@okee-e2ee/protocol 0.1.2 → 0.1.4

package/dist/transport/codecs/internal/InternalCodec.js

@@ -0,0 +1,16 @@
+import { ByteReader, ByteWriter } from "../../../crypto-core";
+export function createInternalCodec(write, read) {
+    return {
+        encode(value) {
+            const writer = new ByteWriter();
+            write(writer, value);
+            return writer.toBytes();
+        },
+        decode(bytes) {
+            const reader = new ByteReader(bytes);
+            const value = read(reader);
+            reader.assertEnd();
+            return value;
+        }
+    };
+}

package/dist/transport/codecs/{RelayEncryptionKeyBundleCodec.d.ts → internal/RelayEncryptionKeyBundleCodec.d.ts}

@@ -1,8 +1,7 @@
 import { Result } from "@okee-e2ee/core";
 import { DecodeError } from "@okee-e2ee/core/errors";
-import { CodecContract } from "../../crypto-core/contracts";
-import { Bytes } from "../../crypto-core/model";
-import { RelayEncryptionKeyBundle } from "../model";
+import { type Bytes, CodecContract } from "../../../crypto-core";
+import { RelayEncryptionKeyBundle } from "../../model";
 export declare class RelayEncryptionKeyBundleCodec implements CodecContract<RelayEncryptionKeyBundle> {
     encode(value: RelayEncryptionKeyBundle): Bytes;
     decode(bytes: Bytes): Result<RelayEncryptionKeyBundle, DecodeError>;

package/dist/transport/codecs/internal/RelayEncryptionKeyBundleCodec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RelayEncryptionKeyBundleCodec.d.ts","sourceRoot":"","sources":["../../../../src/transport/codecs/internal/RelayEncryptionKeyBundleCodec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAEN,KAAK,KAAK,EAEV,aAAa,EAGb,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,wBAAwB,EAA2B,MAAM,aAAa,CAAC;AAEhF,qBAAa,6BAA8B,YAAW,aAAa,CAAC,wBAAwB,CAAC;IACrF,MAAM,CAAC,KAAK,EAAE,wBAAwB,GAAG,KAAK,CAYpD;IAEM,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,wBAAwB,EAAE,WAAW,CAAC,CAyBzE;CACD"}

package/dist/transport/codecs/{RelayEncryptionKeyBundleCodec.js → internal/RelayEncryptionKeyBundleCodec.js}

@@ -1,7 +1,6 @@
 import { DecodeError } from "@okee-e2ee/core/errors";
-import { CRYPTO_SIZES_BYTES } from "../../crypto-core/constants";
-import { ByteReader, ByteWriter } from "../../crypto-core/encoding";
-import { RELAY_KEY_BUNDLE_FORMAT_VERSION } from "../constants";
+import { ByteReader, ByteWriter, CRYPTO_SIZES_BYTES } from "../../../crypto-core";
+import { RELAY_KEY_BUNDLE_FORMAT_VERSION } from "../../constants";
 export class RelayEncryptionKeyBundleCodec {
     encode(value) {
         if (value.formatVersion !== RELAY_KEY_BUNDLE_FORMAT_VERSION) {
@@ -9,7 +8,7 @@ export class RelayEncryptionKeyBundleCodec {
         }
         return new ByteWriter()
             .writeU8(value.formatVersion)
-            .writeU64(value.keyId)
+            .writeU64(value.epoch)
             .writeFixedBytes(value.publicKey, CRYPTO_SIZES_BYTES.xWingPublicKey)
             .writeU64(value.validFrom)
             .writeU64(value.expiresAt)
@@ -25,7 +24,7 @@ export class RelayEncryptionKeyBundleCodec {
             }
             const value = {
                 formatVersion,
-                keyId: reader.readU64(),
+                epoch: reader.readU64(),
                 publicKey: reader.readFixedBytes(CRYPTO_SIZES_BYTES.xWingPublicKey),
                 validFrom: reader.readU64(),
                 expiresAt: reader.readU64()

package/dist/transport/codecs/internal/S2DEncryptedRequestCodec.d.ts

@@ -0,0 +1,9 @@
+import { Result } from "@okee-e2ee/core";
+import { DecodeError } from "@okee-e2ee/core/errors";
+import { type Bytes, CodecContract } from "../../../crypto-core";
+import { S2DEncryptedRequest } from "../../model";
+export declare class S2DEncryptedRequestCodec<T> implements CodecContract<S2DEncryptedRequest<T>> {
+    encode(value: S2DEncryptedRequest<T>): Bytes;
+    decode(bytes: Bytes): Result<S2DEncryptedRequest<T>, DecodeError>;
+}
+//# sourceMappingURL=S2DEncryptedRequestCodec.d.ts.map

package/dist/transport/codecs/internal/S2DEncryptedRequestCodec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"S2DEncryptedRequestCodec.d.ts","sourceRoot":"","sources":["../../../../src/transport/codecs/internal/S2DEncryptedRequestCodec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAEN,KAAK,KAAK,EAEV,aAAa,EAIb,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAA2B,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE3E,qBAAa,wBAAwB,CAAC,CAAC,CAAE,YAAW,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,KAAK,CAclD;IAEM,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CA8BvE;CACD"}

