@vex-chat/libvex 8.0.0 → 9.1.0

package/dist/Client.js

@@ -3,15 +3,15 @@
  * Licensed under AGPL-3.0. See LICENSE for details.
  * Commercial licenses available at vex.wtf
  */
-import { enterCryptoProfileScope, getCryptoProfile, leaveCryptoProfileScope, setCryptoProfile, xBoxKeyPairAsync, xBoxKeyPairFromSecretAsync, xConcat, xConstants, xDHAsync, xEcdhKeyPairFromEcdsaKeyPairAsync, xEncode, xHMAC, xKDF, XKeyConvert, xMakeNonce, xMnemonic, xRandomBytes, xSecretboxAsync, xSecretboxOpenAsync, xSignAsync, xSignKeyPair, xSignKeyPairAsync, xSignKeyPairFromSecret, xSignKeyPairFromSecretAsync, xSignOpenAsync, XUtils, } from "@vex-chat/crypto";
-import { CallEventSchema, CallSessionSchema, IceServerConfigSchema, MailType, MailWSSchema, PermissionSchema, WSMessageSchema, } from "@vex-chat/types";
+import { enterCryptoProfileScope, getCryptoProfile, leaveCryptoProfileScope, setCryptoProfile, xBoxKeyPairAsync, xBoxKeyPairFromSecretAsync, xConcat, xConstants, xDHAsync, xEcdhKeyPairFromEcdsaKeyPairAsync, xEncode, xHMAC, xKDF, XKeyConvert, xMakeNonce, xMessageKeySubkeys, xMnemonic, xPreKeySignaturePayload, xRandomBytes, xSecretboxAsync, xSecretboxOpenAsync, xSignAsync, xSignKeyPair, xSignKeyPairAsync, xSignKeyPairFromSecret, xSignKeyPairFromSecretAsync, xSignOpenAsync, XUtils, } from "@vex-chat/crypto";
+import { ACCOUNT_PASSWORD_MAX_LENGTH, ACCOUNT_PASSWORD_MIN_LENGTH, CallEventSchema, CallSessionSchema, IceServerConfigSchema, MailType, MailWSSchema, PermissionSchema, WSMessageSchema, } from "@vex-chat/types";
 import { EventEmitter } from "eventemitter3";
 import * as uuid from "uuid";
 import { z } from "zod/v4";
 import { createFetchHttpClient, isHttpError, } from "./http.js";
 import { clampLocalMessageRetentionDays, formatVexRetentionEnvelope, stripVexRetentionEnvelope, } from "./retention.js";
 import { WebSocketAdapter, WebSocketNotOpenError, } from "./transport/websocket.js";
-import { decodeFipsInitialExtraV1, encodeFipsInitialExtraV1, fipsP256AdFromIdentityPubs, fipsP256PreKeySignPayload, isFipsInitialExtraV1, } from "./utils/fipsMailExtra.js";
+import { decodeFipsInitialExtraV1, encodeFipsInitialExtraV1, fipsP256AdFromIdentityPubs, isFipsInitialExtraV1, } from "./utils/fipsMailExtra.js";
 import { decodeRatchetHeader, deriveBootstrapSendChain, encodeRatchetHeader, hasRemoteDhChanged, initRatchetSession, ratchetStepReceive, ratchetStepSend, sessionToSqlPatch, takeReceiveMessageKey, takeSendMessageKey, } from "./utils/ratchet.js";
 import { verifyKeyBundleSignatures } from "./utils/verifyKeyBundle.js";
 /**
@@ -148,6 +148,16 @@ function libvexDebugLevel() {
         return "debug";
     }
 }
+function registrationPasswordError(password) {
+    if (password.trim().length === 0 ||
+        password.length < ACCOUNT_PASSWORD_MIN_LENGTH) {
+        return new Error(`Password must be at least ${String(ACCOUNT_PASSWORD_MIN_LENGTH)} characters.`);
+    }
+    if (password.length > ACCOUNT_PASSWORD_MAX_LENGTH) {
+        return new Error(`Password must be at most ${String(ACCOUNT_PASSWORD_MAX_LENGTH)} characters.`);
+    }
+    return null;
+}
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -373,6 +383,7 @@ const retryRequestNotifyData = z.union([
         mailID: z.string(),
     }),
 ]);
+const serverChangeNotifyData = z.string().min(1).max(128);
 export class Client {
     /**
      * Decrypts a secret key from encrypted data produced by encryptKeyData().
@@ -454,6 +465,8 @@ export class Client {
          * @returns The Channel object, or null.
