@vex-chat/libvex 7.2.0 → 7.3.0

package/dist/Client.js

@@ -4,7 +4,7 @@
  * Commercial licenses available at vex.wtf
  */
 import { enterCryptoProfileScope, getCryptoProfile, leaveCryptoProfileScope, setCryptoProfile, xBoxKeyPairAsync, xBoxKeyPairFromSecretAsync, xConcat, xConstants, xDHAsync, xEcdhKeyPairFromEcdsaKeyPairAsync, xEncode, xHMAC, xKDF, XKeyConvert, xMakeNonce, xMnemonic, xRandomBytes, xSecretboxAsync, xSecretboxOpenAsync, xSignAsync, xSignKeyPair, xSignKeyPairAsync, xSignKeyPairFromSecret, xSignKeyPairFromSecretAsync, xSignOpenAsync, XUtils, } from "@vex-chat/crypto";
-import { CallEventSchema, CallSessionSchema, IceServerConfigSchema, MailType, MailWSSchema, PermissionSchema, WSMessageSchema, } from "@vex-chat/types";
+import { CallEnvelopeBodySchema, CallEventSchema, IceServerConfigSchema, MailType, MailWSSchema, PermissionSchema, SignedCallEnvelopeSchema, WSMessageSchema, } from "@vex-chat/types";
 import { EventEmitter } from "eventemitter3";
 import * as uuid from "uuid";
 import { z } from "zod/v4";
@@ -74,15 +74,6 @@ function debugLibvexDm(msg, data) {
     // eslint-disable-next-line no-console -- gated by LIBVEX_DEBUG_DM; remove when debugging is done
     console.error(`[libvex:debug-dm] ${payload}`);
 }
-function errorFromUnknown(err) {
-    if (err instanceof Error) {
-        return err;
-    }
-    if (typeof err === "string") {
-        return new Error(err);
-    }
-    return new Error(JSON.stringify(err));
-}
 function ignoreSocketTeardown(err) {
     if (err instanceof WebSocketNotOpenError)
         return;
@@ -208,8 +199,13 @@ import { ActionTokenCodec, AuthResponseCodec, ChannelArrayCodec, ChannelCodec, C
 import { sqlSessionToCrypto } from "./utils/sqlSessionToCrypto.js";
 import { uuidToUint8 } from "./utils/uint8uuid.js";
 const _protocolMsgRegex = /��\w+:\w+��/g;
+const NotificationSubscriptionChannelSchema = z.enum([
+    "apnsVoip",
+    "expo",
+    "fcmCall",
+]);
 const NotificationSubscriptionSchema = z.object({
-    channel: z.literal("expo"),
+    channel: NotificationSubscriptionChannelSchema,
     createdAt: z.string(),
     deviceID: z.string(),
     enabled: z.boolean(),
@@ -277,6 +273,9 @@ const messageSchema = z.object({
     sender: z.string(),
     timestamp: z.string(),
 });
+const CALL_ENVELOPE_PREFIX = "vex-call:1\n";
+const CALL_INVITE_TTL_MS = 60_000;
+const CALL_MAX_TTL_MS = 2 * 60 * 60 * 1000;
 const MESSAGE_BLOB_PREFIX = "vex-message:1\n";
 const MAIL_FANOUT_CONCURRENCY = 8;
 const MAIL_BATCH_MAX_SIZE = 32;
@@ -291,6 +290,52 @@ const mailBatchResponseSchema = z.object({
         status: z.number().int().optional(),
     })),
 });
+const callWakeNotifyData = z.object({
+    callID: z.string(),
+    expiresAt: z.string().optional(),
+    mailID: z.string().optional(),
+    mailNonce: z.string().optional(),
+});
+function canonicalizeJson(value) {
+    if (Array.isArray(value)) {
+        return value.map((item) => canonicalizeJson(item));
+    }
+    if (!isRecord(value)) {
+        return value;
+    }
+    const out = {};
+    for (const key of Object.keys(value).sort()) {
+        const item = value[key];
+        if (item !== undefined) {
+            out[key] = canonicalizeJson(item);
+        }
+    }
+    return out;
+}
+function canonicalJsonBytes(value) {
+    return XUtils.decodeUTF8(JSON.stringify(canonicalizeJson(jsonWireValue(value))));
+}
+function cloneCallSession(session) {
+    return {
+        ...session,
+        participants: session.participants.map((participant) => ({
+            ...participant,
+        })),
+    };
+}
+function decodeCallEnvelopePlaintext(plaintext) {
+    if (!plaintext.startsWith(CALL_ENVELOPE_PREFIX)) {
+        return null;
+    }
+    try {
+        const raw = JSON.parse(plaintext.slice(CALL_ENVELOPE_PREFIX.length));
+        const parsed = SignedCallEnvelopeSchema.safeParse(raw);
+        return parsed.success ? parsed.data : null;
+    }
+    catch {
+        return null;
+    }
+}
 function decodeMessageBlob(body) {
     if (!body.startsWith(MESSAGE_BLOB_PREFIX)) {
         return { message: body };
@@ -324,6 +369,9 @@ function decodeMessagePlaintext(plaintext) {
         }
         : blob;
 }
+function encodeCallEnvelopePlaintext(envelope) {
+    return XUtils.decodeUTF8(CALL_ENVELOPE_PREFIX + JSON.stringify(envelope));
+}
 function encodeMessagePlaintext(message, opts) {
     const body = opts?.extra === undefined
         ? message
@@ -334,6 +382,12 @@ function encodeMessagePlaintext(message, opts) {
             });
     return formatVexRetentionEnvelope(body, opts?.retentionHintDays);
 }
+function jsonWireValue(value) {
+    // Match the payload JSON.stringify will send, including RTC toJSON() output.
