@rikaidev/yomi 0.2.6

package/dist/line/auth/pwless/steps.js

@@ -0,0 +1,213 @@
+/**
+ * LINE Passwordless Login Protocol Steps.
+ *
+ * Flow: createSession → verifyLoginCertificate → requestPinCodeVerif →
+ *       checkPinCodeVerified → putExchangeKey → requestPaakAuth →
+ *       checkPaakAuthenticated → loginV2
+ *
+ * Field layouts verified against CHRLINE reference + live test (2026-03-27).
+ */
+import { boolField, encodeCallMessage, mapField, stringField, structField, } from '../../core/thrift/index.js';
+/**
+ * Number of long-poll hops `checkPinCodeVerified` makes before giving up.
+ * Each hop is bounded by `PWLESS_POLL_TIMEOUT_MS` (../index.ts) — the two
+ * multiplied together give the real client-side ceiling for this step, which
+ * is minutes, not the duration of a single hop.
+ */
+export const PIN_VERIFY_POLL_ATTEMPTS = 15;
+/**
+ * Number of long-poll hops `checkPaakAuthenticated` makes before giving up.
+ * Same relationship to `PWLESS_POLL_TIMEOUT_MS` as `PIN_VERIFY_POLL_ATTEMPTS`.
+ */
+export const PAAK_AUTH_POLL_ATTEMPTS = 12;
+/**
+ * Step 1: Create a pwless login session with phone number.
+ *
+ * @param ctx - Pwless login context
+ * @param phone - E.164 phone number (e.g. +886912345678)
+ * @param region - Region code (e.g. TW, JP)
+ * @returns Session ID string
+ */
+export async function createSession(ctx, phone, region) {
+    const fields = [
+        structField(1, [stringField(1, phone), stringField(2, region)]),
+    ];
+    const data = encodeCallMessage('createSession', ctx.seq++, fields);
+    const result = await ctx.sendPwless(data);
+    const sid = result?.fields?.[0]?.[1];
+    if (!sid) {
+        throw new Error(`createSession failed: ${JSON.stringify(result)}`);
+    }
+    return sid;
+}
+/**
+ * Step 2: Verify login certificate (skip PIN if cert valid).
+ *
+ * @param ctx - Pwless login context
+ * @param certificate - Previously saved certificate, or empty string
+ * @returns True if certificate is valid (PIN can be skipped)
+ */
+export async function verifyLoginCertificate(ctx, certificate) {
+    const fields = [
+        structField(1, [
+            stringField(1, ctx.sessionId),
+            stringField(2, certificate || ''),
+        ]),
+    ];
+    const data = encodeCallMessage('verifyLoginCertificate', ctx.seq++, fields);
+    const result = await ctx.sendPwless(data);
+    return !!(result?.fields?.[0] && !result?.fields?.[1]);
+}
+/**
+ * Step 3a: Request PIN code verification.
+ *
+ * @param ctx - Pwless login context
+ * @returns PIN code string to display to user
+ */
+export async function requestPinCodeVerif(ctx) {
+    const fields = [
+        structField(1, [stringField(1, ctx.sessionId)]),
+    ];
+    const data = encodeCallMessage('requestPinCodeVerif', ctx.seq++, fields);
+    const result = await ctx.sendPwless(data);
+    const pin = result?.fields?.[0]?.[1];
+    if (!pin) {
+        throw new Error(`requestPinCodeVerif failed: ${JSON.stringify(result)}`);
+    }
+    return pin;
+}
+/**
+ * Step 3b: Long-poll until PIN is verified on phone.
+ *
+ * @param ctx - Pwless login context
+ * @returns True if PIN verified, false if timed out
+ */
+export async function checkPinCodeVerified(ctx) {
+    for (let i = 0; i < PIN_VERIFY_POLL_ATTEMPTS; i++) {
+        if (ctx.aborted) {
+            return false;
+        }
+        const fields = [
+            structField(1, [stringField(1, ctx.sessionId)]),
+        ];
+        const data = encodeCallMessage('checkPinCodeVerified', ctx.seq++, fields);
+        const result = await ctx.sendPwlessLongPoll(data);
+        if (result.error === 'timeout' || result.error) {
+            continue;
+        }
+        if (result.fields && !result.fields[1]) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Step 4: Exchange E2EE public key with server.