package/dist/transport/codecs/internal/S2DEncryptedRequestCodec.js

@@ -0,0 +1,45 @@
+import { DecodeError } from "@okee-e2ee/core/errors";
+import { ByteReader, ByteWriter, CRYPTO_SIZES_BYTES } from "../../../crypto-core";
+import { S2D_ENVELOPE_FORMAT_VERSION } from "../../constants";
+export class S2DEncryptedRequestCodec {
+    encode(value) {
+        if (value.formatVersion !== S2D_ENVELOPE_FORMAT_VERSION) {
+            throw new RangeError(`formatVersion must be ${S2D_ENVELOPE_FORMAT_VERSION}`);
+        }
+        if (value.ciphertext.byteLength < CRYPTO_SIZES_BYTES.aeadTag) {
+            throw new RangeError("ciphertext must include an AEAD authentication tag");
+        }
+        return new ByteWriter()
+            .writeU8(value.formatVersion)
+            .writeU64(value.epoch)
+            .writeFixedBytes(value.encapsulation, CRYPTO_SIZES_BYTES.xWingCiphertext)
+            .writeBytes(value.ciphertext)
+            .toBytes();
+    }
+    decode(bytes) {
+        const reader = new ByteReader(bytes);
+        try {
+            const versionOffset = reader.offset;
+            const formatVersion = reader.readU8();
+            if (formatVersion !== S2D_ENVELOPE_FORMAT_VERSION) {
+                throw new DecodeError(`unsupported formatVersion ${formatVersion}`, versionOffset);
+            }
+            const value = {
+                formatVersion,
+                epoch: reader.readU64(),
+                encapsulation: reader.readFixedBytes(CRYPTO_SIZES_BYTES.xWingCiphertext),
+                ciphertext: reader.readBytes()
+            };
+            if (value.ciphertext.byteLength < CRYPTO_SIZES_BYTES.aeadTag) {
+                throw new DecodeError("ciphertext must include an AEAD authentication tag", reader.offset - value.ciphertext.byteLength);
+            }
+            reader.assertEnd();
+            return { ok: true, value };
+        }
+        catch (error) {
+            if (error instanceof DecodeError)
+                return { ok: false, error };
+            throw error;
+        }
+    }
+}

package/dist/transport/codecs/internal/S2DEncryptedResponseCodec.d.ts

@@ -0,0 +1,9 @@
+import { Result } from "@okee-e2ee/core";
+import { DecodeError } from "@okee-e2ee/core/errors";
+import { type Bytes, CodecContract } from "../../../crypto-core";
+import { S2DEncryptedResponse } from "../../model";
+export declare class S2DEncryptedResponseCodec<T> implements CodecContract<S2DEncryptedResponse<T>> {
+    encode(value: S2DEncryptedResponse<T>): Bytes;
+    decode(bytes: Bytes): Result<S2DEncryptedResponse<T>, DecodeError>;
+}
+//# sourceMappingURL=S2DEncryptedResponseCodec.d.ts.map

package/dist/transport/codecs/internal/S2DEncryptedResponseCodec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"S2DEncryptedResponseCodec.d.ts","sourceRoot":"","sources":["../../../../src/transport/codecs/internal/S2DEncryptedResponseCodec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAEN,KAAK,KAAK,EAEV,aAAa,EAGb,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,qBAAa,yBAAyB,CAAC,CAAC,CAAE,YAAW,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,KAAK,CASnD;IAEM,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CA0BxE;CACD"}

package/dist/transport/codecs/internal/S2DEncryptedResponseCodec.js

@@ -0,0 +1,38 @@
+import { DecodeError } from "@okee-e2ee/core/errors";
+import { ByteReader, ByteWriter, CRYPTO_SIZES_BYTES } from "../../../crypto-core";
+import { S2D_ENVELOPE_FORMAT_VERSION } from "../../constants";
+export class S2DEncryptedResponseCodec {
+    encode(value) {
+        if (value.formatVersion !== S2D_ENVELOPE_FORMAT_VERSION) {
+            throw new RangeError(`formatVersion must be ${S2D_ENVELOPE_FORMAT_VERSION}`);
+        }
+        if (value.ciphertext.byteLength < CRYPTO_SIZES_BYTES.aeadTag) {
+            throw new RangeError("ciphertext must include an AEAD authentication tag");
+        }
+        return new ByteWriter().writeU8(value.formatVersion).writeBytes(value.ciphertext).toBytes();
+    }
+    decode(bytes) {
+        const reader = new ByteReader(bytes);
+        try {
+            const versionOffset = reader.offset;
+            const formatVersion = reader.readU8();
+            if (formatVersion !== S2D_ENVELOPE_FORMAT_VERSION) {
+                throw new DecodeError(`unsupported formatVersion ${formatVersion}`, versionOffset);
+            }
+            const value = {
+                formatVersion,
+                ciphertext: reader.readBytes()
+            };
+            if (value.ciphertext.byteLength < CRYPTO_SIZES_BYTES.aeadTag) {
+                throw new DecodeError("ciphertext must include an AEAD authentication tag", reader.offset - value.ciphertext.byteLength);
+            }
+            reader.assertEnd();
+            return { ok: true, value };
+        }
+        catch (error) {
+            if (error instanceof DecodeError)
+                return { ok: false, error };
+            throw error;
+        }
+    }
+}

