ab-ecosystem-cpass 1.0.0 → 1.0.6

package/dist/internal/device.d.ts

@@ -0,0 +1,24 @@
+import type { DevicePlatform } from '../types';
+/**
+ * A label a person would recognise their own browser by, e.g. `Chrome on Windows`.
+ *
+ * `undefined` rather than a placeholder when there is nothing to go on -- the
+ * field is optional, and an omitted label reads back as `''`, which a UI can
+ * render as "this device" far better than a string like `Unknown on Unknown`
+ * can.
+ *
+ * Only the family and the system, never the version. A version would change the
+ * label every few weeks on a device that has not changed, and the label exists
+ * to be recognised rather than to be precise.
+ */
+export declare const describeDevice: () => string | undefined;
+/**
+ * `'web'` when there is a DOM, `undefined` otherwise.
+ *
+ * Keyed on `document` and not on `navigator`, which is the distinction that
+ * matters: React Native defines a `navigator` but no `document`, so a
+ * navigator-based check would quietly register every mobile device as a browser
+ * and the send path would fill in the `webpush` block instead of `android`/`apns`
+ * -- a notification that is accepted by FCM and never shown.
+ */
+export declare const detectPlatform: () => DevicePlatform | undefined;

package/dist/internal/device.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectPlatform = exports.describeDevice = void 0;
+/**
+ * What the current runtime is, for the two fields a caller should not have to
+ * fill in by hand.
+ *
+ * Both functions here are best-effort and both are cosmetic-or-defaultable:
+ * nothing in the send path depends on getting the label right, and a platform
+ * that cannot be detected is asked for rather than guessed.
+ *
+ * ## Why this is not the `user-agents` package
+ *
+ * The legacy panel sent its `device` field as `new UserAgent().data` from the
+ * `user-agents` npm package. That package **generates a random plausible user
+ * agent**; it does not read the browser's own. So every device row ever written
+ * by the old panel describes a machine that does not exist, which is why the
+ * replacement stores a caller-supplied label instead of a parsed object, and why
+ * the default below reads `navigator.userAgent` directly.
+ */
+/** The browser's own user agent, or `undefined` outside a browser. */
+const userAgent = () => {
+    const nav = globalThis.navigator;
+    return typeof nav?.userAgent === 'string' && nav.userAgent ? nav.userAgent : undefined;
+};
+/**
+ * Browser families, **most specific first**.
+ *
+ * The order is the whole correctness of this table: Edge and Opera both carry
+ * `Chrome/` in their user agent, and every Chromium browser carries `Safari/`.
+ * Matching in declaration order is what keeps Edge from reading as Chrome and
+ * Chrome from reading as Safari.
+ */
+const BROWSERS = [
+    [/\bEdg(?:e|A|iOS)?\//, 'Edge'],
+    [/\bOPR\/|\bOpera\//, 'Opera'],
+    [/\bSamsungBrowser\//, 'Samsung Internet'],
+    [/\bFirefox\/|\bFxiOS\//, 'Firefox'],
+    // Chrome on iOS is `CriOS`: it is Safari's engine wearing Chrome's name, and
+    // the name is what a user would recognise in a device list.
+    [/\bChrome\/|\bCriOS\//, 'Chrome'],
+    [/\bSafari\//, 'Safari'],
+];
+/** Operating systems, also most specific first -- an Android UA also says `Linux`. */
+const SYSTEMS = [
+    [/\bWindows\b/, 'Windows'],
+    [/\bAndroid\b/, 'Android'],
+    [/\b(?:iPhone|iPad|iPod)\b/, 'iOS'],
+    [/\bCrOS\b/, 'ChromeOS'],
+    [/\bMac OS X\b|\bMacintosh\b/, 'macOS'],
+    [/\bLinux\b/, 'Linux'],
+];
+const match = (table, ua) => table.find(([pattern]) => pattern.test(ua))?.[1];
+/**
+ * A label a person would recognise their own browser by, e.g. `Chrome on Windows`.
+ *
+ * `undefined` rather than a placeholder when there is nothing to go on -- the
+ * field is optional, and an omitted label reads back as `''`, which a UI can
+ * render as "this device" far better than a string like `Unknown on Unknown`
+ * can.
+ *
+ * Only the family and the system, never the version. A version would change the
+ * label every few weeks on a device that has not changed, and the label exists
+ * to be recognised rather than to be precise.
+ */
+const describeDevice = () => {
+    const ua = userAgent();
+    if (!ua)
+        return undefined;
+    const browser = match(BROWSERS, ua);
+    const system = match(SYSTEMS, ua);
+    if (browser && system)
+        return `${browser} on ${system}`;
+    return browser ?? system;
+};
+exports.describeDevice = describeDevice;
+/**
+ * `'web'` when there is a DOM, `undefined` otherwise.
+ *
+ * Keyed on `document` and not on `navigator`, which is the distinction that
+ * matters: React Native defines a `navigator` but no `document`, so a
+ * navigator-based check would quietly register every mobile device as a browser
+ * and the send path would fill in the `webpush` block instead of `android`/`apns`
+ * -- a notification that is accepted by FCM and never shown.
+ */
+const detectPlatform = () => typeof globalThis.document === 'object' &&
+    globalThis.document !== null
+    ? 'web'
+    : undefined;
+exports.detectPlatform = detectPlatform;
+//# sourceMappingURL=device.js.map