+ * Uses MAP type for key-value exchange.
+ *
+ * @param ctx - Pwless login context
+ * @param publicKeyBase64 - NaCl X25519 public key in base64
+ */
+export async function putExchangeKey(ctx, publicKeyBase64) {
+    const fields = [
+        structField(1, [
+            stringField(1, ctx.sessionId),
+            mapField(2, 11, 11, {
+                e2eeVersion: '1',
+                temporalPublicKey: publicKeyBase64,
+            }),
+        ]),
+    ];
+    const data = encodeCallMessage('putExchangeKey', ctx.seq++, fields);
+    await ctx.sendPwless(data);
+}
+/**
+ * Step 5: Request PAAK (biometric) authentication.
+ *
+ * @param ctx - Pwless login context
+ */
+export async function requestPaakAuth(ctx) {
+    const fields = [
+        structField(1, [stringField(1, ctx.sessionId)]),
+    ];
+    const data = encodeCallMessage('requestPaakAuth', ctx.seq++, fields);
+    await ctx.sendPwless(data);
+}
+/**
+ * Step 6: Long-poll until biometric is confirmed on phone.
+ *
+ * @param ctx - Pwless login context
+ * @returns True if PAAK confirmed
+ */
+export async function checkPaakAuthenticated(ctx) {
+    for (let i = 0; i < PAAK_AUTH_POLL_ATTEMPTS; i++) {
+        if (ctx.aborted) {
+            return false;
+        }
+        const fields = [
+            structField(1, [
+                stringField(1, ctx.sessionId),
+                stringField(2, 'CHANNELGW'),
+                boolField(3, true),
+            ]),
+        ];
+        const data = encodeCallMessage('checkPaakAuthenticated', ctx.seq++, fields);
+        const result = await ctx.sendPwlessLongPoll(data);
+        if (result.error === 'timeout' || result.error) {
+            continue;
+        }
+        if (result.fields?.[0] && !result.fields?.[1]) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Step 7: Retrieve E2EE key from server.
+ * Must be called after PAAK and before loginV2 to complete the session properly.
+ *
+ * @param ctx - Pwless login context
+ * @returns E2EE key response (encryptedKeyChain, publicKey, etc.)
+ */
+export async function getE2eeKey(ctx) {
+    const fields = [
+        structField(1, [stringField(1, ctx.sessionId)]),
+    ];
+    const data = encodeCallMessage('getE2eeKey', ctx.seq++, fields);
+    const result = await ctx.sendPwless(data);
+    return result?.fields?.[0] ?? null;
+}
+/**
+ * Step 8: Final login call. Returns authToken, certificate, mid.
+ *
+ * @param ctx - Pwless login context
+ * @param systemName - Device hostname
+ * @returns Login result with authToken, refreshToken, certificate, mid
+ */
+export async function loginV2(ctx, systemName) {
+    const fields = [
+        structField(1, [
+            stringField(1, ctx.sessionId),
+            boolField(2, true),
+            stringField(3, systemName),
+            stringField(4, 'CHANNELGW'),
+        ]),
+    ];
+    const data = encodeCallMessage('loginV2', ctx.seq++, fields);
+    const result = await ctx.sendPwless(data);
+    if (result?.fields?.[1]) {
+        const exc = result.fields[1];
+        throw new Error(`loginV2 failed: code=${exc[1]} msg="${exc[2]}"`);
+    }
+    const rp = result?.fields?.[0];
+    if (!rp) {
+        throw new Error(`loginV2: unexpected response`);
+    }
+    const tokenInfo = rp[3];
+    return {
+        authToken: tokenInfo?.[1],
+        refreshToken: tokenInfo?.[2],
+        certificate: rp[2],
+        mid: rp[5],
+    };
+}

package/dist/line/client/auth-service/client.js

@@ -0,0 +1,240 @@
+/**
+ * LINE AuthService client capability.
