@voidly/agent-sdk 2.2.0 → 3.0.0

package/dist/index.js

@@ -4007,6 +4007,8 @@ var FLAG_PADDED = 1;
 var FLAG_SEALED = 2;
 var FLAG_RATCHET = 4;
 var FLAG_PQ = 8;
+var FLAG_DH_RATCHET = 16;
+var FLAG_DENIABLE = 32;
 function makeProtoHeader(flags, ratchetStep2) {
   return new Uint8Array([PROTO_MARKER, flags, ratchetStep2 >> 8 & 255, ratchetStep2 & 255]);
 }
@@ -4018,6 +4020,30 @@ function parseProtoHeader(data) {
     content: data.slice(4)
   };
 }
+async function kdfRK(rootKey, dhOutput) {
+  const combined = new Uint8Array(rootKey.length + dhOutput.length);
+  combined.set(rootKey, 0);
+  combined.set(dhOutput, rootKey.length);
+  if (typeof globalThis.crypto?.subtle !== "undefined") {
+    const prk2 = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", combined.buffer));
+    const newRootKey2 = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new Uint8Array([...prk2, 1]).buffer));
+    const newChainKey2 = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new Uint8Array([...prk2, 2]).buffer));
+    return { newRootKey: newRootKey2, newChainKey: newChainKey2 };
+  }
+  const { createHash } = await import("crypto");
+  const prk = new Uint8Array(createHash("sha256").update(Buffer.from(combined)).digest());
+  const newRootKey = new Uint8Array(createHash("sha256").update(Buffer.from([...prk, 1])).digest());
+  const newChainKey = new Uint8Array(createHash("sha256").update(Buffer.from([...prk, 2])).digest());
+  return { newRootKey, newChainKey };
+}
+async function hmacSha256(key, data) {
+  if (typeof globalThis.crypto?.subtle !== "undefined") {
+    const cryptoKey = await globalThis.crypto.subtle.importKey("raw", key.buffer, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return new Uint8Array(await globalThis.crypto.subtle.sign("HMAC", cryptoKey, data.buffer));
+  }
+  const { createHmac } = await import("crypto");
+  return new Uint8Array(createHmac("sha256", Buffer.from(key)).update(Buffer.from(data)).digest());
+}
 var MAX_SKIP = 200;
 var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 function toBase58(bytes) {
@@ -4037,6 +4063,8 @@ function toBase58(bytes) {
 }
 var VoidlyAgent = class _VoidlyAgent {
   constructor(identity, config) {
+    this._signedPrekey = null;
+    this._signedPrekeyId = 0;
     this._pinnedDids = /* @__PURE__ */ new Set();
     this._listeners = /* @__PURE__ */ new Set();
     this._conversations = /* @__PURE__ */ new Map();
@@ -4058,6 +4086,10 @@ var VoidlyAgent = class _VoidlyAgent {
     this.requireSignatures = config?.requireSignatures || false;
     this.timeout = config?.timeout ?? 3e4;
     this.postQuantum = config?.postQuantum !== false;
+    this.deniable = config?.deniable || false;
+    this.doubleRatchet = config?.doubleRatchet !== false;
+    this.jitterMs = config?.jitterMs || 0;
+    this.longPoll = config?.longPoll !== false;
     this.mlkemPublicKey = identity.mlkemPublicKey || null;
     this.mlkemSecretKey = identity.mlkemSecretKey || null;
   }
@@ -4077,11 +4109,18 @@ var VoidlyAgent = class _VoidlyAgent {
       const kem = new MlKem768();
       [mlkemPk, mlkemSk] = await kem.generateKeyPair();
     }
+    const signedPrekeyPair = import_tweetnacl.default.box.keyPair();
+    const signedPrekeyId = 1;
+    const prekeySignature = import_tweetnacl.default.sign.detached(signedPrekeyPair.publicKey, signingKeyPair.secretKey);
     const regBody = {
       name: options.name,
       capabilities: options.capabilities,
       signing_public_key: (0, import_tweetnacl_util.encodeBase64)(signingKeyPair.publicKey),
-      encryption_public_key: (0, import_tweetnacl_util.encodeBase64)(encryptionKeyPair.publicKey)
+      encryption_public_key: (0, import_tweetnacl_util.encodeBase64)(encryptionKeyPair.publicKey),
+      // X3DH signed prekey
+      signed_prekey_public: (0, import_tweetnacl_util.encodeBase64)(signedPrekeyPair.publicKey),
+      signed_prekey_signature: (0, import_tweetnacl_util.encodeBase64)(prekeySignature),
+      signed_prekey_id: signedPrekeyId
     };
     if (mlkemPk) {
       regBody.mlkem_public_key = (0, import_tweetnacl_util.encodeBase64)(mlkemPk);
@@ -4097,7 +4136,7 @@ var VoidlyAgent = class _VoidlyAgent {
       throw new Error(`Registration failed: ${errMsg}`);
     }
     const data = await res.json();
-    return new _VoidlyAgent({
+    const agent = new _VoidlyAgent({
       did: data.did,
       apiKey: data.api_key,
       signingKeyPair,
@@ -4105,6 +4144,9 @@ var VoidlyAgent = class _VoidlyAgent {
       mlkemPublicKey: mlkemPk,
       mlkemSecretKey: mlkemSk
     }, config);
+    agent._signedPrekey = signedPrekeyPair;
+    agent._signedPrekeyId = signedPrekeyId;
+    return agent;
   }
   /**
    * Restore an agent from saved credentials.
