@nopeek/chat 0.1.0

package/dist/index.js

@@ -0,0 +1,1258 @@
+/**
+ * @nopeek/chat — NoPeek client SDK.
+ *
+ * const np = await NoPeek.connect({ apiUrl, sessionToken });
+ * const ch = await np.channels.create({ channelTypeKey: "direct", memberIds: ["usr_…"] });
+ * await ch.send({ text: "encrypted before it leaves this device" });
+ * ch.on("message", (m) => console.log(m.body?.text));
+ */
+import { b64, decryptBytes, decryptPayload, deriveBackupKey, encryptBytes, encryptPayload, exportChannelKey, exportRawKeyB64, importRawKeyB64, generateChannelKey, generateContentKey, generateDeviceKeys, importChannelKey, keyPackageData, rsaOaepWrapB64, sha256hex, unwrapChannelKey, wrapChannelKey, } from "./crypto.js";
+class MemoryStore {
+    m = new Map();
+    get(k) {
+        return this.m.get(k) ?? null;
+    }
+    set(k, v) {
+        this.m.set(k, v);
+    }
+}
+const defaultStore = () => {
+    try {
+        if (typeof localStorage !== "undefined") {
+            return { get: (k) => localStorage.getItem(k), set: (k, v) => localStorage.setItem(k, v) };
+        }
+    }
+    catch {
+        /* SSR / node */
+    }
+    return new MemoryStore();
+};
+class Emitter {
+    listeners = new Map();
+    on(event, fn) {
+        if (!this.listeners.has(event))
+            this.listeners.set(event, new Set());
+        this.listeners.get(event).add(fn);
+        return () => this.off(event, fn);
+    }
+    off(event, fn) {
+        this.listeners.get(event)?.delete(fn);
+    }
+    emit(event, ...args) {
+        for (const fn of this.listeners.get(event) ?? [])
+            fn(...args);
+    }
+}
+export class NoPeek extends Emitter {
+    apiUrl;
+    appId;
+    userId;
+    deviceId;
+    token;
+    store;
+    keys;
+    ws = null;
+    reqCounter = 0;
+    pending = new Map();
+    channelKeys = new Map(); // channelId -> AES key
+    mlsGroupToChannel = new Map();
+    /** Latest known presence per user, updated on every presence frame (incl. the
+     *  connect-time snapshot that may arrive before app listeners attach). */
+    presenceState = new Map();
+    reconnectDelay = 1000;
+    closed = false;
+    /** Set while the app is backgrounded: the WS is intentionally dropped so the
+     *  server clears presence and delivers pushes instead. Distinct from `closed`
+     *  (permanent) — a suspended client reconnects on resume(). */
+    suspended = false;
+    pingTimer = null;
+    platform;
+    autoWs;
+    deferRegistration;
+    /** Set when connect() had to register a brand-new device — restore() revokes it
+     *  if the backup turns out to hold the user's real device identity. */
+    justRegisteredDeviceId = null;
+    channels;
+    deriveChannelKey;
+    static async connect(opts) {
+        const np = new NoPeek(opts);
+        await np.ensureDevice();
+        // With deferDeviceRegistration and no locally saved identity there is no
+        // deviceId yet — key packages and the WS wait for restore()/registerDevice().
+        if (np.deviceId) {
+            await np.ensureKeyPackages();
+            if (np.autoWs)
+                await np.connectWs();
+        }
+        return np;
+    }
+    constructor(opts) {
+        super();
+        this.apiUrl = opts.apiUrl.replace(/\/$/, "");
+        this.token = opts.sessionToken;
+        this.appId = opts.appId;
+        this.userId = opts.userId;
+        this.store = opts.storage ?? defaultStore();
+        this.deriveChannelKey = opts.deriveChannelKey;
+        this.platform = opts.platform ?? "web";
+        this.autoWs = opts.autoConnectWs !== false;
+        this.deferRegistration = opts.deferDeviceRegistration === true;
+        this.channels = new Channels(this);
+    }
+    /** Ensure a channel key exists via the preshared-key hook; returns false if no hook. */
+    async deriveAndSet(channelId) {
+        if (!this.deriveChannelKey)
+            return false;
+        if (this.channelKeys.has(channelId))
+            return true;
+        this.channelKeys.set(channelId, await this.deriveChannelKey(channelId));
+        return true;
+    }
+    // ------------------------------------------------------------- REST ----
+    async api(method, path, body) {
+        const res = await fetch(`${this.apiUrl}${path}`, {
+            method,
+            headers: {
+                authorization: `Bearer ${this.token}`,
+                ...(body !== undefined ? { "content-type": "application/json" } : {}),
+                ...(this.deviceId ? { "x-nopeek-device": this.deviceId } : {}),
+            },
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+        });
+        const text = await res.text();
+        if (!text) {
+            if (!res.ok)
+                throw new Error(`HTTP ${res.status}`);
+            return undefined;
+        }
+        const json = JSON.parse(text);
+        if (!res.ok)
+            throw new Error(json.error ? `${json.error.code}: ${json.error.message}` : `HTTP ${res.status}`);
+        return json;
+    }
+    // ----------------------------------------------------------- device ----
+    async ensureDevice() {
+        const saved = await this.store.get(`nopeek:${this.userId}:device`);
+        if (saved) {
+            const parsed = JSON.parse(saved);
+            this.deviceId = parsed.deviceId;
+            this.keys = parsed.keys;
+            const savedKeys = await this.store.get(`nopeek:${this.userId}:channelKeys`);
+            if (savedKeys) {
+                for (const [chId, raw] of Object.entries(JSON.parse(savedKeys))) {
+                    this.channelKeys.set(chId, await importChannelKey(raw));
+                }
+            }
+            return;
+        }
+        this.keys = await generateDeviceKeys();
+        // Deferred: the caller decides whether to restore() the real identity from a
+        // backup or registerDevice() a genuinely new one. Registering here would
+        // orphan a device on every fresh login of a returning user.
+        if (this.deferRegistration)
+            return;
+        await this.registerDeviceNow();
+        this.justRegisteredDeviceId = this.deviceId;
+    }
+    /** Whether this client has a server-registered device identity yet. False only
+     *  during a deferred connect, before restore()/registerDevice() completes. */
+    get deviceRegistered() {
+        return Boolean(this.deviceId);
+    }
+    /**
+     * Complete a deferred connect by registering a brand-new device. Call this
+     * only when the user has NO restorable backup (genuine new user/device) —
+     * otherwise call restore(), which adopts the backed-up device identity.
+     * No-op when a device identity already exists. Publishes key packages and
+     * opens the WebSocket (unless autoConnectWs was disabled).
