@muhkoo/connect 0.14.0-alpha.8 → 0.15.0-alpha.0

package/dist/workers/index.js

@@ -1030,6 +1030,8 @@ class KeyStore {
     static instance;
     _keys = new Map();
     _authKeys = new Map();
+    /** The exact pairs marked vault-backed, so a pair written over them later is never taken for them. */
+    _vaultBacked = new Map();
     constructor() { }
     static getInstance() {
         if (!KeyStore.instance) {
@@ -1067,7 +1069,28 @@ class KeyStore {
         const dehydrated = await this.dehydrateKeyPair(id);
         appLogger.debug(`Stored remote public keys for ${id}: ecdhPub=${dehydrated.ecdhPub.slice(0, 16)}...`);
     }
+    /** Generate an own pair without touching the store; {@link replaceOwnKeyPair} puts it in place. */
+    async generateKeyPair() {
+        const ecdh = await crypto.subtle.generateKey({ name: 'ECDH', namedCurve: 'P-384' }, true, ['deriveKey', 'deriveBits']);
+        const ecdsa = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-384' }, true, ['sign', 'verify']);
+        return {
+            ecdh: { privateKey: ecdh.privateKey, publicKey: ecdh.publicKey },
+            ecdsa: { privateKey: ecdsa.privateKey, publicKey: ecdsa.publicKey },
+        };
+    }
     async hydrateKeyPair(id, dehydrated) {
+        const { ecdh, ecdsa } = await this.importKeyPair(dehydrated);
+        const existing = this._keys.get(id);
+        if (!existing || !existing.privateKey) {
+            this._keys.set(id, ecdh);
+        }
+        const existingAuth = this._authKeys.get(id);
+        if (!existingAuth || !existingAuth.privateKey) {
+            this._authKeys.set(id, ecdsa);
+        }
+    }
+    /** Import a dehydrated pair without touching the store; {@link replaceOwnKeyPair} puts it in place. */
+    async importKeyPair(dehydrated) {
         const ecdhPubJwk = JSON.parse(deserialize(dehydrated.ecdhPub));
         const ecdhPublicKey = await crypto.subtle.importKey('jwk', ecdhPubJwk, { name: 'ECDH', namedCurve: 'P-384' }, true, []);
         const ecdsaPubJwk = JSON.parse(deserialize(dehydrated.ecdsaPub));
@@ -1082,14 +1105,10 @@ class KeyStore {
             const ecdsaPrivJwk = JSON.parse(deserialize(dehydrated.ecdsaPriv));
             ecdsaPrivateKey = await crypto.subtle.importKey('jwk', ecdsaPrivJwk, { name: 'ECDSA', namedCurve: 'P-384' }, true, ['sign']);
         }
-        const existing = this._keys.get(id);
-        if (!existing || !existing.privateKey) {
-            this._keys.set(id, { privateKey: ecdhPrivateKey, publicKey: ecdhPublicKey });
-        }
-        const existingAuth = this._authKeys.get(id);
-        if (!existingAuth || !existingAuth.privateKey) {
-            this._authKeys.set(id, { privateKey: ecdsaPrivateKey, publicKey: ecdsaPublicKey });
-        }
+        return {
+            ecdh: { privateKey: ecdhPrivateKey, publicKey: ecdhPublicKey },
+            ecdsa: { privateKey: ecdsaPrivateKey, publicKey: ecdsaPublicKey },
+        };
     }
     getKeyPair(id) {
         return this._keys.get(id) || null;
@@ -1097,12 +1116,54 @@ class KeyStore {
     getAuthKeyPair(id) {
         return this._authKeys.get(id) || null;
     }
+    /** Record that the pair `id` holds now came from the seed-wrapped vault (ChatKeyVault). */
+    markVaultBacked(id) {
+        const ecdh = this._keys.get(id);
+        const ecdsa = this._authKeys.get(id);
+        if (ecdh && ecdsa)
+            this._vaultBacked.set(id, { ecdh, ecdsa });
+    }
+    /**
+     * Put `pair` in place as `id`'s own pair and mark it vault-backed, in one
+     * synchronous step: whatever `id` held before is dropped, so a pair minted
+     * while the vault pair was being fetched or generated is never kept and
+     * marked in its place (design §3.3).