package/dist/transport/codecs/internal/SignedRelayEncryptionKeyBundleCodec.d.ts

@@ -0,0 +1,9 @@
+import { Result } from "@okee-e2ee/core";
+import { DecodeError } from "@okee-e2ee/core/errors";
+import { type Bytes, CodecContract } from "../../../crypto-core";
+import { SignedRelayEncryptionKeyBundle } from "../../model";
+export declare class SignedRelayEncryptionKeyBundleCodec implements CodecContract<SignedRelayEncryptionKeyBundle> {
+    encode(value: SignedRelayEncryptionKeyBundle): Bytes;
+    decode(bytes: Bytes): Result<SignedRelayEncryptionKeyBundle, DecodeError>;
+}
+//# sourceMappingURL=SignedRelayEncryptionKeyBundleCodec.d.ts.map

package/dist/transport/codecs/internal/SignedRelayEncryptionKeyBundleCodec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignedRelayEncryptionKeyBundleCodec.d.ts","sourceRoot":"","sources":["../../../../src/transport/codecs/internal/SignedRelayEncryptionKeyBundleCodec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAEN,KAAK,KAAK,EAEV,aAAa,EAGb,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC;AAS7D,qBAAa,mCAAoC,YAAW,aAAa,CAAC,8BAA8B,CAAC;IACjG,MAAM,CAAC,KAAK,EAAE,8BAA8B,GAAG,KAAK,CAK1D;IAEM,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAC,8BAA8B,EAAE,WAAW,CAAC,CAqB/E;CACD"}

package/dist/transport/codecs/internal/SignedRelayEncryptionKeyBundleCodec.js

@@ -0,0 +1,35 @@
+import { DecodeError } from "@okee-e2ee/core/errors";
+import { ByteReader, ByteWriter, CRYPTO_SIZES_BYTES, HybridSignatureCodec } from "../../../crypto-core";
+import { RelayEncryptionKeyBundleCodec } from "./RelayEncryptionKeyBundleCodec";
+const bundleCodec = new RelayEncryptionKeyBundleCodec();
+const signatureCodec = new HybridSignatureCodec();
+const HYBRID_SIGNATURE_SIZE_BYTES = CRYPTO_SIZES_BYTES.ed25519Signature + CRYPTO_SIZES_BYTES.mlDsaSignature;
+export class SignedRelayEncryptionKeyBundleCodec {
+    encode(value) {
+        return new ByteWriter()
+            .writeBytes(bundleCodec.encode(value))
+            .writeFixedBytes(signatureCodec.encode(value.signature), HYBRID_SIGNATURE_SIZE_BYTES)
+            .toBytes();
+    }
+    decode(bytes) {
+        const reader = new ByteReader(bytes);
+        try {
+            const bundleResult = bundleCodec.decode(reader.readBytes());
+            if (!bundleResult.ok)
+                throw bundleResult.error;
+            const signatureResult = signatureCodec.decode(reader.readFixedBytes(HYBRID_SIGNATURE_SIZE_BYTES));
+            if (!signatureResult.ok)
+                throw signatureResult.error;
+            reader.assertEnd();
+            return {
+                ok: true,
+                value: { ...bundleResult.value, signature: signatureResult.value }
+            };
+        }
+        catch (error) {
+            if (error instanceof DecodeError)
+                return { ok: false, error };
+            throw error;
+        }
+    }
+}

package/dist/transport/codecs/internal/destination-send-codec-helpers.d.ts

@@ -0,0 +1,5 @@
+import { ByteReader } from "../../../crypto-core";
+import { DestinationSendRequestPayload } from "../../model";
+export declare function encodeDestinationSendRequestPayload(payload: DestinationSendRequestPayload): import("../../../crypto-core").Bytes;
+export declare function decodeDestinationSendRequestPayload(reader: ByteReader): DestinationSendRequestPayload;
+//# sourceMappingURL=destination-send-codec-helpers.d.ts.map

package/dist/transport/codecs/internal/destination-send-codec-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destination-send-codec-helpers.d.ts","sourceRoot":"","sources":["../../../../src/transport/codecs/internal/destination-send-codec-helpers.ts"],"names":[],"mappings":"AACA,OAAO,EACN,UAAU,EAIV,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAEN,6BAA6B,EAI7B,MAAM,aAAa,CAAC;AAMrB,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,6BAA6B,mDA4BzF;AAED,wBAAgB,mCAAmC,CAClD,MAAM,EAAE,UAAU,GAChB,6BAA6B,CAqC/B"}