+     */
+    async registerDevice() {
+        if (this.deviceId)
+            return;
+        if (!this.keys)
+            this.keys = await generateDeviceKeys();
+        await this.registerDeviceNow();
+        await this.ensureKeyPackages();
+        if (this.autoWs && !this.ws)
+            await this.connectWs();
+    }
+    /** POST the current keypair as a new device and persist the identity locally. */
+    async registerDeviceNow() {
+        const device = await this.api("POST", `/v1/apps/${this.appId}/users/${this.userId}/devices`, {
+            credentialKey: b64.enc(new TextEncoder().encode(JSON.stringify(this.keys.publicKeyJwk))),
+            platform: this.platform,
+            displayName: `${this.platform} device`,
+        });
+        this.deviceId = device.deviceId;
+        await this.persistDevice();
+    }
+    async persistDevice() {
+        await this.store.set(`nopeek:${this.userId}:device`, JSON.stringify({ deviceId: this.deviceId, keys: this.keys }));
+    }
+    async persistChannelKeys() {
+        const out = {};
+        for (const [chId, key] of this.channelKeys)
+            out[chId] = await exportChannelKey(key);
+        await this.store.set(`nopeek:${this.userId}:channelKeys`, JSON.stringify(out));
+    }
+    async ensureKeyPackages() {
+        const { available } = await this.api("GET", `/v1/apps/${this.appId}/users/${this.userId}/devices/${this.deviceId}/key-packages`);
+        if (available >= 10)
+            return;
+        const data = keyPackageData(this.deviceId, this.keys.publicKeyJwk);
+        const expiresAt = new Date(Date.now() + 90 * 86_400_000).toISOString();
+        await this.api("POST", `/v1/apps/${this.appId}/users/${this.userId}/devices/${this.deviceId}/key-packages`, {
+            keyPackages: await Promise.all(Array.from({ length: 20 }, async () => ({
+                cipherSuite: 1,
+                data,
+                dataHash: await sha256hex(data),
+                expiresAt,
+            }))),
+        });
+    }
+    // --------------------------------------------------------------- WS ----
+    connectWs() {
+        return new Promise((resolve, reject) => {
+            const wsUrl = `${this.apiUrl.replace(/^http/, "ws")}/v1/ws?token=${encodeURIComponent(this.token)}&deviceId=${this.deviceId}`;
+            const ws = new WebSocket(wsUrl);
+            this.ws = ws;
+            const authTimeout = setTimeout(() => reject(new Error("WS auth timeout")), 10_000);
+            ws.onmessage = (ev) => void this.handleFrame(JSON.parse(String(ev.data)), resolve, authTimeout);
+            ws.onclose = () => {
+                this.stopPing();
+                this.emit("disconnected");
+                // Don't reconnect while permanently closed OR intentionally suspended
+                // (app backgrounded — we WANT the socket down so pushes take over).
+                if (!this.closed && !this.suspended) {
+                    setTimeout(() => void this.connectWs().catch(() => { }), this.reconnectDelay);
+                    this.reconnectDelay = Math.min(this.reconnectDelay * 2, 30_000);
+                }
+            };
+            ws.onerror = () => {
+                clearTimeout(authTimeout);
+                reject(new Error("WS connection failed"));
+            };
+        });
+    }
+    /** Heartbeat: keep the socket alive while foregrounded so the server's idle
+     *  timeout only fires once the client actually stops pinging (backgrounded /
+     *  crashed / lost network), at which point presence clears and pushes resume. */
+    startPing() {
+        this.stopPing();
+        this.pingTimer = setInterval(() => {
+            try {
+                if (this.ws?.readyState === WebSocket.OPEN)
+                    this.ws.send(JSON.stringify({ type: "ping" }));
+            }
+            catch {
+                /* next reconnect handles it */
+            }
+        }, 25_000);
+    }
+    stopPing() {
+        if (this.pingTimer) {
+            clearInterval(this.pingTimer);
+            this.pingTimer = null;
+        }
+    }
+    /** Drop the WS when the app goes to the background (native): the server clears
+     *  presence immediately and routes new messages to APNs/FCM push instead of a
+     *  socket that iOS is about to freeze. Safe to call repeatedly. */
+    suspend() {
+        if (this.suspended)
+            return;
+        this.suspended = true;
+        this.stopPing();
+        try {
+            this.ws?.close();
+        }
+        catch {
+            /* already closing */
+        }
+        this.ws = null;
+    }
+    /** Reconnect when the app returns to the foreground. */
+    resume() {
+        if (!this.suspended)
+            return;
+        this.suspended = false;
+        this.reconnectDelay = 1000;
+        if (!this.closed && (!this.ws || this.ws.readyState > WebSocket.OPEN)) {
+            void this.connectWs().catch(() => { });
+        }
+    }
+    close() {
+        this.closed = true;
+        this.stopPing();
+        this.ws?.close();
+    }
+    sendFrame(frame) {
+        const reqId = `r${++this.reqCounter}`;
+        return new Promise((resolve, reject) => {
+            this.pending.set(reqId, { resolve, reject });
+            this.ws?.send(JSON.stringify({ ...frame, reqId }));
+            setTimeout(() => {
+                if (this.pending.delete(reqId))
+                    reject(new Error(`timeout waiting for ack of ${String(frame.type)}`));
+            }, 15_000);
+        });
+    }
+    async handleFrame(frame, authResolve, authTimeout) {
+        switch (frame.type) {
+            case "auth.ok":
+                clearTimeout(authTimeout);
+                this.reconnectDelay = 1000;
+                this.startPing();
+                this.emit("connected", frame);
+                authResolve?.();
+                void this.ensureKeyPackages().catch(() => { });
+                break;
+            case "ack": {
+                const p = this.pending.get(String(frame.reqId));
+                if (p) {
+                    this.pending.delete(String(frame.reqId));
+                    p.resolve(frame);
+                }
+                break;
+            }
+            case "error": {
+                const p = frame.reqId ? this.pending.get(String(frame.reqId)) : undefined;
+                if (p) {
+                    this.pending.delete(String(frame.reqId));
+                    p.reject(new Error(`${String(frame.code)}: ${String(frame.message)}`));
+                }
+                else {
+                    this.emit("error", frame);
+                }
+                break;
+            }
+            case "message.new":
+            case "message.updated": {
+                const decrypted = await this.decryptEnvelope(frame.message);
+                // E2EE reactions arrive as carrier messages; surface as reaction events
+                if (decrypted.body?.type === "reaction" && decrypted.body.targetMessageId) {
+                    this.emit("reaction", {
+                        channelId: decrypted.channelId,
+                        messageId: decrypted.body.targetMessageId,
+                        userId: decrypted.senderUserId,
+                        emoji: decrypted.body.emoji,
+                        op: decrypted.body.op ?? "add",
+                    });
+                    break;
+                }
+                // poll votes and RSVPs are carrier events aggregated client-side
+                if (decrypted.body?.type === "poll_vote" && decrypted.body.targetMessageId) {
+                    const pollMessageId = String(decrypted.body.targetMessageId);
+                    this.recordPollVote(pollMessageId, decrypted.senderUserId, decrypted.body.pollOptionIds ?? []);
+                    this.emit("pollVote", {
+                        channelId: decrypted.channelId,
+                        pollMessageId,
+                        userId: decrypted.senderUserId,
+                        optionIds: decrypted.body.pollOptionIds ?? [],
+                        results: this.pollResults(pollMessageId),
+                    });
+                    break;
+                }
+                if (decrypted.body?.type === "rsvp" && decrypted.body.targetMessageId) {
+                    const eventMessageId = String(decrypted.body.targetMessageId);
+                    const response = decrypted.body.rsvp;
+                    this.recordRsvp(eventMessageId, decrypted.senderUserId, response);
+                    this.emit("rsvp", {
+                        channelId: decrypted.channelId,
+                        eventMessageId,
+                        userId: decrypted.senderUserId,
+                        response,
+                        results: this.rsvpResults(eventMessageId),
+                    });
+                    break;
+                }
+                this.emit(frame.type === "message.new" ? "message" : "messageUpdated", decrypted);
+                break;
+            }
+            case "message.recalled":
+                this.emit("messageRecalled", frame);
+                break;
+            case "reaction":
+                this.emit("reaction", frame);
+                break;
+            case "typing":
+                this.emit("typing", frame);
+                break;
+            case "signal":
+                // Call-signaling relay (offer/answer/ICE). Surfacing it here lets
+                // integrators receive signals on their existing connection instead of
+                // opening a second WebSocket to the same endpoint.
