@threadbase-sh/streamer 1.58.2 → 1.59.0

package/dist/index.js

@@ -11239,6 +11239,259 @@ var RuntimeStore = class _RuntimeStore {
   }
 };
 
+// src/e2ee/noise.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash as createHash4,
+  createPrivateKey as createPrivateKey2,
+  createPublicKey as createPublicKey2,
+  diffieHellman,
+  generateKeyPairSync as generateKeyPairSync2,
+  hkdfSync
+} from "crypto";
+var NOISE_PROTOCOL_NAME = "Noise_IKpsk1_25519_ChaChaPoly_SHA256";
+var PAIR_PROLOGUE = Buffer.from("threadbase-e2ee/1 pair", "utf-8");
+var DHLEN = 32;
+var HASHLEN = 32;
+var TAGLEN = 16;
+var NOISE_MESSAGE_1_OVERHEAD = DHLEN + DHLEN + TAGLEN + TAGLEN;
+var NOISE_MESSAGE_2_OVERHEAD = DHLEN + TAGLEN;
+var NOISE_MAX_MESSAGE_BYTES = 4096;
+var NoiseError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "NoiseError";
+  }
+};
+function generateKeyPair() {
+  const { publicKey, privateKey } = generateKeyPairSync2("x25519");
+  return { publicKey, privateKey, publicKeyRaw: rawPublicKey(publicKey) };
+}
+function keyPairFrom(privateKey) {
+  const publicKey = createPublicKey2(privateKey);
+  return { publicKey, privateKey, publicKeyRaw: rawPublicKey(publicKey) };
+}
+function rawPublicKey(key) {
+  const pub = key.type === "public" ? key : createPublicKey2(key);
+  const jwk = pub.export({ format: "jwk" });
+  if (jwk.crv !== "X25519" || typeof jwk.x !== "string") {
+    throw new NoiseError("Not an X25519 public key");
+  }
+  return Buffer.from(jwk.x, "base64url");
+}
+function publicKeyFromRaw(raw) {
+  if (raw.length !== DHLEN) {
+    throw new NoiseError(`X25519 public key must be ${DHLEN} bytes, got ${raw.length}`);
+  }
+  try {
+    return createPublicKey2({
+      key: { kty: "OKP", crv: "X25519", x: raw.toString("base64url") },
+      format: "jwk"
+    });
+  } catch {
+    throw new NoiseError("Invalid X25519 public key");
+  }
+}
+function pskFromPairToken(token) {
+  return createHash4("sha256").update("threadbase-e2ee/1 psk", "utf-8").update(token, "utf-8").digest();
+}
+function chachaNonce(n) {
+  const nonce = Buffer.alloc(12);
+  nonce.writeBigUInt64LE(n, 4);
+  return nonce;
+}
+var CipherState = class {
+  k = null;
+  n = 0n;
+  initializeKey(key) {
+    this.k = key;
+    this.n = 0n;
+  }
+  hasKey() {
+    return this.k !== null;
+  }
+  encryptWithAd(ad, plaintext) {
+    if (!this.k) return plaintext;
+    const cipher = createCipheriv("chacha20-poly1305", this.k, chachaNonce(this.n), {
+      authTagLength: TAGLEN
+    });
+    cipher.setAAD(ad, { plaintextLength: plaintext.length });
+    const out = Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
+    this.n += 1n;
+    return out;
+  }
+  decryptWithAd(ad, ciphertext) {
+    if (!this.k) return ciphertext;
+    if (ciphertext.length < TAGLEN) throw new NoiseError("Ciphertext shorter than its tag");
+    const body = ciphertext.subarray(0, ciphertext.length - TAGLEN);
+    const tag = ciphertext.subarray(ciphertext.length - TAGLEN);
+    const decipher = createDecipheriv("chacha20-poly1305", this.k, chachaNonce(this.n), {
+      authTagLength: TAGLEN
+    });
+    decipher.setAAD(ad, { plaintextLength: body.length });
+    decipher.setAuthTag(tag);
+    let out;
+    try {
+      out = Buffer.concat([decipher.update(body), decipher.final()]);
+    } catch {
+      throw new NoiseError("Decryption failed");
+    }
+    this.n += 1n;
+    return out;
+  }
+};
+var SymmetricState = class {
+  ck;
+  h;
+  cipher = new CipherState();
+  constructor(protocolName) {
+    const name = Buffer.from(protocolName, "utf-8");
+    this.h = name.length <= HASHLEN ? Buffer.concat([name, Buffer.alloc(HASHLEN - name.length)]) : createHash4("sha256").update(name).digest();
+    this.ck = Buffer.from(this.h);
+    this.cipher.initializeKey(null);
+  }
+  /**
+   * Noise's HKDF (spec §4.3) is RFC 5869 with `salt = chaining_key`,
+   * `ikm = input_key_material` and an EMPTY info, so Node's `hkdfSync` is
+   * exactly it rather than approximately it. Using the platform's HKDF removes
+   * the HMAC chain that would otherwise be the easiest thing here to get
+   * subtly wrong.