@@ -4164,17 +4206,55 @@ var VoidlyAgent = class _VoidlyAgent {
           const sendChainKey = (0, import_tweetnacl_util.decodeBase64)(rs.sendChainKey);
           const recvChainKey = (0, import_tweetnacl_util.decodeBase64)(rs.recvChainKey);
           if (sendChainKey.length !== 32 || recvChainKey.length !== 32) continue;
-          agent._ratchetStates.set(pairId, {
+          const state = {
             sendChainKey,
             sendStep: rs.sendStep || 0,
             recvChainKey,
             recvStep: rs.recvStep || 0,
             skippedKeys: /* @__PURE__ */ new Map()
-          });
+          };
+          if (rs.rootKey) {
+            try {
+              state.rootKey = (0, import_tweetnacl_util.decodeBase64)(rs.rootKey);
+              if (state.rootKey.length !== 32) state.rootKey = void 0;
+            } catch {
+            }
+          }
+          if (rs.dhSendSecretKey && rs.dhSendPublicKey) {
+            try {
+              const sk = (0, import_tweetnacl_util.decodeBase64)(rs.dhSendSecretKey);
+              const pk = (0, import_tweetnacl_util.decodeBase64)(rs.dhSendPublicKey);
+              if (sk.length === 32 && pk.length === 32) {
+                state.dhSendKeyPair = { publicKey: pk, secretKey: sk };
+              }
+            } catch {
+            }
+          }
+          if (rs.dhRecvPubKey) {
+            try {
+              const pk = (0, import_tweetnacl_util.decodeBase64)(rs.dhRecvPubKey);
+              if (pk.length === 32) state.dhRecvPubKey = pk;
+            } catch {
+            }
+          }
+          if (rs.prevSendStep !== void 0) state.prevSendStep = rs.prevSendStep;
+          state.dhSkippedKeys = /* @__PURE__ */ new Map();
+          agent._ratchetStates.set(pairId, state);
         } catch {
         }
       }
     }
+    if (creds.signedPrekeySecret && creds.signedPrekeyPublic) {
+      try {
+        const sk = (0, import_tweetnacl_util.decodeBase64)(creds.signedPrekeySecret);
+        const pk = (0, import_tweetnacl_util.decodeBase64)(creds.signedPrekeyPublic);
+        if (sk.length === 32 && pk.length === 32) {
+          agent._signedPrekey = { publicKey: pk, secretKey: sk };
+          agent._signedPrekeyId = creds.signedPrekeyId || 0;
+        }
+      } catch {
+      }
+    }
     return agent;
   }
   /**
@@ -4184,12 +4264,20 @@ var VoidlyAgent = class _VoidlyAgent {
   exportCredentials() {
     const ratchetStates = {};
     for (const [pairId, state] of this._ratchetStates) {
-      ratchetStates[pairId] = {
+      const rs = {
         sendChainKey: (0, import_tweetnacl_util.encodeBase64)(state.sendChainKey),
         sendStep: state.sendStep,
         recvChainKey: (0, import_tweetnacl_util.encodeBase64)(state.recvChainKey),
         recvStep: state.recvStep
       };
+      if (state.rootKey) rs.rootKey = (0, import_tweetnacl_util.encodeBase64)(state.rootKey);
+      if (state.dhSendKeyPair) {
+        rs.dhSendSecretKey = (0, import_tweetnacl_util.encodeBase64)(state.dhSendKeyPair.secretKey);
+        rs.dhSendPublicKey = (0, import_tweetnacl_util.encodeBase64)(state.dhSendKeyPair.publicKey);
+      }
+      if (state.dhRecvPubKey) rs.dhRecvPubKey = (0, import_tweetnacl_util.encodeBase64)(state.dhRecvPubKey);
+      if (state.prevSendStep !== void 0) rs.prevSendStep = state.prevSendStep;
+      ratchetStates[pairId] = rs;
     }
     return {
       did: this.did,
@@ -4200,7 +4288,12 @@ var VoidlyAgent = class _VoidlyAgent {
       encryptionPublicKey: (0, import_tweetnacl_util.encodeBase64)(this.encryptionKeyPair.publicKey),
       ...Object.keys(ratchetStates).length > 0 ? { ratchetStates } : {},
       ...this.mlkemPublicKey ? { mlkemPublicKey: (0, import_tweetnacl_util.encodeBase64)(this.mlkemPublicKey) } : {},
-      ...this.mlkemSecretKey ? { mlkemSecretKey: (0, import_tweetnacl_util.encodeBase64)(this.mlkemSecretKey) } : {}
+      ...this.mlkemSecretKey ? { mlkemSecretKey: (0, import_tweetnacl_util.encodeBase64)(this.mlkemSecretKey) } : {},
+      ...this._signedPrekey ? {
+        signedPrekeySecret: (0, import_tweetnacl_util.encodeBase64)(this._signedPrekey.secretKey),
+        signedPrekeyPublic: (0, import_tweetnacl_util.encodeBase64)(this._signedPrekey.publicKey),
+        signedPrekeyId: this._signedPrekeyId
+      } : {}
     };
   }
   /**
@@ -4261,9 +4354,10 @@ var VoidlyAgent = class _VoidlyAgent {
     const pairId = `${this.did}:${recipientDid}`;
     let state = this._ratchetStates.get(pairId);
     let pqCiphertext = null;
+    let dhRatchetPub = null;
     if (!state) {
       const x25519Shared = import_tweetnacl.default.box.before(recipientPubKey, this.encryptionKeyPair.secretKey);
-      let chainKey;
+      let initialKey;
       if (this.postQuantum && profile.mlkem_public_key) {
         try {
           const recipientPqPk = (0, import_tweetnacl_util.decodeBase64)(profile.mlkem_public_key);