          */
         retrieveByID: this.getChannelByID.bind(this),
+        /** Changes a channel's display name. */
+        update: this.updateChannel.bind(this),
         /**
          * Retrieves a channel's userlist.
          * @param channelID - The channel to retrieve the userlist for.
@@ -529,6 +542,7 @@ export class Client {
      * Helpers for information/actions related to the currently authenticated account.
      */
     me = {
+        changePassword: this.changePassword.bind(this),
         /**
          * Retrieves current device details.
          *
@@ -590,6 +604,7 @@ export class Client {
     moderation = {
         fetchPermissionList: this.fetchPermissionList.bind(this),
         kick: this.kickUser.bind(this),
+        setRole: this.setServerMemberRole.bind(this),
     };
     /**
      * Passkey ("recovery credential") methods.
@@ -614,6 +629,7 @@ export class Client {
         listDevices: this.passkeyListDevices.bind(this),
         recoverDeviceRequest: this.passkeyRecoverDeviceRequest.bind(this),
         rejectDeviceRequest: this.passkeyRejectDeviceRequest.bind(this),
+        resetPassword: this.resetPasswordWithPasskey.bind(this),
     };
     /**
      * Permission-management methods for the current user.
@@ -645,7 +661,9 @@ export class Client {
          * @param serverID - The server to delete.
          */
         delete: this.deleteServer.bind(this),
+        iconURL: this.getServerIconURL.bind(this),
         leave: this.leaveServer.bind(this),
+        removeIcon: this.removeServerIcon.bind(this),
         /**
          * Retrieves all servers the logged in user has access to.
          *
@@ -659,6 +677,8 @@ export class Client {
          */
         retrieveByID: this.getServerByID.bind(this),
         retrieveWithChannels: this.getServerChannelBootstrap.bind(this),
+        setIcon: this.uploadServerIcon.bind(this),
+        update: this.updateServer.bind(this),
     };
     /**
      * Encryption-session helpers.
@@ -849,14 +869,23 @@ export class Client {
         const atRestAes = XUtils.deriveLocalAtRestAesKey(idKeys.secretKey, profile);
         let resolvedStorage = storage;
         if (!resolvedStorage) {
-            const { createNodeStorage } = await import("./storage/node.js");
+            const nodeStorageModule = "./storage/node.js";
+            const isNodeStorageModule = (value) => typeof value === "object" &&
+                value !== null &&
+                "createNodeStorage" in value &&
+                typeof value.createNodeStorage === "function";
+            const nodeStorage = await import(
+            /* @vite-ignore */ nodeStorageModule);
+            if (!isNodeStorageModule(nodeStorage)) {
+                throw new Error("Node storage adapter is unavailable.");
+            }
             const dbFileName = options?.inMemoryDb
                 ? ":memory:"
                 : XUtils.encodeHex(signKeys.publicKey) + ".sqlite";
             const dbPath = options?.dbFolder
                 ? options.dbFolder + "/" + dbFileName
                 : dbFileName;
-            resolvedStorage = createNodeStorage(dbPath, atRestAes);
+            resolvedStorage = nodeStorage.createNodeStorage(dbPath, atRestAes);
         }
         await resolvedStorage.init();
         const client = new Client({
@@ -1147,10 +1176,37 @@ export class Client {
         return null;
     }
     /**
-     * Logs out the current authenticated session from the server.
+     * Ends the local authenticated session and disconnects realtime transport.
+     * Spire access tokens are stateless, so local credential removal is the
+     * authoritative logout boundary.
      */
     async logout() {
-        await this.http.post(this.getHost() + "/goodbye");
+        try {
+            if (this.token) {
+                await this.http.post(this.getHost() + "/goodbye");
+            }
+        }
+        catch {
+            // Logout must still complete locally when the server is unreachable.
+        }
+        finally {
+            this.token = null;
+            this.user = undefined;
+            this.device = undefined;
+            delete this.http.defaults.headers.common.Authorization;
+            delete this.http.defaults.headers.common["X-Device-Token"];
+            this.autoReconnectEnabled = false;
+            this.postAuthVersion++;
+            if (this.reconnectTimer) {
+                clearTimeout(this.reconnectTimer);
+                this.reconnectTimer = null;
+            }
+            if (this.pingInterval) {
+                clearInterval(this.pingInterval);
+                this.pingInterval = null;
+            }
+            this.socket.close();
+        }
     }
     /** Removes an event listener. See {@link ClientEvents} for available events. */
     off(event, fn, context) {
@@ -1202,8 +1258,8 @@ export class Client {
     /**
      * Registers a new account on the server.
      *
-     * @param username - Optional username to register (must be unique when provided).
-     * @param password - Password for new accounts. Existing-account device approval requests may omit it.
