@rikaidev/yomi 0.2.6

package/dist/line/core/config.js

@@ -0,0 +1,67 @@
+/**
+ * LINE Desktop client configuration.
+ * Shared across LINE protocol clients.
+ *
+ * Protocol version derived from installed LINE.app via Info.plist.
+ */
+import { execSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+const LINE_INFO_PLIST_PATH = '/Applications/LINE.app/Contents/Info.plist';
+/**
+ * Read a plist key from LINE.app, with fallback.
+ *
+ * @param key - The plist key to read
+ * @param fallback - Default value if read fails
+ * @returns The plist value or fallback
+ */
+function plist(key, fallback) {
+    if (!fs.existsSync(LINE_INFO_PLIST_PATH)) {
+        return fallback;
+    }
+    try {
+        return execSync(`defaults read ${LINE_INFO_PLIST_PATH} ${key} 2>/dev/null`, { encoding: 'utf-8', timeout: 3000 }).trim();
+    }
+    catch {
+        return fallback;
+    }
+}
+/**
+ * macOS product version (e.g. "15.3"), NOT Darwin kernel version.
+ *
+ * @returns The macOS version string
+ */
+function macosVersion() {
+    try {
+        return execSync('sw_vers -productVersion', {
+            encoding: 'utf-8',
+            timeout: 3000,
+        }).trim();
+    }
+    catch {
+        return '15.0';
+    }
+}
+const LINE_SHORT = plist('CFBundleShortVersionString', '26.0.2');
+const LINE_BUILD = plist('CFBundleVersion', '3828');
+const LINE_VERSION = `${LINE_SHORT}.${LINE_BUILD}`;
+const MACOS_VER = macosVersion();
+export const LINE_APP_CONFIG = {
+    host: 'ga2.line.naver.jp',
+    // Service paths
+    talkPath: '/S4',
+    syncPath: '/SYNC4',
+    authPath: '/AS4',
+    revokePath: '/RS4',
+    tokenRefreshPath: '/EXT/auth/tokenrefresh/v1',
+    qrPath: '/acct/lgn/sq/v1',
+    qrLongPollPath: '/acct/lp/lgn/sq/v1',
+    pwlessPath: '/acct/lgn/secpwless/v1',
+    pwlessLongPollPath: '/acct/lp/lgn/secpwless/v1',
+    // Client identification — matches real LINE desktop format
+    lineApp: `DESKTOPMAC\t${LINE_VERSION}\tMAC\t${MACOS_VER}`,
+    userAgent: `Line/${LINE_VERSION}`,
+    // Device info shown on phone during secondary-device approval.
+    systemName: os.hostname() || 'yomi',
+    modelName: 'yomi',
+};

package/dist/line/core/constants.js

@@ -0,0 +1,56 @@
+/**
+ * LINE protocol constants — operation types and content types.
+ */
+export const OP_TYPE = {
+    END_OF_OPERATION: 0,
+    UPDATE_PROFILE: 1,
+    NOTIFIED_UPDATE_PROFILE: 2,
+    RECEIVE_MESSAGE: 26,
+    SEND_MESSAGE: 25,
+    RECEIVE_MESSAGE_RECEIPT: 28,
+    SEND_MESSAGE_RECEIPT: 29,
+    NOTIFIED_READ_MESSAGE: 55,
+    NOTIFIED_UNREAD_COUNT: 56,
+    NOTIFIED_DESTROY_MESSAGE: 61,
+    NOTIFIED_TYPING: 90,
+    ADD_CONTACT: 15,
+    BLOCK_CONTACT: 16,
+    UNBLOCK_CONTACT: 17,
+    UPDATE_GROUP: 9,
+    NOTIFIED_UPDATE_GROUP: 10,
+    INVITE_INTO_GROUP: 11,
+    ACCEPT_GROUP_INVITATION: 13,
+    LEAVE_GROUP: 31,
+    NOTIFIED_INVITE_INTO_GROUP: 32,
+    NOTIFIED_ACCEPT_GROUP_INVITATION: 34,
+    NOTIFIED_LEAVE_GROUP: 35,
+    KICKOUT_FROM_GROUP: 36,
+};
+// Values mirror LINE's Thrift `ContentType` enum exactly. Do not renumber to
+// match intuition: a wrong value silently misroutes a message type (e.g. FILE
+// was 19 = MUSIC, so file attachments were never recognized as downloadable).
+export const CONTENT_TYPE = {
+    NONE: 0,
+    IMAGE: 1,
+    VIDEO: 2,
+    AUDIO: 3,
+    HTML: 4,
+    PDF: 5,
+    CALL: 6,
+    STICKER: 7,
+    PRESENCE: 8,
+    GIFT: 9,
+    GROUPBOARD: 10,
+    APPLINK: 11,
+    LINK: 12,
+    CONTACT: 13,
+    FILE: 14,
+    LOCATION: 15,
+    POSTNOTIFICATION: 16,
+    RICH: 17,
+    CHATEVENT: 18,
+    MUSIC: 19,
+    PAYMENT: 20,
+    EXTIMAGE: 21,
+    FLEX: 22,
+};