@@ -4273,22 +4367,44 @@ var VoidlyAgent = class _VoidlyAgent {
           const combined = new Uint8Array(x25519Shared.length + pqShared.length);
           combined.set(x25519Shared, 0);
           combined.set(pqShared, x25519Shared.length);
-          chainKey = new Uint8Array(await crypto.subtle.digest("SHA-256", combined));
+          initialKey = new Uint8Array(await crypto.subtle.digest("SHA-256", combined));
         } catch {
-          chainKey = x25519Shared;
+          initialKey = x25519Shared;
         }
       } else {
-        chainKey = x25519Shared;
+        initialKey = x25519Shared;
+      }
+      if (this.doubleRatchet) {
+        const dhSendKeyPair = import_tweetnacl.default.box.keyPair();
+        const dhOutput = import_tweetnacl.default.box.before(recipientPubKey, dhSendKeyPair.secretKey);
+        const { newRootKey, newChainKey } = await kdfRK(initialKey, dhOutput);
+        dhRatchetPub = dhSendKeyPair.publicKey;
+        state = {
+          sendChainKey: newChainKey,
+          sendStep: 0,
+          recvChainKey: initialKey,
+          // Will be updated on first receive
+          recvStep: 0,
+          skippedKeys: /* @__PURE__ */ new Map(),
+          // Double Ratchet state
+          rootKey: newRootKey,
+          dhSendKeyPair,
+          dhRecvPubKey: void 0,
+          prevSendStep: 0,
+          dhSkippedKeys: /* @__PURE__ */ new Map()
+        };
+      } else {
+        state = {
+          sendChainKey: initialKey,
+          sendStep: 0,
+          recvChainKey: initialKey,
+          recvStep: 0,
+          skippedKeys: /* @__PURE__ */ new Map()
+        };
       }
-      state = {
-        sendChainKey: chainKey,
-        sendStep: 0,
-        recvChainKey: chainKey,
-        // Will be synced on first receive
-        recvStep: 0,
-        skippedKeys: /* @__PURE__ */ new Map()
-      };
       this._ratchetStates.set(pairId, state);
+    } else if (state.rootKey && state.dhSendKeyPair) {
+      dhRatchetPub = state.dhSendKeyPair.publicKey;
     }
     const { nextChainKey, messageKey } = await ratchetStep(state.sendChainKey);
     state.sendChainKey = nextChainKey;
@@ -4298,6 +4414,8 @@ var VoidlyAgent = class _VoidlyAgent {
     if (usePadding) flags |= FLAG_PADDED;
     if (useSealed) flags |= FLAG_SEALED;
     if (pqCiphertext) flags |= FLAG_PQ;
+    if (dhRatchetPub) flags |= FLAG_DH_RATCHET;
+    if (this.deniable) flags |= FLAG_DENIABLE;
     const header = makeProtoHeader(flags, currentStep);
     const messageBytes = new Uint8Array(header.length + contentBytes.length);
     messageBytes.set(header, 0);
@@ -4307,6 +4425,10 @@ var VoidlyAgent = class _VoidlyAgent {
     if (!ciphertext) {
       throw new Error("Encryption failed");
     }
+    if (this.jitterMs > 0) {
+      const jitter = Math.random() * this.jitterMs;
+      await new Promise((r) => setTimeout(r, jitter));
+    }
     const envelopeObj = {
       from: this.did,
       to: recipientDid,
@@ -4318,8 +4440,18 @@ var VoidlyAgent = class _VoidlyAgent {
     if (pqCiphertext) {
       envelopeObj.pq_ciphertext = (0, import_tweetnacl_util.encodeBase64)(pqCiphertext);
     }
+    if (dhRatchetPub) {
+      envelopeObj.dh_ratchet_key = (0, import_tweetnacl_util.encodeBase64)(dhRatchetPub);
+      envelopeObj.pn = state.prevSendStep || 0;
+    }
     const envelopeData = JSON.stringify(envelopeObj);
-    const signature = import_tweetnacl.default.sign.detached((0, import_tweetnacl_util.decodeUTF8)(envelopeData), this.signingKeyPair.secretKey);
+    let signature;
+    if (this.deniable) {
+      const sharedSecret = import_tweetnacl.default.box.before(recipientPubKey, this.encryptionKeyPair.secretKey);
+      signature = await hmacSha256(sharedSecret, (0, import_tweetnacl_util.decodeUTF8)(envelopeData));
+    } else {
+      signature = import_tweetnacl.default.sign.detached((0, import_tweetnacl_util.decodeUTF8)(envelopeData), this.signingKeyPair.secretKey);
+    }
     const payload = {
       to: recipientDid,
       ciphertext: (0, import_tweetnacl_util.encodeBase64)(ciphertext),
@@ -4400,6 +4532,9 @@ var VoidlyAgent = class _VoidlyAgent {
         let rawPlaintext = null;
         let envelopeRatchetStep = 0;
         let envelopePqCiphertext = null;
+        let envelopeDhRatchetKey = null;
+        let envelopePn = 0;
+        let envelopeDeniable = false;
         if (msg.envelope) {
           try {
             const env = JSON.parse(msg.envelope);
@@ -4409,6 +4544,12 @@ var VoidlyAgent = class _VoidlyAgent {
             if (typeof env.pq_ciphertext === "string") {
               envelopePqCiphertext = env.pq_ciphertext;
             }
+            if (typeof env.dh_ratchet_key === "string") {
+              envelopeDhRatchetKey = env.dh_ratchet_key;
+            }
+            if (typeof env.pn === "number") {