+                this.emit("signal", frame);
+                break;
+            case "receipt":
+                this.emit("receipt", frame);
+                break;
+            case "presence":
+                this.presenceState.set(String(frame.userId), {
+                    status: frame.status,
+                    lastSeenAt: frame.lastSeenAt ?? null,
+                });
+                this.emit("presence", frame);
+                break;
+            case "member.joined":
+            case "member.left":
+            case "channel.updated":
+                this.emit(frame.type, frame);
+                break;
+            case "mls.handshake": {
+                const hs = frame.handshake;
+                if (hs.kind === "welcome")
+                    await this.handleWelcome(hs);
+                this.emit("mlsHandshake", hs);
+                break;
+            }
+        }
+    }
+    // ------------------------------------------------------------- E2EE ----
+    async handleWelcome(hs) {
+        try {
+            const welcome = JSON.parse(new TextDecoder().decode(b64.dec(hs.payload)));
+            const mine = welcome.wrapped.find((w) => w.deviceId === this.deviceId);
+            if (!mine)
+                return;
+            const key = await unwrapChannelKey(mine, this.keys.privateKeyJwk);
+            this.channelKeys.set(welcome.channelId, key);
+            this.mlsGroupToChannel.set(hs.mlsGroupId, welcome.channelId);
+            await this.persistChannelKeys();
+            this.emit("channelKeyReceived", { channelId: welcome.channelId });
+        }
+        catch {
+            /* not a dev-suite welcome or not for us */
+        }
+    }
+    /** Fetch any welcomes we missed while offline. */
+    async syncChannelKey(channelId, mlsGroupId) {
+        if (this.channelKeys.has(channelId))
+            return true;
+        const { handshakes } = await this.api("GET", `/v1/apps/${this.appId}/mls/groups/${mlsGroupId}/handshakes?sinceEpoch=0`);
+        for (const hs of handshakes.reverse()) {
+            if (hs.kind === "welcome" && hs.recipientDeviceIds?.includes(this.deviceId)) {
+                await this.handleWelcome({ mlsGroupId, payload: hs.payload });
+                if (this.channelKeys.has(channelId))
+                    return true;
+            }
+        }
+        return false;
+    }
+    getChannelKey(channelId) {
+        return this.channelKeys.get(channelId) ?? null;
+    }
+    /** How many channel keys this device currently holds (for backup-freshness checks). */
+    get channelKeyCount() {
+        return this.channelKeys.size;
+    }
+    // ---------------------------------------------- encrypted attachments ----
+    /** Encrypt bytes under a fresh content key and upload the ciphertext to S3. */
+    async uploadEncrypted(bytes) {
+        const key = await generateContentKey();
+        const { iv, data } = await encryptBytes(key, bytes);
+        const { blobUrl, uploadUrl } = await this.api("POST", `/v1/apps/${this.appId}/uploads`, { sizeBytes: data.byteLength });
+        const put = await fetch(uploadUrl, { method: "PUT", body: data, headers: { "content-type": "application/octet-stream" } });
+        if (!put.ok)
+            throw new Error(`attachment upload failed: HTTP ${put.status}`);
+        return { blobUrl, contentKey: await exportRawKeyB64(key), iv, size: data.byteLength };
+    }
+    // ------------------------------------------- WhatsApp-style key backup ----
+    /**
+     * Enable/refresh an encrypted key backup so the user can restore their chats
+     * on a new device. Back up your channel keys + device identity under a key
+     * derived from `recoveryCode` (which the user keeps; NoPeek never sees it).
+     * Call `generateRecoveryCode()` to make one, show it to the user ONCE, then
+     * pass it here. Returns the backupId.
+     */
+    /**
+     * Encrypted history backup. The chat payload is encrypted with a random data
+     * key, which is then WRAPPED separately by each provided secret — so the same
+     * backup can be unlocked by the account **password** OR the **recovery code**.
+     * This is what lets a user restore on a new device by just signing in with
+     * their password; the recovery code is only needed as a last resort (e.g. the
+     * password was reset). Accepts a string (treated as a recovery code, legacy)
+     * or `{ password?, recoveryCode? }`.
+     */
+    async backup(secrets) {
+        const s = typeof secrets === "string" ? { recoveryCode: secrets } : secrets;
+        if (!s.password && !s.recoveryCode)
+            throw new Error("backup requires a password or a recovery code");
+        // WRAP PRESERVATION: a refresh that only knows ONE secret (the common case —
+        // after login only the password is in memory) must NOT drop the other unlock
+        // path. If we can unwrap the existing envelope's data key, reuse it and carry
+        // forward any wraps we can't recreate; otherwise start a fresh envelope.