package/dist/transport/codecs/internal/destination-send-codec-helpers.js

@@ -0,0 +1,58 @@
+import { DecodeError } from "@okee-e2ee/core";
+import { ByteWriter, CRYPTO_SIZES_BYTES, HybridSignaturePublicKeyCodec } from "../../../crypto-core";
+import { DESTINATION_SEND_FORMAT_VERSION, QUEUE_SETUP_CAPABILITY_SIZE_BYTES } from "../../constants";
+const hybridPublicKeyCodec = new HybridSignaturePublicKeyCodec();
+const HYBRID_PUBLIC_KEY_SIZE_BYTES = CRYPTO_SIZES_BYTES.ed25519PublicKey + CRYPTO_SIZES_BYTES.mlDsaPublicKey;
+export function encodeDestinationSendRequestPayload(payload) {
+    if (payload.formatVersion !== DESTINATION_SEND_FORMAT_VERSION) {
+        throw new RangeError(`formatVersion must be ${DESTINATION_SEND_FORMAT_VERSION}`);
+    }
+    const writer = new ByteWriter()
+        .writeU8(payload.formatVersion)
+        .writeString(payload.senderQueueId)
+        .writeString(payload.deliveryId)
+        .writeBytes(payload.payload);
+    const hasSetupCapability = payload.setupCapability !== undefined;
+    const hasSenderAuthPublicKey = payload.senderAuthPublicKey !== undefined;
+    if (hasSetupCapability !== hasSenderAuthPublicKey) {
+        throw new RangeError("setupCapability and senderAuthPublicKey must be provided together");
+    }
+    if (!hasSetupCapability) {
+        return writer.writeU8(0).toBytes();
+    }
+    return writer
+        .writeU8(1)
+        .writeFixedBytes(payload.setupCapability, QUEUE_SETUP_CAPABILITY_SIZE_BYTES)
+        .writeFixedBytes(hybridPublicKeyCodec.encode(payload.senderAuthPublicKey), HYBRID_PUBLIC_KEY_SIZE_BYTES)
+        .toBytes();
+}
+export function decodeDestinationSendRequestPayload(reader) {
+    const versionOffset = reader.offset;
+    const formatVersion = reader.readU8();
+    if (formatVersion !== DESTINATION_SEND_FORMAT_VERSION) {
+        throw new DecodeError(`unsupported formatVersion ${formatVersion}`, versionOffset);
+    }
+    const senderQueueId = reader.readString();
+    const deliveryId = reader.readString();
+    const payload = reader.readBytes();
+    const setupTagOffset = reader.offset;
+    const setupTag = reader.readU8();
+    if (setupTag === 0) {
+        return { formatVersion, senderQueueId, deliveryId, payload };
+    }
+    if (setupTag !== 1) {
+        throw new DecodeError("setup tag must be 0 or 1", setupTagOffset);
+    }
+    const setupCapability = reader.readFixedBytes(QUEUE_SETUP_CAPABILITY_SIZE_BYTES);
+    const publicKeyResult = hybridPublicKeyCodec.decode(reader.readFixedBytes(HYBRID_PUBLIC_KEY_SIZE_BYTES));
+    if (!publicKeyResult.ok)
+        throw publicKeyResult.error;
+    return {
+        formatVersion,
+        senderQueueId,
+        deliveryId,
+        payload,
+        setupCapability,
+        senderAuthPublicKey: publicKeyResult.value
+    };
+}

package/dist/transport/codecs/internal/transport-payload-codecs.d.ts

@@ -0,0 +1,7 @@
+import { type Bytes } from "../../../crypto-core";
+import { TransportCommandType, type TransportRequestPayloadMap, type TransportResponsePayloadMap } from "../../model";
+export declare function encodeTransportRequestPayload<C extends TransportCommandType>(command: C, payload: TransportRequestPayloadMap[C]): Bytes;
+export declare function decodeTransportRequestPayload<C extends TransportCommandType>(command: C, bytes: Bytes): TransportRequestPayloadMap[C];
+export declare function encodeTransportResponsePayload<C extends TransportCommandType>(command: C, payload: TransportResponsePayloadMap[C]): Bytes;
+export declare function decodeTransportResponsePayload<C extends TransportCommandType>(command: C, bytes: Bytes): TransportResponsePayloadMap[C];
+//# sourceMappingURL=transport-payload-codecs.d.ts.map

package/dist/transport/codecs/internal/transport-payload-codecs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-payload-codecs.d.ts","sourceRoot":"","sources":["../../../../src/transport/codecs/internal/transport-payload-codecs.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,KAAK,KAAK,EAMV,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAuBN,oBAAoB,EACpB,KAAK,0BAA0B,EAC/B,KAAK,2BAA2B,EAGhC,MAAM,aAAa,CAAC;AAoJrB,wBAAgB,6BAA6B,CAAC,CAAC,SAAS,oBAAoB,EAC3E,OAAO,EAAE,CAAC,EACV,OAAO,EAAE,0BAA0B,CAAC,CAAC,CAAC,GACpC,KAAK,CAEP;AAED,wBAAgB,6BAA6B,CAAC,CAAC,SAAS,oBAAoB,EAC3E,OAAO,EAAE,CAAC,EACV,KAAK,EAAE,KAAK,GACV,0BAA0B,CAAC,CAAC,CAAC,CAE/B;AAED,wBAAgB,8BAA8B,CAAC,CAAC,SAAS,oBAAoB,EAC5E,OAAO,EAAE,CAAC,EACV,OAAO,EAAE,2BAA2B,CAAC,CAAC,CAAC,GACrC,KAAK,CAEP;AAED,wBAAgB,8BAA8B,CAAC,CAAC,SAAS,oBAAoB,EAC5E,OAAO,EAAE,CAAC,EACV,KAAK,EAAE,KAAK,GACV,2BAA2B,CAAC,CAAC,CAAC,CAEhC"}

