgB,GAAG,IAAI;CA+BhF"}

package/dist/server/message-pipeline.js

@@ -0,0 +1,199 @@
+import { randomBytes } from 'node:crypto';
+import { noopLogger } from '@mt-tl/tl';
+import { TlReader } from '../tl/reader.js';
+import { TlWriter } from '../tl/writer.js';
+import { Handshake } from '../auth/handshake.js';
+import { replyToBadAccept } from '../dispatch/types.js';
+import { ensureSession } from '../session/session-manager.js';
+import { messageClass } from '../session/inbound-tracker.js';
+import { igeDecrypt, igeEncrypt } from '../crypto/aes-ige.js';
+import { generateMessageKey, computeMsgKey } from '../crypto/msg-key.js';
+import { toBigIntLE, toBufferLE } from '../util/bytes.js';
+import { NoopPresenceBinder } from '../updates/presence-binder.js';
+/**
+ * Central message pipeline. Routes plaintext (handshake) vs encrypted packets,
+ * performs MTProto 2.0 decrypt/encrypt, ensures the session, and hands decoded
+ * payloads to the dispatcher. Implements {@link Responder} so the dispatcher and
+ * session manager can send encrypted replies.
+ */
+export class MessagePipeline {
+    deps;
+    /** Set once after construction (the dispatcher needs this pipeline as its Responder). */
+    dispatcher;
+    binder;
+    log;
+    constructor(deps) {
+        this.deps = deps;
+        this.binder = deps.binder ?? new NoopPresenceBinder();
+        this.log = deps.logger ?? noopLogger;
+        // Surface the insecure interop shim ONCE at startup, not per message.
+        if (deps.disableMsgKeyCheck) {
+            this.log.warn('enc.msgkey.disabled', {
+                insecure: true,
+                hint: 'inbound ciphertext integrity not verified; see docs/internals/msgkey-v1-quirk.md',
+            });
+        }
+    }
+    async handlePacket(packet, conn) {
+        if (packet.length < 8) {
+            conn.close();
+            return;
+        }
+        // Any inbound traffic resets a pending ping_delay_disconnect idle timer.
+        conn.resetDisconnect();
+        const isPlaintext = packet.readUInt32LE(0) === 0 && packet.readUInt32LE(4) === 0;
+        if (isPlaintext)
+            return this.handlePlaintext(packet, conn);
+        return this.handleEncrypted(packet, conn);
+    }
+    // --- plaintext (handshake) ---------------------------------------------
+    async handlePlaintext(packet, conn) {
+        // [auth_key_id=0 (8)][msg_id (8)][len (4)][body]
+        if (packet.length < 20)
+            return conn.close();
+        const len = packet.readUInt32LE(16);
+        if (len < 4 || packet.length < 20 + len)
+            return conn.close();
+        const reader = new TlReader(packet.subarray(20, 20 + len));
+        const id = reader.readUInt32();
+        if (!Handshake.isHandshakeId(id))
+            return;
+        const res = await this.deps.handshake.handle(id, reader);
+        if (!res)
+            return;
+        if ('raw' in res) {
+            conn.send(res.raw);
+            return;
+        }
+        this.sendPlain(conn, res.reply);
+    }
+    sendPlain(conn, body) {
+        const bodyBuf = this.deps.codec.encode(body);
+        const w = new TlWriter(bodyBuf.length + 24);
+        w.writeLong(0n); // auth_key_id
+        w.writeLong(conn.nextMessageId());
+        w.writeUInt32(bodyBuf.length);
+        w.writeRaw(bodyBuf);
+        conn.send(w.toBuffer());
+    }
+    // --- encrypted ----------------------------------------------------------
+    async handleEncrypted(packet, conn) {
+        if (packet.length < 24)
+            return conn.close();
+        const authKeyId = toBigIntLE(packet.subarray(0, 8));
+        const msgKey = packet.subarray(8, 24);
+        const ciphertext = packet.subarray(24);
+        if (ciphertext.length % 16 !== 0 || ciphertext.length === 0) {
+            this.log.debug('enc.badlen', { authKeyId, len: ciphertext.length });
+            return conn.close();
+        }
+        const rec = await this.deps.storage.authKeys.getById(authKeyId);
+        this.log.debug('enc.key', { authKeyId, found: !!rec, blocked: rec?.isBlocked });
+        if (!rec || rec.isBlocked)
+            return conn.close();
+        const { aesKey, aesIv } = generateMessageKey(rec.key, msgKey, false);
+        const plain = igeDecrypt(ciphertext, aesKey, aesIv);
+        // Inbound msg_key integrity (MTProto 2.0): the packet's msg_key must equal
+        // SHA256(authKey[88:120] ‖ plaintext)[8:24]. This authenticates the ciphertext
+        // and binds it to the auth key. Disabling the check (deps.disableMsgKeyCheck)
+        // is insecure and only intended as a temporary interop shim for non-compliant
+        // clients — see docs/internals/msgkey-v1-quirk.md.
+        if (!this.deps.disableMsgKeyCheck) {
+            if (!computeMsgKey(rec.key, plain, false).equals(msgKey)) {
+                // Ciphertext failed integrity/binding — a forged or non-2.0 client.