package/dist/line/core/contact-query-service.js

@@ -0,0 +1,20 @@
+import { requireLineClient } from './client-runtime.js';
+/**
+ * Build the LINE contact query boundary for a connected runtime.
+ *
+ * @param getClient - Deferred LINE client accessor
+ * @returns Contact query methods
+ */
+export function createContactQueryService(getClient) {
+    return {
+        /**
+         * Fetch a LINE contact profile.
+         *
+         * @param mid - LINE contact MID
+         * @returns LINE contact profile
+         */
+        async getContact(mid) {
+            return requireLineClient(getClient).getContact(mid);
+        },
+    };
+}

package/dist/line/core/directory-runtime-service.js

@@ -0,0 +1,83 @@
+/**
+ * LINE core directory/runtime capability.
+ */
+import { fetchStickerPackageMeta } from '../client/sticker-meta.js';
+import { createContactQueryService } from './contact-query-service.js';
+import { createGroupQueryService } from './group-query-service.js';
+/**
+ * Create the directory runtime capability bound to one LINE protocol service.
+ *
+ * @param service - Mutable LINE protocol service runtime.
+ * @returns Directory and lightweight runtime methods.
+ */
+export function createDirectoryRuntimeService(service) {
+    return {
+        /**
+         * Resolve a display name for one MID from the in-memory cache.
+         *
+         * @param mid - The user or group MID.
+         * @returns Cached name or the MID itself.
+         */
+        resolveName(mid) {
+            return service.nameCache.get(mid) || mid;
+        },
+        /**
+         * Fetch a LINE contact profile through the explicit contact-query boundary.
+         *
+         * @param mid - LINE contact MID.
+         * @returns LINE contact profile.
+         */
+        async getContact(mid) {
+            return createContactQueryService(() => service.client).getContact(mid);
+        },
+        /**
+         * Fetch a LINE group profile through the explicit group-query boundary.
+         *
+         * @param groupId - LINE group MID.
+         * @returns LINE group profile.
+         */
+        async getGroup(groupId) {
+            return createGroupQueryService(() => service.client).getGroup(groupId);
+        },
+        /**
+         * List the sticker packages the account owns (and can therefore send).
+         *
+         * @param language - Locale for package titles (default 'en').
+         * @returns Owned sticker packages: { packageId, title, version }.
+         */
+        async listStickerPackages(language = 'en') {
+            return service.client.getOwnedStickerPackages(language);
+        },
+        /**
+         * Search the account's OWNED sticker packages by title substring, and
+         * expand each match into its sendable individual sticker ids (via the
+         * public sticker CDN) so send_sticker can be called directly.
+         *
+         * @param query - Case-insensitive substring to match against package titles.
+         * @param language - Locale for package titles (default 'en').
+         * @param limit - Max matching packages to expand (default 8).
+         * @returns Matching packages with their sticker ids.
+         */
+        async searchStickerPackages(query, language = 'en', limit = 8) {
+            const owned = await service.client.getOwnedStickerPackages(language);
+            const needle = (query ?? '').trim().toLowerCase();
+            const matches = needle
+                ? owned.filter((p) => String(p.title ?? '')
+                    .toLowerCase()
+                    .includes(needle))
+                : owned;
+            const top = matches.slice(0, limit);
+            const packages = await Promise.all(top.map(async (p) => {
+                const meta = await fetchStickerPackageMeta(p.packageId).catch(() => null);
+                return {
+                    packageId: p.packageId,
+                    version: p.version,
+                    title: p.title,
+                    titles: meta?.title ?? {},
+                    stickerIds: meta?.stickerIds ?? [],
+                };
+            }));
+            return { total: matches.length, packages };
+        },
+    };
+}