+   */
+  hkdf(ikm, outputs) {
+    const raw = Buffer.from(hkdfSync("sha256", ikm, this.ck, Buffer.alloc(0), HASHLEN * outputs));
+    const out = [];
+    for (let i = 0; i < outputs; i++) out.push(raw.subarray(i * HASHLEN, (i + 1) * HASHLEN));
+    return out;
+  }
+  mixKey(ikm) {
+    const [ck, tempK] = this.hkdf(ikm, 2);
+    this.ck = ck;
+    this.cipher.initializeKey(tempK);
+  }
+  mixHash(data) {
+    this.h = createHash4("sha256").update(this.h).update(data).digest();
+  }
+  /** Spec §5.2. Used only by the `psk` token. */
+  mixKeyAndHash(ikm) {
+    const [ck, tempH, tempK] = this.hkdf(ikm, 3);
+    this.ck = ck;
+    this.mixHash(tempH);
+    this.cipher.initializeKey(tempK);
+  }
+  encryptAndHash(plaintext) {
+    const ciphertext = this.cipher.encryptWithAd(this.h, plaintext);
+    this.mixHash(ciphertext);
+    return ciphertext;
+  }
+  decryptAndHash(ciphertext) {
+    const plaintext = this.cipher.decryptWithAd(this.h, ciphertext);
+    this.mixHash(ciphertext);
+    return plaintext;
+  }
+  /** The transcript hash. Both sides must arrive at the same value. */
+  handshakeHash() {
+    return Buffer.from(this.h);
+  }
+  /** Spec §5.2 `Split()`: the two directional transport keys. */
+  split() {
+    const [k1, k2] = this.hkdf(Buffer.alloc(0), 2);
+    return { k1: Buffer.from(k1), k2: Buffer.from(k2) };
+  }
+};
+function dh(privateKey, publicKey) {
+  return diffieHellman({ privateKey, publicKey });
+}
+function readMessage1(args) {
+  assertMessageSize(args.message1, NOISE_MESSAGE_1_OVERHEAD);
+  const state = new SymmetricState(NOISE_PROTOCOL_NAME);
+  state.mixHash(args.prologue ?? PAIR_PROLOGUE);
+  state.mixHash(args.staticKeyPair.publicKeyRaw);
+  const reRaw = args.message1.subarray(0, DHLEN);
+  const re = publicKeyFromRaw(reRaw);
+  state.mixHash(reRaw);
+  state.mixKey(reRaw);
+  state.mixKey(dh(args.staticKeyPair.privateKey, re));
+  const encryptedStatic = args.message1.subarray(DHLEN, DHLEN + DHLEN + TAGLEN);
+  const initiatorStaticPub = state.decryptAndHash(encryptedStatic);
+  const rs = publicKeyFromRaw(initiatorStaticPub);
+  state.mixKey(dh(args.staticKeyPair.privateKey, rs));
+  state.mixKeyAndHash(args.psk);
+  const payload = state.decryptAndHash(args.message1.subarray(DHLEN + DHLEN + TAGLEN));
+  return {
+    symmetric: state,
+    initiatorStaticPub,
+    payload,
+    initiatorEphemeral: re,
+    initiatorStatic: rs,
+    staticKeyPair: args.staticKeyPair
+  };
+}
+function writeMessage2(state, responsePayload, ephemeral) {
+  const e = ephemeral ?? generateKeyPair();
+  state.symmetric.mixHash(e.publicKeyRaw);
+  state.symmetric.mixKey(e.publicKeyRaw);
+  state.symmetric.mixKey(dh(e.privateKey, state.initiatorEphemeral));
+  state.symmetric.mixKey(dh(e.privateKey, state.initiatorStatic));
+  const encryptedPayload = state.symmetric.encryptAndHash(responsePayload);
+  return {
+    message2: Buffer.concat([e.publicKeyRaw, encryptedPayload]),
+    keys: finish(state.symmetric)
+  };
+}
+function finish(state) {
+  const { k1, k2 } = state.split();
+  return { handshakeHash: state.handshakeHash(), clientToServer: k1, serverToClient: k2 };
+}
+function assertMessageSize(message, minimum) {
+  if (message.length < minimum) {
+    throw new NoiseError(`Handshake message too short: ${message.length} < ${minimum}`);
+  }
+  if (message.length > NOISE_MAX_MESSAGE_BYTES) {
+    throw new NoiseError(`Handshake message too large: ${message.length}`);
+  }
+}
+
+// src/e2ee/pair-request.ts
+var E2EE_EXCHANGE_VERSION = 1;
+var MAX_BASE64_CHARS = Math.ceil(NOISE_MAX_MESSAGE_BYTES * 4 / 3) + 4;
+var E2eeRequestError = class extends Error {
+  /** Stable code for the client, so a version mismatch is not a parse failure. */
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "E2eeRequestError";
+    this.code = code;
+  }
+};
+function parseE2eeRequest(raw) {
+  if (raw === void 0 || raw === null) return null;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee must be an object");
+  }
+  const { v, noise } = raw;
+  if (typeof v !== "number" || !Number.isInteger(v)) {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee.v must be an integer");