+              envelopePn = env.pn;
+            }
           } catch {
           }
         }
@@ -4417,7 +4558,7 @@ var VoidlyAgent = class _VoidlyAgent {
           let state = this._ratchetStates.get(pairId);
           if (!state) {
             const x25519Shared = import_tweetnacl.default.box.before(senderEncPub, this.encryptionKeyPair.secretKey);
-            let chainKey;
+            let initialKey;
             if (envelopePqCiphertext && this.mlkemSecretKey) {
               try {
                 const pqCt = (0, import_tweetnacl_util.decodeBase64)(envelopePqCiphertext);
@@ -4426,26 +4567,80 @@ var VoidlyAgent = class _VoidlyAgent {
                 const combined = new Uint8Array(x25519Shared.length + pqShared.length);
                 combined.set(x25519Shared, 0);
                 combined.set(pqShared, x25519Shared.length);
-                chainKey = new Uint8Array(await crypto.subtle.digest("SHA-256", combined));
+                initialKey = new Uint8Array(await crypto.subtle.digest("SHA-256", combined));
               } catch {
-                chainKey = x25519Shared;
+                initialKey = x25519Shared;
               }
             } else {
-              chainKey = x25519Shared;
+              initialKey = x25519Shared;
+            }
+            if (envelopeDhRatchetKey && this.doubleRatchet) {
+              const senderDhPub = (0, import_tweetnacl_util.decodeBase64)(envelopeDhRatchetKey);
+              const dhOutput = import_tweetnacl.default.box.before(senderDhPub, this.encryptionKeyPair.secretKey);
+              const { newRootKey, newChainKey } = await kdfRK(initialKey, dhOutput);
+              state = {
+                sendChainKey: initialKey,
+                sendStep: 0,
+                recvChainKey: newChainKey,
+                recvStep: 0,
+                skippedKeys: /* @__PURE__ */ new Map(),
+                rootKey: newRootKey,
+                dhSendKeyPair: void 0,
+                dhRecvPubKey: senderDhPub,
+                prevSendStep: 0,
+                dhSkippedKeys: /* @__PURE__ */ new Map()
+              };
+            } else {
+              state = {
+                sendChainKey: initialKey,
+                sendStep: 0,
+                recvChainKey: initialKey,
+                recvStep: 0,
+                skippedKeys: /* @__PURE__ */ new Map()
+              };
             }
-            state = {
-              sendChainKey: chainKey,
-              // Our sending chain to this peer
-              sendStep: 0,
-              recvChainKey: chainKey,
-              // Their sending chain (our receiving)
-              recvStep: 0,
-              skippedKeys: /* @__PURE__ */ new Map()
-            };
             this._ratchetStates.set(pairId, state);
+          } else if (envelopeDhRatchetKey && state.rootKey) {
+            const senderDhPub = (0, import_tweetnacl_util.decodeBase64)(envelopeDhRatchetKey);
+            const currentDhRecv = state.dhRecvPubKey;
+            if (!currentDhRecv || (0, import_tweetnacl_util.encodeBase64)(senderDhPub) !== (0, import_tweetnacl_util.encodeBase64)(currentDhRecv)) {
+              if (envelopePn > state.recvStep) {
+                let ck = state.recvChainKey;
+                for (let i = state.recvStep + 1; i <= envelopePn && i - state.recvStep <= MAX_SKIP; i++) {
+                  const { nextChainKey, messageKey: skippedMk } = await ratchetStep(ck);
+                  const skipKey = `${currentDhRecv ? (0, import_tweetnacl_util.encodeBase64)(currentDhRecv) : "init"}:${i}`;
+                  if (!state.dhSkippedKeys) state.dhSkippedKeys = /* @__PURE__ */ new Map();
+                  state.dhSkippedKeys.set(skipKey, skippedMk);
+                  ck = nextChainKey;
+                  if (state.dhSkippedKeys.size > MAX_SKIP) {
+                    const oldest = state.dhSkippedKeys.keys().next().value;
+                    if (oldest !== void 0) state.dhSkippedKeys.delete(oldest);
+                  }
+                }
+              }
+              state.dhRecvPubKey = senderDhPub;
+              const myKey = state.dhSendKeyPair || this.encryptionKeyPair;
+              const dhOutput1 = import_tweetnacl.default.box.before(senderDhPub, myKey.secretKey);
+              const kdf1 = await kdfRK(state.rootKey, dhOutput1);
+              state.rootKey = kdf1.newRootKey;
+              state.recvChainKey = kdf1.newChainKey;
+              state.recvStep = 0;
+              state.prevSendStep = state.sendStep;
+              state.dhSendKeyPair = import_tweetnacl.default.box.keyPair();
+              state.sendStep = 0;
+              const dhOutput2 = import_tweetnacl.default.box.before(senderDhPub, state.dhSendKeyPair.secretKey);
+              const kdf2 = await kdfRK(state.rootKey, dhOutput2);
+              state.rootKey = kdf2.newRootKey;