+ *
+ * Keep auth-service calls separate from TalkService calls so the client mirrors
+ * linejs more closely: Talk handles messaging and contacts, Auth handles token
+ * lifecycle and credential/bootstrap flows on /AS4, /RS4, and refresh paths.
+ */
+import { Buffer } from 'node:buffer';
+import { createCliLogger } from '../../../util/log.js';
+import { LINE_APP_CONFIG } from '../../core/config.js';
+import { encodeCallMessage } from '../../core/thrift/index.js';
+import { sendRequest } from '../transport.js';
+/**
+ * Resolve the active LINE client logger, preserving startup indentation.
+ *
+ * @param client - LINE client instance.
+ * @returns Logger for auth transport diagnostics.
+ */
+function getLineClientLog(client) {
+    if (client?.startupFlowLogger) {
+        return client.startupFlowLogger;
+    }
+    if (client?.logger?.info) {
+        return client.logger;
+    }
+    return client?.logger || createCliLogger('LINE');
+}
+/**
+ * Normalize LINE auth-service success/error responses.
+ *
+ * @param method - AuthService method name for diagnostics.
+ * @param result - Decoded thrift response.
+ * @returns Success payload or boolean true for void methods.
+ */
+function unwrapAuthSuccess(method, result) {
+    if (result.fields?.[1]) {
+        const err = result.fields[1];
+        throw new Error(`${method} failed: code=${err?.[1]} msg="${err?.[2] || 'Unknown error'}"`);
+    }
+    return result.fields?.[0] ?? true;
+}
+/**
+ * Create the auth capability bound to one LINE client runtime.
+ *
+ * @param runtime - Mutable LINE client runtime.
+ * @returns Auth service methods bound to the runtime.
+ */
+export function createAuthClient(runtime) {
+    return {
+        /**
+         * Send a generic AuthService request to LINE.
+         *
+         * This helper mirrors linejs AuthService.request() behavior for the subset of
+         * methods implemented directly here. All callers should pass thrift field
+         * tuples that match the upstream struct layout for the target method.
+         *
+         * @param method - AuthService method name.
+         * @param args - TCompact thrift field tuples for the request body.
+         * @param path - Override service path when the method is not served from /AS4.
+         * @returns Decoded thrift response.
+         */
+        async sendAuth(method, args = [], path = LINE_APP_CONFIG.authPath) {
+            const data = encodeCallMessage(method, runtime.seq++, args);
+            const result = await sendRequest(runtime.host, path, data, { 'X-Line-Access': runtime.authToken }, 30000, { logger: getLineClientLog(runtime) });
+            if (result.nextToken) {
+                runtime.authToken = result.nextToken;
+                runtime.emit('tokenRotated', result.nextToken);
+            }
+            if (result.fields?.[1] && typeof result.fields[1] === 'object') {
+                const exc = result.fields[1];
+                const msg = typeof exc[2] === 'string' ? exc[2] : JSON.stringify(exc);
+                console.error(`[LINE] ${method} exception: ${msg}`);
+            }
+            return result;
+        },
+        /**
+         * Refresh the authentication token through LINE's refresh endpoint.
+         *
+         * @param refreshToken - The refresh token.
+         * @returns Refresh payload with auth token and refresh timing metadata.
+         */
+        async refreshAuthToken(refreshToken) {
+            // stderr-only logger — stdout is the MCP JSON-RPC channel and this runs
+            // inside the stdio server (token refresh on resume/rotation).
