@profullstack/qryptchat 0.4.4 → 0.4.6

package/dist/{chunk-jdt6p3k7.js → chunk-kabknfjj.js}

@@ -12,32 +12,10 @@ import { MlKem1024 as MlKem10242 } from "mlkem";
 
 // src/lib/crypto/post-quantum-encryption.js
 import { MlKem1024, MlKem768 } from "mlkem";
+import { decrypt as decryptEnvelope, encrypt as encryptEnvelope } from "@profullstack/encrypt";
 
 // src/lib/crypto/index.js
 import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
-var CRYPTO_CONFIG = {
-  KYBER: {
-    PUBLIC_KEY_SIZE: 1568,
-    PRIVATE_KEY_SIZE: 3168,
-    CIPHERTEXT_SIZE: 1568,
-    SHARED_SECRET_SIZE: 32
-  },
-  DILITHIUM: {
-    PUBLIC_KEY_SIZE: 2592,
-    PRIVATE_KEY_SIZE: 4864,
-    SIGNATURE_SIZE: 4595
-  },
-  CHACHA20_POLY1305: {
-    KEY_SIZE: 32,
-    NONCE_SIZE: 12,
-    TAG_SIZE: 16
-  },
-  HKDF: {
-    HASH: "SHA-256",
-    SALT_SIZE: 32,
-    INFO_PREFIX: "QryptChat-v1"
-  }
-};
 var Base64 = {
   encode(bytes) {
     let binary = "";
@@ -56,134 +34,6 @@ var Base64 = {
   }
 };
 
-class SecureRandom {
-  static getRandomBytes(length) {
-    const bytes = new Uint8Array(length);
-    crypto.getRandomValues(bytes);
-    return bytes;
-  }
-  static generateSalt() {
-    return this.getRandomBytes(CRYPTO_CONFIG.HKDF.SALT_SIZE);
-  }
-  static generateNonce() {
-    return this.getRandomBytes(CRYPTO_CONFIG.CHACHA20_POLY1305.NONCE_SIZE);
-  }
-}
-
-class HKDF {
-  static async derive(inputKeyMaterial, salt, info, length) {
-    const key = await crypto.subtle.importKey("raw", inputKeyMaterial, { name: "HKDF" }, false, ["deriveKey", "deriveBits"]);
-    const derivedBits = await crypto.subtle.deriveBits({
-      name: "HKDF",
-      hash: CRYPTO_CONFIG.HKDF.HASH,
-      salt,
-      info: new TextEncoder().encode(`${CRYPTO_CONFIG.HKDF.INFO_PREFIX}-${info}`)
-    }, key, length * 8);
-    return new Uint8Array(derivedBits);
-  }
-  static async deriveRootAndChainKeys(sharedSecret, salt, context) {
-    const derivedKey = await this.derive(sharedSecret, salt, context, 64);
-    return {
-      rootKey: derivedKey.slice(0, 32),
-      chainKey: derivedKey.slice(32, 64)
-    };
-  }
-  static async deriveMessageKey(chainKey, messageNumber) {
-    const info = `MessageKey-${messageNumber}`;
-    return await this.derive(chainKey, new Uint8Array(0), info, CRYPTO_CONFIG.CHACHA20_POLY1305.KEY_SIZE);
-  }
-}
-
-class ChaCha20Poly1305 {
-  static async encrypt(key, nonce, plaintext, additionalData = new Uint8Array(0)) {
-    try {
-      const cipher = chacha20poly1305(key, nonce, additionalData);
-      const ciphertext = cipher.encrypt(plaintext);
-      return ciphertext;
-    } catch (error) {
-      throw new EncryptionError(`ChaCha20-Poly1305 encryption failed: ${error.message}`);
-    }
-  }
-  static async decrypt(key, nonce, ciphertext, additionalData = new Uint8Array(0)) {
-    try {
-      const cipher = chacha20poly1305(key, nonce, additionalData);
-      const plaintext = cipher.decrypt(ciphertext);
-      return plaintext;
-    } catch (error) {
-      throw new DecryptionError(`ChaCha20-Poly1305 decryption failed: ${error.message}`);
-    }
-  }
-}
-
-class CryptoError extends Error {
-  constructor(message, code) {
-    super(message);
-    this.name = "CryptoError";
-    this.code = code;
-  }
-}
-class EncryptionError extends CryptoError {
-  constructor(message) {
-    super(message, "ENCRYPTION_ERROR");
-    this.name = "EncryptionError";
-  }
-}
-
-class DecryptionError extends CryptoError {