package/dist/transport/codecs/internal/transport-payload-codecs.js

@@ -0,0 +1,128 @@
+import { CRYPTO_SIZES_BYTES, HybridSignaturePublicKeyCodec } from "../../../crypto-core";
+import { TransportCommandType } from "../../model";
+import { createInternalCodec } from "./InternalCodec";
+import { S2DEncryptedRequestCodec } from "./S2DEncryptedRequestCodec";
+import { S2DEncryptedResponseCodec } from "./S2DEncryptedResponseCodec";
+import { SignedRelayEncryptionKeyBundleCodec } from "./SignedRelayEncryptionKeyBundleCodec";
+const hybridPublicKeyCodec = new HybridSignaturePublicKeyCodec();
+const signedRelayBundleCodec = new SignedRelayEncryptionKeyBundleCodec();
+const s2dRequestCodec = new S2DEncryptedRequestCodec();
+const s2dResponseCodec = new S2DEncryptedResponseCodec();
+const HYBRID_PUBLIC_KEY_SIZE_BYTES = CRYPTO_SIZES_BYTES.ed25519PublicKey + CRYPTO_SIZES_BYTES.mlDsaPublicKey;
+const emptyPayloadCodec = createInternalCodec((_writer, value) => {
+    if (value !== undefined)
+        throw new RangeError("payload must be undefined");
+}, () => undefined);
+const createQueueRequestCodec = createInternalCodec((writer, value) => writeQueueRegistration(writer, value.registration), reader => ({ registration: readQueueRegistration(reader) }));
+const createQueueResponseCodec = createInternalCodec((writer, value) => {
+    writer.writeString(value.recipientQueueId).writeString(value.senderQueueId);
+}, reader => ({
+    recipientQueueId: reader.readString(),
+    senderQueueId: reader.readString()
+}));
+const recipientQueueRequestCodec = createInternalCodec((writer, value) => {
+    writer.writeString(value.recipientQueueId);
+}, reader => ({ recipientQueueId: reader.readString() }));
+const recipientQueueResponseCodec = createInternalCodec((writer, value) => {
+    writer.writeString(value.recipientQueueId);
+}, reader => ({ recipientQueueId: reader.readString() }));
+const getDestinationBundleRequestCodec = createInternalCodec((writer, value) => writeRelayAddress(writer, value.destination), reader => ({ destination: readRelayAddress(reader) }));
+const getDestinationBundleResponseCodec = createInternalCodec((writer, value) => {
+    writeRelayAddress(writer, value.destination);
+    writer
+        .writeFixedBytes(hybridPublicKeyCodec.encode(value.identityPublicKey), HYBRID_PUBLIC_KEY_SIZE_BYTES)
+        .writeBytes(signedRelayBundleCodec.encode(value.bundle));
+}, reader => ({
+    destination: readRelayAddress(reader),
+    identityPublicKey: decodeWithCodec(hybridPublicKeyCodec, reader.readFixedBytes(HYBRID_PUBLIC_KEY_SIZE_BYTES)),
+    bundle: decodeWithCodec(signedRelayBundleCodec, reader.readBytes())
+}));
+const sendRequestCodec = createInternalCodec((writer, value) => {
+    writeRelayAddress(writer, value.destination);
+    writer.writeBytes(s2dRequestCodec.encode(value.encryptedRequest));
+}, reader => ({
+    destination: readRelayAddress(reader),
+    encryptedRequest: decodeWithCodec(s2dRequestCodec, reader.readBytes())
+}));
+const sendResponseCodec = createInternalCodec((writer, value) => {
+    writer.writeBytes(s2dResponseCodec.encode(value.encryptedResponse));
+}, reader => ({
+    encryptedResponse: decodeWithCodec(s2dResponseCodec, reader.readBytes())
+}));
+const acknowledgeCodec = createInternalCodec((writer, value) => {
+    writer.writeString(value.recipientQueueId).writeU32(value.deliveryIds.length);
+    for (const deliveryId of value.deliveryIds)
+        writer.writeString(deliveryId);
+}, reader => {
+    const recipientQueueId = reader.readString();
+    const deliveryCount = reader.readU32();
+    const deliveryIds = [];
+    for (let index = 0; index < deliveryCount; index += 1) {
+        deliveryIds.push(reader.readString());
+    }
+    return { recipientQueueId, deliveryIds };
+});
+const requestPayloadCodecs = {
+    [TransportCommandType.HEALTH]: emptyPayloadCodec,
+    [TransportCommandType.CREATE_QUEUE]: createQueueRequestCodec,
+    [TransportCommandType.REMOVE_QUEUE]: recipientQueueRequestCodec,
+    [TransportCommandType.SUBSCRIBE_QUEUE]: recipientQueueRequestCodec,
+    [TransportCommandType.UNSUBSCRIBE_QUEUE]: recipientQueueRequestCodec,
+    [TransportCommandType.SEND]: sendRequestCodec,
+    [TransportCommandType.ACK]: acknowledgeCodec,
+    [TransportCommandType.GET_DESTINATION_BUNDLE]: getDestinationBundleRequestCodec
+};
+const responsePayloadCodecs = {
+    [TransportCommandType.HEALTH]: emptyPayloadCodec,
+    [TransportCommandType.CREATE_QUEUE]: createQueueResponseCodec,
+    [TransportCommandType.REMOVE_QUEUE]: recipientQueueResponseCodec,
+    [TransportCommandType.SUBSCRIBE_QUEUE]: recipientQueueResponseCodec,
+    [TransportCommandType.UNSUBSCRIBE_QUEUE]: recipientQueueResponseCodec,
+    [TransportCommandType.SEND]: sendResponseCodec,
+    [TransportCommandType.ACK]: acknowledgeCodec,
+    [TransportCommandType.GET_DESTINATION_BUNDLE]: getDestinationBundleResponseCodec
+};
+export function encodeTransportRequestPayload(command, payload) {
+    return requestPayloadCodecs[command].encode(payload);
+}
+export function decodeTransportRequestPayload(command, bytes) {
+    return requestPayloadCodecs[command].decode(bytes);
+}
+export function encodeTransportResponsePayload(command, payload) {
+    return responsePayloadCodecs[command].encode(payload);
+}
+export function decodeTransportResponsePayload(command, bytes) {
+    return responsePayloadCodecs[command].decode(bytes);
+}
+function writeRelayAddress(writer, value) {
+    writer.writeString(value.address).writeFixedBytes(value.fingerprint, CRYPTO_SIZES_BYTES.sha256);
+}
+function readRelayAddress(reader) {
+    return {
+        address: reader.readString(),
+        fingerprint: reader.readFixedBytes(CRYPTO_SIZES_BYTES.sha256)
+    };
+}
+function writeQueueRegistration(writer, value) {
+    writer
+        .writeString(value.recipientQueueId)
+        .writeString(value.senderQueueId)
+        .writeFixedBytes(hybridPublicKeyCodec.encode(value.recipientAuthPublicKey), HYBRID_PUBLIC_KEY_SIZE_BYTES)
+        .writeFixedBytes(value.d2rPublicKey, CRYPTO_SIZES_BYTES.xWingPublicKey)
+        .writeFixedBytes(value.setupVerifier, CRYPTO_SIZES_BYTES.sha256);
+}
+function readQueueRegistration(reader) {
+    return {
+        recipientQueueId: reader.readString(),
+        senderQueueId: reader.readString(),
+        recipientAuthPublicKey: decodeWithCodec(hybridPublicKeyCodec, reader.readFixedBytes(HYBRID_PUBLIC_KEY_SIZE_BYTES)),
+        d2rPublicKey: reader.readFixedBytes(CRYPTO_SIZES_BYTES.xWingPublicKey),
+        setupVerifier: reader.readFixedBytes(CRYPTO_SIZES_BYTES.sha256)
+    };
+}
+function decodeWithCodec(codec, bytes) {
+    const result = codec.decode(bytes);
+    if (!result.ok)
+        throw result.error;
+    return result.value;
+}