+     */
+    replaceOwnKeyPair(id, pair) {
+        this.forget(id);
+        this._keys.set(id, pair.ecdh);
+        this._authKeys.set(id, pair.ecdsa);
+        this._vaultBacked.set(id, { ecdh: pair.ecdh, ecdsa: pair.ecdsa });
+    }
+    /**
+     * Whether `id`'s own pair was loaded from, or persisted to, the vault in this
+     * tab, and is still the very pair that was marked. A Space identity must be
+     * vault-backed (design §3.3): any other pair, such as one minted by a locked
+     * DM subscription, never takes part, even one that lands over the marked pair.
+     */
+    isVaultBacked(id) {
+        const marked = this._vaultBacked.get(id);
+        return !!marked && marked.ecdh.privateKey != null
+            && this._keys.get(id) === marked.ecdh && this._authKeys.get(id) === marked.ecdsa;
+    }
+    /** Drop every key held for `id` (SpecA §6.4 `KeyStore.forget`). */
+    forget(id) {
+        this._keys.delete(id);
+        this._authKeys.delete(id);
+        this._vaultBacked.delete(id);
+    }
     async dehydrateKeyPair(id) {
         const keyPair = this._keys.get(id);
         const authKeyPair = this._authKeys.get(id);
         if (!keyPair || !authKeyPair) {
             throw new Error(`No key pair for ${id}`);
         }
+        return this.exportKeyPair({ ecdh: keyPair, ecdsa: authKeyPair });
+    }
+    /** Dehydrate a pair that is not (yet) in the store, in the same format as {@link dehydrateKeyPair}. */
+    async exportKeyPair(pair) {
+        const keyPair = pair.ecdh;
+        const authKeyPair = pair.ecdsa;
         const ecdhPubJwk = await crypto.subtle.exportKey('jwk', keyPair.publicKey);
         const ecdhPrivJwk = keyPair.privateKey ? await crypto.subtle.exportKey('jwk', keyPair.privateKey) : null;
         const ecdsaPubJwk = await crypto.subtle.exportKey('jwk', authKeyPair.publicKey);
@@ -1158,7 +1219,6 @@ class DoubleRatchet {
     sessionType;
     maxSkip = 3000;
     overlapPeriod = 30000; // ms
-    windowSize = 100; // messages per DH ratchet
     constructor(senderId, recipientId, sessionType, isClient = true) {
         this.sessionType = sessionType;
         const keyStore = KeyStore.getInstance();
@@ -1232,16 +1292,24 @@ class DoubleRatchet {
             throw new Error(`Session type mismatch: expected ${this.sessionType}, got ${sessionType}`);
         }
         const keyStore = KeyStore.getInstance();
-        if (this.sessionType === 'specific' && this.state.sendCount >= this.windowSize && this.state.sendCount > 0) {
-            newDhKey = true;
-        }
+        // The DH-ratchet path is disabled, deliberately. It used to fire by
+        // itself once `sendCount` passed a 100-message window, and it was wrong
+        // in three ways at once: it wrote the fresh pair into the PROCESS-GLOBAL
+        // `KeyStore` under our own id (clobbering the long-term ECDH key that
+        // every other ratchet and the Space key-unwrap path read back from the
+        // same entry), it stepped our sending chain without telling the peer (so
+        // message 101 of any conversation stopped decrypting), and it hardcoded
+        // the client role regardless of which half of the session we are.
+        //
+        // No caller in the SDK asks for a rotation — every one passes `false` —
+        // so failing loudly here is strictly better than silently desynchronising
+        // a session. Rotation returns on the standard trigger (receipt of a new
+        // peer `dhPub`) with the key schedule rebuilt; see
+        // docs/superpowers/specs/2026-09-24-dm-protocol-design.md §0 and §3.6.