+                this.log.warn('enc.msgkey.reject', { authKeyId });
+                return conn.close();
+            }
+        }
+        const r = new TlReader(plain);
+        const salt = r.readLong();
+        const sessionId = r.readLong();
+        const msgId = r.readLong();
+        const seqNo = r.readUInt32();
+        const len = r.readUInt32();
+        this.log.trace('enc.ok', { authKeyId, len });
+        if (len < 4 || len > plain.length)
+            return conn.close();
+        const payload = r.read(len);
+        // Bind auth/session state to the connection.
+        conn.ctx.authKeyId = authKeyId;
+        conn.ctx.authKey = rec.key;
+        conn.ctx.sessionId = sessionId;
+        if (rec.meta?.apiLayer && conn.ctx.apiLayer === this.deps.defaultLayer) {
+            conn.ctx.apiLayer = rec.meta.apiLayer;
+        }
+        // Server-salt schedule: advertise the current salt and validate the one the
+        // client encrypted with. A wrong/expired salt earns a `bad_server_salt`
+        // carrying the current salt — the client re-sends with it — and we drop this
+        // message. See docs/internals/protocol-compliance.md.
+        const { current, valid } = await this.deps.saltService.resolve(authKeyId, salt);
+        conn.ctx.serverSalt = current;
+        if (!valid) {
+            this.log.debug('salt.bad', { authKeyId });
+            this.sendEncrypted(conn, {
+                _: 'bad_server_salt',
+                bad_msg_id: msgId,
+                bad_msg_seqno: seqNo,
+                error_code: 48,
+                new_server_salt: current,
+            }, { contentRelated: false });
+            return;
+        }
+        // Inbound msg_id / seqno validation (https://core.telegram.org/mtproto/description):
+        // a wrong/duplicate/out-of-window msg_id (or bad seqno) earns a
+        // `bad_msg_notification` and the message is dropped (not dispatched, no session
+        // touched). Runs after the salt gate so a salt re-send keeps its original
+        // msg_id. Content-relatedness is read from the payload's constructor id. See
+        // docs/internals/protocol-compliance.md.
+        const seqCheck = !this.deps.disableSeqNoCheck;
+        const check = conn.tracker.accept(msgId, seqNo, {
+            ...messageClass(payload),
+            checkSeqNo: seqCheck,
+            checkOrder: seqCheck,
+        });
+        if (!check.ok) {
+            this.log.debug('msg.rejected', { authKeyId, result: check });
+            replyToBadAccept(this, conn, check, msgId, seqNo);
+            return;
+        }
+        await ensureSession(this.deps.storage, this, conn, { sessionId, authKeyId, firstMsgId: msgId, subject: rec.subject ?? undefined }, this.log);
+        // Register presence: by auth key (any connection — enables anonymous push)
+        // and, for already-authorized keys, by subject.
+        this.binder.bindAuthKey(conn, authKeyId.toString());
+        if (conn.ctx.subject !== undefined)
+            this.binder.bind(conn, conn.ctx.subject);
+        const ctx = { msgId, seqNo, sessionId, authKeyId, salt };
+        await this.dispatcher.dispatchPayload(payload, ctx, conn);
+    }
+    // --- Responder ----------------------------------------------------------
+    sendEncrypted(conn, body, opts = {}) {
+        const authKey = conn.ctx.authKey;
+        const authKeyId = conn.ctx.authKeyId;
+        if (!authKey || authKeyId === undefined)
+            return;
+        const bodyBuf = this.deps.codec.encode(body, conn.ctx.apiLayer);
+        const outMsgId = conn.nextMessageId(opts.isNotification);
+        // Cache the answer to a request so a later duplicate of it gets a
+        // `msg_detailed_info` (the request id is the `rpc_result.req_msg_id`).
+        if (body._ === 'rpc_result' && typeof body.req_msg_id === 'bigint') {
+            conn.tracker.recordAnswer(body.req_msg_id, outMsgId, bodyBuf.length);
+        }
+        const w = new TlWriter(bodyBuf.length + 32);
+        w.writeLong(conn.ctx.serverSalt ?? 0n);
+        w.writeLong(conn.ctx.sessionId ?? 0n);
+        w.writeLong(outMsgId);
+        w.writeUInt32(conn.nextSeqNo(opts.contentRelated ?? true));
+        w.writeUInt32(bodyBuf.length);
+        w.writeRaw(bodyBuf);
+        let plain = w.toBuffer();
+        // MTProto 2.0 padding: 12..1024 random bytes, total length divisible by 16.
+        const minPad = 12;
+        const pad = minPad + ((16 - ((plain.length + minPad) % 16)) % 16);
+        plain = Buffer.concat([plain, randomBytes(pad)]);
+        const msgKey = computeMsgKey(authKey, plain, true);
+        const { aesKey, aesIv } = generateMessageKey(authKey, msgKey, true);
+        const ciphertext = igeEncrypt(plain, aesKey, aesIv);
+        conn.send(Buffer.concat([toBufferLE(authKeyId, 8), msgKey, ciphertext]));
+    }
+}
+//# sourceMappingURL=message-pipeline.js.map