+        let dataKey = await generateChannelKey();
+        let rawDK = await exportRawKeyB64(dataKey);
+        const carried = {};
+        try {
+            const { backups } = await this.api("GET", `/v1/apps/${this.appId}/users/${this.userId}/history-backups`);
+            const kd = backups[0]?.keyDerivation;
+            if (kd?.scheme === "wrapped-v2" && kd.wraps) {
+                let oldDK = null;
+                const unlockers = [
+                    ["password", s.password],
+                    ["password", s.previousPassword],
+                    ["recovery", s.recoveryCode],
+                ];
+                for (const [kind, secret] of unlockers) {
+                    const w = secret ? kd.wraps[kind] : undefined;
+                    if (!w)
+                        continue;
+                    try {
+                        const kek = await deriveBackupKey(secret, w.salt, w.iterations);
+                        oldDK = (await decryptPayload(kek, w.wrapped)).dk;
+                        break;
+                    }
+                    catch {
+                        /* stale wrap (rotated secret) — try the next unlocker */
+                    }
+                }
+                // Escrow-restored session: this device just recovered the data key via
+                // the server escrow endpoint (restoreViaEscrow) — the old password wrap
+                // is stale (password was reset) and no recovery code is in memory, but
+                // we still KNOW the envelope's data key, so reuse it and carry the
+                // recovery wrap forward instead of orphaning it under a fresh dk.
+                if (!oldDK && this.escrowRestoredDK)
+                    oldDK = this.escrowRestoredDK;
+                if (oldDK) {
+                    rawDK = oldDK;
+                    dataKey = await importRawKeyB64(oldDK);
+                    for (const kind of ["password", "recovery"]) {
+                        const provided = kind === "password" ? s.password : s.recoveryCode;
+                        if (!provided && kd.wraps[kind])
+                            carried[kind] = kd.wraps[kind];
+                    }
+                }
+            }
+        }
+        catch {
+            /* no existing backup / fetch failed — fresh envelope below */
+        }
+        const channelKeys = {};
+        for (const [chId, k] of this.channelKeys)
+            channelKeys[chId] = await exportChannelKey(k);
+        const ciphertext = await encryptPayload(dataKey, { v: 2, device: { deviceId: this.deviceId, keys: this.keys }, channelKeys });
+        const iterations = 210_000;
+        const wraps = { ...carried };
+        for (const [kind, secret] of [["password", s.password], ["recovery", s.recoveryCode]]) {
+            if (!secret)
+                continue;
+            const salt = b64.enc(globalThis.crypto.getRandomValues(new Uint8Array(16)));
+            const kek = await deriveBackupKey(secret, salt, iterations);
+            wraps[kind] = { salt, iterations, wrapped: await encryptPayload(kek, { dk: rawDK }) };
+        }
+        // OPTIONAL server-side key escrow (per-workspace opt-in; strict workspaces
+        // never get this wrap). The data key is ADDITIONALLY wrapped under the
+        // server's escrow PUBLIC key (RSA-OAEP-SHA256), so backups stay
+        // ciphertext-only server-side at backup time; only the escrow endpoint —
+        // gated on an authenticated session in a key_escrow workspace — can unwrap
+        // with the private key held in Secrets Manager. This is what lets a user
+        // recover ALL messages with only email + password after a password reset
+        // (see restoreViaEscrow). Best-effort: escrow being off/unreachable never
+        // blocks a backup.
+        try {
+            const esc = await this.escrowConfig();
+            if (esc?.enabled && esc.escrowPublicKey) {
+                wraps.escrow = { alg: "RSA-OAEP-256", wrapped: await rsaOaepWrapB64(esc.escrowPublicKey, b64.dec(rawDK)) };
+            }
+        }
+        catch {
+            /* escrow unavailable — password/recovery wraps still protect the backup */
+        }
+        const bytes = b64.dec(ciphertext);
+        const manifestHash = await sha256hex(ciphertext);
+        const { backup: rec, uploadUrl } = await this.api("POST", `/v1/apps/${this.appId}/users/${this.userId}/history-backups`, { keyDerivation: { scheme: "wrapped-v2", wraps }, sizeBytes: bytes.byteLength, manifestHash });
+        const put = await fetch(uploadUrl, { method: "PUT", body: bytes, headers: { "content-type": "application/octet-stream" } });
+        if (!put.ok)
+            throw new Error(`backup upload failed: HTTP ${put.status}`);
+        return rec.backupId;
+    }
+    /**
+     * Restore chats on a NEW device from the latest encrypted backup. Pass the
+     * account password (preferred) and/or the recovery code — whichever unlocks
+     * the backup is used. Rehydrates channel keys so server-stored history
+     * decrypts. Returns the number of channels restored.
+     */
+    async restore(secrets) {
+        const s = typeof secrets === "string" ? { recoveryCode: secrets } : secrets;
+        const { backups } = await this.api("GET", `/v1/apps/${this.appId}/users/${this.userId}/history-backups`);
+        if (!backups.length)
+            throw new Error("No backup found for this user.");
+        const b = backups[0]; // newest first
+        const kd = b.keyDerivation || {};
+        const res = await fetch(b.downloadUrl);
+        if (!res.ok)
+            throw new Error(`backup download failed: HTTP ${res.status}`);
+        const ct = b64.enc(new Uint8Array(await res.arrayBuffer()));
+        let payload;
+        if (kd.scheme === "wrapped-v2") {
+            let dataKey = null;
+            for (const [kind, secret] of [["password", s.password], ["recovery", s.recoveryCode]]) {
+                const w = secret && kd.wraps?.[kind];
+                if (!w)
+                    continue;
+                try {
+                    const kek = await deriveBackupKey(secret, w.salt, w.iterations);
+                    const { dk } = await decryptPayload(kek, w.wrapped);
+                    dataKey = await importRawKeyB64(dk);
+                    break;
+                }
+                catch {
+                    /* wrong secret for this wrap — try the next */
+                }
+            }
+            if (!dataKey)
+                throw new Error("Couldn't unlock the backup with the provided password or recovery code.");
+            payload = await decryptPayload(dataKey, ct);
+        }
+        else {
+            // legacy single-layer backup: payload keyed directly off the recovery code
+            const code = s.recoveryCode ?? s.password;
+            if (!code)
+                throw new Error("This backup requires a recovery code.");
+            const key = await deriveBackupKey(code, kd.salt, kd.iterations);
+            try {
+                payload = await decryptPayload(key, ct);
+            }
+            catch {
+                throw new Error("Recovery code is incorrect — could not decrypt the backup.");
+            }
+        }
+        await this.adoptBackedUpDevice(payload.device);
+        for (const [chId, raw] of Object.entries(payload.channelKeys)) {
+            this.channelKeys.set(chId, await importChannelKey(raw));
+        }
+        await this.persistChannelKeys();
+        return Object.keys(payload.channelKeys).length;
+    }
+    // ------------------------------------------------- server-side escrow ----
+    /** Cached escrow availability for THIS caller ({enabled, escrowPublicKey}). */
+    escrowCfg;
+    /** Set by restoreViaEscrow(): the recovered raw data key (b64), so a follow-up
+     *  backup() can preserve wraps it can't unlock (e.g. after a password reset). */
+    escrowRestoredDK = null;
+    /** Whether the server escrows backup keys for this user's workspace (cached). */
+    async escrowConfig() {
+        if (this.escrowCfg !== undefined)
+            return this.escrowCfg;
+        try {
+            this.escrowCfg = await this.api("GET", `/v1/apps/${this.appId}/escrow-public-key`);
+        }
+        catch {
+            this.escrowCfg = null; // older server / escrow off — cache the miss
+        }
+        return this.escrowCfg;
+    }
+    /**
+     * Recover chats with NO client-held secret, via server-side key escrow
+     * (workspace opt-in). The newest backup's `wraps.escrow` blob — the data key
+     * wrapped under the server's escrow PUBLIC key at backup time — is posted to
+     * the authenticated escrow-unwrap endpoint; the server decrypts it with the
+     * escrow PRIVATE key (Secrets Manager, never the DB) and returns the raw
+     * data key. The rest is identical to the password restore path.