+     * @param username - Username to register.
+     * @param password - Password for the account and device approval request.
      * @returns `[user, null]` on success, `[null, error]` on failure.
      *
      * @example
@@ -1212,113 +1268,35 @@ export class Client {
      * ```
      */
     async register(username, password) {
-        while (!this.xKeyRing) {
-            await sleep(100);
-        }
-        const regKey = await this.getToken("register");
-        if (regKey) {
-            // Usernames are case-insensitive at the protocol level;
-            // lowercase before sending so the local SDK view matches
-            // what the server canonicalizes and persists.
-            const resolvedUsername = username?.trim().length !== 0 && username !== undefined
-                ? username.trim().toLowerCase()
-                : Client.randomUsername();
-            const resolvedPassword = password?.trim().length !== 0 && password !== undefined
-                ? password
-                : undefined;
-            const signKey = XUtils.encodeHex(this.signKeys.publicKey);
-            const signed = XUtils.encodeHex(await xSignAsync(Uint8Array.from(uuid.parse(regKey.key)), this.signKeys.secretKey));
-            const preKeyIndex = this.xKeyRing.preKeys.index;
-            const regMsg = {
-                deviceName: this.options?.deviceName ?? "unknown",
-                preKey: XUtils.encodeHex(this.xKeyRing.preKeys.keyPair.publicKey),
-                preKeyIndex,
-                preKeySignature: XUtils.encodeHex(this.xKeyRing.preKeys.signature),
-                signed,
-                signKey,
-                username: resolvedUsername,
-            };
-            if (resolvedPassword !== undefined) {
-                regMsg.password = resolvedPassword;
-            }
-            try {
-                const res = await this.http.post(this.getHost() + "/register", msgpack.encode(regMsg), { headers: { "Content-Type": "application/msgpack" } });
-                // New key-cluster server response: { device, token, user }.
-                // Legacy response (still deployed in some environments): user only.
-                let didDecodeRegisterResponse = false;
-                let pendingApproval = null;
-                try {
-                    const { device, token, user } = decodeHttpResponse(RegisterResponseCodec, res.data);
-                    this.device = device;
-                    this.setUser(user);
-                    this.token = token;
-                    this.http.defaults.headers.common.Authorization = `Bearer ${token}`;
-                    didDecodeRegisterResponse = true;
-                }
-                catch {
-                    // fall through to legacy decode path
-                }
-                if (!didDecodeRegisterResponse) {
-                    try {
-                        pendingApproval = decodeHttpResponse(RegisterPendingApprovalCodec, res.data);
-                    }
-                    catch {
-                        // fall through to legacy decode path
-                    }
-                }
-                if (!didDecodeRegisterResponse) {
-                    if (pendingApproval !== null) {
-                        return [
-                            null,
-                            new DeviceApprovalRequiredError({
-                                challenge: pendingApproval.challenge,
-                                expiresAt: pendingApproval.expiresAt,
-                                requestID: pendingApproval.requestID,
-                                userID: pendingApproval.userID ?? null,
-                            }),
-                        ];
-                    }
-                    const legacyUser = decodeHttpResponse(UserCodec, res.data);
-                    this.setUser(legacyUser);
-                    // Legacy servers require /auth after /register to get a JWT.
-                    if (resolvedPassword === undefined) {
-                        return [
-                            null,
-                            new Error("Legacy register succeeded without a password, so the SDK could not complete login."),
-                        ];
-                    }
-                    const loginResult = await this.login(resolvedUsername, resolvedPassword);
-                    if (!loginResult.ok) {
-                        return [
-                            null,
-                            new Error(loginResult.error ??
-                                "Legacy register succeeded but login failed."),
-                        ];
-                    }
-                }
-                return [this.getUser(), null];
-            }
-            catch (err) {
-                if (isHttpError(err) && err.response) {
-                    return [
-                        null,
-                        new Error(spireErrorBodyMessage(err.response.data)),
-                    ];
-                }
-                return [
-                    null,
-                    err instanceof Error ? err : new Error(String(err)),
-                ];
-            }
-        }
-        else {
-            return [null, new Error("Couldn't get regkey from server.")];
+        const passwordError = registrationPasswordError(password);
+        if (passwordError) {
+            return [null, passwordError];
         }
+        return this.registerAccountOrEnrollment(username, "create-account", password);
     }
     removeAllListeners(event) {
         this.emitter.removeAllListeners(event);
         return this;
     }
+    /**
+     * Requests approval for a new device using the account password. This
+     * enrollment flow never creates an account when the username is unknown.