+            const lineLog = getLineClientLog(runtime);
+            lineLog.info('auth.refresh.call', {
+                auth: `${String(runtime.authToken || '').slice(0, 16)}...`,
+                refresh: `${String(refreshToken || '').slice(0, 12)}...`,
+            });
+            const result = await runtime.sendAuth('refresh', [[12, 1, [[11, 1, refreshToken]]]], LINE_APP_CONFIG.tokenRefreshPath);
+            const resp = result.fields?.[0];
+            if (resp?.[1]) {
+                runtime.authToken = resp[1];
+                runtime.emit('tokenRotated', resp[1]);
+                const durationUntilRefreshInSec = typeof resp[2] === 'bigint' ? Number(resp[2]) : resp[2] || 0;
+                const tokenIssueTimeEpochSec = typeof resp[3] === 'bigint' ? Number(resp[3]) : resp[3] || null;
+                lineLog.info('auth.refresh.success', {
+                    auth: `${String(resp[1]).slice(0, 16)}...`,
+                    next_in_hours: Math.round(durationUntilRefreshInSec / 3600),
+                });
+                return {
+                    authToken: resp[1],
+                    durationUntilRefreshInSec,
+                    tokenIssueTimeEpochSec,
+                };
+            }
+            console.error('[LINE] refresh() exception payload:', JSON.stringify(result, (_key, val) => typeof val === 'bigint' ? val.toString() : val));
+            throw new Error(`Token refresh failed: ${JSON.stringify(result, (_key, val) => (typeof val === 'bigint' ? val.toString() : val))}`);
+        },
+        /**
+         * Report a freshly rotated access token back to LINE's auth service.
+         *
+         * @param authToken - The refreshed access token issued by LINE.
+         * @returns Raw decoded auth-service success payload.
+         */
+        async reportRefreshedAccessToken(authToken) {
+            const result = await runtime.sendAuth('reportRefreshedAccessToken', [
+                [12, 1, [[11, 1, authToken]]],
+            ]);
+            return unwrapAuthSuccess('reportRefreshedAccessToken', result);
+        },
+        /**
+         * Open a generic auth session on /AS4.
+         *
+         * @param metaData - Optional auth session metadata map.
+         * @returns Auth session ID string.
+         */
+        async openAuthSession(metaData = {}) {
+            const result = await runtime.sendAuth('openAuthSession', [
+                [12, 2, [[13, 1, [11, 11, metaData]]]],
+            ]);
+            return unwrapAuthSuccess('openAuthSession', result);
+        },
+        /**
+         * Open a legacy auth session using the same metadata-map shape linejs sends.
+         *
+         * @param metaData - Optional auth session metadata map.
+         * @returns Open session response payload.
+         */
+        async openSession(metaData = {}) {
+            const result = await runtime.sendAuth('openSession', [
+                [12, 1, [[13, 1, [11, 11, metaData]]]],
+            ]);
+            return unwrapAuthSuccess('openSession', result);
+        },
+        /**
+         * Fetch the RSA challenge key for identifier/password-style auth flows.
+         *
+         * @param authSessionId - Session ID returned by openAuthSession/openSession.
+         * @param identityProvider - LINE identity-provider enum value.
+         * @returns RSA key payload used for upstream credential encryption.
+         */
+        async getAuthRSAKey(authSessionId, identityProvider) {
+            const result = await runtime.sendAuth('getAuthRSAKey', [
+                [11, 2, authSessionId],
+                [8, 3, identityProvider],
+            ]);
+            return unwrapAuthSuccess('getAuthRSAKey', result);
+        },
+        /**
+         * Issue a V3 access token for a primary-device style bootstrap flow.
+         *
+         * @param request - Device identification payload.
+         * @returns Access token, refresh token, MID, and refresh timing metadata.
+         */
+        async issueV3TokenForPrimary(request) {
+            const result = await runtime.sendAuth('issueV3TokenForPrimary', [
+                [
+                    12,
+                    1,
+                    [
+                        [11, 1, request?.udid],
+                        [11, 2, request?.systemDisplayName],
+                        [11, 3, request?.modelName],
+                    ],
+                ],
+            ]);
+            return unwrapAuthSuccess('issueV3TokenForPrimary', result);
+        },
+        /**
+         * Create an enforced E2EE key backup blob on the auth service.
+         *
+         * @param request - Backup request payload.
+         * @returns Backup creation response payload.