+    const encoded = JSON.stringify(value);
+    const parsed = JSON.parse(encoded);
+    return parsed;
+}
 function messageFromDecodedPlaintext(decoded) {
     return {
         ...(decoded.extra !== undefined ? { extra: decoded.extra } : {}),
@@ -343,6 +397,9 @@ function messageFromDecodedPlaintext(decoded) {
             : {}),
     };
 }
+function normalizeCallEnvelopeBodyForWire(body) {
+    return CallEnvelopeBodySchema.parse(jsonWireValue(body));
+}
 function normalizeForwardedMessage(message) {
     const decoded = decodeMessagePlaintext(message.message);
     return {
@@ -396,22 +453,15 @@ export class Client {
      * authenticated signaling and call state over Spire.
      */
     calls = {
-        accept: (callID, signal) => this.sendCallResource("ACCEPT", {
-            callID,
-            ...(signal ? { signal } : {}),
-        }),
+        accept: (callID, signal) => this.sendEncryptedCallAction("accept", callID, signal),
         active: this.fetchActiveCalls.bind(this),
-        cancel: (callID) => this.sendCallResource("CANCEL", { callID }),
-        hangup: (callID) => this.sendCallResource("HANGUP", { callID }),
-        ice: (callID, signal) => this.sendCallResource("ICE", { callID, signal }),
+        cancel: (callID) => this.sendEncryptedCallAction("cancel", callID),
+        hangup: (callID) => this.sendEncryptedCallAction("hangup", callID),
+        ice: (callID, signal) => this.sendEncryptedCallAction("ice", callID, signal),
         iceServers: this.fetchIceServers.bind(this),
-        reject: (callID) => this.sendCallResource("REJECT", { callID }),
-        signal: (callID, signal) => this.sendCallResource("SIGNAL", { callID, signal }),
-        startDM: (recipientUserID, signal) => this.sendCallResource("INVITE", {
-            conversationType: "dm",
-            recipientUserID,
-            ...(signal ? { signal } : {}),
-        }),
+        reject: (callID) => this.sendEncryptedCallAction("reject", callID),
+        signal: (callID, signal) => this.sendEncryptedCallAction("signal", callID, signal),
+        startDM: (recipientUserID, signal) => this.startEncryptedDmCall(recipientUserID, signal),
     };
     /**
      * Browser-safe NODE_ENV accessor.
@@ -697,6 +747,7 @@ export class Client {
         retrieve: this.fetchUser.bind(this),
     };
     autoReconnectEnabled = false;
+    callStates = new Map();
     cryptoProfile;
     database;
     dbPath;
@@ -1389,6 +1440,86 @@ export class Client {
         this.emitUndecryptedMessage(mail, timestamp);
         this.acknowledgeInboundMail(mail);
     }
+    applyCallEnvelopeBody(body) {
+        const localUserID = this.getUser().userID;
+        const peerUserID = body.fromUserID === localUserID ? body.toUserID : body.fromUserID;
+        const peerDeviceID = body.fromUserID === localUserID
+            ? body.toDeviceID
+            : body.fromDeviceID;
+        let state = this.callStates.get(body.callID);
+        if (!state) {
+            state = {
+                peerDeviceID,
+                peerUserID,
+                pendingPeerDevices: [],
+                sequence: 0,
+                session: this.sessionFromCallEnvelope(body),
+            };
+        }
+        state.peerUserID = peerUserID;
+        if (body.fromUserID !== localUserID || body.action === "accept") {
+            state.peerDeviceID = peerDeviceID;
+        }
+        state.sequence = Math.max(state.sequence, body.sequence);
+        state.session.expiresAt = body.expiresAt;
+        const now = new Date().toISOString();
+        switch (body.action) {
+            case "accept":
+                state.session.status = "active";
+                this.upsertCallParticipant(state.session, {
+                    acceptedAt: now,
+                    deviceID: body.fromDeviceID,
+                    joinedAt: now,
+                    state: "accepted",
+                    userID: body.fromUserID,
+                });
+                break;
+            case "cancel":
+            case "end":
+            case "hangup":
+            case "reject":
+            case "timeout":
+                state.session.status = "ended";
+                state.session.endedAt = now;
+                this.upsertCallParticipant(state.session, {
+                    leftAt: now,
+                    state: body.action === "reject" ? "rejected" : "left",
+                    userID: body.fromUserID,
+                });
+                break;
+            case "ice":
+            case "signal":
+                break;
+            case "invite":
+                state.session.status = "ringing";
+                this.upsertCallParticipant(state.session, {
+                    acceptedAt: body.createdAt,
+                    deviceID: body.createdByDeviceID,
+                    joinedAt: body.createdAt,
+                    state: "accepted",
+                    userID: body.createdBy,
+                });
+                this.upsertCallParticipant(state.session, {
+                    state: "ringing",
+                    userID: body.toUserID,
+                });
+                break;
+        }
+        const event = {
+            action: body.action,
+            call: cloneCallSession(state.session),
+            fromDeviceID: body.fromDeviceID,
+            fromUserID: body.fromUserID,
+            ...(body.signal ? { signal: body.signal } : {}),
+        };
+        if (state.session.status === "ended") {
+            this.callStates.delete(body.callID);
+        }
+        else {
+            this.callStates.set(body.callID, state);
+        }
+        return event;
+    }
     async approveDeviceRequest(requestID) {
         const req = await this.getDeviceRegistrationRequest(requestID);