+     *
+     * SECURITY: possession of a valid session is the gate. After a password
+     * reset, a session means the user proved email ownership via the emailed
+     * reset code — so "email owner → full recovery" is the EXPLICIT tradeoff of
+     * escrow mode. Strict (zero-custody) workspaces have no escrow wrap and the
+     * endpoint refuses them. Returns the number of channels restored.
+     */
+    async restoreViaEscrow() {
+        const { backups } = await this.api("GET", `/v1/apps/${this.appId}/users/${this.userId}/history-backups`);
+        if (!backups.length)
+            throw new Error("No backup found for this user.");
+        const b = backups[0]; // newest first
+        const kd = b.keyDerivation || {};
+        const esc = kd.scheme === "wrapped-v2" ? kd.wraps?.escrow : undefined;
+        if (!esc?.wrapped)
+            throw new Error("This backup has no escrow wrap.");
+        const { dk } = await this.api("POST", `/v1/apps/${this.appId}/users/${this.userId}/history-backups/escrow-unwrap`, { wrapped: esc.wrapped });
+        const dataKey = await importRawKeyB64(dk);
+        const res = await fetch(b.downloadUrl);
+        if (!res.ok)
+            throw new Error(`backup download failed: HTTP ${res.status}`);
+        const ct = b64.enc(new Uint8Array(await res.arrayBuffer()));
+        const payload = await decryptPayload(dataKey, ct);
+        this.escrowRestoredDK = dk; // lets the next backup() carry old wraps forward
+        await this.adoptBackedUpDevice(payload.device);
+        for (const [chId, raw] of Object.entries(payload.channelKeys)) {
+            this.channelKeys.set(chId, await importChannelKey(raw));
+        }
+        await this.persistChannelKeys();
+        return Object.keys(payload.channelKeys).length;
+    }
+    /**
+     * Adopt the device identity stored in a backup so a returning user on a fresh
+     * install ends up with EXACTLY their original deviceId — not a freshly minted
+     * one. Only applies when this client has no established local identity (a
+     * deferred connect, or an identity registered moments ago during this very
+     * connect, which is then revoked as an orphan). A long-standing local device
+     * identity is never hijacked — for those, restore() only rehydrates channel
+     * keys, exactly as before.
+     */
+    async adoptBackedUpDevice(device) {
+        if (!device?.deviceId || !device.keys)
+            return;
+        if (this.deviceId === device.deviceId)
+            return; // already the real device
+        const established = this.deviceId && this.deviceId !== this.justRegisteredDeviceId;
+        if (established)
+            return;
+        const orphan = this.justRegisteredDeviceId;
+        this.justRegisteredDeviceId = null;
+        this.deviceId = device.deviceId;
+        this.keys = device.keys;
+        await this.persistDevice();
+        // Revoke the device connect() just registered — it would otherwise linger
+        // forever and poison peers' MLS key-package claims. Best-effort.
+        if (orphan && orphan !== device.deviceId) {
+            await this.api("DELETE", `/v1/apps/${this.appId}/users/${this.userId}/devices/${orphan}`).catch(() => { });
+        }
+        // Replenish key packages for the RESTORED device. If the server no longer
+        // knows it (revoked/pruned), fall back to re-registering the restored keys
+        // under a fresh deviceId so the account stays usable.
+        try {
+            await this.ensureKeyPackages();
+        }
+        catch {
+            this.deviceId = undefined;
+            await this.registerDeviceNow();
+            await this.ensureKeyPackages().catch(() => { });
+        }
+        // The WS session is bound to a deviceId: connect it now (deferred path), or
+        // reconnect if it was opened under the orphan identity.
+        if (this.ws) {
+            const old = this.ws;
+            this.ws = null;
+            old.onclose = null; // don't let the old socket's close trigger a reconnect race
+            try {
+                old.close();
+            }
+            catch {
+                /* ignore */
+            }
+        }
+        // Swallow WS errors here: a transient socket failure must not make restore()
+        // look like a wrong password. The onclose handler keeps retrying anyway.