+         */
+        async createE2EEKeyBackupEnforced(request) {
+            const result = await runtime.sendAuth('createE2EEKeyBackupEnforced', [
+                [
+                    12,
+                    2,
+                    [
+                        [11, 1, request?.blobHeader],
+                        [11, 2, request?.blobPayload],
+                        [8, 3, request?.reason],
+                    ],
+                ],
+            ]);
+            return unwrapAuthSuccess('createE2EEKeyBackupEnforced', result);
+        },
+        /**
+         * Restore an E2EE key backup from a server-issued restore claim.
+         *
+         * @param restoreClaim - Restore claim/token issued by LINE.
+         * @returns Restore payload containing the encrypted backup blob.
+         */
+        async restoreE2EEKeyBackup(restoreClaim) {
+            const result = await runtime.sendAuth('restoreE2EEKeyBackup', [
+                [12, 2, [[11, 1, restoreClaim]]],
+            ]);
+            return unwrapAuthSuccess('restoreE2EEKeyBackup', result);
+        },
+        /**
+         * Revoke the current LINE session on the server via logoutZ.
+         *
+         * @returns Whether the server acknowledged logout success.
+         */
+        async logoutZ() {
+            const payload = Buffer.from([
+                0x82, 0x21, 0x00, 0x07, 0x6c, 0x6f, 0x67, 0x6f, 0x75, 0x74, 0x5a, 0x00,
+            ]);
+            const result = await sendRequest(runtime.host, LINE_APP_CONFIG.revokePath, payload, { 'X-Line-Access': runtime.authToken }, 30000, { logger: getLineClientLog(runtime) });
+            if (result.nextToken) {
+                runtime.authToken = result.nextToken;
+                runtime.emit('tokenRotated', result.nextToken);
+            }
+            if (result.fields?.[1]) {
+                const err = result.fields[1];
+                const code = String(err?.[1] || '');
+                const message = String(err?.[2] || '');
+                if (code !== 'MUST_REFRESH_V3_TOKEN' &&
+                    !message.includes('MUST_REFRESH_V3_TOKEN')) {
+                    throw new Error(`logoutZ failed: code=${code} msg="${message || 'Unknown error'}"`);
+                }
+            }
+            runtime.polling = false;
+            runtime.aborted = true;
+            return result.fields?.[0] ?? true;
+        },
+    };
+}

package/dist/line/client/e2ee-service/client.js

@@ -0,0 +1,69 @@
+/**
+ * LINE Client E2EE transport capability.
+ */
+import { buildGetE2EEMessageInfoRequest, buildGetLastGroupSharedKeyRequest, buildGetLastPublicKeysRequest, buildGetPublicKeysRequest, buildNegotiatePublicKeyRequest, buildRegisterGroupKeyRequest, buildRegisterPublicKeyRequest, } from './requests.js';
+import { buildSharedKeyEventLog } from './shared-key-log.js';
+/**
+ * Resolve a logger suitable for E2EE client events.
+ *
+ * @param client - LINE client instance.
+ * @returns Logger-like object when available.
+ */
+function getE2EEClientLog(client) {
+    if (client?.startupFlowLogger) {
+        return client.startupFlowLogger;
+    }
+    if (client?.logger?.info) {
+        return client.logger;
+    }
+    return client?.logger;
+}
+/**
+ * Create the E2EE transport capability bound to one LINE client runtime.
+ *
+ * @param runtime - Mutable LINE client runtime.
+ * @returns E2EE transport methods bound to the runtime.