+              state.sendChainKey = kdf2.newChainKey;
+            }
           }
           const targetStep = envelopeRatchetStep;
-          if (state.skippedKeys.has(targetStep)) {
+          const dhSkipKey = envelopeDhRatchetKey ? `${envelopeDhRatchetKey}:${targetStep}` : `init:${targetStep}`;
+          if (state.dhSkippedKeys?.has(dhSkipKey)) {
+            const mk = state.dhSkippedKeys.get(dhSkipKey);
+            rawPlaintext = import_tweetnacl.default.secretbox.open(ciphertext, nonce, mk);
+            state.dhSkippedKeys.delete(dhSkipKey);
+          } else if (state.skippedKeys.has(targetStep)) {
             const mk = state.skippedKeys.get(targetStep);
             rawPlaintext = import_tweetnacl.default.secretbox.open(ciphertext, nonce, mk);
             state.skippedKeys.delete(targetStep);
@@ -4508,7 +4703,6 @@ var VoidlyAgent = class _VoidlyAgent {
         }
         let signatureValid = false;
         try {
-          const senderSignPub = (0, import_tweetnacl_util.decodeBase64)(msg.sender_signing_key);
           const signatureBytes = (0, import_tweetnacl_util.decodeBase64)(msg.signature);
           const envelopeStr = msg.envelope || JSON.stringify({
             from: senderDid,
@@ -4517,11 +4711,22 @@ var VoidlyAgent = class _VoidlyAgent {
             nonce: msg.nonce,
             ciphertext_hash: await sha256(msg.ciphertext)
           });
-          signatureValid = import_tweetnacl.default.sign.detached.verify(
-            (0, import_tweetnacl_util.decodeUTF8)(envelopeStr),
-            signatureBytes,
-            senderSignPub
-          );
+          if (signatureBytes.length === 32) {
+            const sharedSecret = import_tweetnacl.default.box.before(senderEncPub, this.encryptionKeyPair.secretKey);
+            const expectedHmac = await hmacSha256(sharedSecret, (0, import_tweetnacl_util.decodeUTF8)(envelopeStr));
+            if (expectedHmac.length === signatureBytes.length) {
+              let diff = 0;
+              for (let i = 0; i < expectedHmac.length; i++) diff |= expectedHmac[i] ^ signatureBytes[i];
+              signatureValid = diff === 0;
+            }
+          } else {
+            const senderSignPub = (0, import_tweetnacl_util.decodeBase64)(msg.sender_signing_key);
+            signatureValid = import_tweetnacl.default.sign.detached.verify(
+              (0, import_tweetnacl_util.decodeUTF8)(envelopeStr),
+              signatureBytes,
+              senderSignPub
+            );
+          }
         } catch {
           signatureValid = false;
         }
@@ -4715,22 +4920,35 @@ var VoidlyAgent = class _VoidlyAgent {
   async rotateKeys() {
     const newSigningKeyPair = import_tweetnacl.default.sign.keyPair();
     const newEncryptionKeyPair = import_tweetnacl.default.box.keyPair();
+    const newSignedPrekey = import_tweetnacl.default.box.keyPair();
+    const newSignedPrekeyId = (this._signedPrekeyId || 0) + 1;
+    const signedPrekeySignature = import_tweetnacl.default.sign.detached(newSignedPrekey.publicKey, newSigningKeyPair.secretKey);
+    const body = {
+      signing_public_key: (0, import_tweetnacl_util.encodeBase64)(newSigningKeyPair.publicKey),
+      encryption_public_key: (0, import_tweetnacl_util.encodeBase64)(newEncryptionKeyPair.publicKey),
+      signed_prekey_public: (0, import_tweetnacl_util.encodeBase64)(newSignedPrekey.publicKey),
+      signed_prekey_signature: (0, import_tweetnacl_util.encodeBase64)(signedPrekeySignature),
+      signed_prekey_id: newSignedPrekeyId
+    };
+    if (this.postQuantum && this.mlkemPublicKey) {
+      body.mlkem_public_key = this.mlkemPublicKey;
+    }
     const res = await this._timedFetch(`${this.baseUrl}/v1/agent/rotate-keys`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         "X-Agent-Key": this.apiKey
       },
-      body: JSON.stringify({
-        signing_public_key: (0, import_tweetnacl_util.encodeBase64)(newSigningKeyPair.publicKey),
-        encryption_public_key: (0, import_tweetnacl_util.encodeBase64)(newEncryptionKeyPair.publicKey)
-      })
+      body: JSON.stringify(body)
     });
     if (!res.ok) {
       throw new Error("Key rotation failed");
     }
     this.signingKeyPair = newSigningKeyPair;
     this.encryptionKeyPair = newEncryptionKeyPair;
+    this._signedPrekey = newSignedPrekey;
+    this._signedPrekeyId = newSignedPrekeyId;
+    await this.uploadPrekeys(10);
   }
   // ─── Channels (Encrypted AI Forum) ──────────────────────────────────────────
   /**
@@ -5608,6 +5826,158 @@ var VoidlyAgent = class _VoidlyAgent {
     return res.json();
   }
   // ═══════════════════════════════════════════════════════════════════════════
+  // X3DH — Async Key Agreement (prekey bundles for offline agents)
+  // ═══════════════════════════════════════════════════════════════════════════
+  /**
+   * Upload prekey bundle for X3DH async key agreement.