         if (!req) {
@@ -1425,6 +1556,35 @@ export class Client {
             "/passkeys/register/begin", msgpack.encode({ name: args.name, signed }), { headers: { "Content-Type": "application/msgpack" } });
         return decodeHttpResponse(PasskeyOptionsCodec, response.data);
     }
+    async callEnvelopeForBody(body) {
+        const wireBody = normalizeCallEnvelopeBodyForWire(body);
+        const signed = await xSignAsync(canonicalJsonBytes(wireBody), this.signKeys.secretKey);
+        return {
+            body: wireBody,
+            signed: XUtils.encodeHex(signed),
+        };
+    }
+    async callTargetsForState(state) {
+        if (state.peerDeviceID) {
+            const cached = this.deviceRecords[state.peerDeviceID];
+            const device = cached ?? (await this.getDeviceByID(state.peerDeviceID));
+            if (!device) {
+                throw new Error(`Call peer device not found: ${state.peerDeviceID}`);
+            }
+            return [device];
+        }
+        return state.pendingPeerDevices;
+    }
+    callWakeForEnvelope(body) {
+        if (body.action !== "invite") {
+            return undefined;
+        }
+        return {
+            callID: body.callID,
+            event: "callWake",
+            expiresAt: body.expiresAt,
+        };
+    }
     censorPreKey(preKey) {
         if (!preKey.index) {
             throw new Error("Key index is required.");
@@ -1527,7 +1687,7 @@ export class Client {
      * When `readMail` triggers a best-effort session re-establish, key-bundle
      * errors should not reject the full read pipeline.
      */
-    allowKeyBundleFailure = false) {
+    allowKeyBundleFailure = false, notify) {
         return this.runWithThisCryptoProfile(async () => {
             let keyBundle;
             try {
@@ -1608,10 +1768,11 @@ export class Client {
                 recipient: device.deviceID,
                 sender: this.getDevice().deviceID,
             };
+            const wireMail = notify ? { ...mail, notify } : mail;
             const hmac = xHMAC(mail, SK);
             const msg = {
                 action: "CREATE",
-                data: mail,
+                data: wireMail,
                 resourceType: "mail",
                 transmissionID: uuid.v4(),
                 type: "resource",
@@ -1631,32 +1792,38 @@ export class Client {
             };
             await this.database.saveSession(sessionEntry);
             this.emitter.emit("session", sessionEntry, user);
-            // emit the message
+            const rawPlaintext = forward ? "" : XUtils.encodeUTF8(message);
+            const callEnvelope = forward
+                ? null
+                : decodeCallEnvelopePlaintext(rawPlaintext);
             const forwardedMsg = forward
                 ? messageSchema.parse(msgpack.decode(message))
                 : null;
-            const shouldEmitHandshakeMessage = forward || message.length > 0;
             const emitMsg = forwardedMsg
                 ? { ...normalizeForwardedMessage(forwardedMsg), forward: true }
-                : {
-                    authorID: mail.authorID,
-                    decrypted: true,
-                    direction: "outgoing",
-                    forward: mail.forward,
-                    group: mail.group ? uuid.stringify(mail.group) : null,
-                    mailID: mail.mailID,
-                    ...messageFromDecodedPlaintext(decodeMessagePlaintext(XUtils.encodeUTF8(message))),
-                    nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
-                    readerID: mail.readerID,
-                    recipient: mail.recipient,
-                    sender: mail.sender,
-                    timestamp: new Date().toISOString(),
-                };
-            if (shouldEmitHandshakeMessage) {
+                : callEnvelope
+                    ? null
+                    : message.length > 0
+                        ? {
+                            authorID: mail.authorID,
+                            decrypted: true,
+                            direction: "outgoing",
+                            forward: mail.forward,
+                            group: mail.group ? uuid.stringify(mail.group) : null,
+                            mailID: mail.mailID,
+                            ...messageFromDecodedPlaintext(decodeMessagePlaintext(rawPlaintext)),
+                            nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
+                            readerID: mail.readerID,
+                            recipient: mail.recipient,
+                            sender: mail.sender,
+                            timestamp: new Date().toISOString(),
+                        }
+                        : null;
+            if (emitMsg) {
                 this.emitter.emit("message", emitMsg);
             }
-            await this.deliverMailResource(msg, hmac, mail);
-            return shouldEmitHandshakeMessage ? emitMsg : null;
+            await this.deliverMailResource(msg, hmac, wireMail);
+            return emitMsg;
         });
     }
     async deleteChannel(channelID) {
@@ -1686,6 +1853,49 @@ export class Client {
     async deleteServer(serverID) {
         await this.http.delete(this.getHost() + "/server/" + serverID);
     }
+    async deliverCallEnvelopeBatch(args) {
+        let failCount = 0;
+        let lastErr;
+        for (let index = 0; index < args.bodies.length; index += MAIL_FANOUT_CONCURRENCY) {
+            const batch = args.bodies.slice(index, index + MAIL_FANOUT_CONCURRENCY);
+            const results = await Promise.all(batch.map(async (body) => {
+                try {
+                    const targetDevice = this.deviceRecords[body.toDeviceID] ??