+ */
+export function createE2EEClient(runtime) {
+    return {
+        async getE2EEPublicKeys() {
+            const result = await runtime.sendTalk('getE2EEPublicKeys', []);
+            return result.fields?.[0] || [];
+        },
+        async registerE2EEPublicKey(version, keyId, keyData, timestamp) {
+            const result = await runtime.sendTalk('registerE2EEPublicKey', buildRegisterPublicKeyRequest(version, keyId, keyData, timestamp));
+            return result.fields?.[0] || null;
+        },
+        async negotiateE2EEPublicKey(mid) {
+            const result = await runtime.sendTalk('negotiateE2EEPublicKey', buildNegotiatePublicKeyRequest(mid));
+            return result.fields?.[0] || null;
+        },
+        async getE2EEPublicKeysEx(mids) {
+            const result = await runtime.sendTalk('getE2EEPublicKeysEx', buildGetPublicKeysRequest(mids));
+            return result.fields?.[0] || [];
+        },
+        async getE2EEMessageInfo(mid, messageId, receiverKeyId) {
+            const result = await runtime.sendTalk('getE2EEMessageInfo', buildGetE2EEMessageInfoRequest(mid, messageId, receiverKeyId));
+            return result.fields?.[0] || null;
+        },
+        async getLastE2EEGroupSharedKey(keyVersion, chatMid) {
+            const result = await runtime.sendTalk('getLastE2EEGroupSharedKey', buildGetLastGroupSharedKeyRequest(keyVersion, chatMid));
+            const shared = result.fields?.[0] || null;
+            getE2EEClientLog(runtime)?.info?.('e2ee.group_shared_key.response', buildSharedKeyEventLog(chatMid, shared));
+            return shared;
+        },
+        async getLastE2EEPublicKeys(chatMid) {
+            const result = await runtime.sendTalk('getLastE2EEPublicKeys', buildGetLastPublicKeysRequest(chatMid));
+            return result.fields?.[0] || {};
+        },
+        async registerE2EEGroupKey(keyVersion, chatMid, members, keyIds, encryptedSharedKeys) {
+            const result = await runtime.sendTalk('registerE2EEGroupKey', buildRegisterGroupKeyRequest(keyVersion, chatMid, members, keyIds, encryptedSharedKeys));
+            const shared = result.fields?.[0] || null;
+            getE2EEClientLog(runtime)?.info?.('e2ee.group_shared_key.registered', buildSharedKeyEventLog(chatMid, shared, {
+                members: members.length,
+                key_ids: keyIds.length,
+            }));
+            return shared;
+        },
+    };
+}

package/dist/line/client/e2ee-service/requests.js

@@ -0,0 +1,92 @@
+import { i32Field, i64Field, listField, stringField, structField, } from '../../core/thrift/index.js';
+/**
+ * Build the registerE2EEPublicKey request fields.
+ *
+ * @param version - Public key version.
+ * @param keyId - Assigned key identifier.
+ * @param keyData - Public key payload.
+ * @param timestamp - Registration timestamp.
+ * @returns Thrift request fields.
+ */
+export function buildRegisterPublicKeyRequest(version, keyId, keyData, timestamp) {
+    return [
+        i32Field(1, 0),
+        structField(2, [
+            i32Field(1, version),
+            i32Field(2, keyId),
+            stringField(4, keyData),
+            i64Field(5, timestamp),
+        ]),
+    ];
+}
+/**
+ * Build the negotiateE2EEPublicKey request fields.
+ *
+ * @param mid - Target MID.
+ * @returns Thrift request fields.
+ */
+export function buildNegotiatePublicKeyRequest(mid) {
+    return [stringField(2, mid)];
+}
+/**
+ * Build the getE2EEPublicKeysEx request fields.
+ *
+ * @param mids - Target MIDs.
+ * @returns Thrift request fields.
+ */
+export function buildGetPublicKeysRequest(mids) {
+    return [listField(2, 11, mids)];
+}
+/**
+ * Build the getE2EEMessageInfo request fields.
+ *
+ * @param mid - Peer or chat MID.
+ * @param messageId - LINE message id.
+ * @param receiverKeyId - Receiver key id from the E2EE envelope.
+ * @returns Thrift request fields.
+ */
+export function buildGetE2EEMessageInfoRequest(mid, messageId, receiverKeyId) {
+    return [
+        stringField(2, mid),
+        stringField(3, messageId),
+        i32Field(4, Number(receiverKeyId)),
+    ];
+}
+/**
+ * Build the getLastE2EEGroupSharedKey request fields.
+ *
+ * @param keyVersion - Shared key version.
+ * @param chatMid - Target chat MID.