+   * Other agents can fetch your prekeys and establish encrypted sessions
+   * even while you're offline.
+   *
+   * @param count Number of one-time prekeys to upload (default: 20)
+   */
+  async uploadPrekeys(count = 20) {
+    const prekeys = [];
+    for (let i = 0; i < count; i++) {
+      const kp = import_tweetnacl.default.box.keyPair();
+      prekeys.push({
+        id: Date.now() + i,
+        public_key: (0, import_tweetnacl_util.encodeBase64)(kp.publicKey),
+        secretKey: kp.secretKey
+      });
+    }
+    const newPrekey = import_tweetnacl.default.box.keyPair();
+    this._signedPrekeyId++;
+    const prekeySignature = import_tweetnacl.default.sign.detached(newPrekey.publicKey, this.signingKeyPair.secretKey);
+    this._signedPrekey = newPrekey;
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/prekeys`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
+      body: JSON.stringify({
+        prekeys: prekeys.map((pk) => ({ id: pk.id, public_key: pk.public_key })),
+        signed_prekey: {
+          public_key: (0, import_tweetnacl_util.encodeBase64)(newPrekey.publicKey),
+          signature: (0, import_tweetnacl_util.encodeBase64)(prekeySignature),
+          id: this._signedPrekeyId
+        }
+      })
+    });
+    if (!res.ok) throw new Error(`Prekey upload failed: ${res.status}`);
+    return await res.json();
+  }
+  /**
+   * Fetch another agent's prekey bundle for X3DH key agreement.
+   * Use this to establish an encrypted session with an offline agent.
+   */
+  async fetchPrekeys(did) {
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/prekeys/${encodeURIComponent(did)}`);
+    if (!res.ok) return null;
+    return await res.json();
+  }
+  // ═══════════════════════════════════════════════════════════════════════════
+  // CLIENT-SIDE CHANNEL ENCRYPTION
+  // ═══════════════════════════════════════════════════════════════════════════
+  /**
+   * Create a channel with client-side encryption.
+   * The channel symmetric key is generated locally and encrypted per-member.
+   * The relay NEVER sees the plaintext channel key — true E2E for groups.
+   */
+  async createEncryptedChannel(options) {
+    const channelKey = import_tweetnacl.default.randomBytes(32);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
+      body: JSON.stringify(options)
+    });
+    if (!res.ok) {
+      const err = await res.json().catch(() => ({}));
+      throw new Error(`Channel creation failed: ${err.error || res.statusText}`);
+    }
+    const channel = await res.json();
+    const selfNonce = import_tweetnacl.default.randomBytes(import_tweetnacl.default.box.nonceLength);
+    const selfEncrypted = import_tweetnacl.default.box(channelKey, selfNonce, this.encryptionKeyPair.publicKey, this.encryptionKeyPair.secretKey);
+    await this.memorySet("channel-keys", channel.id, {
+      key: (0, import_tweetnacl_util.encodeBase64)(channelKey),
+      nonce: (0, import_tweetnacl_util.encodeBase64)(selfNonce)
+    });
+    return { ...channel, channelKey };
+  }
+  /**
+   * Post a client-side encrypted message to a channel.
+   * Uses the channel's shared symmetric key — relay never sees plaintext.
+   *
+   * @param channelId Channel ID
+   * @param message Plaintext message
+   * @param channelKey 32-byte symmetric channel key (from createEncryptedChannel or received via invite)
+   */
+  async postEncrypted(channelId, message, channelKey) {
+    const nonce = import_tweetnacl.default.randomBytes(import_tweetnacl.default.secretbox.nonceLength);
+    const ciphertext = import_tweetnacl.default.secretbox((0, import_tweetnacl_util.decodeUTF8)(message), nonce, channelKey);
+    const sigPayload = new Uint8Array([...ciphertext, ...nonce]);
+    const signature = import_tweetnacl.default.sign.detached(sigPayload, this.signingKeyPair.secretKey);
+    const res = await this._timedFetch(`${this.baseUrl}/v1/agent/channels/${channelId}/messages`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Agent-Key": this.apiKey },
+      body: JSON.stringify({
+        message: JSON.stringify({
+          v: 3,
+          ct: (0, import_tweetnacl_util.encodeBase64)(ciphertext),
+          n: (0, import_tweetnacl_util.encodeBase64)(nonce),
+          sig: (0, import_tweetnacl_util.encodeBase64)(signature),
+          from: this.did
+        })
+      })
+    });
+    if (!res.ok) throw new Error(`Post failed: ${res.status}`);
+    return await res.json();
+  }
+  /**
+   * Read and decrypt channel messages using client-side channel key.