+                        (await this.getDeviceByID(body.toDeviceID));
+                    if (!targetDevice) {
+                        throw new Error(`Call target device not found: ${body.toDeviceID}`);
+                    }
+                    await this.sendCallEnvelopeMail({
+                        body,
+                        mailID: args.mailID,
+                        notify: this.callWakeForEnvelope(body),
+                        targetDevice,
+                        targetUser: args.targetUser,
+                    });
+                    return undefined;
+                }
+                catch (err) {
+                    return err;
+                }
+            }));
+            for (const result of results) {
+                if (result !== undefined) {
+                    lastErr = result;
+                    failCount += 1;
+                }
+            }
+        }
+        if (failCount > 0) {
+            const base = lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+            if (failCount === args.bodies.length) {
+                throw base;
+            }
+            const partial = new Error(`Call signaling failed to reach ${String(failCount)} of ` +
+                `${String(args.bodies.length)} peer device(s).`);
+            partial.cause = base;
+            throw partial;
+        }
+    }
     deliverMailResource(msg, header, mail) {
         if (this.mailBatchUnsupported) {
             return this.deliverMailResourceOverSocket(msg, header);
@@ -1758,12 +1968,50 @@ export class Client {
             timestamp,
         });
     }
-    async fetchActiveCalls() {
-        const res = await this.http.get(this.getHost() + "/calls/active", {
-            responseType: "json",
-        });
-        return z.object({ calls: z.array(CallSessionSchema) }).parse(res.data)
-            .calls;
+    fetchActiveCalls() {
+        const now = Date.now();
+        const active = [];
+        for (const [callID, state] of this.callStates.entries()) {
+            if (state.session.status === "ended" ||
+                Date.parse(state.session.expiresAt) <= now) {
+                this.callStates.delete(callID);
+                continue;
+            }
+            active.push(cloneCallSession(state.session));
+        }
+        return Promise.resolve(active);
+    }
+    async fetchCallPeer(args) {
+        const [user, err] = await this.fetchUser(args.userID);
+        if (err) {
+            throw err;
+        }
+        if (!user) {
+            throw new Error("Call peer not found.");
+        }
+        const afterBackoff = await this.fetchUserDeviceListWithBackoff(args.userID, "peer");
+        let deviceListRaw;
+        try {
+            const again = await this.fetchUserDeviceListOnce(args.userID);
+            const byID = new Map();
+            for (const device of afterBackoff) {
+                byID.set(device.deviceID, device);
+            }
+            for (const device of again) {
+                byID.set(device.deviceID, device);
+            }
+            deviceListRaw = [...byID.values()];
+        }
+        catch {
+            deviceListRaw = afterBackoff;
+        }
+        const devices = deviceListRaw
+            .filter((device) => !device.deleted)
+            .sort((a, b) => a.deviceID.localeCompare(b.deviceID, "en"));
+        if (devices.length === 0) {
+            throw new Error("Call peer has no active devices.");
+        }
+        return { devices, user };
     }
     async fetchIceServers() {
         const res = await this.http.get(this.getHost() + "/calls/ice-servers", {
@@ -1867,6 +2115,23 @@ export class Client {
         }
         throw new Error(`${base}${this.deviceListFailureDetail(lastErr)}`);
     }
+    async fetchUserOrThrow(userID) {
+        if (userID === this.getUser().userID) {
+            return this.getUser();
+        }
+        const cached = this.userRecords[userID];
+        if (cached) {
+            return cached;
+        }
+        const [user, err] = await this.fetchUser(userID);
+        if (err) {
+            throw err;
+        }
+        if (!user) {
+            throw new Error(`User not found: ${userID}`);
+        }
+        return user;
+    }
     /**
      * Finish a passkey login and adopt the resulting JWT as the
      * client's bearer token. After this call, `client.passkeys.*`
@@ -2253,6 +2518,14 @@ export class Client {
                 }
                 break;
             }
+            case "callWake": {
+                const parsed = callWakeNotifyData.safeParse(msg.data);
+                await this.getMail();
+                if (parsed.success) {
+                    this.emitter.emit("callWake", parsed.data);
+                }
+                break;
+            }
             case "deviceRequest": {
                 const parsed = deviceRequestNotifyData.safeParse(msg.data);
                 if (parsed.success) {
@@ -2470,6 +2743,67 @@ export class Client {
         const response = await this.http.get(this.getHost() + "/user/" + userID + "/passkeys");
         return decodeHttpResponse(PasskeyArrayCodec, response.data);
     }
+    makeCallEnvelopeBody(args) {
+        return {
+            action: args.action,
+            callID: args.state.session.callID,
+            conversationID: args.state.session.conversationID,
+            conversationType: args.state.session.conversationType,
+            createdAt: args.state.session.createdAt,
+            createdBy: args.state.session.createdBy,
+            createdByDeviceID: args.state.session.createdByDeviceID,
+            expiresAt: args.expiresAt,
+            fromDeviceID: this.getDevice().deviceID,
+            fromUserID: this.getUser().userID,
+            media: "audio",
+            sequence: args.sequence,
+            ...(args.signal ? { signal: args.signal } : {}),
+            toDeviceID: args.toDeviceID,
+            toUserID: args.toUserID,
+            version: 1,
+        };
+    }
+    markLocalCallAction(state, action, signal) {
+        const now = new Date().toISOString();
+        if (action === "accept") {
+            state.session.status = "active";
+            state.session.expiresAt = new Date(Date.now() + CALL_MAX_TTL_MS).toISOString();