+     */
+    async requestDeviceEnrollment(username, password) {
+        const passwordError = registrationPasswordError(password);
+        if (passwordError) {
+            return [null, passwordError];
+        }
+        return this.registerAccountOrEnrollment(username, "enroll-device", password);
+    }
+    /**
+     * Requests enrollment for this device after a successful passkey ceremony.
+     * This is not account registration: the passkey bearer must identify an
+     * existing account, and the server returns a pending device request.
+     */
+    async requestDeviceEnrollmentWithPasskey(username) {
+        return this.registerAccountOrEnrollment(username, "enroll-device");
+    }
     /**
      * Updates the local retention cap (1–30 days) and prunes immediately.
      * Does not affect server-side storage.
@@ -1456,6 +1434,16 @@ export class Client {
             signature: XUtils.decodeHex(preKey.signature),
         };
     }
+    async changePassword(currentPassword, newPassword) {
+        const passwordError = registrationPasswordError(newPassword);
+        if (passwordError)
+            throw passwordError;
+        if (currentPassword.length === 0 ||
+            currentPassword.length > ACCOUNT_PASSWORD_MAX_LENGTH) {
+            throw new Error("Current password is invalid.");
+        }
+        await this.replaceAccountPassword({ currentPassword, newPassword });
+    }
     async createChannel(name, serverID) {
         const body = { name };
         const res = await this.http.post(this.getHost() + "/server/" + serverID + "/channels", msgpack.encode(body), { headers: { "Content-Type": "application/msgpack" } });
@@ -1523,12 +1511,10 @@ export class Client {
         const res = await this.http.post(this.getHost() + "/server/" + serverID + "/invites", msgpack.encode(payload), { headers: { "Content-Type": "application/msgpack" } });
         return decodeHttpResponse(InviteCodec, res.data);
     }
-    async createPreKey() {
+    async createPreKey(kind) {
         return this.runWithThisCryptoProfile(async () => {
             const preKeyPair = await xBoxKeyPairAsync();
-            const toSign = this.cryptoProfile === "fips"
-                ? fipsP256PreKeySignPayload(preKeyPair.publicKey)
-                : xEncode(xConstants.CURVE, preKeyPair.publicKey);
+            const toSign = xPreKeySignaturePayload(preKeyPair.publicKey, kind, this.cryptoProfile);
             return {
                 keyPair: preKeyPair,
                 signature: await xSignAsync(toSign, this.signKeys.secretKey),
@@ -1536,7 +1522,7 @@ export class Client {
         });
     }
     async createServer(name) {
-        const res = await this.http.post(this.getHost() + "/server/" + globalThis.btoa(name));
+        const res = await this.http.post(this.getHost() + "/servers", msgpack.encode({ name }), { headers: { "Content-Type": "application/msgpack" } });
         return decodeHttpResponse(ServerCodec, res.data);
     }
     async createSession(device, user, message, group, 
@@ -1604,12 +1590,13 @@ export class Client {
                 : XUtils.numberToUint8Arr(0);
             // shared secret key
             const SK = xKDF(IKM);
+            const initialSubkeys = xMessageKeySubkeys(SK);
             const PK = (await xBoxKeyPairFromSecretAsync(SK)).publicKey;
             const AD = fips
                 ? fipsP256AdFromIdentityPubs(IK_AP, new Uint8Array(keyBundle.signKey))
                 : xConcat(xEncode(xConstants.CURVE, IK_AP), xEncode(xConstants.CURVE, IK_B));
             const nonce = xMakeNonce();
-            const cipher = await xSecretboxAsync(message, nonce, SK);
+            const cipher = await xSecretboxAsync(message, nonce, initialSubkeys.encryptionKey);
             const signKeyWire = fips ? IK_AP : this.signKeys.publicKey;
             const ephKeyWire = ephemeralKeys.publicKey;
             const extra = fips
@@ -1628,7 +1615,7 @@ export class Client {
                 recipient: device.deviceID,
                 sender: this.getDevice().deviceID,
             };
-            const hmac = xHMAC(mail, SK);
+            const hmac = xHMAC(mail, initialSubkeys.authenticationKey);
             const msg = {
                 action: "CREATE",
                 data: mail,
@@ -2122,6 +2109,9 @@ export class Client {
                 "/device/" +
                 this.getDevice().deviceID +
                 "/mail");
+            if (!this.token || this.isManualCloseInFlight()) {
+                return;
+            }
             const mailBuffer = new Uint8Array(res.data);
             const rawInbox = z
                 .array(mailInboxEntry)
@@ -2220,6 +2210,9 @@ export class Client {
             "/servers/bootstrap");
         return decodeHttpResponse(ServerChannelBootstrapCodec, res.data);
     }
+    getServerIconURL(iconID) {
+        return this.getHost() + "/server-icon/" + encodeURIComponent(iconID);
+    }
     async getServerList() {
         const res = await this.http.get(this.getHost() + "/user/" + this.getUser().userID + "/servers");
         return decodeHttpResponse(ServerArrayCodec, res.data);