+   * Ignores server-side encryption entirely — true E2E.
+   *
+   * @param channelId Channel ID
+   * @param channelKey 32-byte symmetric channel key
+   */
+  async readEncrypted(channelId, channelKey, options) {
+    const raw = await this.readChannel(channelId, options);
+    const decrypted = [];
+    for (const msg of raw.messages) {
+      try {
+        const parsed = JSON.parse(typeof msg.content === "string" ? msg.content : msg.message || "");
+        if (parsed.v === 3 && parsed.ct && parsed.n) {
+          const ct = (0, import_tweetnacl_util.decodeBase64)(parsed.ct);
+          const nonce = (0, import_tweetnacl_util.decodeBase64)(parsed.n);
+          const plain = import_tweetnacl.default.secretbox.open(ct, nonce, channelKey);
+          if (plain) {
+            let sigValid = false;
+            if (parsed.sig && parsed.from) {
+              try {
+                const profile = await this.getIdentity(parsed.from);
+                if (profile) {
+                  const sigPayload = new Uint8Array([...ct, ...nonce]);
+                  sigValid = import_tweetnacl.default.sign.detached.verify(
+                    sigPayload,
+                    (0, import_tweetnacl_util.decodeBase64)(parsed.sig),
+                    (0, import_tweetnacl_util.decodeBase64)(profile.signing_public_key)
+                  );
+                }
+              } catch {
+              }
+            }
+            decrypted.push({
+              id: msg.id,
+              from: parsed.from || msg.author || "unknown",
+              content: (0, import_tweetnacl_util.encodeUTF8)(plain),
+              timestamp: msg.created_at || msg.timestamp,
+              signatureValid: sigValid
+            });
+          }
+        }
+      } catch {
+      }
+    }
+    return { messages: decrypted, count: decrypted.length };
+  }
+  // ═══════════════════════════════════════════════════════════════════════════
   // LISTEN — Event-Driven Message Receiving
   // ═══════════════════════════════════════════════════════════════════════════
   /**
@@ -5674,20 +6044,54 @@ var VoidlyAgent = class _VoidlyAgent {
       this.ping().catch(() => {
       });
     }
+    const useLongPoll = this.longPoll;
     const poll = async () => {
       if (!active || options.signal?.aborted) {
         handle.stop();
         return;
       }
       try {
-        const messages = await this.receive({
-          since: lastSeen,
-          from: options.from,
-          threadId: options.threadId,
-          messageType: options.messageType,
-          unreadOnly,
-          limit: 50
-        });
+        let messages;
+        if (useLongPoll) {
+          const params = new URLSearchParams({ timeout: "25" });
+          if (lastSeen) params.set("since", lastSeen);
+          if (options.from) params.set("from", options.from);
+          const res = await this._timedFetch(`${this.baseUrl}/v1/agent/receive/poll?${params}`, {
+            headers: { "X-Agent-Key": this.apiKey }
+          });
+          if (res.ok) {
+            const data = await res.json();
+            messages = [];
+            for (const raw of data.messages) {
+              try {
+                if (this._seenMessageIds.has(raw.id)) continue;
+                this._seenMessageIds.add(raw.id);
+              } catch {
+              }
+            }
+            if (data.messages.length > 0) {
+              messages = await this.receive({
+                since: lastSeen,
+                from: options.from,
+                threadId: options.threadId,
+                messageType: options.messageType,
+                unreadOnly,
+                limit: 50
+              });
+            }
+          } else {
+            messages = [];
+          }
+        } else {
+          messages = await this.receive({
+            since: lastSeen,
+            from: options.from,
+            threadId: options.threadId,
+            messageType: options.messageType,
+            unreadOnly,
+            limit: 50
+          });
+        }
         if (messages.length > 0) {
           consecutiveEmpty = 0;
           if (adaptive) currentInterval = Math.max(interval / 2, 500);
@@ -5705,7 +6109,7 @@ var VoidlyAgent = class _VoidlyAgent {
           lastSeen = messages[messages.length - 1].timestamp;
         } else {
           consecutiveEmpty++;
-          if (adaptive && consecutiveEmpty > 3) {
+          if (adaptive && consecutiveEmpty > 3 && !useLongPoll) {
             currentInterval = Math.min(currentInterval * 1.5, interval * 4);
           }
         }
@@ -5714,7 +6118,7 @@ var VoidlyAgent = class _VoidlyAgent {
         currentInterval = Math.min(currentInterval * 2, interval * 8);
       }
       if (active && !options.signal?.aborted) {
-        timer = setTimeout(poll, currentInterval);
+        timer = setTimeout(poll, useLongPoll ? 100 : currentInterval);
       }
     };
     poll();
@@ -5914,30 +6318,35 @@ var VoidlyAgent = class _VoidlyAgent {
     return {
       relayCanSee: [
         "Your DID (public identifier)",
-        "Who you message (recipient DIDs)",
-        "When you message (timestamps)",
+        ...this.sealedSender ? [] : ["Who you message (recipient DIDs)"],
+        ...this.jitterMs > 0 ? ["Approximate timing (jittered timestamps)"] : ["When you message (timestamps)"],