+            this.upsertCallParticipant(state.session, {
+                acceptedAt: now,
+                deviceID: this.getDevice().deviceID,
+                joinedAt: now,
+                state: "accepted",
+                userID: this.getUser().userID,
+            });
+        }
+        else if (action === "cancel" ||
+            action === "end" ||
+            action === "hangup" ||
+            action === "reject" ||
+            action === "timeout") {
+            state.session.status = "ended";
+            state.session.endedAt = now;
+            this.upsertCallParticipant(state.session, {
+                leftAt: now,
+                state: action === "reject" ? "rejected" : "left",
+                userID: this.getUser().userID,
+            });
+        }
+        const event = {
+            action,
+            call: cloneCallSession(state.session),
+            fromDeviceID: this.getDevice().deviceID,
+            fromUserID: this.getUser().userID,
+            ...(signal ? { signal } : {}),
+        };
+        if (state.session.status === "ended") {
+            this.callStates.delete(state.session.callID);
+        }
+        else {
+            this.callStates.set(state.session.callID, state);
+        }
+        return event;
+    }
     async markSessionVerified(sessionID) {
         return this.database.markSessionVerified(sessionID);
     }
@@ -2652,6 +2986,29 @@ export class Client {
             }
         }
     }
+    async processDecryptedCallEnvelope(args) {
+        const body = args.envelope.body;
+        if (body.fromDeviceID !== args.mail.sender ||
+            body.fromUserID !== args.mail.authorID ||
+            body.toDeviceID !== args.mail.recipient ||
+            body.toUserID !== args.mail.readerID ||
+            body.toDeviceID !== this.getDevice().deviceID ||
+            body.toUserID !== this.getUser().userID) {
+            return null;
+        }
+        const senderDevice = await this.getDeviceByID(body.fromDeviceID);
+        if (!senderDevice || senderDevice.owner !== body.fromUserID) {
+            return null;
+        }
+        const opened = await xSignOpenAsync(XUtils.decodeHex(args.envelope.signed), XUtils.decodeHex(senderDevice.signKey));
+        if (!opened) {
+            return null;
+        }
+        if (!XUtils.bytesEqual(opened, canonicalJsonBytes(body))) {
+            return null;
+        }
+        return this.applyCallEnvelopeBody(body);
+    }
     async publishPendingDeviceRegistration(args) {
         const signed = await this.signPendingRegistrationChallenge(args.challenge);
         await this.http.post(this.getHost() +
@@ -2904,39 +3261,52 @@ export class Client {
                             if (!mail.forward) {
                                 plaintext = XUtils.encodeUTF8(unsealed);
                             }
-                            const decodedPlaintext = mail.forward
+                            const callEnvelope = mail.forward
                                 ? null
-                                : decodeMessagePlaintext(plaintext);
-                            // emit the message
-                            const fwdMsg1 = mail.forward
-                                ? messageSchema.parse(msgpack.decode(unsealed))
-                                : null;
-                            const message = fwdMsg1
-                                ? {
-                                    ...normalizeForwardedMessage(fwdMsg1),
-                                    forward: true,
+                                : decodeCallEnvelopePlaintext(plaintext);
+                            if (callEnvelope) {
+                                const event = await this.processDecryptedCallEnvelope({
+                                    envelope: callEnvelope,
+                                    mail,
+                                });
+                                if (event) {
+                                    this.emitter.emit("call", event);
+                                }
+                            }
+                            else {
+                                const decodedPlaintext = mail.forward
+                                    ? null
+                                    : decodeMessagePlaintext(plaintext);
+                                const fwdMsg1 = mail.forward
+                                    ? messageSchema.parse(msgpack.decode(unsealed))
+                                    : null;
+                                const message = fwdMsg1
+                                    ? {
+                                        ...normalizeForwardedMessage(fwdMsg1),
+                                        forward: true,
+                                    }
+                                    : {
+                                        authorID: mail.authorID,
+                                        decrypted: true,
+                                        direction: "incoming",
+                                        forward: mail.forward,
+                                        group: mail.group
+                                            ? uuid.stringify(mail.group)
+                                            : null,
+                                        mailID: mail.mailID,
+                                        ...messageFromDecodedPlaintext(decodedPlaintext ?? {
+                                            message: plaintext,
+                                        }),
+                                        nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
+                                        readerID: mail.readerID,
+                                        recipient: mail.recipient,
+                                        sender: mail.sender,
+                                        timestamp: timestamp,
+                                    };
+                                const shouldEmitIncomingInitial = mail.forward || plaintext.length > 0;
+                                if (shouldEmitIncomingInitial) {
+                                    this.emitter.emit("message", message);
                                 }
-                                : {
-                                    authorID: mail.authorID,
-                                    decrypted: true,