package/dist/transport/constants/index.d.ts

@@ -1,3 +1,4 @@
 export * from "./relay-constants";
 export * from "./transport-context";
+export * from "./transport-packet-constants";
 //# sourceMappingURL=index.d.ts.map

package/dist/transport/constants/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transport/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transport/constants/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,qBAAqB,CAAC;AACpC,cAAc,8BAA8B,CAAC"}

package/dist/transport/constants/index.js

@@ -1,2 +1,3 @@
 export * from "./relay-constants";
 export * from "./transport-context";
+export * from "./transport-packet-constants";

package/dist/transport/constants/relay-constants.d.ts

@@ -1,4 +1,9 @@
 export declare const RELAY_KEY_BUNDLE_FORMAT_VERSION = 1;
 export declare const RELAY_IDENTITY_FINGERPRINT_CONTEXT: string;
 export declare const RELAY_KEY_BUNDLE_SIGNATURE_CONTEXT: string;
+export declare const DESTINATION_SEND_AUTHORIZATION_CONTEXT: string;
+export declare const TRANSPORT_REQUEST_AUTHORIZATION_CONTEXT: string;
+export declare const S2D_KEY_MATERIAL_CONTEXT: string;
+export declare const S2D_REQUEST_ASSOCIATED_DATA_CONTEXT: string;
+export declare const S2D_RESPONSE_ASSOCIATED_DATA_CONTEXT: string;
 //# sourceMappingURL=relay-constants.d.ts.map

package/dist/transport/constants/relay-constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relay-constants.d.ts","sourceRoot":"","sources":["../../../src/transport/constants/relay-constants.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAEjD,eAAO,MAAM,kCAAkC,QAE9C,CAAC;AACF,eAAO,MAAM,kCAAkC,QAE9C,CAAC"}
+{"version":3,"file":"relay-constants.d.ts","sourceRoot":"","sources":["../../../src/transport/constants/relay-constants.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAEjD,eAAO,MAAM,kCAAkC,QAE9C,CAAC;AACF,eAAO,MAAM,kCAAkC,QAE9C,CAAC;AACF,eAAO,MAAM,sCAAsC,QAElD,CAAC;AACF,eAAO,MAAM,uCAAuC,QAEnD,CAAC;AACF,eAAO,MAAM,wBAAwB,QAAmD,CAAC;AACzF,eAAO,MAAM,mCAAmC,QAE/C,CAAC;AACF,eAAO,MAAM,oCAAoC,QAEhD,CAAC"}

package/dist/transport/constants/relay-constants.js

@@ -2,3 +2,8 @@ import { createTransportCryptoContext } from "./transport-context";
 export const RELAY_KEY_BUNDLE_FORMAT_VERSION = 1;
 export const RELAY_IDENTITY_FINGERPRINT_CONTEXT = createTransportCryptoContext("relay/identity-fingerprint");
 export const RELAY_KEY_BUNDLE_SIGNATURE_CONTEXT = createTransportCryptoContext("relay/encryption-key-bundle-signature");
+export const DESTINATION_SEND_AUTHORIZATION_CONTEXT = createTransportCryptoContext("relay/destination-send-authorization");
+export const TRANSPORT_REQUEST_AUTHORIZATION_CONTEXT = createTransportCryptoContext("relay/transport-request-authorization");
+export const S2D_KEY_MATERIAL_CONTEXT = createTransportCryptoContext("s2d/key-material");
+export const S2D_REQUEST_ASSOCIATED_DATA_CONTEXT = createTransportCryptoContext("s2d/request-associated-data");
+export const S2D_RESPONSE_ASSOCIATED_DATA_CONTEXT = createTransportCryptoContext("s2d/response-associated-data");