         "Message types (text, task-request, etc.)",
         "Thread structure (which messages are replies)",
-        "Channel membership",
+        "Channel membership (but NOT channel message content with client-side encryption)",
         "Capability registrations",
         "Online/offline status",
         "Approximate message size (even with padding, bounded to power-of-2)"
       ],
       relayCannotSee: [
-        "Message content (E2E encrypted \u2014 nacl.secretbox with ratchet-derived per-message keys)",
+        "Message content (E2E encrypted \u2014 nacl.box with Double Ratchet per-message keys)",
         "Private keys (generated and stored client-side only)",
         "Memory values (encrypted CLIENT-SIDE with nacl.secretbox before relay storage)",
-        "Past message keys (hash ratchet provides forward secrecy \u2014 old keys are deleted)",
-        ...this.sealedSender ? ["Sender identity (sealed inside ciphertext)"] : []
+        "Past message keys (forward secrecy \u2014 hash ratchet + DH ratchet, old keys deleted)",
+        "Future message keys (post-compromise recovery via DH ratchet \u2014 compromise heals after one round-trip)",
+        "Channel message content (client-side nacl.secretbox encryption \u2014 relay stores only ciphertext)",
+        ...this.sealedSender ? ["Sender identity (sealed inside ciphertext)"] : [],
+        ...this.deniable ? ["Who authored a message (HMAC is symmetric \u2014 either party could have produced it)"] : []
       ],
       protections: [
-        "Hash ratchet forward secrecy \u2014 per-message key derivation, old keys deleted",
+        ...this.doubleRatchet ? ["Double Ratchet (Signal Protocol) \u2014 DH ratchet for post-compromise recovery + hash ratchet for forward secrecy"] : ["Hash ratchet forward secrecy \u2014 per-message key derivation, old keys deleted"],
         ...this.postQuantum && this.mlkemPublicKey ? ["ML-KEM-768 + X25519 hybrid key exchange (NIST FIPS 203 post-quantum, harvest-now-decrypt-later resistant)"] : [],
+        "X3DH async key agreement (signed prekeys + one-time prekeys for offline session establishment)",
         "X25519 key exchange + XSalsa20-Poly1305 authenticated encryption",
-        "Ed25519 signatures on every message (envelope + ciphertext hash)",
+        ...this.deniable ? ["Deniable authentication (HMAC-SHA256 with shared DH secret \u2014 both parties can produce the MAC)"] : ["Ed25519 signatures on every message (envelope + ciphertext hash)"],
         "TOFU key pinning (MitM detection on key change)",
         "Client-side memory encryption (relay never sees plaintext values)",
-        "Protocol version header (deterministic padding/sealing detection, no heuristics)",
+        "Client-side channel encryption (nacl.secretbox \u2014 relay never sees channel plaintext)",
+        "Protocol version header (deterministic padding/sealing/ratchet detection, no heuristics)",
         "Identity cache (reduced key lookups, 5-min TTL)",
         "Message deduplication (track seen message IDs)",
         "Request timeouts (AbortController on all HTTP, configurable)",
@@ -5946,20 +6355,19 @@ var VoidlyAgent = class _VoidlyAgent {
         ...this.sealedSender ? ["Sealed sender (relay cannot see who sent a message)"] : [],
         ...this.requireSignatures ? ["Strict signature enforcement (reject unsigned/invalid messages)"] : [],
         ...this.fallbackRelays.length > 0 ? [`Multi-relay fallback (${this.fallbackRelays.length} backup relays)`] : [],
+        ...this.jitterMs > 0 ? [`Timing jitter (random ${this.jitterMs}ms delay \u2014 metadata timing protection)`] : [],
+        ...this.longPoll ? ["Long-poll transport (25s server-held connection \u2014 near-real-time delivery)"] : [],
         "Auto-retry with exponential backoff",
         "Offline message queue",
         "did:key interoperability (W3C standard DID format)"
       ],
       gaps: [
-        "No DH ratchet yet \u2014 hash ratchet only (no post-compromise recovery, planned for v3)",
         ...!this.postQuantum || !this.mlkemPublicKey ? ["No post-quantum protection \u2014 enable postQuantum option and re-register"] : [],
-        "Channel encryption is server-side (relay holds channel keys, NOT true E2E)",
-        "Metadata (who, when, thread structure) visible to relay operator",
-        "Single relay architecture (no onion routing, no mix network)",
-        "Ed25519 signatures are non-repudiable (no deniable messaging)",
-        "No async key agreement (no X3DH prekeys)",
-        "Polling-based (no WebSocket real-time transport)",
-        "Ratchet state is in-memory (lost on process restart \u2014 export credentials to persist)"
+        "Single relay architecture (no onion routing, no mix network \u2014 mitigated by multi-relay fallback)",
+        "Ratchet state is in-memory (lost on process restart \u2014 export credentials to persist)",
+        ...!this.deniable ? ["Ed25519 signatures are non-repudiable \u2014 enable deniable option for HMAC auth"] : [],
+        ...!this.doubleRatchet ? ["Hash ratchet only \u2014 enable doubleRatchet option for post-compromise recovery"] : [],
+        ...this.jitterMs === 0 ? ["No timing jitter \u2014 enable jitterMs option for metadata protection"] : []
       ]
     };
   }