-                                    direction: "incoming",
-                                    forward: mail.forward,
-                                    group: mail.group
-                                        ? uuid.stringify(mail.group)
-                                        : null,
-                                    mailID: mail.mailID,
-                                    ...messageFromDecodedPlaintext(decodedPlaintext ?? {
-                                        message: plaintext,
-                                    }),
-                                    nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
-                                    readerID: mail.readerID,
-                                    recipient: mail.recipient,
-                                    sender: mail.sender,
-                                    timestamp: timestamp,
-                                };
-                            const shouldEmitIncomingInitial = mail.forward || plaintext.length > 0;
-                            if (shouldEmitIncomingInitial) {
-                                this.emitter.emit("message", message);
                             }
                             if (libvexDebugDmEnabled()) {
                                 try {
@@ -3102,33 +3472,47 @@ export class Client {
                                 ? messageSchema.parse(msgpack.decode(decrypted))
                                 : null;
                             const rawIncoming = XUtils.encodeUTF8(decrypted);
-                            const decodedPlaintext = mail.forward
+                            const callEnvelope = mail.forward
                                 ? null
-                                : decodeMessagePlaintext(rawIncoming);
-                            const message = fwdMsg2
-                                ? {
-                                    ...normalizeForwardedMessage(fwdMsg2),
-                                    forward: true,
+                                : decodeCallEnvelopePlaintext(rawIncoming);
+                            if (callEnvelope) {
+                                const event = await this.processDecryptedCallEnvelope({
+                                    envelope: callEnvelope,
+                                    mail,
+                                });
+                                if (event) {
+                                    this.emitter.emit("call", event);
                                 }
-                                : {
-                                    authorID: mail.authorID,
-                                    decrypted: true,
-                                    direction: "incoming",
-                                    forward: mail.forward,
-                                    group: mail.group
-                                        ? uuid.stringify(mail.group)
-                                        : null,
-                                    mailID: mail.mailID,
-                                    ...messageFromDecodedPlaintext(decodedPlaintext ?? {
-                                        message: rawIncoming,
-                                    }),
-                                    nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
-                                    readerID: mail.readerID,
-                                    recipient: mail.recipient,
-                                    sender: mail.sender,
-                                    timestamp: timestamp,
-                                };
-                            this.emitter.emit("message", message);
+                            }
+                            else {
+                                const decodedPlaintext = mail.forward
+                                    ? null
+                                    : decodeMessagePlaintext(rawIncoming);
+                                const message = fwdMsg2
+                                    ? {
+                                        ...normalizeForwardedMessage(fwdMsg2),
+                                        forward: true,
+                                    }
+                                    : {
+                                        authorID: mail.authorID,
+                                        decrypted: true,
+                                        direction: "incoming",
+                                        forward: mail.forward,
+                                        group: mail.group
+                                            ? uuid.stringify(mail.group)
+                                            : null,
+                                        mailID: mail.mailID,
+                                        ...messageFromDecodedPlaintext(decodedPlaintext ?? {
+                                            message: rawIncoming,
+                                        }),
+                                        nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
+                                        readerID: mail.readerID,
+                                        recipient: mail.recipient,
+                                        sender: mail.sender,
+                                        timestamp: timestamp,
+                                    };
+                                this.emitter.emit("message", message);
+                            }
                             const sqlPatch = sessionToSqlPatch(session);
                             const persisted = {
                                 CKr: sqlPatch.CKr,
@@ -3466,68 +3850,44 @@ export class Client {
             throw err;
         }
     }
-    async sendCallResource(action, data) {
-        const msg = {
+    async sendCallEnvelopeMail(args) {
+        const envelope = await this.callEnvelopeForBody(args.body);
+        await this.sendMailWithRecovery(args.targetDevice, args.targetUser, encodeCallEnvelopePlaintext(envelope), null, args.mailID, false, false, args.notify);
+    }
+    async sendEncryptedCallAction(action, callID, signal) {
+        const state = this.callStates.get(callID);
+        if (!state) {
+            throw new Error("Unknown encrypted call: " + callID);
+        }
+        const targets = await this.callTargetsForState(state);