package/dist/line/core/e2ee/bootstrap/keychain.js

@@ -0,0 +1,41 @@
+/**
+ * LINE E2EE login bootstrap keychain decryption.
+ */
+import { Buffer } from 'node:buffer';
+import * as crypto from 'node:crypto';
+import { readStructFields } from '../../thrift/index.js';
+import { computeSharedSecret, deriveKeyAndIV, } from '../crypto/crypto-primitives.js';
+/**
+ * Decrypt the E2EE key chain from login response.
+ *
+ * @param encryptedKeyChain - From login metaData.encryptedKeyChain (base64 decoded)
+ * @param serverPublicKey - From login metaData.publicKey (base64 decoded, 32 bytes)
+ * @param ourPrivateKey - Our NaCl 32-byte private key (secretKey from login)
+ * @returns Parsed E2EE keys
+ */
+export function decryptKeyChain(encryptedKeyChain, serverPublicKey, ourPrivateKey) {
+    const shared = computeSharedSecret(ourPrivateKey, serverPublicKey);
+    const { key, iv } = deriveKeyAndIV(shared);
+    const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+    decipher.setAutoPadding(false);
+    const decrypted = Buffer.concat([
+        decipher.update(encryptedKeyChain),
+        decipher.final(),
+    ]);
+    const parsed = readStructFields(decrypted);
+    const keyList = parsed[1];
+    if (!Array.isArray(keyList)) {
+        return [];
+    }
+    return keyList.map((keyStruct) => ({
+        version: keyStruct[1],
+        keyId: keyStruct[2],
+        publicKey: Buffer.isBuffer(keyStruct[4])
+            ? keyStruct[4]
+            : Buffer.from(keyStruct[4]),
+        privateKey: Buffer.isBuffer(keyStruct[5])
+            ? keyStruct[5]
+            : Buffer.from(keyStruct[5]),
+        createdTime: keyStruct[6] ? Number(keyStruct[6]) : null,
+    }));
+}