+        if (this.autoWs && !this.closed)
+            await this.connectWs().catch(() => { });
+    }
+    /** Whether this user has any restorable backup on the server. */
+    async hasBackup() {
+        const { backups } = await this.api("GET", `/v1/apps/${this.appId}/users/${this.userId}/history-backups`);
+        return backups.length > 0;
+    }
+    /** Fetch an encrypted attachment blob and decrypt it back to bytes. */
+    async downloadDecrypt(ref) {
+        const rest = ref.blobUrl.replace(/^nopeek-blob:\/\//, "");
+        const path = rest.slice(rest.indexOf("/") + 1); // strip the leading appId/
+        const res = await fetch(`${this.apiUrl}/v1/apps/${this.appId}/blobs/${path}`, {
+            headers: { authorization: `Bearer ${this.token}` },
+        });
+        if (!res.ok)
+            throw new Error(`attachment download failed: HTTP ${res.status}`);
+        return decryptBytes(ref.contentKey, ref.iv, await res.arrayBuffer());
+    }
+    /** App branding/theme tokens (colors, font, radius…) set by the customer. Null until loaded. */
+    branding = null;
+    /** Fetch the app's branding tokens (customer white-label theme). */
+    async loadBranding() {
+        try {
+            const res = await this.api("GET", `/v1/apps/${this.appId}/branding`);
+            this.branding = res.branding ?? null;
+        }
+        catch {
+            this.branding = null;
+        }
+        return this.branding;
+    }
+    /** Current known presence for a user (survives listener-attach timing). */
+    getPresence(userId) {
+        return this.presenceState.get(userId) ?? null;
+    }
+    isOnline(userId) {
+        return this.presenceState.get(userId)?.status === "online";
+    }
+    // ------------------------------------------------------ poll tallies ----
+    /** pollMessageId -> (userId -> selected optionIds). Latest vote wins. */
+    pollVotes = new Map();
+    recordPollVote(pollMessageId, userId, optionIds) {
+        if (!this.pollVotes.has(pollMessageId))
+            this.pollVotes.set(pollMessageId, new Map());
+        const byUser = this.pollVotes.get(pollMessageId);
+        if (optionIds.length === 0)
+            byUser.delete(userId);
+        else
+            byUser.set(userId, optionIds);
+    }
+    /** Public entry so Channel.history() can fold in historical votes. */
+    applyPollVote(pollMessageId, userId, optionIds) {
+        this.recordPollVote(pollMessageId, userId, optionIds);
+    }
+    /** Aggregate results for a poll: { optionId -> count } plus total voters. */
+    pollResults(pollMessageId) {
+        const byUser = this.pollVotes.get(pollMessageId);
+        const counts = {};
+        if (!byUser)
+            return { counts, voters: 0 };
+        for (const opts of byUser.values())
+            for (const o of opts)
+                counts[o] = (counts[o] ?? 0) + 1;
+        return { counts, voters: byUser.size };
+    }
+    myPollVote(pollMessageId) {
+        return this.pollVotes.get(pollMessageId)?.get(this.userId) ?? [];
+    }
+    // ------------------------------------------------------ event RSVPs ----
+    /** eventMessageId -> (userId -> "yes" | "no" | "maybe"). Latest response wins. */
+    rsvps = new Map();
+    recordRsvp(eventMessageId, userId, response) {
+        if (!this.rsvps.has(eventMessageId))
+            this.rsvps.set(eventMessageId, new Map());
+        this.rsvps.get(eventMessageId).set(userId, response);
+    }
+    /** Public entry so Channel.history() can fold in historical RSVPs. */
+    applyRsvp(eventMessageId, userId, response) {
+        this.recordRsvp(eventMessageId, userId, response);
+    }
+    /** Tally for an event: counts by response + the responding userIds per bucket. */
+    rsvpResults(eventMessageId) {
+        const byUser = this.rsvps.get(eventMessageId);
+        const voters = { yes: [], no: [], maybe: [] };
+        if (byUser)
+            for (const [uid, r] of byUser)
+                voters[r].push(uid);
+        return { counts: { yes: voters.yes.length, no: voters.no.length, maybe: voters.maybe.length }, voters };
+    }
+    myRsvp(eventMessageId) {
+        return this.rsvps.get(eventMessageId)?.get(this.userId) ?? null;
+    }
+    setChannelKey(channelId, key) {
+        this.channelKeys.set(channelId, key);
+        void this.persistChannelKeys();
+    }
+    async decryptEnvelope(env) {
+        const channelId = String(env.channelId);
+        const base = {
+            messageId: String(env.messageId),
+            channelId,
+            senderUserId: String(env.senderUserId),
+            seq: Number(env.seq),
+            threadParentId: env.threadParentId ?? null,
+            createdAt: String(env.createdAt),
+            editedAt: env.editedAt ?? null,
+            recalledAt: env.recalledAt ?? null,
+            body: null,
+            encrypted: Boolean(env.ciphertext),
+        };
+        if (env.recalledAt)
+            return base;
+        if (env.plaintext) {
+            base.body = env.plaintext;
+            return base;
+        }
+        if (env.ciphertext) {
+            if (!this.channelKeys.has(channelId))
+                await this.deriveAndSet(channelId);
+            const key = this.channelKeys.get(channelId);
+            if (!key) {
+                base.decryptionFailed = true;
+                return base;
+            }
+            try {
+                base.body = await decryptPayload(key, String(env.ciphertext));
+            }
+            catch {
+                base.decryptionFailed = true;
+            }
+        }
+        return base;
+    }
+}
+class Channels {
+    np;
+    constructor(np) {
+        this.np = np;
+    }
+    async list() {
+        const { channels } = await this.np.api("GET", `/v1/apps/${this.np.appId}/channels`);
+        return channels.map((c) => new Channel(this.np, c));
+    }
+    async get(channelId) {
+        const rec = await this.np.api("GET", `/v1/apps/${this.np.appId}/channels/${channelId}`);
+        return new Channel(this.np, rec);
+    }
+    /**
+     * Create a channel. For E2EE channels this performs the full key ceremony:
+     * generate channel key → claim key packages for every member device →
+     * commit epoch 0→1 → send Welcome with the wrapped key to each device.
+     */
+    async create(opts) {
+        const rec = await this.np.api("POST", `/v1/apps/${this.np.appId}/channels`, opts);
+        const channel = new Channel(this.np, rec);
+        if (rec.e2ee && !this.np.getChannelKey(rec.channelId)) {
+            // preshared-key mode derives locally; otherwise run the MLS ceremony
+            if (!(await this.np.deriveAndSet(rec.channelId)) && rec.mlsGroupId) {
+                await channel.establishKeys(opts.memberIds ?? []);
+            }
+        }
+        return channel;
+    }
+}
+export class Channel {
+    np;
+    record;
+    constructor(np, record) {
+        this.np = np;
+        this.record = record;
+    }
+    get channelId() {
+        return this.record.channelId;
+    }
+    get e2ee() {
+        return this.record.e2ee;
+    }
+    /** E2EE key ceremony (creator side). */
+    async establishKeys(memberIds) {
+        const key = await generateChannelKey();
+        this.np.setChannelKey(this.channelId, key);
+        const recipients = [];
+        const others = memberIds.filter((m) => m !== this.np.userId);
+        for (const userId of others) {
+            const { keyPackages } = await this.np.api("POST", `/v1/apps/${this.np.appId}/users/${userId}/key-packages/claim`);
+            for (const kp of keyPackages) {
+                const parsed = JSON.parse(new TextDecoder().decode(b64.dec(kp.data)));
+                recipients.push({ deviceId: kp.deviceId, publicKeyJwk: parsed.pub });
+            }
+        }
+        // advance epoch 0 -> 1 (server-enforced single writer)
+        await this.np.api("POST", `/v1/apps/${this.np.appId}/mls/groups/${this.record.mlsGroupId}/handshakes`, {
+            epoch: 0,
+            kind: "commit",
+            senderDeviceId: this.np.deviceId,
+            payload: b64.enc(new TextEncoder().encode(JSON.stringify({ suite: "npdev-1", op: "init" }))),
+        });
+        if (recipients.length) {
+            const wrapped = await wrapChannelKey(key, recipients);
+            const welcome = { suite: "npdev-1", channelId: this.channelId, wrapped };
+            await this.np.api("POST", `/v1/apps/${this.np.appId}/mls/groups/${this.record.mlsGroupId}/handshakes`, {
+                epoch: 1,
+                kind: "welcome",
+                senderDeviceId: this.np.deviceId,
+                recipientDeviceIds: wrapped.map((w) => w.deviceId),
+                payload: b64.enc(new TextEncoder().encode(JSON.stringify(welcome))),
+            });
+        }
+    }
+    /** Joiner side: derive (preshared mode) or pull the welcome if we lack the key. */
+    async ensureKey() {
+        if (!this.e2ee)
+            return true;
+        if (this.np.getChannelKey(this.channelId))
+            return true;
+        if (await this.np.deriveAndSet(this.channelId))
+            return true;
+        if (!this.record.mlsGroupId)
+            return false;
+        if (await this.np.syncChannelKey(this.channelId, this.record.mlsGroupId))
+            return true;
+        // No key and no welcome yet — e.g. the channel was created server-side, or the
+        // original creator's key was lost. Bootstrap the ceremony as the originator:
+        // the server enforces a single epoch-0→1 writer, so if a peer races us we lose
+        // the commit and fall back to pulling their welcome.