package/dist/transport/constants/transport-packet-constants.d.ts

@@ -0,0 +1,5 @@
+export declare const TRANSPORT_PACKET_FORMAT_VERSION = 1;
+export declare const DESTINATION_SEND_FORMAT_VERSION = 1;
+export declare const S2D_ENVELOPE_FORMAT_VERSION = 1;
+export declare const QUEUE_SETUP_CAPABILITY_SIZE_BYTES = 32;
+//# sourceMappingURL=transport-packet-constants.d.ts.map

package/dist/transport/constants/transport-packet-constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport-packet-constants.d.ts","sourceRoot":"","sources":["../../../src/transport/constants/transport-packet-constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,+BAA+B,IAAI,CAAC;AACjD,eAAO,MAAM,+BAA+B,IAAI,CAAC;AACjD,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAC7C,eAAO,MAAM,iCAAiC,KAAK,CAAC"}

package/dist/transport/constants/transport-packet-constants.js

@@ -0,0 +1,4 @@
+export const TRANSPORT_PACKET_FORMAT_VERSION = 1;
+export const DESTINATION_SEND_FORMAT_VERSION = 1;
+export const S2D_ENVELOPE_FORMAT_VERSION = 1;
+export const QUEUE_SETUP_CAPABILITY_SIZE_BYTES = 32;

package/dist/transport/helpers/derive-relay-identity-fingerprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"derive-relay-identity-fingerprint.d.ts","sourceRoot":"","sources":["../../../src/transport/helpers/derive-relay-identity-fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,8BAA8B,EAEnC,KAAK,wBAAwB,EAC7B,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAIpD,wBAAsB,8BAA8B,CACnD,MAAM,EAAE,8BAA8B,EACtC,SAAS,EAAE,wBAAwB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAInC"}
+{"version":3,"file":"derive-relay-identity-fingerprint.d.ts","sourceRoot":"","sources":["../../../src/transport/helpers/derive-relay-identity-fingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,8BAA8B,EAEnC,KAAK,wBAAwB,EAE7B,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAIpD,wBAAsB,8BAA8B,CACnD,MAAM,EAAE,8BAA8B,EACtC,SAAS,EAAE,wBAAwB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAInC"}

package/dist/transport/helpers/derive-relay-identity-fingerprint.js

@@ -1,7 +1,6 @@
-import { encodeSignatureInput } from "../../crypto-core";
-import { RelayIdentityPublicKeyCodec } from "../codecs";
+import { encodeSignatureInput, HybridSignaturePublicKeyCodec } from "../../crypto-core";
 import { RELAY_IDENTITY_FINGERPRINT_CONTEXT } from "../constants";
-const identityCodec = new RelayIdentityPublicKeyCodec();
+const identityCodec = new HybridSignaturePublicKeyCodec();
 export async function deriveRelayIdentityFingerprint(crypto, publicKey) {
     return (await crypto.sha256(encodeSignatureInput(RELAY_IDENTITY_FINGERPRINT_CONTEXT, identityCodec.encode(publicKey))));
 }

package/dist/transport/helpers/derive-s2d-key-material.d.ts

@@ -0,0 +1,4 @@
+import { type CryptoPrimitivesFacadeContract, type XWingSharedSecret } from "../../crypto-core";
+import { S2DKeyMaterial } from "../model";
+export declare function deriveS2DKeyMaterial(crypto: CryptoPrimitivesFacadeContract, sharedSecret: XWingSharedSecret): Promise<S2DKeyMaterial>;
+//# sourceMappingURL=derive-s2d-key-material.d.ts.map

package/dist/transport/helpers/derive-s2d-key-material.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive-s2d-key-material.d.ts","sourceRoot":"","sources":["../../../src/transport/helpers/derive-s2d-key-material.ts"],"names":[],"mappings":"AACA,OAAO,EAEN,KAAK,8BAA8B,EACnC,KAAK,iBAAiB,EACtB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAU1C,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,8BAA8B,EACtC,YAAY,EAAE,iBAAiB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAiBzB"}

package/dist/transport/helpers/derive-s2d-key-material.js

@@ -0,0 +1,25 @@
+import { assertByteLength } from "@okee-e2ee/core/helpers";
+import { CRYPTO_SIZES_BYTES } from "../../crypto-core";
+import { S2D_KEY_MATERIAL_CONTEXT } from "../constants";
+const REQUEST_KEY_END = CRYPTO_SIZES_BYTES.aeadKey;
+const REQUEST_NONCE_END = REQUEST_KEY_END + CRYPTO_SIZES_BYTES.aeadNonce;
+const RESPONSE_KEY_END = REQUEST_NONCE_END + CRYPTO_SIZES_BYTES.aeadKey;
+const RESPONSE_NONCE_END = RESPONSE_KEY_END + CRYPTO_SIZES_BYTES.aeadNonce;
+const HKDF_SALT = new Uint8Array(CRYPTO_SIZES_BYTES.sha256);
+const HKDF_INFO = new TextEncoder().encode(S2D_KEY_MATERIAL_CONTEXT);
+export async function deriveS2DKeyMaterial(crypto, sharedSecret) {
+    assertByteLength(sharedSecret, CRYPTO_SIZES_BYTES.xWingSharedSecret, "X-Wing sharedSecret");
+    const material = await crypto.hkdf({
+        inputKeyMaterial: sharedSecret,
+        salt: HKDF_SALT,
+        info: HKDF_INFO,
+        outputLength: RESPONSE_NONCE_END
+    });
+    assertByteLength(material, RESPONSE_NONCE_END, "S2D key material");
+    return {
+        requestKey: material.slice(0, REQUEST_KEY_END),
+        requestNonce: material.slice(REQUEST_KEY_END, REQUEST_NONCE_END),
+        responseKey: material.slice(REQUEST_NONCE_END, RESPONSE_KEY_END),
+        responseNonce: material.slice(RESPONSE_KEY_END, RESPONSE_NONCE_END)
+    };
+}