-  constructor(message) {
-    super(message, "DECRYPTION_ERROR");
-    this.name = "DecryptionError";
-  }
-}
-class CryptoUtils {
-  static constantTimeEqual(a, b) {
-    if (a.length !== b.length) {
-      return false;
-    }
-    let result = 0;
-    for (let i = 0;i < a.length; i++) {
-      result |= a[i] ^ b[i];
-    }
-    return result === 0;
-  }
-  static secureClear(data) {
-    if (data && data.fill) {
-      data.fill(0);
-    }
-  }
-  static concatenate(...arrays) {
-    const totalLength = arrays.reduce((sum, arr) => sum + arr.length, 0);
-    const result = new Uint8Array(totalLength);
-    let offset = 0;
-    for (const array of arrays) {
-      result.set(array, offset);
-      offset += array.length;
-    }
-    return result;
-  }
-  static generateKeyId() {
-    const randomBytes = SecureRandom.getRandomBytes(16);
-    return Base64.encode(randomBytes).replace(/[+/=]/g, "").substring(0, 22);
-  }
-  static async hash(data) {
-    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-    return new Uint8Array(hashBuffer);
-  }
-  static validateKeySize(key, algorithm, keyType) {
-    const config = CRYPTO_CONFIG[algorithm];
-    if (!config) {
-      throw new CryptoError(`Unknown algorithm: ${algorithm}`);
-    }
-    const expectedSize = config[`${keyType.toUpperCase()}_KEY_SIZE`];
-    if (!expectedSize) {
-      throw new CryptoError(`Unknown key type: ${keyType} for algorithm: ${algorithm}`);
-    }
-    if (key.length !== expectedSize) {
-      throw new CryptoError(`Invalid ${keyType} key size for ${algorithm}. Expected ${expectedSize}, got ${key.length}`);
-    }
-  }
-}
-
 // src/lib/crypto/indexed-db-manager.js
 var DB_NAME = "QryptChatKeys";
 var DB_VERSION = 1;
@@ -375,96 +225,34 @@ class PostQuantumEncryptionService {
     return this.publicKeyCache.get(userId) || null;
   }
   async encryptForRecipient(message, recipientPublicKey) {
+    if (!this.isInitialized) {
+      throw new Error("Post-quantum encryption service not initialized");
+    }
+    if (!recipientPublicKey || typeof recipientPublicKey !== "string") {
+      throw new Error("Invalid recipient public key format");
+    }
+    if (!/^[A-Za-z0-9+/=]+$/.test(recipientPublicKey)) {
+      throw new Error("Public key contains invalid Base64 characters");
+    }
+    let recipientPubKeyBytes;
     try {
-      if (!this.isInitialized) {
-        throw new Error("Post-quantum encryption service not initialized");
-      }
-      console.log(`\uD83D\uDD10 Encrypting message using ML-KEM-1024...`);
-      if (!recipientPublicKey || typeof recipientPublicKey !== "string") {
-        throw new Error("Invalid recipient public key format");
-      }
-      if (!/^[A-Za-z0-9+/=]+$/.test(recipientPublicKey)) {
-        throw new Error("Public key contains invalid Base64 characters");
-      }
-      let recipientPubKeyBytes;
-      try {
-        recipientPubKeyBytes = Base64.decode(recipientPublicKey);
-      } catch (decodeError) {
-        console.error("\uD83D\uDD10 [ERROR] Failed to decode public key from Base64:", decodeError);
-        throw new Error("Failed to decode public key");
-      }
-      recipientPubKeyBytes = this.stripKeyHeaderIfPresent(recipientPubKeyBytes);
-      if (recipientPubKeyBytes.length !== this.ML_KEM_1024_PUBLIC_KEY_SIZE && recipientPubKeyBytes.length !== this.ML_KEM_768_PUBLIC_KEY_SIZE) {