@@ -2312,6 +2305,13 @@ export class Client {
                     }
                 }
                 break;
+            case "serverChange": {
+                const parsed = serverChangeNotifyData.safeParse(msg.data);
+                if (parsed.success) {
+                    this.emitter.emit("serverChange", parsed.data);
+                }
+                break;
+            }
             default:
                 break;
         }
@@ -2453,9 +2453,7 @@ export class Client {
     }
     async isPreKeySignedByCurrentDevice(preKey) {
         return this.runWithThisCryptoProfile(async () => {
-            const payload = this.cryptoProfile === "fips"
-                ? fipsP256PreKeySignPayload(preKey.keyPair.publicKey)
-                : xEncode(xConstants.CURVE, preKey.keyPair.publicKey);
+            const payload = xPreKeySignaturePayload(preKey.keyPair.publicKey, "signed", this.cryptoProfile);
             const opened = await xSignOpenAsync(preKey.signature, this.signKeys.publicKey);
             return Boolean(opened && XUtils.bytesEqual(opened, payload));
         });
@@ -2627,7 +2625,7 @@ export class Client {
             let preKeys = await this.database.getPreKeys();
             if (!preKeys ||
                 !(await this.isPreKeySignedByCurrentDevice(preKeys))) {
-                const unsaved = await this.createPreKey();
+                const unsaved = await this.createPreKey("signed");
                 const [saved] = await this.database.savePreKeys([unsaved], false);
                 if (!saved || saved.index == null)
                     throw new Error("Failed to save prekey — no index returned.");
@@ -2897,9 +2895,10 @@ export class Client {
                             : xConcat(DH1, DH2, DH3);
                         // shared secret key
                         const SK = xKDF(IKM);
+                        const initialSubkeys = xMessageKeySubkeys(SK);
                         const PK = (await xBoxKeyPairFromSecretAsync(SK))
                             .publicKey;
-                        const hmac = xHMAC(mail, SK);
+                        const hmac = xHMAC(mail, initialSubkeys.authenticationKey);
                         // associated data
                         const AD = fipsRead
                             ? fipsP256AdFromIdentityPubs(IK_A, IK_BP)
@@ -2930,7 +2929,7 @@ export class Client {
                             this.acknowledgeRepeatedDecryptFailure(mail, failureCount, timestamp);
                             return;
                         }
-                        const unsealed = await xSecretboxOpenAsync(new Uint8Array(mail.cipher), new Uint8Array(mail.nonce), SK);
+                        const unsealed = await xSecretboxOpenAsync(new Uint8Array(mail.cipher), new Uint8Array(mail.nonce), initialSubkeys.encryptionKey);
                         if (unsealed) {
                             let plaintext = "";
                             if (!mail.forward) {
@@ -3084,15 +3083,17 @@ export class Client {
                         else if (hasRemoteDhChanged(candidateSession.DHr, ratchetHeader.dhPub)) {
                             await ratchetStepReceive(candidateSession, ratchetHeader.dhPub, ratchetHeader.pn);
                         }
-                        let messageKey = takeReceiveMessageKey(candidateSession, ratchetHeader.dhPub, ratchetHeader.n);
-                        let HMAC = xHMAC(mail, messageKey);
+                        const messageKey = takeReceiveMessageKey(candidateSession, ratchetHeader.dhPub, ratchetHeader.n);
+                        let messageSubkeys = xMessageKeySubkeys(messageKey);
+                        let HMAC = xHMAC(mail, messageSubkeys.authenticationKey);
                         if (!XUtils.bytesEqual(HMAC, header) &&
                             firstInboundFromSubsequent &&
                             !originalSession.CKr) {
                             const ratchetedCandidate = cloneSessionCrypto(originalSession);
                             await ratchetStepReceive(ratchetedCandidate, ratchetHeader.dhPub, ratchetHeader.pn);
                             const ratchetedMessageKey = takeReceiveMessageKey(ratchetedCandidate, ratchetHeader.dhPub, ratchetHeader.n);
-                            const ratchetedHMAC = xHMAC(mail, ratchetedMessageKey);
+                            const ratchetedSubkeys = xMessageKeySubkeys(ratchetedMessageKey);
+                            const ratchetedHMAC = xHMAC(mail, ratchetedSubkeys.authenticationKey);
                             if (XUtils.bytesEqual(ratchetedHMAC, header)) {
                                 if (libvexDebugDmEnabled()) {
                                     debugLibvexDm("readMail subsequent: first inbound used DH-ratchet fallback", {
@@ -3101,7 +3102,7 @@ export class Client {
                                     });
                                 }
                                 candidateSession = ratchetedCandidate;
-                                messageKey = ratchetedMessageKey;
+                                messageSubkeys = ratchetedSubkeys;