         if (newDhKey && this.sessionType === 'specific') {
-            appLogger.debug(`Generating new DH key pair for ${senderId}`);
-            const ecdhKeyPair = await crypto.subtle.generateKey({ name: 'ECDH', namedCurve: 'P-384' }, true, ['deriveKey', 'deriveBits']);
-            this.state.clientDhPriv = ecdhKeyPair.privateKey;
-            this.state.clientDhPub = ecdhKeyPair.publicKey;
-            keyStore.keys.set(senderId, { privateKey: ecdhKeyPair.privateKey, publicKey: ecdhKeyPair.publicKey });
-            await this.dhRatchet(this.state.serverDhPub, true);
+            throw new Error('DoubleRatchet: DH key rotation is disabled — the previous implementation ' +
+                'corrupted the process-global KeyStore and desynchronised the peer. ' +
+                'Rotation is reinstated with the key-schedule rewrite (audit H1).');
         }
         const [messageKey, newChainKey] = await this.symmetricRatchet(this.state.sendChainKey);
         this.state.sendChainKey = newChainKey;
@@ -1996,6 +2064,7 @@ class WSTransport extends EventCore {
     pongFrame;
     heartbeatTimer = null;
     pongTimer = null;
+    terminalCloseCodes;
     constructor(opts) {
         super();
         if (!opts || !opts.url) {
@@ -2012,6 +2081,7 @@ class WSTransport extends EventCore {
         this.heartbeatTimeout = opts.heartbeatTimeout ?? 10000;
         this.pingFrame = opts.pingFrame ?? "ping";
         this.pongFrame = opts.pongFrame ?? "pong";
+        this.terminalCloseCodes = opts.terminalCloseCodes ?? [];
     }
     /** Open the socket. Resolves when CONNECTED fires. Rejects on first error. */
     async connect() {
@@ -2064,12 +2134,17 @@ class WSTransport extends EventCore {
                         reject(err);
                     }
                 };
-                socket.onclose = () => {
+                socket.onclose = (ev) => {
+                    const code = typeof ev?.code === "number" ? ev.code : undefined;
                     const wasConnected = this._isConnected;
                     this._isConnected = false;
                     this._isConnecting = false;
                     this.stopHeartbeat();
-                    this.emit(EventCoreEvents.DISCONNECTED, undefined);
+                    this.emit(EventCoreEvents.DISCONNECTED, code !== undefined ? { code, reason: ev?.reason ?? "" } : undefined);
+                    if (code !== undefined && this.terminalCloseCodes.includes(code)) {
+                        this.autoReconnect = false;
+                        return;
+                    }
                     if (this.autoReconnect && wasConnected) {
                         this.scheduleReconnect();
                     }
@@ -2099,6 +2174,14 @@ class WSTransport extends EventCore {
         this._isConnected = false;
         this._isConnecting = false;
     }
+    /** Restart reconnecting after a terminal close or `disconnect()`; the next URL comes from `urlProvider`. */
+    resume() {
+        // A reconnect already pending is left to run: a second timer would dial on top of it.
+        if (this._isConnected || this._isConnecting || this.reconnectTimeout)
+            return;
+        this.autoReconnect = true;
+        this.scheduleReconnect();
+    }
     /**
      * Send a raw frame. If currently disconnected, the frame is queued and sent
      * after the next successful reconnect (up to `maxQueueSize`).
@@ -2199,6 +2282,7 @@ class WSTransport extends EventCore {
         this.reconnectAttempts++;
         this.emit(EventCoreEvents.RECONNECTING, { attempt: this.reconnectAttempts });
         this.reconnectTimeout = setTimeout(async () => {
+            this.reconnectTimeout = null;
             try {
                 await this.connect();
             }
@@ -2316,8 +2400,9 @@ class BroadcastChannel {
                 void this.announce();
             }
         });
-        this.transport.on(EventCoreEvents.DISCONNECTED, () => {
-            this.emit(BroadcastChannelEvents.DISCONNECTED);
+        // `detail` is the close `{code, reason}` when the socket reported one.
+        this.transport.on(EventCoreEvents.DISCONNECTED, (e) => {
+            this.emit(BroadcastChannelEvents.DISCONNECTED, e.detail);
         });
         this.transport.on(EventCoreEvents.RECONNECTING, (e) => {
             this.emit(BroadcastChannelEvents.RECONNECTING, e.detail);
@@ -2352,6 +2437,10 @@ class BroadcastChannel {
     disconnect() {
         this.transport.disconnect();
     }
+    /** Reconnect after a terminal close (see `terminalCloseCodes`) or `disconnect()`, on a fresh `urlProvider` URL. */
+    resume() {
+        this.transport.resume();
+    }
     /**
      * Send our `keyExchange` frame to the room. Idempotent — only sends on the
      * first call. Call this once your higher-level handshake (e.g. sending a