-        throw new Error(`Invalid recipient public key size: ${recipientPubKeyBytes.length} bytes. ` + `Expected ${this.ML_KEM_1024_PUBLIC_KEY_SIZE} (ML-KEM-1024) or ${this.ML_KEM_768_PUBLIC_KEY_SIZE} (ML-KEM-768). ` + `Recipient may need to use Nuclear Key Reset in Settings.`);
-      }
-      let kemAlgorithm = this.kemAlgorithm;
-      let kemName = this.kemName;
-      console.log(`\uD83D\uDD10 [DEBUG] Recipient public key length: ${recipientPubKeyBytes.length} bytes`);
-      if (!this.isValidPublicKey(recipientPubKeyBytes)) {
-        console.error(`\uD83D\uDD10 [ERROR] Invalid public key format detected (length: ${recipientPubKeyBytes.length} bytes)`);
-        throw new Error("Invalid public key format");
-      }
-      if (recipientPubKeyBytes.length === this.ML_KEM_768_PUBLIC_KEY_SIZE) {
-        console.log(`\uD83D\uDD10 [COMPATIBILITY] Detected ML-KEM-768 public key, using ML-KEM-768 for encryption`);
-        try {
-          const [kem768Ciphertext, kem768SharedSecret] = await this.kemAlgorithm768.encap(recipientPubKeyBytes);
-          const salt = SecureRandom.generateSalt();
-          const chachaKey = await HKDF.derive(kem768SharedSecret, salt, "ChaCha20-Poly1305", 32);
-          const nonce = SecureRandom.generateNonce();
-          const plaintext = new TextEncoder().encode(message);
-          const messageCiphertext = await ChaCha20Poly1305.encrypt(chachaKey, nonce, plaintext);
-          const encryptedMessage = {
-            v: 3,
-            alg: this.kemName768,
-            kem: Base64.encode(kem768Ciphertext),
-            s: Base64.encode(salt),
-            n: Base64.encode(nonce),
-            c: Base64.encode(messageCiphertext),
-            t: Date.now()
-          };
-          CryptoUtils.secureClear(chachaKey);
-          CryptoUtils.secureClear(kem768SharedSecret);
-          const result = JSON.stringify(encryptedMessage);
-          console.log(`\uD83D\uDD10 ✅ Encrypted message using ${this.kemName768}`);
-          return result;
-        } catch (kem768Error) {
-          console.error(`\uD83D\uDD10 ❌ ML-KEM-768 encryption failed:`, kem768Error);
-          throw kem768Error;
-        }
-      } else {
-        kemAlgorithm = this.kemAlgorithm;
-        kemName = this.kemName;
-      }
-      try {
-        const [kemCiphertext, sharedSecret] = await kemAlgorithm.encap(recipientPubKeyBytes);
-        const salt = SecureRandom.generateSalt();
-        const chachaKey = await HKDF.derive(sharedSecret, salt, "ChaCha20-Poly1305", 32);
-        const nonce = SecureRandom.generateNonce();
-        const plaintext = new TextEncoder().encode(message);
-        const messageCiphertext = await ChaCha20Poly1305.encrypt(chachaKey, nonce, plaintext);
-        const encryptedMessage = {
-          v: 3,
-          alg: kemName,
-          kem: Base64.encode(kemCiphertext),
-          s: Base64.encode(salt),
-          n: Base64.encode(nonce),
-          c: Base64.encode(messageCiphertext),
-          t: Date.now()
-        };
-        CryptoUtils.secureClear(chachaKey);
-        CryptoUtils.secureClear(sharedSecret);
-        const result = JSON.stringify(encryptedMessage);
-        console.log(`\uD83D\uDD10 ✅ Encrypted message using ${kemName}`);
-        return result;
-      } catch (encapError) {
-        console.error(`\uD83D\uDD10 ❌ ML-KEM encapsulation failed:`, encapError);
-        const keyInfo = this.analyzePublicKey(recipientPubKeyBytes);
-        console.log(`\uD83D\uDD10 [DEBUG] Public key analysis:`, keyInfo);