+        if (targets.length === 0) {
+            throw new Error("Call has no reachable peer devices.");
+        }
+        const targetUser = await this.fetchUserOrThrow(state.peerUserID);
+        const sequence = state.sequence + 1;
+        state.sequence = sequence;
+        const expiresAt = action === "accept"
+            ? new Date(Date.now() + CALL_MAX_TTL_MS).toISOString()
+            : state.session.expiresAt;
+        const bodies = targets.map((target) => this.makeCallEnvelopeBody({
             action,
-            data,
-            resourceType: "call",
-            transmissionID: uuid.v4(),
-            type: "resource",
-        };
-        return await new Promise((resolve, reject) => {
-            const settle = (err, event) => {
-                this.socket.off("message", callback);
-                if (err !== null) {
-                    reject(errorFromUnknown(err));
-                    return;
-                }
-                if (!event) {
-                    reject(new Error("Call signaling response was empty."));
-                    return;
-                }
-                resolve(event);
-            };
-            const callback = (packedMsg) => {
-                const [_header, receivedMsg] = XUtils.unpackMessage(packedMsg);
-                if (receivedMsg.transmissionID !== msg.transmissionID) {
-                    return;
-                }
-                const parsed = WSMessageSchema.safeParse(receivedMsg);
-                if (!parsed.success) {
-                    settle("Call signaling failed: " + JSON.stringify(receivedMsg));
-                    return;
-                }
-                if (parsed.data.type === "success") {
-                    const event = CallEventSchema.safeParse(parsed.data.data);
-                    if (!event.success) {
-                        settle("Invalid call signaling response: " +
-                            JSON.stringify(event.error.issues));
-                        return;
-                    }
-                    settle(null, event.data);
-                    return;
-                }
-                if (parsed.data.type === "error") {
-                    settle(new Error(parsed.data.error));
-                    return;
-                }
-                if (parsed.data.type === "notify" &&
-                    (parsed.data.event === "call" ||
-                        parsed.data.event === "callInvite")) {
-                    const event = CallEventSchema.safeParse(parsed.data.data);
-                    if (event.success) {
-                        settle(null, event.data);
-                    }
-                    return;
-                }
-                settle("Unexpected call signaling response: " +
-                    JSON.stringify(parsed.data));
-            };
-            this.socket.on("message", callback);
-            this.send(msg).catch((err) => {
-                settle(err);
-            });
+            expiresAt,
+            sequence,
+            signal,
+            state,
+            toDeviceID: target.deviceID,
+            toUserID: target.owner,
+        }));
+        await this.deliverCallEnvelopeBatch({
+            bodies,
+            mailID: uuid.v4(),
+            targetUser,
         });
+        if (targets.length === 1) {
+            state.peerDeviceID = targets[0]?.deviceID;
+        }
+        state.session.expiresAt = expiresAt;
+        return this.markLocalCallAction(state, action, signal);
     }
     async sendGroupMessage(channelID, message, opts) {
         const userList = await this.getUserList(channelID);
@@ -3616,7 +3976,7 @@ export class Client {
         }
     }
     /* Sends encrypted mail to a user. */
-    async sendMail(device, user, msg, group, mailID, forward, retry = false) {
+    async sendMail(device, user, msg, group, mailID, forward, retry = false, notify) {
         while (this.sending.has(device.deviceID)) {
             await sleep(100);
         }
@@ -3631,7 +3991,7 @@ export class Client {
                         retry: String(retry),
                     });
                 }
-                const createdMessage = await this.createSession(device, user, msg, group, mailID, forward, false);
+                const createdMessage = await this.createSession(device, user, msg, group, mailID, forward, false, notify);
                 if (libvexDebugDmEnabled()) {
                     debugLibvexDm("sendMail: createSession returned", {
                         peerDevice: device.deviceID,
@@ -3670,34 +4030,43 @@ export class Client {
                 recipient: device.deviceID,
                 sender: this.getDevice().deviceID,
             };
+            const wireMail = notify ? { ...mail, notify } : mail;
             const msgb = {
                 action: "CREATE",
-                data: mail,
+                data: wireMail,
                 resourceType: "mail",
                 transmissionID: uuid.v4(),
                 type: "resource",
             };
             const hmac = xHMAC(mail, messageKey);
+            const rawPlaintext = forward ? "" : XUtils.encodeUTF8(msg);
+            const callEnvelope = forward
+                ? null
+                : decodeCallEnvelopePlaintext(rawPlaintext);
             const fwdOut = forward
                 ? messageSchema.parse(msgpack.decode(msg))
                 : null;
             const outMsg = fwdOut
                 ? { ...normalizeForwardedMessage(fwdOut), forward: true }
-                : {
-                    authorID: mail.authorID,
-                    decrypted: true,
-                    direction: "outgoing",
-                    forward: mail.forward,
-                    group: mail.group ? uuid.stringify(mail.group) : null,
-                    mailID: mail.mailID,
-                    ...messageFromDecodedPlaintext(decodeMessagePlaintext(XUtils.encodeUTF8(msg))),
-                    nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
-                    readerID: mail.readerID,
-                    recipient: mail.recipient,
-                    sender: mail.sender,
-                    timestamp: new Date().toISOString(),
-                };
-            this.emitter.emit("message", outMsg);
+                : callEnvelope