package/dist/line/core/e2ee/crypto/crypto-primitives.js

@@ -0,0 +1,98 @@
+/**
+ * Crypto Primitives for E2EE
+ */
+import { Buffer } from 'node:buffer';
+import crypto from 'node:crypto';
+import { sharedKey as curve25519SharedKey } from 'curve25519-js';
+/**
+ * Compute SHA-256 hash of input data
+ * @param args - Data to hash (strings or Uint8Array)
+ * @returns Hash digest as Buffer
+ */
+export function sha256(...args) {
+    const h = crypto.createHash('sha256');
+    for (const a of args) {
+        const buf = Buffer.from(a);
+        h.update(buf);
+    }
+    return h.digest();
+}
+/**
+ * XOR the two halves of a buffer together
+ * @param buf - Buffer to XOR
+ * @returns Resulting buffer with half the length
+ */
+export function xorHalves(buf) {
+    const half = Math.floor(buf.length / 2);
+    const out = Buffer.alloc(half);
+    for (let i = 0; i < half; i++) {
+        out[i] = buf[i] ^ buf[half + i];
+    }
+    return out;
+}
+/**
+ * Decrypt data using AES-256-CBC
+ * @param data - Encrypted data
+ * @param key - Decryption key
+ * @param iv - Initialization vector
+ * @returns Decrypted data
+ */
+export function aesDecrypt(data, key, iv) {
+    const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+    return Buffer.concat([decipher.update(data), decipher.final()]);
+}
+/**
+ * Generate X25519 key pair for E2EE
+ * @returns Key pair object
+ */
+export function generateKeyPair() {
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('x25519');
+    const pub = publicKey.export({ type: 'spki', format: 'der' }).slice(-32);
+    const priv = privateKey.export({ type: 'pkcs8', format: 'der' }).slice(-32);
+    return {
+        publicKey: pub,
+        privateKey: priv,
+    };
+}
+/**
+ * Compute X25519 shared secret from raw 32-byte keys.
+ *
+ * @param privateKey - 32-byte private key
+ * @param publicKey - 32-byte public key
+ * @returns 32-byte shared secret
+ */
+export function computeSharedSecret(privateKey, publicKey) {
+    return Buffer.from(curve25519SharedKey(Uint8Array.from(privateKey), Uint8Array.from(publicKey)));
+}
+/**
+ * Derive AES-256 key and 16-byte IV from shared secret.
+ * @param sharedSecret - 32-byte ECDH shared secret
+ * @returns Derived key and IV
+ */
+export function deriveKeyAndIV(sharedSecret) {
+    return {
+        key: sha256(sharedSecret, 'Key'),
+        iv: xorHalves(sha256(sharedSecret, 'IV')),
+    };
+}
+/**
+ * Derive message-specific key and IV (for V1 messages with salt).
+ * @param sharedSecret - 32-byte ECDH shared secret
+ * @param salt - Message salt
+ * @returns Object containing derived key and IV
+ */
+export function deriveMessageKeyAndIV(sharedSecret, salt) {
+    return {
+        key: sha256(sharedSecret, salt, 'Key'),
+        iv: xorHalves(sha256(sharedSecret, salt, 'IV')),
+    };
+}
+/**
+ * Derive GCM key for V2 messages.
+ * @param sharedSecret - 32-byte ECDH shared secret
+ * @param salt - Message salt
+ * @returns Derived 32-byte key
+ */
+export function deriveGCMKey(sharedSecret, salt) {
+    return sha256(sharedSecret, salt, 'Key');
+}

package/dist/line/core/e2ee/index.js

@@ -0,0 +1,6 @@
+/**
+ * LINE E2EE - exports
+ */
+export { decryptKeyChain } from './bootstrap/keychain.js';
+export { aesDecrypt, generateKeyPair, sha256, xorHalves, } from './crypto/crypto-primitives.js';
+export { KeyManager as E2EEKeyManager } from './keys/key-manager.js';