-        throw new Error(`ML-KEM encryption failed: ${encapError.message}`);
-      }
+      recipientPubKeyBytes = Base64.decode(recipientPublicKey);
+    } catch {
+      throw new Error("Failed to decode public key");
+    }
+    recipientPubKeyBytes = this.stripKeyHeaderIfPresent(recipientPubKeyBytes);
+    if (recipientPubKeyBytes.length !== this.ML_KEM_1024_PUBLIC_KEY_SIZE && recipientPubKeyBytes.length !== this.ML_KEM_768_PUBLIC_KEY_SIZE) {
+      throw new Error(`Invalid recipient public key size: ${recipientPubKeyBytes.length} bytes. ` + `Expected ${this.ML_KEM_1024_PUBLIC_KEY_SIZE} (ML-KEM-1024) or ${this.ML_KEM_768_PUBLIC_KEY_SIZE} (ML-KEM-768). ` + `Recipient may need to use Nuclear Key Reset in Settings.`);
+    }
+    if (!this.isValidPublicKey(recipientPubKeyBytes)) {
+      throw new Error("Invalid public key format");
+    }
+    const algorithm = recipientPubKeyBytes.length === this.ML_KEM_768_PUBLIC_KEY_SIZE ? this.kemName768 : this.kemName;
+    try {
+      return await encryptEnvelope(message, recipientPubKeyBytes, { algorithm });
     } catch (error) {
-      console.error(`\uD83D\uDD10 ❌ All encryption methods failed:`, error);
-      throw new Error("Unable to encrypt message with any available method");
+      console.error("\uD83D\uDD10 ❌ ML-KEM encryption failed:", this.analyzePublicKey(recipientPubKeyBytes));
+      throw new Error(`ML-KEM encryption failed: ${error?.message ?? error}`);
     }
   }
   analyzePublicKey(keyBytes) {
@@ -530,118 +318,51 @@ class PostQuantumEncryptionService {
       if (!this.isInitialized) {
         throw new Error("Post-quantum encryption service not initialized");
       }
-      console.log(`\uD83D\uDD10 [DEBUG] Starting decryption...`);
-      console.log(`\uD83D\uDD10 [DEBUG] Encrypted content type:`, typeof encryptedContent);
-      console.log(`\uD83D\uDD10 [DEBUG] Encrypted content length:`, encryptedContent?.length || 0);
-      console.log(`\uD83D\uDD10 [DEBUG] Encrypted content preview:`, encryptedContent?.substring(0, 100) || "N/A");
       let messageData;
       try {
         messageData = JSON.parse(encryptedContent);
-        console.log(`\uD83D\uDD10 [DEBUG] Successfully parsed JSON, algorithm:`, messageData.alg);
-      } catch (parseError) {
-        const errorMessage = parseError instanceof Error ? parseError.message : String(parseError);
-        console.log("\uD83D\uDD10 [DEBUG] Content is not JSON, parse error:", errorMessage);
-        console.log("\uD83D\uDD10 [DEBUG] Raw content that failed to parse:", encryptedContent);
+      } catch {
         return "[Encrypted message]";
       }
       const version = messageData.v || messageData.version || 0;
       const algorithm = messageData.alg || messageData.algorithm || "";
-      const kemCiphertextBase64 = messageData.kem || messageData.kemCiphertext || "";
-      const saltBase64 = messageData.s || messageData.salt || "";
-      const nonceBase64 = messageData.n || messageData.nonce || "";
-      const ciphertextBase64 = messageData.c || messageData.ciphertext || "";
-      let decryptionAlgorithm, userKeysToUse;
-      if (algorithm === this.kemName) {
-        console.log(`\uD83D\uDD10 [DEBUG] Using ${this.kemName} for decryption`);
-        decryptionAlgorithm = this.kemAlgorithm;
-        userKeysToUse = await this.getUserKeys();
-      } else if (algorithm === this.kemName768) {