                                 HMAC = ratchetedHMAC;
                             }
                         }
@@ -3128,7 +3129,7 @@ export class Client {
                             return;
                         }
                         session = candidateSession;
-                        const decrypted = await xSecretboxOpenAsync(new Uint8Array(mail.cipher), new Uint8Array(mail.nonce), messageKey);
+                        const decrypted = await xSecretboxOpenAsync(new Uint8Array(mail.cipher), new Uint8Array(mail.nonce), messageSubkeys.encryptionKey);
                         if (decrypted) {
                             const fwdMsg2 = mail.forward
                                 ? messageSchema.parse(msgpack.decode(decrypted))
@@ -3251,6 +3252,75 @@ export class Client {
         const res = await this.http.patch(this.getHost() + "/invite/" + inviteID);
         return decodeHttpResponse(PermissionCodec, res.data);
     }
+    async registerAccountOrEnrollment(username, intent, password) {
+        const resolvedUsername = username.trim().toLowerCase();
+        if (!/^\w{3,19}$/.test(resolvedUsername)) {
+            return [
+                null,
+                new Error("Username must be between three and nineteen letters, digits, or underscores."),
+            ];
+        }
+        while (!this.xKeyRing) {
+            await sleep(100);
+        }
+        const regKey = await this.getToken("register");
+        if (regKey) {
+            const signKey = XUtils.encodeHex(this.signKeys.publicKey);
+            const signed = XUtils.encodeHex(await xSignAsync(Uint8Array.from(uuid.parse(regKey.key)), this.signKeys.secretKey));
+            const preKeyIndex = this.xKeyRing.preKeys.index;
+            const regMsg = {
+                deviceName: this.options?.deviceName ?? "unknown",
+                intent,
+                preKey: XUtils.encodeHex(this.xKeyRing.preKeys.keyPair.publicKey),
+                preKeyIndex,
+                preKeySignature: XUtils.encodeHex(this.xKeyRing.preKeys.signature),
+                signed,
+                signKey,
+                username: resolvedUsername,
+            };
+            if (password !== undefined) {
+                regMsg.password = password;
+            }
+            try {
+                const res = await this.http.post(this.getHost() + "/register", msgpack.encode(regMsg), { headers: { "Content-Type": "application/msgpack" } });
+                try {
+                    const { device, token, user } = decodeHttpResponse(RegisterResponseCodec, res.data);
+                    this.device = device;
+                    this.setUser(user);
+                    this.token = token;
+                    this.http.defaults.headers.common.Authorization = `Bearer ${token}`;
+                }
+                catch {
+                    const pendingApproval = decodeHttpResponse(RegisterPendingApprovalCodec, res.data);
+                    return [
+                        null,
+                        new DeviceApprovalRequiredError({
+                            challenge: pendingApproval.challenge,
+                            expiresAt: pendingApproval.expiresAt,
+                            requestID: pendingApproval.requestID,
+                            userID: pendingApproval.userID,
+                        }),
+                    ];
+                }
+                return [this.getUser(), null];
+            }
+            catch (err) {
+                if (isHttpError(err) && err.response) {
+                    return [
+                        null,
+                        new Error(spireErrorBodyMessage(err.response.data)),
+                    ];
+                }
+                return [
+                    null,
+                    err instanceof Error ? err : new Error(String(err)),
+                ];
+            }
+        }
+        else {
+            return [null, new Error("Couldn't get regkey from server.")];
+        }
+    }
     registerDecryptFailure(mail) {
         const count = (this.decryptFailureCounts.get(mail.mailID) ?? 0) + 1;
         this.decryptFailureCounts.set(mail.mailID, count);
@@ -3299,6 +3369,19 @@ export class Client {
             requestID +
             "/reject");
     }
+    async removeServerIcon(serverID) {
+        const res = await this.http.delete(this.getHost() + "/server-icon/" + serverID);
+        return decodeHttpResponse(ServerCodec, res.data);
+    }
+    async replaceAccountPassword(payload) {
+        await this.http.patch(this.getHost() + "/user/" + this.getUser().userID + "/password", msgpack.encode(payload), { headers: { "Content-Type": "application/msgpack" } });
+    }
+    async resetPasswordWithPasskey(newPassword) {
+        const passwordError = registrationPasswordError(newPassword);
+        if (passwordError)
+            throw passwordError;
+        await this.replaceAccountPassword({ newPassword });
+    }
     async respond(msg) {
         const response = {
             signed: await xSignAsync(new Uint8Array(msg.challenge), this.signKeys.secretKey),
@@ -3378,7 +3461,7 @@ export class Client {