+                    ? null
+                    : {
+                        authorID: mail.authorID,
+                        decrypted: true,
+                        direction: "outgoing",
+                        forward: mail.forward,
+                        group: mail.group ? uuid.stringify(mail.group) : null,
+                        mailID: mail.mailID,
+                        ...messageFromDecodedPlaintext(decodeMessagePlaintext(rawPlaintext)),
+                        nonce: XUtils.encodeHex(new Uint8Array(mail.nonce)),
+                        readerID: mail.readerID,
+                        recipient: mail.recipient,
+                        sender: mail.sender,
+                        timestamp: new Date().toISOString(),
+                    };
+            if (outMsg) {
+                this.emitter.emit("message", outMsg);
+            }
             const sqlPatch = sessionToSqlPatch(session);
             const persisted = {
                 CKr: sqlPatch.CKr,
@@ -3722,22 +4091,22 @@ export class Client {
             };
             await this.database.saveSession(persisted);
             this.sessionRecords[XUtils.encodeHex(session.publicKey)] = session;
-            await this.deliverMailResource(msgb, hmac, mail);
+            await this.deliverMailResource(msgb, hmac, wireMail);
             return outMsg;
         }
         finally {
             this.sending.delete(device.deviceID);
         }
     }
-    async sendMailWithRecovery(device, user, msg, group, mailID, forward, forceFreshSession = false) {
+    async sendMailWithRecovery(device, user, msg, group, mailID, forward, forceFreshSession = false, notify) {
         try {
-            return await this.sendMail(device, user, msg, group, mailID, forward, forceFreshSession);
+            return await this.sendMail(device, user, msg, group, mailID, forward, forceFreshSession, notify);
         }
         catch (err) {
             if (!this.shouldRetryDeliveryWithFreshSession(err)) {
                 throw err;
             }
-            return await this.sendMail(device, user, msg, group, mailID, forward, true);
+            return await this.sendMail(device, user, msg, group, mailID, forward, true, notify);
         }
     }
     async sendMessage(userID, message, opts) {
@@ -3872,6 +4241,32 @@ export class Client {
         // Don't surface a teardown race as an unhandled rejection.
         this.send(receipt).catch(ignoreSocketTeardown);
     }
+    sessionFromCallEnvelope(body) {
+        const session = {
+            callID: body.callID,
+            conversationID: body.conversationID,
+            conversationType: body.conversationType,
+            createdAt: body.createdAt,
+            createdBy: body.createdBy,
+            createdByDeviceID: body.createdByDeviceID,
+            expiresAt: body.expiresAt,
+            media: "audio",
+            participants: [],
+            status: body.action === "invite" ? "ringing" : "active",
+        };
+        this.upsertCallParticipant(session, {
+            acceptedAt: body.createdAt,
+            deviceID: body.createdByDeviceID,
+            joinedAt: body.createdAt,
+            state: "accepted",
+            userID: body.createdBy,
+        });
+        this.upsertCallParticipant(session, {
+            state: "ringing",
+            userID: body.conversationID,
+        });
+        return session;
+    }
     setAlive(status) {
         this.isAlive = status;
     }
@@ -3904,6 +4299,66 @@ export class Client {
     async signPendingRegistrationChallenge(challengeHex) {
         return XUtils.encodeHex(await xSignAsync(XUtils.decodeHex(challengeHex), this.signKeys.secretKey));
     }
+    async startEncryptedDmCall(recipientUserID, signal) {
+        const { devices, user } = await this.fetchCallPeer({
+            userID: recipientUserID,
+        });
+        const now = new Date();
+        const createdAt = now.toISOString();
+        const expiresAt = new Date(now.getTime() + CALL_INVITE_TTL_MS).toISOString();
+        const session = {
+            callID: uuid.v4(),
+            conversationID: recipientUserID,
+            conversationType: "dm",
+            createdAt,
+            createdBy: this.getUser().userID,
+            createdByDeviceID: this.getDevice().deviceID,
+            expiresAt,
+            media: "audio",
+            participants: [
+                {
+                    acceptedAt: createdAt,
+                    deviceID: this.getDevice().deviceID,
+                    joinedAt: createdAt,
+                    state: "accepted",
+                    userID: this.getUser().userID,
+                },
+                {
+                    state: "ringing",
+                    userID: recipientUserID,
+                },
+            ],
+            status: "ringing",
+        };
+        const state = {
+            peerUserID: recipientUserID,
+            pendingPeerDevices: devices,
+            sequence: 1,
+            session,
+        };
+        this.callStates.set(session.callID, state);
+        const bodies = devices.map((device) => this.makeCallEnvelopeBody({
+            action: "invite",
+            expiresAt,
+            sequence: state.sequence,
+            signal,
+            state,
+            toDeviceID: device.deviceID,
+            toUserID: recipientUserID,
+        }));
+        await this.deliverCallEnvelopeBatch({
+            bodies,
+            mailID: uuid.v4(),
+            targetUser: user,
+        });
+        return {
+            action: "invite",
+            call: cloneCallSession(session),
+            fromDeviceID: this.getDevice().deviceID,
+            fromUserID: this.getUser().userID,
+            ...(signal ? { signal } : {}),
+        };
+    }
     async submitOTK(amount) {
         const otks = [];
         for (let i = 0; i < amount; i++) {
@@ -4001,5 +4456,13 @@ export class Client {
             return null;
         }
     }
+    upsertCallParticipant(session, patch) {
+        const existing = session.participants.find((participant) => participant.userID === patch.userID);
+        if (!existing) {
+            session.participants.push({ ...patch });
+            return;
+        }
+        Object.assign(existing, patch);
+    }
 }
 //# sourceMappingURL=Client.js.map