-        console.log(`\uD83D\uDD10 [DEBUG] Using ${this.kemName768} for decryption`);
-        decryptionAlgorithm = this.kemAlgorithm768;
-        userKeysToUse = await this.getUserKeys768();
-      } else if (algorithm === "FALLBACK-AES-GCM" || algorithm === "FALLBACK-AES") {
-        console.log("\uD83D\uDD10 [LEGACY] AES encrypted message detected - no longer supported");
+      const envelope = {
+        v: version,
+        kem: messageData.kem || messageData.kemCiphertext || "",
+        s: messageData.s || messageData.salt || "",
+        n: messageData.n || messageData.nonce || "",
+        c: messageData.c || messageData.ciphertext || ""
+      };
+      if (algorithm === "FALLBACK-AES-GCM" || algorithm === "FALLBACK-AES") {
         return "[Legacy encrypted message - please delete]";
-      } else {
-        if (!version || version !== 3 || !kemCiphertextBase64 || !saltBase64 || !nonceBase64 || !ciphertextBase64) {
-          console.log("\uD83D\uDD10 [DEBUG] Content is not post-quantum encrypted format, fields:", {
-            version,
-            algorithm,
-            hasKem: !!kemCiphertextBase64,
-            hasSalt: !!saltBase64,
-            hasNonce: !!nonceBase64,
-            hasCiphertext: !!ciphertextBase64
-          });
-          return "[Encrypted message - format error]";
+      }
+      const open = async (alg) => {
+        const keys = alg === this.kemName768 ? await this.getUserKeys768() : await this.getUserKeys();
+        const privateKeyBytes = this.stripKeyHeaderIfPresent(Base64.decode(keys.privateKey));
+        const expected = alg === this.kemName768 ? 2400 : 3168;
+        if (privateKeyBytes.length !== expected) {
+          throw new Error(`Invalid private key size: expected ${expected} bytes, got ${privateKeyBytes.length}. ` + `Please use Nuclear Key Reset in Settings to generate new encryption keys.`);
         }
-        console.log(`\uD83D\uDD10 [DEBUG] Unknown algorithm "${algorithm}", trying ML-KEM-1024 first, then ML-KEM-768 if needed`);
+        return decryptEnvelope({ ...envelope, alg }, privateKeyBytes);
+      };
+      if (algorithm === this.kemName || algorithm === this.kemName768) {
+        return await open(algorithm);
+      }
+      if (version !== 3 || !envelope.kem || !envelope.s || !envelope.n || !envelope.c) {
+        return "[Encrypted message - format error]";
+      }
+      try {
+        return await open(this.kemName);
+      } catch {
         try {
-          decryptionAlgorithm = this.kemAlgorithm;
-          userKeysToUse = await this.getUserKeys();
-          console.log(`\uD83D\uDD10 [DEBUG] Using keys with algorithm ${this.kemName}`);
-          console.log(`\uD83D\uDD10 [DEBUG] Public key length:`, userKeysToUse?.publicKey?.length || 0);
-          let privateKeyBytes = Base64.decode(userKeysToUse.privateKey);
-          const kemCiphertext = Base64.decode(kemCiphertextBase64);
-          privateKeyBytes = this.stripKeyHeaderIfPresent(privateKeyBytes);
-          console.log(`\uD83D\uDD10 [DEBUG] Decoded private key length:`, privateKeyBytes.length);
-          console.log(`\uD83D\uDD10 [DEBUG] Decoded KEM ciphertext length:`, kemCiphertext.length);
-          console.log(`\uD83D\uDD10 [DEBUG] Starting ML-KEM decapsulation with algorithm:`, this.kemName);
-          const sharedSecret = await decryptionAlgorithm.decap(kemCiphertext, privateKeyBytes);
-          console.log(`\uD83D\uDD10 [DEBUG] ML-KEM decapsulation successful, shared secret length:`, sharedSecret.length);