                         challenge: newDevice.challenge,
                         expiresAt: newDevice.expiresAt,
                         requestID: newDevice.requestID,
-                        userID: newDevice.userID ?? null,
+                        userID: newDevice.userID,
                     });
                 }
                 else {
@@ -3606,8 +3689,8 @@ export class Client {
             return;
         }
         const stableDevices = [...targetDevices.values()].sort((a, b) => a.deviceID.localeCompare(b.deviceID, "en"));
-        let failCount = 0;
-        let lastErr;
+        const successfulOwnerIDs = new Set();
+        const lastErrorByOwnerID = new Map();
         for (let index = 0; index < stableDevices.length; index += MAIL_FANOUT_CONCURRENCY) {
             const batch = stableDevices.slice(index, index + MAIL_FANOUT_CONCURRENCY);
             const results = await Promise.all(batch.map(async (device) => {
@@ -3615,36 +3698,40 @@ export class Client {
                     ? this.getUser()
                     : this.userRecords[device.owner];
                 if (!ownerRecord) {
-                    return new Error(`Missing owner record for device ${device.deviceID}.`);
+                    return {
+                        device,
+                        error: new Error(`Missing owner record for device ${device.deviceID}.`),
+                        ok: false,
+                    };
                 }
                 try {
                     await this.sendMailWithRecovery(device, ownerRecord, msgBytes, uuidToUint8(channelID), mailID, false);
-                    return undefined;
+                    return { device, ok: true };
                 }
-                catch (e) {
-                    return e;
+                catch (error) {
+                    return { device, error, ok: false };
                 }
             }));
             for (const result of results) {
-                if (result !== undefined) {
-                    lastErr = result;
-                    failCount += 1;
+                if (result.ok) {
+                    successfulOwnerIDs.add(result.device.owner);
+                }
+                else {
+                    lastErrorByOwnerID.set(result.device.owner, result.error);
                 }
             }
-            if (failCount === stableDevices.length) {
-                break;
-            }
-        }
-        if (failCount === stableDevices.length) {
-            throw lastErr instanceof Error
-                ? lastErr
-                : new Error(String(lastErr));
         }
-        if (failCount > 0) {
-            const partial = new Error(`Group message failed to reach ${String(failCount)} of ` +
-                `${String(stableDevices.length)} peer device(s).`);
-            partial.cause = lastErr;
-            throw partial;
+        const requiredOwnerIDs = peerUserIDs.length > 0 ? peerUserIDs : [myUserID];
+        const unreachableOwnerIDs = requiredOwnerIDs.filter((ownerID) => !successfulOwnerIDs.has(ownerID));
+        if (unreachableOwnerIDs.length > 0) {
+            const lastError = lastErrorByOwnerID.get(unreachableOwnerIDs.at(-1) ?? "");
+            if (unreachableOwnerIDs.length === requiredOwnerIDs.length &&
+                lastError instanceof Error) {
+                throw lastError;
+            }
+            const deliveryError = new Error(`Message could not be delivered to ${String(unreachableOwnerIDs.length)} channel member(s).`);
+            deliveryError.cause = lastError;
+            throw deliveryError;
         }
     }
     /* Sends encrypted mail to a user. */
@@ -3680,6 +3767,7 @@ export class Client {
                 await ratchetStepSend(session);
             }
             const { messageKey, n } = takeSendMessageKey(session);
+            const messageSubkeys = xMessageKeySubkeys(messageKey);
             const ratchetHeader = {
                 dhPub: session.DHsPublic,
                 n,
@@ -3687,7 +3775,7 @@ export class Client {
                 version: 1,
             };
             const nonce = xMakeNonce();
-            const cipher = await xSecretboxAsync(msg, nonce, messageKey);
+            const cipher = await xSecretboxAsync(msg, nonce, messageSubkeys.encryptionKey);
             const extra = encodeRatchetHeader(ratchetHeader);
             const mail = {
                 authorID: this.getUser().userID,
@@ -3709,7 +3797,7 @@ export class Client {
                 transmissionID: uuid.v4(),
                 type: "resource",
             };
-            const hmac = xHMAC(mail, messageKey);
+            const hmac = xHMAC(mail, messageSubkeys.authenticationKey);
             const fwdOut = forward
                 ? messageSchema.parse(msgpack.decode(msg))
                 : null;
@@ -3822,6 +3910,7 @@ export class Client {
             }
             let lastErr;
             let failCount = 0;
+            let successCount = 0;
             // One logical DM fan-outs to multiple recipient devices. Reuse a
             // single mailID so local/UI dedupe treats it as one message.