package/dist/line/core/e2ee/keys/decrypt.js

@@ -0,0 +1,110 @@
+import { tryDecryptInner } from './message-decrypt.js';
+const PEER_KEY_MISMATCH_PATTERN = /Peer E2EE key mismatch/i;
+const MISSING_GROUP_SENDER_KEY_PATTERN = /Missing group sender key/i;
+const GCM_AUTH_FAILURE_PATTERN = /unable to authenticate data|Unsupported state or unable to authenticate/i;
+export { decryptV1, decryptV2, decryptV2WithCandidates, extractTextPayload, generateAAD, getIntBytes, toChunkKeyId, } from './message-crypto.js';
+/**
+ * Build one structured decrypt-failure log payload from a raw LINE message.
+ *
+ * @param ctx - KeyManager context.
+ * @param msg - Raw LINE message object.
+ * @param error - Thrown decryption error.
+ * @returns Structured log context.
+ */
+function buildDecryptFailureContext(ctx, msg, error) {
+    const chatMid = resolveDecryptFailureChatMid(msg);
+    return {
+        chat: chatMid,
+        message_id: msg?.id ?? null,
+        sender: msg?.from ?? null,
+        to: msg?.to ?? null,
+        sender_key_id: readDecryptFailureChunkKeyId(ctx, msg, 3),
+        receiver_key_id: readDecryptFailureChunkKeyId(ctx, msg, 4),
+        content_type: msg?.contentType ?? null,
+        e2ee_version: msg?.contentMetadata?.e2eeVersion ?? null,
+        error: error.message,
+    };
+}
+/**
+ * Convert one thrown decrypt error into a stable reason code.
+ *
+ * @param error - Thrown decrypt error.
+ * @returns Diagnostic reason code.
+ */
+function resolveDecryptFailureReason(error) {
+    if (PEER_KEY_MISMATCH_PATTERN.test(error.message)) {
+        return 'peer_key_mismatch';
+    }
+    if (MISSING_GROUP_SENDER_KEY_PATTERN.test(error.message)) {
+        return 'missing_group_sender_key';
+    }
+    if (GCM_AUTH_FAILURE_PATTERN.test(error.message)) {
+        return 'gcm_auth_failed';
+    }
+    return 'decrypt_failed';
+}
+/**
+ * Resolve the group chat MID for one failed decrypt attempt.
+ *
+ * @param msg - Raw LINE message object.
+ * @returns Group chat MID or null.
+ */
+function resolveDecryptFailureChatMid(msg) {
+    const isGroup = Number(msg?.toType) !== 0;
+    return isGroup && typeof msg?.to === 'string' ? msg.to : null;
+}
+/**
+ * Read one parsed LINE E2EE chunk key id from a failed decrypt payload.
+ *
+ * @param ctx - KeyManager context.
+ * @param msg - Raw LINE message object.
+ * @param index - Chunk index.
+ * @returns Parsed chunk key id or null.
+ */
+function readDecryptFailureChunkKeyId(ctx, msg, index) {
+    if (typeof ctx.readChunkKeyId !== 'function') {
+        return null;
+    }
+    return ctx.readChunkKeyId(msg?.chunks?.[index]);
+}
+/**
+ * Handle one E2EE decrypt failure without escalating to auth/session state.
+ *
+ * @param ctx - KeyManager context.
+ * @param msg - Raw LINE message object.
+ * @param error - Thrown decryption error.
+ * @returns Stable failed decrypt result.
+ */
+async function handleDecryptFailure(ctx, msg, error) {
+    // Do NOT invalidate the group key on failure. Keys are cached per epoch
+    // (chat:groupKeyId) and are never the wrong secret for their id; a group
+    // decrypt failure means the message's epoch is one LINE can no longer hand
+    // us (it only returns the latest), which a refetch cannot fix. Dropping the
+    // key here would only evict epochs this device can still read and churn the
+    // credential store.
+    ctx.logGroupKeyEvent?.('e2ee.message.decrypt_failed', buildDecryptFailureContext(ctx, msg, error));
+    console.warn('[E2EE] Decryption failed:', error.message);
+    return {
+        decrypted: false,
+        error: error.message,
+        reason: resolveDecryptFailureReason(error),
+        receiverKeyId: readDecryptFailureChunkKeyId(ctx, msg, 4),
+        senderKeyId: readDecryptFailureChunkKeyId(ctx, msg, 3),
+    };
+}
+/**
+ * Attempt to decrypt an E2EE message using stored keys.
+ * Returns plaintext on success, or a no-op result for plaintext messages.
+ *
+ * @param ctx - KeyManager context
+ * @param msg - Parsed message object (from parsers.ts)
+ * @returns Decryption result with optional plaintext
+ */
+export async function tryDecrypt(ctx, msg) {
+    try {
+        return await tryDecryptInner(ctx, msg);
+    }
+    catch (err) {
+        return handleDecryptFailure(ctx, msg, err);
+    }
+}