-        } catch (err1024) {
-          console.warn(`\uD83D\uDD10 [DEBUG] ML-KEM-1024 decryption failed, trying ML-KEM-768. Error:`, err1024);
-          try {
-            decryptionAlgorithm = this.kemAlgorithm768;
-            userKeysToUse = await this.getUserKeys768();
-            console.log(`\uD83D\uDD10 [DEBUG] Using keys with algorithm ${this.kemName768}`);
-            console.log(`\uD83D\uDD10 [DEBUG] Public key length:`, userKeysToUse?.publicKey?.length || 0);
-            const privateKeyBytes = Base64.decode(userKeysToUse.privateKey);
-            const kemCiphertext = Base64.decode(kemCiphertextBase64);
-            console.log(`\uD83D\uDD10 [DEBUG] Decoded private key length:`, privateKeyBytes.length);
-            console.log(`\uD83D\uDD10 [DEBUG] Decoded KEM ciphertext length:`, kemCiphertext.length);
-            console.log(`\uD83D\uDD10 [DEBUG] Starting ML-KEM decapsulation with algorithm:`, this.kemName768);
-            const sharedSecret = await decryptionAlgorithm.decap(kemCiphertext, privateKeyBytes);
-            console.log(`\uD83D\uDD10 [DEBUG] ML-KEM decapsulation successful, shared secret length:`, sharedSecret.length);
-          } catch (err768) {
-            console.error(`\uD83D\uDD10 [DEBUG] ML-KEM-768 decryption also failed. Error:`, err768);
-            return "[Encrypted message - could not decrypt with any supported algorithm]";
-          }
+          return await open(this.kemName768);
+        } catch {
+          return "[Encrypted message - could not decrypt with any supported algorithm]";
         }
       }
-      console.log(`\uD83D\uDD10 [DEBUG] Using keys with algorithm ${userKeysToUse ? algorithm === this.kemName768 ? this.kemName768 : this.kemName : "unknown"}`);
-      console.log(`\uD83D\uDD10 [DEBUG] Public key length:`, userKeysToUse?.publicKey?.length || 0);
-      let privateKeyBytes = Base64.decode(userKeysToUse.privateKey);
-      const kemCiphertext = Base64.decode(kemCiphertextBase64);
-      privateKeyBytes = this.stripKeyHeaderIfPresent(privateKeyBytes);
-      const targetPrivateKeySize = algorithm === this.kemName768 ? 2400 : 3168;
-      if (privateKeyBytes.length !== targetPrivateKeySize) {
-        throw new Error(`Invalid private key size: expected ${targetPrivateKeySize} bytes, got ${privateKeyBytes.length}. ` + `Please use Nuclear Key Reset in Settings to generate new encryption keys.`);
-      }
-      console.log(`\uD83D\uDD10 [DEBUG] Decoded private key length:`, privateKeyBytes.length);
-      console.log(`\uD83D\uDD10 [DEBUG] Decoded KEM ciphertext length:`, kemCiphertext.length);
-      console.log(`\uD83D\uDD10 [DEBUG] Starting ML-KEM decapsulation with algorithm:`, algorithm === this.kemName768 ? this.kemName768 : this.kemName);
-      const sharedSecret = await decryptionAlgorithm.decap(kemCiphertext, privateKeyBytes);
-      console.log(`\uD83D\uDD10 [DEBUG] ML-KEM decapsulation successful, shared secret length:`, sharedSecret.length);
-      const salt = Base64.decode(saltBase64);
-      const chachaKey = await HKDF.derive(sharedSecret, salt, "ChaCha20-Poly1305", 32);
-      const nonce = Base64.decode(nonceBase64);
-      const messageCiphertext = Base64.decode(ciphertextBase64);
-      console.log(`\uD83D\uDD10 [DEBUG] Nonce length:`, nonce.length);
-      console.log(`\uD83D\uDD10 [DEBUG] Message ciphertext length:`, messageCiphertext.length);