package/dist/internal/device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device.js","sourceRoot":"","sources":["../../src/internal/device.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,sEAAsE;AACtE,MAAM,SAAS,GAAG,GAAuB,EAAE;IACzC,MAAM,GAAG,GAAI,UAAsD,CAAC,SAAS,CAAC;IAC9E,OAAO,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,QAAQ,GAAgC;IAC5C,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAC/B,CAAC,mBAAmB,EAAE,OAAO,CAAC;IAC9B,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;IAC1C,CAAC,uBAAuB,EAAE,SAAS,CAAC;IACpC,6EAA6E;IAC7E,4DAA4D;IAC5D,CAAC,sBAAsB,EAAE,QAAQ,CAAC;IAClC,CAAC,YAAY,EAAE,QAAQ,CAAC;CACzB,CAAC;AAEF,sFAAsF;AACtF,MAAM,OAAO,GAAgC;IAC3C,CAAC,aAAa,EAAE,SAAS,CAAC;IAC1B,CAAC,aAAa,EAAE,SAAS,CAAC;IAC1B,CAAC,0BAA0B,EAAE,KAAK,CAAC;IACnC,CAAC,UAAU,EAAE,UAAU,CAAC;IACxB,CAAC,4BAA4B,EAAE,OAAO,CAAC;IACvC,CAAC,WAAW,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,KAAkC,EAAE,EAAU,EAAsB,EAAE,CACnF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAEnD;;;;;;;;;;;GAWG;AACI,MAAM,cAAc,GAAG,GAAuB,EAAE;IACrD,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAE1B,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAElC,IAAI,OAAO,IAAI,MAAM;QAAE,OAAO,GAAG,OAAO,OAAO,MAAM,EAAE,CAAC;IACxD,OAAO,OAAO,IAAI,MAAM,CAAC;AAC3B,CAAC,CAAC;AATW,QAAA,cAAc,kBASzB;AAEF;;;;;;;;GAQG;AACI,MAAM,cAAc,GAAG,GAA+B,EAAE,CAC7D,OAAQ,UAAqC,CAAC,QAAQ,KAAK,QAAQ;IAClE,UAAqC,CAAC,QAAQ,KAAK,IAAI;IACtD,CAAC,CAAC,KAAK;IACP,CAAC,CAAC,SAAS,CAAC;AAJH,QAAA,cAAc,kBAIX"}

package/dist/internal/md5.d.ts

@@ -0,0 +1,4 @@
+/** MD5 of raw bytes, as lower-case hex. */
+export declare const md5Bytes: (input: Uint8Array) => string;
+/** MD5 of a string's UTF-8 bytes, as lower-case hex -- what `md5(value)` on npm returns. */
+export declare const md5: (value: string) => string;