+        try {
+            const { members } = await this.np.api("GET", `/v1/apps/${this.np.appId}/channels/${this.channelId}/members`);
+            await this.establishKeys(members.map((m) => m.userId));
+            if (this.np.getChannelKey(this.channelId))
+                return true;
+        }
+        catch {
+            /* lost the epoch race, or a member has no key package — fall through */
+        }
+        return this.np.syncChannelKey(this.channelId, this.record.mlsGroupId);
+    }
+    /** Low-level: send an arbitrary structured payload (image, poll, contact…). */
+    async sendPayload(payload, opts = {}) {
+        const clientMessageId = opts.clientMessageId ?? `c${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+        if (this.e2ee) {
+            if (!(await this.ensureKey()))
+                throw new Error("No channel key — has the key ceremony completed?");
+            const ciphertext = await encryptPayload(this.np.getChannelKey(this.channelId), { v: 1, ...payload });
+            const ack = (await this.np.sendFrame({
+                type: "message.send",
+                channelId: this.channelId,
+                clientMessageId,
+                threadParentId: opts.threadParentId,
+                mlsEpoch: 1,
+                ciphertext,
+            }));
+            return this.np.decryptEnvelope(ack.message);
+        }
+        const ack = (await this.np.sendFrame({
+            type: "message.send",
+            channelId: this.channelId,
+            clientMessageId,
+            threadParentId: opts.threadParentId,
+            plaintext: { type: payload.type ?? "text", ...payload },
+        }));
+        return this.np.decryptEnvelope(ack.message);
+    }
+    async send(body) {
+        return this.sendPayload({ type: body.type ?? "text", text: body.text, metadata: body.metadata, linkPreview: body.linkPreview }, { threadParentId: body.threadParentId });
+    }
+    // ---------------------------------------------------- rich content ----
+    /** Encrypt + upload a file and send it as an image/video/audio/file message. */
+    async sendAttachment(a, opts = {}) {
+        const up = await this.np.uploadEncrypted(a.bytes);
+        let thumb = {};
+        if (a.thumbnail) {
+            const t = await this.np.uploadEncrypted(a.thumbnail.bytes);
+            thumb = { thumbBlobUrl: t.blobUrl, thumbContentKey: t.contentKey, thumbIv: t.iv };
+        }
+        const type = a.contentType.startsWith("image/")
+            ? "image"
+            : a.contentType.startsWith("video/")
+                ? "video"
+                : a.contentType.startsWith("audio/")
+                    ? "audio"
+                    : "file";
+        return this.sendPayload({
+            type,
+            text: opts.caption,
+            attachments: [
+                {
+                    blobUrl: up.blobUrl,
+                    contentKey: up.contentKey,
+                    iv: up.iv,
+                    size: up.size,
+                    name: a.name,
+                    contentType: a.contentType,
+                    width: a.width,
+                    height: a.height,
+                    durationSec: a.durationSec,
+                    ...thumb,
+                },
+            ],
+        }, { threadParentId: opts.threadParentId });
+    }
+    /** Convenience wrapper for a browser File/Blob (uses .name/.type). */
+    async sendFile(file, opts) {
+        return this.sendAttachment({
+            bytes: await file.arrayBuffer(),
+            name: file.name ?? "file",
+            contentType: file.type || "application/octet-stream",
+            thumbnail: opts?.thumbnail,
+            width: opts?.width,
+            height: opts?.height,
+            durationSec: opts?.durationSec,
+        }, { caption: opts?.caption });
+    }
+    /** Download + decrypt an attachment; returns a Blob you can objectURL. */
+    async fetchAttachment(att) {
+        const buf = await this.np.downloadDecrypt(att);
+        return new Blob([buf], { type: att.contentType || "application/octet-stream" });
+    }
+    async sendPoll(poll) {
+        const id = `poll_${Math.random().toString(36).slice(2, 10)}`;
+        return this.sendPayload({
+            type: "poll",
+            poll: {
+                id,
+                question: poll.question,
+                options: poll.options.map((label, i) => ({ id: `o${i}`, label })),
+                multiple: poll.multiple ?? false,
+                anonymous: poll.anonymous ?? false,
+                closesAt: poll.closesAt,
+            },
+        });
+    }
+    /** Cast (or, with an empty array, retract) a vote on a poll message. */
+    async votePoll(pollMessageId, optionIds) {
+        await this.sendPayload({ type: "poll_vote", targetMessageId: pollMessageId, pollOptionIds: optionIds });
+    }
+    async sendContact(contact) {
+        return this.sendPayload({ type: "contact", contact });
+    }
+    async sendCalendarEvent(event) {
+        return this.sendPayload({ type: "calendar_event", calendarEvent: { allDay: false, ...event } });
+    }
+    async rsvp(eventMessageId, response) {
+        await this.sendPayload({ type: "rsvp", targetMessageId: eventMessageId, rsvp: response });
+    }
+    async sendLocation(lat, lng, label) {
+        return this.sendPayload({ type: "location", location: { lat, lng, label } });
+    }
+    // ------------------------------------------------------- bot actions ----
+    // Structured E2EE bodies for the bots feature — no new crypto, no new
+    // events: they ride the normal encrypted message path and surface through
+    // the generic `message` event like any other typed body.
+    /**
+     * Bot → humans: a message with tappable action buttons under the text
+     * (Telegram-style inline keyboard). Humans respond via invokeAction().
+     */
+    async sendActions(opts) {
+        return this.sendPayload({ type: "actions", text: opts.text, actions: opts.actions });
+    }
+    /**
+     * Bot → humans: advertise (or replace) the bot's persistent quick-action
+     * bar for this chat. Clients render the LATEST action_bar per bot as chips
+     * above the composer; sending a new one supersedes the previous.
+     */
+    async sendActionBar(opts) {
+        return this.sendPayload({ type: "action_bar", actions: opts.actions });
+    }
+    /**
+     * Human → bot: what a tapped action button sends. `label` is optional
+     * display sugar so clients can echo "You ran <label>" without a lookup.