package/dist/line/core/e2ee/keys/encrypt.js

@@ -0,0 +1,117 @@
+import { Buffer } from 'node:buffer';
+import crypto from 'node:crypto';
+import { computeSharedSecret, deriveGCMKey, } from '../crypto/crypto-primitives.js';
+import { getGroupKey } from './group-key.js';
+import { normalizeNegotiatedPublicKey } from './key-payload.js';
+import { generateAAD, getIntBytes } from './message-crypto.js';
+/**
+ * Infer the LINE MID type from its leading prefix.
+ * `u` = user, `c` = group, `r` = room.
+ *
+ * @param mid - LINE MID
+ * @returns Numeric MID type compatible with Talk/E2EE logic
+ */
+function getMidType(mid) {
+    if (typeof mid !== 'string' || mid.length === 0) {
+        return -1;
+    }
+    if (mid.startsWith('u')) {
+        return 0;
+    }
+    if (mid.startsWith('c')) {
+        return 1;
+    }
+    if (mid.startsWith('r')) {
+        return 2;
+    }
+    return -1;
+}
+/**
+ * Encrypt an outbound LINE E2EE v2 payload and append the GCM auth tag.
+ *
+ * @param data - Serialized message payload
+ * @param gcmKey - Derived AES-GCM key
+ * @param nonce - Random 12-byte GCM nonce
+ * @param aad - Additional authenticated data
+ * @returns Ciphertext buffer with trailing auth tag
+ */
+function encryptE2EEMessageV2(data, gcmKey, nonce, aad) {
+    const cipher = crypto.createCipheriv('aes-256-gcm', gcmKey, nonce);
+    cipher.setAAD(aad);
+    const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+    return Buffer.concat([encrypted, cipher.getAuthTag()]);
+}
+/**
+ * Prepare an outbound LINE E2EE payload using the same chunk layout as linejs.
+ *
+ * The returned structure is transport-ready for TalkService sendMessage:
+ * `chunks` contains `[salt, ciphertext+tag, nonce, senderKeyIdBytes, receiverKeyIdBytes]`
+ * and `contentMetadata` includes the E2EE markers LINE expects for version 2.
+ *
+ * @param ctx - KeyManager context
+ * @param to - Target LINE MID
+ * @param data - Text or structured payload to encrypt
+ * @param contentType - LINE content type of the payload
+ * @returns Message chunks plus metadata required by LINE
+ */
+export async function encryptE2EEMessage(ctx, to, data, contentType = 0) {
+    const selfMid = ctx.getProfileMid();
+    if (!selfMid) {
+        throw new Error('Cannot encrypt E2EE message without an authenticated LINE profile');
+    }
+    const selfKey = ctx.getSelfKeyByMid(selfMid);
+    if (!selfKey) {
+        throw new Error(`Missing self E2EE key for mid=${selfMid}`);
+    }
+    const toType = getMidType(to);
+    if (![0, 1, 2].includes(toType)) {
+        throw new Error(`Invalid LINE target MID for E2EE: ${to}`);
+    }
+    const senderKeyId = Number(selfKey.keyId);
+    let receiverKeyId;
+    let sharedSecret;
+    if (toType === 0) {
+        const publicKey = normalizeNegotiatedPublicKey(await ctx.getClient()?.negotiateE2EEPublicKey?.(to));
+        if (!publicKey) {
+            throw new Error(`Failed to negotiate peer E2EE public key for ${to}`);
+        }
+        receiverKeyId = Number(publicKey.keyId);
+        sharedSecret = computeSharedSecret(selfKey.privateKey, publicKey.keyData);
+    }
+    else {
+        // Never mint: resolve an EXISTING group key or fail. Registering a new
+        // group key is an account-visible write that rotates the group's shared
+        // secret for every member and strands all history under the previous
+        // secret — Yomi must never do that (see getGroupKey).
+        const groupKey = await getGroupKey(ctx, to, null, selfMid, selfKey.keyId);
+        if (!groupKey) {
+            throw new Error(`No existing LINE group E2EE key for ${to}; Yomi will not register one (that would rotate the group key for every member). Let the official LINE client establish the group's E2EE key first.`);
+        }
+        receiverKeyId = Number(groupKey.keyId);
+        sharedSecret = computeSharedSecret(groupKey.privateKey, selfKey.publicKey);
+    }
+    const specVersion = 2;
+    const salt = crypto.randomBytes(16);
+    const nonce = crypto.randomBytes(12);
+    const gcmKey = deriveGCMKey(sharedSecret, salt);
+    const aad = generateAAD(to, selfMid, senderKeyId, receiverKeyId, specVersion, contentType);
+    const serialized = typeof data === 'string'
+        ? Buffer.from(JSON.stringify({ text: data }))
+        : Buffer.from(JSON.stringify(contentType === 15 ? { location: data } : data));
+    const ciphertext = encryptE2EEMessageV2(serialized, gcmKey, nonce, aad);
+    return {
+        chunks: [
+            salt,
+            ciphertext,
+            nonce,
+            getIntBytes(senderKeyId),
+            getIntBytes(receiverKeyId),
+        ],
+        contentType,
+        contentMetadata: {
+            e2eeVersion: '2',
+            contentType: String(contentType),
+            e2eeMark: '2',
+        },
+    };
+}