package/dist/internal/md5.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.md5 = exports.md5Bytes = void 0;
+const bytes_1 = require("./bytes");
+/**
+ * MD5, because the receiver file's key derivation uses it and no platform offers
+ * it.
+ *
+ * Web Crypto deliberately does not implement MD5 -- it is broken for every
+ * purpose it was designed for -- and Node's `crypto.createHash('md5')` does not
+ * exist in a browser. So it is written out here.
+ *
+ * **This is not a security choice, it is a compatibility requirement.** The
+ * campaign manager decrypts these files with `md5(secret)` as the AES key, and
+ * that algorithm is fixed on the reading side. Changing it here would produce
+ * files nothing can read. See `receiver-file.ts`, which documents the whole
+ * scheme and its weaknesses in one place.
+ *
+ * Not exported from the package: nothing outside the receiver file should reach
+ * for an MD5.
+ */
+/** Per-round left-rotation amounts. */
+const SHIFTS = [
+    7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22, 7, 12, 17, 22,
+    5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20, 5, 9, 14, 20,
+    4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23, 4, 11, 16, 23,
+    6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21, 6, 10, 15, 21,
+];
+/**
+ * `floor(abs(sin(i + 1)) * 2^32)`, the constants from RFC 1321.
+ *
+ * Computed rather than transcribed: sixty-four hand-typed 32-bit hex literals is
+ * a place to make a silent mistake, and the derivation is exact in IEEE-754 for
+ * every one of these values. The test vectors in RFC 1321 are what confirm it.
+ */
+const K = (() => {
+    const table = new Uint32Array(64);
+    for (let i = 0; i < 64; i += 1)
+        table[i] = Math.floor(Math.abs(Math.sin(i + 1)) * 2 ** 32);
+    return table;
+})();
+const rotl = (value, bits) => (value << bits) | (value >>> (32 - bits));
+/** MD5 of raw bytes, as lower-case hex. */
+const md5Bytes = (input) => {
+    const bitLength = input.length * 8;
+    // One 0x80 byte, then zeroes, then the bit length as a little-endian u64 --
+    // padded so the total is a whole number of 64-byte blocks.
+    const blocks = Math.floor((input.length + 8) / 64) + 1;
+    const padded = new Uint8Array(blocks * 64);
+    padded.set(input);
+    padded[input.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, bitLength >>> 0, true);
+    view.setUint32(padded.length - 4, Math.floor(bitLength / 0x1_0000_0000), true);
+    let h0 = 0x67452301;
+    let h1 = 0xefcdab89;
+    let h2 = 0x98badcfe;
+    let h3 = 0x10325476;
+    const words = new Uint32Array(16);
+    for (let block = 0; block < blocks; block += 1) {
+        const offset = block * 64;
+        for (let i = 0; i < 16; i += 1)
+            words[i] = view.getUint32(offset + i * 4, true);
+        let a = h0;
+        let b = h1;
+        let c = h2;
+        let d = h3;
+        for (let i = 0; i < 64; i += 1) {
+            let f;
+            let g;
+            if (i < 16) {
+                f = (b & c) | (~b & d);
+                g = i;
+            }
+            else if (i < 32) {
+                f = (d & b) | (~d & c);
+                g = (5 * i + 1) % 16;
+            }
+            else if (i < 48) {
+                f = b ^ c ^ d;
+                g = (3 * i + 5) % 16;
+            }
+            else {
+                f = c ^ (b | ~d);
+                g = (7 * i) % 16;
+            }
+            const rotated = rotl((a + f + K[i] + words[g]) | 0, SHIFTS[i]);
+            a = d;
+            d = c;
+            c = b;
+            b = (b + rotated) | 0;
+        }
+        h0 = (h0 + a) | 0;
+        h1 = (h1 + b) | 0;
+        h2 = (h2 + c) | 0;
+        h3 = (h3 + d) | 0;
+    }
+    const digest = new Uint8Array(16);
+    new DataView(digest.buffer).setUint32(0, h0 >>> 0, true);
+    new DataView(digest.buffer).setUint32(4, h1 >>> 0, true);
+    new DataView(digest.buffer).setUint32(8, h2 >>> 0, true);
+    new DataView(digest.buffer).setUint32(12, h3 >>> 0, true);
+    return (0, bytes_1.toHex)(digest);
+};
+exports.md5Bytes = md5Bytes;
+/** MD5 of a string's UTF-8 bytes, as lower-case hex -- what `md5(value)` on npm returns. */
+const md5 = (value) => (0, exports.md5Bytes)((0, bytes_1.utf8)(value));
+exports.md5 = md5;
+//# sourceMappingURL=md5.js.map