-      console.log(`\uD83D\uDD10 [DEBUG] Starting ChaCha20-Poly1305 decryption...`);
-      const plaintext = await ChaCha20Poly1305.decrypt(chachaKey, nonce, messageCiphertext);
-      console.log(`\uD83D\uDD10 [DEBUG] ChaCha20-Poly1305 decryption successful, plaintext length:`, plaintext.length);
-      const messageText = new TextDecoder("utf-8").decode(plaintext);
-      CryptoUtils.secureClear(chachaKey);
-      CryptoUtils.secureClear(sharedSecret);
-      console.log(`\uD83D\uDD10 ✅ Successfully decrypted message using ${algorithm === this.kemName768 ? this.kemName768 : this.kemName}`);
-      return messageText;
     } catch (error) {
-      console.error(`\uD83D\uDD10 ❌ Failed to decrypt message with ${this.kemName}:`, error);
-      if (error instanceof Error && error.stack) {
-        console.error(`\uD83D\uDD10 ❌ Error stack:`, error.stack);
-      }
       const errorMsg = error instanceof Error ? error.message : String(error);
+      console.error(`\uD83D\uDD10 ❌ Failed to decrypt message: ${errorMsg}`);
       if (errorMsg.includes("Algorithm mismatch")) {
         return "[Message encrypted with different keys]";
       }
@@ -1371,8 +1092,9 @@ Usage:
 <chat> is a chat id or part of its name. Options: --json, --url <server> (or QC_URL).
 Keys and tokens are sealed (ChaCha20-Poly1305) in ${"$"}QC_HOME or ~/.config/qc; the key is in your
 OS keychain, or comes from a passphrase (QC_PASSPHRASE for scripts and qc mcp).
-HD: emoji and icons are drawn as our OpenEmoji/OpenIcon images in Kitty and Ghostty. Over SSH or in
-tmux (set -g allow-passthrough on), run with QC_HD=1; QC_HD=0 turns it off.`;
+HD: emoji and icons are drawn as our OpenEmoji/OpenIcon images in Kitty, Ghostty, WezTerm and iTerm2.
+Over SSH or in tmux (set -g allow-passthrough on) say which: QC_HD=1 (Kitty/Ghostty) or
+QC_HD=wezterm (WezTerm/iTerm2). QC_HD=0 turns it off.`;
 function parseArgs2(argv) {
   const args = { _: [], flags: {} };
   for (let i = 0;i < argv.length; i++) {

package/dist/commands.js

@@ -3,7 +3,7 @@ import {
   parseArgs2,
   findChat2,
   main2
-} from "./chunk-jdt6p3k7.js";
+} from "./chunk-kabknfjj.js";
 import"./chunk-vfahhydf.js";
 export {
   HELP2 as HELP,

package/dist/mcp.js

@@ -1,7 +1,7 @@
 import"./chunk-vfahhydf.js";
 import {
   findChat2
-} from "./chunk-jdt6p3k7.js";
+} from "./chunk-kabknfjj.js";
 
 // src/cli/mcp.js
 import { createInterface } from "node:readline";

package/dist/tui.js

@@ -215,6 +215,7 @@ async function runTui(client, { initialChat } = {}) {
   const redraw = () => app.invalidate();
   const env = process.env.QC_HD && !process.env.HQTUI_IMAGES ? { ...process.env, HQTUI_IMAGES: process.env.QC_HD } : process.env;
   state.images = createImageStore({ write: (seq) => app.terminal.write(seq), onReady: redraw, env });
+  state.images.attach(app);
   const note = (msg, { sticky = false } = {}) => {
     state.notice = msg;
     redraw();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/qryptchat",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "qc: qrypt.chat in your terminal. A full-screen end-to-end encrypted chat client (ML-KEM-1024), plus a scriptable CLI and an MCP server.",
   "type": "module",
   "bin": {
@@ -17,7 +17,8 @@
   },
   "dependencies": {
     "@noble/ciphers": "^2.0.0",
-    "@profullstack/hqtui": "^0.9.0",
+    "@profullstack/encrypt": "^0.1.0",
+    "@profullstack/hqtui": "^0.10.0",
     "mlkem": "^2.5.0"
   },
   "keywords": [