+     */
+    async invokeAction(opts) {
+        return this.sendPayload({
+            type: "action_invoke",
+            actionId: opts.actionId,
+            ...(opts.label !== undefined ? { label: opts.label } : {}),
+            ...(opts.params !== undefined ? { params: opts.params } : {}),
+        });
+    }
+    async edit(messageId, body) {
+        if (this.e2ee) {
+            const key = this.np.getChannelKey(this.channelId);
+            if (!key)
+                throw new Error("No channel key");
+            // the edited body must keep the message's real type — writing a synthetic
+            // "edit" type made every consumer treat the message as non-text afterwards
+            const ciphertext = await encryptPayload(key, { v: 1, type: "text", text: body.text });
+            await this.np.api("PATCH", `/v1/apps/${this.np.appId}/channels/${this.channelId}/messages/${messageId}`, {
+                mlsEpoch: 1,
+                ciphertext,
+            });
+        }
+        else {
+            await this.np.api("PATCH", `/v1/apps/${this.np.appId}/channels/${this.channelId}/messages/${messageId}`, {
+                plaintext: { type: "text", text: body.text },
+            });
+        }
+    }
+    async recall(messageId) {
+        await this.np.api("DELETE", `/v1/apps/${this.np.appId}/channels/${this.channelId}/messages/${messageId}`);
+    }
+    async react(messageId, emoji, op = "add") {
+        if (this.e2ee) {
+            const key = this.np.getChannelKey(this.channelId);
+            if (!key)
+                throw new Error("No channel key");
+            const ciphertext = await encryptPayload(key, { v: 1, type: "reaction", targetMessageId: messageId, emoji, op });
+            await this.np.sendFrame({
+                type: "message.send",
+                channelId: this.channelId,
+                clientMessageId: `rx${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`,
+                mlsEpoch: 1,
+                ciphertext,
+            });
+        }
+        else if (op === "add") {
+            await this.np.api("POST", `/v1/apps/${this.np.appId}/channels/${this.channelId}/messages/${messageId}/reactions`, { emoji });
+        }
+        else {
+            await this.np.api("DELETE", `/v1/apps/${this.np.appId}/channels/${this.channelId}/messages/${messageId}/reactions?emoji=${encodeURIComponent(emoji)}`);
+        }
+    }
+    typing(isTyping) {
+        this.np["ws"]?.send(JSON.stringify({ type: isTyping ? "typing.start" : "typing.stop", channelId: this.channelId }));
+    }
+    async markRead(messageId) {
+        await this.np.sendFrame({ type: "receipt.mark", channelId: this.channelId, kind: "read", messageId });
+    }
+    async history(opts = {}) {
+        await this.ensureKey();
+        const params = new URLSearchParams();
+        if (opts.beforeSeq)
+            params.set("beforeSeq", String(opts.beforeSeq));
+        if (opts.limit)
+            params.set("limit", String(opts.limit));
+        const { messages } = await this.np.api("GET", `/v1/apps/${this.np.appId}/channels/${this.channelId}/messages?${params}`);
+        const out = [];
+        for (const env of messages) {
+            const m = await this.np.decryptEnvelope(env);
+            // carrier messages (reactions, poll votes, rsvps) aggregate client-side
+            if (m.body?.type === "reaction")
+                continue;
+            if (m.body?.type === "rsvp") {
+                this.np.applyRsvp(m.body.targetMessageId, m.senderUserId, m.body.rsvp);
+                continue;
+            }
+            if (m.body?.type === "poll_vote") {
+                this.np.applyPollVote(m.body.targetMessageId, m.senderUserId, m.body.pollOptionIds ?? []);
+                continue;
+            }
+            out.push(m);
+        }
+        return out;
+    }
+    pollResults(pollMessageId) {
+        return this.np.pollResults(pollMessageId);
+    }
+    myPollVote(pollMessageId) {
+        return this.np.myPollVote(pollMessageId);
+    }
+    rsvpResults(eventMessageId) {
+        return this.np.rsvpResults(eventMessageId);
+    }
+    myRsvp(eventMessageId) {
+        return this.np.myRsvp(eventMessageId);
+    }
+    on(event, fn) {
+        return this.np.on(event, ((payload) => {
+            if (!payload.channelId || payload.channelId === this.channelId)
+                fn(payload);
+        }));
+    }
+}
+export { b64, deriveSharedChannelKey, generateRecoveryCode } from "./crypto.js";
+// ---------------------------------------------------------------------------
+// Browser helpers for attaching media. No-ops outside a DOM. Native apps
+// (Capacitor/React Native) should use their platform camera/file plugins and
+// pass the resulting bytes to channel.sendAttachment().
+// ---------------------------------------------------------------------------
+/** Open the OS file picker. `accept` e.g. "image/*", "video/*", "*​/*". */
+export function pickFiles(opts = {}) {
+    return new Promise((resolve) => {
+        const input = document.createElement("input");
+        input.type = "file";
+        if (opts.accept)
+            input.accept = opts.accept;
+        if (opts.multiple)
+            input.multiple = true;
+        if (opts.capture)
+            input.setAttribute("capture", opts.capture);
+        input.style.display = "none";
+        input.addEventListener("change", () => {
+            resolve(input.files ? Array.from(input.files) : []);
+            input.remove();
+        });
+        document.body.appendChild(input);
+        input.click();
+    });
+}
+/** Pick images from the gallery. */
+export const pickImages = (multiple = false) => pickFiles({ accept: "image/*", multiple });
+/** Pick a video. */
+export const pickVideo = () => pickFiles({ accept: "video/*" });
+/** Open the rear camera to take a photo (mobile web). */
+export const capturePhoto = () => pickFiles({ accept: "image/*", capture: "environment" });
+/**
+ * Downscale an image File to a JPEG thumbnail (browser only). Returns bytes +
+ * intrinsic dimensions, suitable for channel.sendFile({ thumbnail, width, height }).
+ */
+export async function makeImageThumbnail(file, max = 480) {
+    const bitmap = await createImageBitmap(file);
+    const { width, height } = bitmap;
+    const scale = Math.min(1, max / Math.max(width, height));
+    const canvas = document.createElement("canvas");
+    canvas.width = Math.round(width * scale);
+    canvas.height = Math.round(height * scale);
+    canvas.getContext("2d").drawImage(bitmap, 0, 0, canvas.width, canvas.height);
+    const blob = await new Promise((r) => canvas.toBlob((b) => r(b), "image/jpeg", 0.8));
+    return { thumbnail: { bytes: await blob.arrayBuffer(), contentType: "image/jpeg" }, width, height };
+}
+//# sourceMappingURL=index.js.map