package/dist/transport/helpers/index.d.ts

@@ -1,3 +1,3 @@
 export * from "./derive-relay-identity-fingerprint";
-export * from "./encode-relay-key-bundle-signature-input";
+export * from "./derive-s2d-key-material";
 //# sourceMappingURL=index.d.ts.map

package/dist/transport/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transport/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC;AACpD,cAAc,2CAA2C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transport/helpers/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC;AACpD,cAAc,2BAA2B,CAAC"}

package/dist/transport/helpers/index.js

@@ -1,2 +1,2 @@
 export * from "./derive-relay-identity-fingerprint";
-export * from "./encode-relay-key-bundle-signature-input";
+export * from "./derive-s2d-key-material";

package/dist/transport/model/destination-send.d.ts

@@ -0,0 +1,44 @@
+import { Bytes, HybridSignature } from "../../crypto-core";
+import { DESTINATION_SEND_FORMAT_VERSION } from "../constants";
+import { DeliveryId, QueueSetupCapability, SenderHybridAuthPublicKey, SenderQueueId } from "./queue-model";
+type DestinationSendRequestPayloadBase = {
+    readonly formatVersion: typeof DESTINATION_SEND_FORMAT_VERSION;
+    readonly senderQueueId: SenderQueueId;
+    readonly deliveryId: DeliveryId;
+    readonly payload: Bytes;
+};
+export type DestinationSendRequestPayload = DestinationSendRequestPayloadBase & ({
+    readonly setupCapability: QueueSetupCapability;
+    readonly senderAuthPublicKey: SenderHybridAuthPublicKey;
+} | {
+    readonly setupCapability?: never;
+    readonly senderAuthPublicKey?: never;
+});
+export type DestinationSendRequest = {
+    readonly payload: DestinationSendRequestPayload;
+    readonly authorization: HybridSignature;
+};
+export declare enum DestinationSendResponseStatus {
+    ERROR = 0,
+    SUCCESS = 1
+}
+export declare enum DestinationSendErrorCode {
+    QUEUE_NOT_FOUND = 0,
+    AUTHORIZATION_INVALID = 1,
+    SETUP_CAPABILITY_INVALID = 2,
+    SENDER_KEY_CONFLICT = 3,
+    DELIVERY_CONFLICT = 4,
+    PAYLOAD_TOO_LARGE = 5
+}
+type DestinationSendResponseBase = {
+    readonly formatVersion: typeof DESTINATION_SEND_FORMAT_VERSION;
+    readonly deliveryId: DeliveryId;
+};
+export type DestinationSendResponse = DestinationSendResponseBase & ({
+    readonly status: DestinationSendResponseStatus.SUCCESS;
+} | {
+    readonly status: DestinationSendResponseStatus.ERROR;
+    readonly errorCode: DestinationSendErrorCode;
+});
+export {};
+//# sourceMappingURL=destination-send.d.ts.map

package/dist/transport/model/destination-send.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destination-send.d.ts","sourceRoot":"","sources":["../../../src/transport/model/destination-send.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,EAAE,+BAA+B,EAAE,MAAM,cAAc,CAAC;AAE/D,OAAO,EACN,UAAU,EACV,oBAAoB,EACpB,yBAAyB,EACzB,aAAa,EACb,MAAM,eAAe,CAAC;AAEvB,KAAK,iCAAiC,GAAG;IACxC,QAAQ,CAAC,aAAa,EAAE,OAAO,+BAA+B,CAAC;IAC/D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,iCAAiC,GAC5E,CACG;IACA,QAAQ,CAAC,eAAe,EAAE,oBAAoB,CAAC;IAC/C,QAAQ,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;CACvD,GACD;IACA,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC;IACjC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,KAAK,CAAC;CACpC,CACH,CAAC;AAEH,MAAM,MAAM,sBAAsB,GAAG;IACpC,QAAQ,CAAC,OAAO,EAAE,6BAA6B,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC;CACxC,CAAC;AAEF,oBAAY,6BAA6B;IACxC,KAAK,IAAI;IACT,OAAO,IAAI;CACX;AAED,oBAAY,wBAAwB;IACnC,eAAe,IAAI;IACnB,qBAAqB,IAAI;IACzB,wBAAwB,IAAI;IAC5B,mBAAmB,IAAI;IACvB,iBAAiB,IAAI;IACrB,iBAAiB,IAAI;CACrB;AAED,KAAK,2BAA2B,GAAG;IAClC,QAAQ,CAAC,aAAa,EAAE,OAAO,+BAA+B,CAAC;IAC/D,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,2BAA2B,GAChE,CACG;IACA,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC,OAAO,CAAC;CACtD,GACD;IACA,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC,KAAK,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,wBAAwB,CAAC;CAC5C,CACH,CAAC"}