+  }
+  if (v !== E2EE_EXCHANGE_VERSION) {
+    throw new E2eeRequestError(
+      "E2EE_VERSION_UNSUPPORTED",
+      `e2ee.v ${v} is not supported; this server speaks ${E2EE_EXCHANGE_VERSION}`
+    );
+  }
+  if (typeof noise !== "string") {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee.noise must be a base64 string");
+  }
+  if (noise.length > MAX_BASE64_CHARS) {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee.noise is too large");
+  }
+  const message1 = Buffer.from(noise, "base64");
+  if (message1.length === 0) {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee.noise is not valid base64");
+  }
+  return { version: v, message1 };
+}
+
 // src/external-tails.ts
 import { statSync as statSync6 } from "fs";
 var EXTERNAL_TAIL_RECENCY_MS = RESUME_BUSY_WINDOW_MS;
@@ -11435,7 +11688,7 @@ var PairTokenStore = class {
     };
   }
   /**
-   * Whether `consume` would succeed right now, WITHOUT spending the token.
+   * What `consume` would answer right now, WITHOUT spending the token.
    *
    * Exists so a caller can reject a bad token before doing any work, and still
    * spend the token only once the work has succeeded. A pair token is
@@ -11444,10 +11697,14 @@ var PairTokenStore = class {
    * indistinguishable from an attacker replaying a photographed code, which is
    * the one signal `design.md` §2.6 designates as replay detection.
    *
-   * Advisory, not a reservation: it takes no lock and holds nothing. The
-   * authoritative answer is still `consume`'s.
+   * **Named for its relationship to `consume`, deliberately.** It reserves
+   * nothing and takes no lock, so two callers can both be told `{ ok: true }`
+   * for the same token. A name like `verify` would read as a gate that had
+   * decided something, and inviting a caller to act on this alone is precisely
+   * the misuse the ordering it enables exists to prevent. A reader who sees
+   * `wouldConsume` asks where the `consume` is, which is the right question.
    */
-  verify(token) {
+  wouldConsume(token) {
     const result = this.check(token);
     return result.ok ? { ok: true } : result;
   }
@@ -12609,7 +12866,7 @@ function createApiDeps(deps) {
 }
 
 // src/services/cache-integrity/cacheIntegrityMonitor.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 import { existsSync as existsSync12 } from "fs";
 
 // src/services/cache-integrity/alertStore.ts
@@ -12674,7 +12931,7 @@ function envInt(name, fallback) {
 }
 function fingerprintOf(ids) {
   const sorted = [...ids].sort();
-  return `sha256:${createHash4("sha256").update(sorted.join("\n")).digest("hex")}`;
+  return `sha256:${createHash5("sha256").update(sorted.join("\n")).digest("hex")}`;
 }
 var CacheIntegrityMonitor = class {
   constructor(cache, wsHub, log10, cacheDir, rescan, runDuringReset) {
@@ -16308,11 +16565,44 @@ var StreamerServer = class {
       json(res, 400, { error: "Missing token or clientPublicKey" });
       return;
     }
-    const precheck = this.pairTokens.verify(token);
+    let e2eeRequest;
+    try {
+      e2eeRequest = parseE2eeRequest(body?.e2ee);
+    } catch (err) {
+      const e = err;
+      json(res, 400, { error: e.message, code: e.code });
+      return;
+    }
+    const precheck = this.pairTokens.wouldConsume(token);
     if (!precheck.ok) {
+      if (precheck.reason === "used") {
+        this.log.warn(
+          "[pair] a pair token was replayed. If you did not just pair a device, check the paired-devices list and revoke anything you do not recognise.",
+          { event: "pair.token_replayed", ip }
+        );
+      }
       json(res, 401, { error: `Pair token ${precheck.reason}` });
       return;
     }
+    let handshake = null;
+    if (e2eeRequest) {
+      try {
+        handshake = readMessage1({
+          staticKeyPair: keyPairFrom(loadOrCreateServerIdentity().privateKey),
+          // The pair token binds this handshake to the scanned QR. Derivation
+          // is specified in design.md §2.4 and pinned by a committed vector
+          // that tb-mobile checks against independently.