+ * @returns Thrift request fields.
+ */
+export function buildGetLastGroupSharedKeyRequest(keyVersion, chatMid) {
+    return [i32Field(2, keyVersion), stringField(3, chatMid)];
+}
+/**
+ * Build the getLastE2EEPublicKeys request fields.
+ *
+ * @param chatMid - Target chat MID.
+ * @returns Thrift request fields.
+ */
+export function buildGetLastPublicKeysRequest(chatMid) {
+    return [stringField(2, chatMid)];
+}
+/**
+ * Build the registerE2EEGroupKey request fields.
+ *
+ * @param keyVersion - Shared key version.
+ * @param chatMid - Target chat MID.
+ * @param members - Group member MIDs.
+ * @param keyIds - Public key IDs.
+ * @param encryptedSharedKeys - Encrypted shared keys.
+ * @returns Thrift request fields.
+ */
+export function buildRegisterGroupKeyRequest(keyVersion, chatMid, members, keyIds, encryptedSharedKeys) {
+    return [
+        i32Field(2, keyVersion),
+        stringField(3, chatMid),
+        listField(4, 11, members),
+        listField(5, 8, keyIds),
+        listField(6, 11, encryptedSharedKeys),
+    ];
+}

package/dist/line/client/e2ee-service/shared-key-log.js

@@ -0,0 +1,24 @@
+import { Buffer } from 'node:buffer';
+import { extractSharedKeyIdentity, readSharedKeyResponseField, } from './shared-key-payload.js';
+/**
+ * Build a normalized log payload for group shared-key transport events.
+ *
+ * @param chatMid - Group or room id.
+ * @param shared - Shared-key response payload.
+ * @param extra - Additional fields to merge into the payload.
+ * @returns Log payload object.
+ */
+export function buildSharedKeyEventLog(chatMid, shared, extra = {}) {
+    const encryptedSharedKey = readSharedKeyResponseField(shared, 'encryptedSharedKey', 7);
+    return {
+        chat: chatMid,
+        ...extractSharedKeyIdentity(shared),
+        encrypted_shared_key_bytes: Buffer.isBuffer(encryptedSharedKey) ||
+            encryptedSharedKey instanceof Uint8Array
+            ? encryptedSharedKey.length
+            : typeof encryptedSharedKey === 'string'
+                ? encryptedSharedKey.length
+                : 0,
+        ...extra,
+    };
+}

package/dist/line/client/e2ee-service/shared-key-payload.js

@@ -0,0 +1,35 @@
+/**
+ * LINE shared-key response payload normalization.
+ */
+/**
+ * Resolve one shared-key field from either a named property or raw tuple form.
+ *
+ * @param shared - Shared-key response payload.
+ * @param namedKey - Preferred named property.
+ * @param tupleIndex - Fallback tuple index.
+ * @returns Resolved field value or null.
+ */
+export function readSharedKeyResponseField(shared, namedKey, tupleIndex) {
+    if (shared?.[namedKey] !== undefined && shared?.[namedKey] !== null) {
+        return shared[namedKey];
+    }
+    if (shared?.[tupleIndex] !== undefined && shared?.[tupleIndex] !== null) {
+        return shared[tupleIndex];
+    }
+    return null;
+}
+/**
+ * Extract normalized shared-key identity fields from a LINE response payload.
+ *
+ * @param shared - Shared-key response payload.
+ * @returns Normalized shared-key fields used by downstream logging/diagnostics.
+ */
+export function extractSharedKeyIdentity(shared) {
+    return {
+        creator: readSharedKeyResponseField(shared, 'creator', 3),
+        creator_key_id: readSharedKeyResponseField(shared, 'creatorKeyId', 4),
+        receiver_key_id: readSharedKeyResponseField(shared, 'receiverKeyId', 6),
+        group_key_id: readSharedKeyResponseField(shared, 'groupKeyId', 2),
+        has_encrypted_shared_key: Boolean(readSharedKeyResponseField(shared, 'encryptedSharedKey', 7)),
+    };
+}