             const messageMailID = uuid.v4();
@@ -3865,24 +3954,19 @@ export class Client {
                         lastErr = result;
                         failCount += 1;
                     }
+                    else {
+                        successCount += 1;
+                    }
                 }
                 if (failCount === deviceList.length) {
                     break;
                 }
             }
-            if (failCount > 0) {
+            if (successCount === 0) {
                 const base = lastErr instanceof Error
                     ? lastErr
                     : new Error(String(lastErr));
-                if (failCount === deviceList.length) {
-                    throw base;
-                }
-                // Multi-device: do not “succeed” when only one device of several got mail —
-                // callers and tests have no per-device result and the other copy times out.
-                const partial = new Error(`Direct message failed to reach ${String(failCount)} of ` +
-                    `${String(deviceList.length)} peer device(s) (X3DH/post).`);
-                partial.cause = base;
-                throw partial;
+                throw base;
             }
             if (userID !== this.getUser().userID &&
                 firstOutgoingMessage.current !== null) {
@@ -3917,6 +4001,10 @@ export class Client {
         });
         return decodeHttpResponse(AccountEntitlementsCodec, res.data);
     }
+    async setServerMemberRole(permissionID, powerLevel) {
+        const res = await this.http.patch(this.getHost() + "/permission/" + permissionID, msgpack.encode({ powerLevel }), { headers: { "Content-Type": "application/msgpack" } });
+        return decodeHttpResponse(PermissionCodec, res.data);
+    }
     setUser(user) {
         this.user = user;
         // Fresh identity / token: drop stale 404 negative-cache entries so a
@@ -3957,13 +4045,21 @@ export class Client {
     async submitOTK(amount) {
         const otks = [];
         for (let i = 0; i < amount; i++) {
-            otks.push(await this.createPreKey());
+            otks.push(await this.createPreKey("one-time"));
         }
         const savedKeys = await this.database.savePreKeys(otks, true);
         await this.http.post(this.getHost() + "/device/" + this.getDevice().deviceID + "/otk", msgpack.encode(savedKeys.map((key) => this.censorPreKey(key))), {
             headers: { "Content-Type": "application/msgpack" },
         });
     }
+    async updateChannel(channelID, name) {
+        const res = await this.http.patch(this.getHost() + "/channel/" + channelID, msgpack.encode({ name }), { headers: { "Content-Type": "application/msgpack" } });
+        return decodeHttpResponse(ChannelCodec, res.data);
+    }
+    async updateServer(serverID, name) {
+        const res = await this.http.patch(this.getHost() + "/server/" + serverID, msgpack.encode({ name }), { headers: { "Content-Type": "application/msgpack" } });
+        return decodeHttpResponse(ServerCodec, res.data);
+    }
     async uploadAvatar(avatar) {
         const canUseMultipart = typeof FormData !== "undefined" &&
             (() => {
@@ -4051,5 +4147,37 @@ export class Client {
             return null;
         }
     }
+    async uploadServerIcon(serverID, icon) {
+        const canUseMultipart = typeof FormData !== "undefined" &&
+            (() => {
+                try {
+                    void new Blob([new Uint8Array([1, 2, 3])]);
+                    return true;
+                }
+                catch {
+                    return false;
+                }
+            })();
+        if (canUseMultipart) {
+            const payload = new FormData();
+            payload.set("icon", new Blob([new Uint8Array(icon)]));
+            const res = await this.http.post(this.getHost() + "/server-icon/" + serverID, payload, {
+                headers: { "Content-Type": "multipart/form-data" },
+                onUploadProgress: (progressEvent) => {
+                    const { loaded, total = 0 } = progressEvent;
+                    this.emitter.emit("fileProgress", {
+                        direction: "upload",
+                        loaded,
+                        progress: Math.round((loaded * 100) / (progressEvent.total ?? 1)),
+                        token: serverID,
+                        total,
+                    });
+                },
+            });
+            return decodeHttpResponse(ServerCodec, res.data);
+        }
+        const res = await this.http.post(this.getHost() + "/server-icon/" + serverID + "/json", msgpack.encode({ file: XUtils.encodeBase64(icon) }), { headers: { "Content-Type": "application/msgpack" } });
+        return decodeHttpResponse(ServerCodec, res.data);
+    }
 }
 //# sourceMappingURL=Client.js.map