+          psk: pskFromPairToken(token),
+          message1: e2eeRequest.message1
+        });
+      } catch {
+        json(res, 400, {
+          error: "E2EE handshake failed. Scan a fresh pairing code and try again.",
+          code: "E2EE_HANDSHAKE_FAILED"
+        });
+        return;
+      }
+    }
     let sealed;
     try {
       sealed = seal(this.apiKey, clientPublicKey);
@@ -16336,14 +16626,59 @@ var StreamerServer = class {
     try {
       const name = typeof body?.deviceName === "string" ? body.deviceName.slice(0, 100) : null;
       const preset = body?.readOnly === true ? "read-only" : "full";
-      device = this.devicesRepo?.register({ publicKey: clientPublicKey, name, preset }) ?? null;
+      device = this.devicesRepo?.register({
+        publicKey: clientPublicKey,
+        name,
+        preset,
+        // Recorded only when the handshake authenticated it. The static key
+        // comes out of the transcript, never off the wire as a claim — that
+        // is the difference between a device identified by a key it proved
+        // it holds and one identified by a string it sent.
+        //
+        // Setting it also sets `e2ee_required`, so a device that has once
+        // paired encrypted is pinned and never served plaintext again.
+        ...handshake && {
+          e2eeStaticPub: handshake.initiatorStaticPub.toString("base64"),
+          e2eeVersion: E2EE_EXCHANGE_VERSION
+        }
+      }) ?? null;
     } catch (err) {
       this.log.warn("[pair] device registration failed; pairing continues", {
         event: "pair.device_register_failed",
         err
       });
     }
+    let e2eeResponse = null;
+    if (handshake) {
+      try {
+        const { message2 } = writeMessage2(
+          handshake,
+          Buffer.from(
+            JSON.stringify({
+              v: E2EE_EXCHANGE_VERSION,
+              deviceId: device?.deviceId ?? null,
+              serverVersion: getVersion(),
+              // Always true on this path: completing a handshake is what pins
+              // the device, and design.md §6.3 says nothing a client sends
+              // ever clears it.
+              e2eeRequired: true
+            }),
+            "utf-8"
+          )
+        );
+        e2eeResponse = { v: E2EE_EXCHANGE_VERSION, noise: message2.toString("base64") };
+      } catch (err) {
+        this.log.warn("[pair] E2EE response could not be written; pairing continues", {
+          event: "pair.e2ee_response_failed",
+          err
+        });
+      }
+    }
     json(res, 200, {
+      // Unchanged and still sent on the E2EE path, deliberately. An older app
+      // is the only thing that can read these and it cannot be force-updated
+      // (docs/compatibility/tb-mobile.md); a new app ignores them and uses the
+      // Noise result. The response grows a field, it never loses one.
       ciphertext: sealed.ciphertext,
       nonce: sealed.nonce,
       ephemeralPublicKey: sealed.ephemeralPublicKey,
@@ -16366,7 +16701,11 @@ var StreamerServer = class {
         deviceId: device.deviceId,
         deviceToken: device.deviceToken,
         capabilities: device.capabilities
-      }
+      },
+      // Additive. Absent means this pairing is plaintext — either the client
+      // never asked, or writing the reply failed — and a client that asked for
+      // encryption must treat its absence as a refusal, not as consent.
+      ...e2eeResponse && { e2ee: e2eeResponse }
     });
   }
   rotateApiKey() {