package/dist/internal/md5.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"md5.js","sourceRoot":"","sources":["../../src/internal/md5.ts"],"names":[],"mappings":";;;AAAA,mCAAsC;AAEtC;;;;;;;;;;;;;;;;GAgBG;AAEH,uCAAuC;AACvC,MAAM,MAAM,GAAG;IACb,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IAC1D,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE;IACtD,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;IAC1D,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;CAC3D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE;IACd,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC;AACf,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAEhG,2CAA2C;AACpC,MAAM,QAAQ,GAAG,CAAC,KAAiB,EAAU,EAAE;IACpD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAEnC,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAE5B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;IAE/E,IAAI,EAAE,GAAG,UAAU,CAAC;IACpB,IAAI,EAAE,GAAG,UAAU,CAAC;IACpB,IAAI,EAAE,GAAG,UAAU,CAAC;IACpB,IAAI,EAAE,GAAG,UAAU,CAAC;IAEpB,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAElC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,GAAG,EAAE,CAAC;QAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;QAEhF,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;QAEX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAS,CAAC;YACd,IAAI,CAAS,CAAC;YAEd,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACX,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvB,CAAC,GAAG,CAAC,CAAC;YACR,CAAC;iBAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAClB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBACvB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACvB,CAAC;iBAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAClB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACnB,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;YAClE,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QAClB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;IAE1D,OAAO,IAAA,aAAK,EAAC,MAAM,CAAC,CAAC;AACvB,CAAC,CAAC;AApEW,QAAA,QAAQ,YAoEnB;AAEF,4FAA4F;AACrF,MAAM,GAAG,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,IAAA,gBAAQ,EAAC,IAAA,YAAI,EAAC,KAAK,CAAC,CAAC,CAAC;AAAvD,QAAA,GAAG,OAAoD"}

package/dist/internal/receiver-file.d.ts

@@ -0,0 +1,106 @@
+/** One recipient and the variables their message is rendered with. */
+export interface CampaignReceiver {
+    /** The recipient's number, digits only, no `+` and no separators. */
+    waba: string;
+    /**
+     * Per-recipient template variables, as the manager expects them: a flat list of
+     * `{id, value}` rather than an object, because the ids come from CSV headers
+     * and are not safe as object keys.
+     */
+    custom_fields: {
+        id: string;
+        value: string;
+    }[];
+}
+/** An encrypted receiver file, ready to upload. */
+export interface ReceiverFile {
+    /** Base64 AES ciphertext. This is the entire file body. */
+    body: string;
+    /** The secret the file was encrypted under. Stored on the campaign as `hash`. */
+    secret: string;
+    filename: string;
+    contentType: 'text/plain';
+    /** Byte length of `body`, which the upload ticket is signed against. */
+    size: number;
+    /** How many recipients the file contains. */
+    receivers: number;
+}
+/**
+ * A fresh secret for one receiver file.
+ *
+ * Sixteen random bytes as hex -- thirty-two characters, which is the shape
+ * already in the field and what the `hash` field on a stored campaign holds.
+ *
+ * The legacy frontend generated this as 16 random bytes, hex-encoded, then
+ * applied `.toString('base64url').replace(/_/gi,'U').replace(/-/gi,'D')`. That
+ * chain is a **no-op**: `String.prototype.toString` ignores its argument and
+ * returns the string unchanged, and the hex alphabet contains no `_` or `-` for
+ * the replacements to find. So the value that reaches the manager has always been
+ * plain hex, and this produces the identical thing without the dead code.
+ *
+ * One secret per file, never reused. That is what keeps the fixed IV above from
+ * being the flaw it would otherwise be.
+ */
+export declare const generateReceiverSecret: () => string;
+/**
+ * Encrypts the receiver list exactly as the campaign manager expects to read it.
+ *
+ * ```
+ * key        = md5(secret)                     -- 32 lower-case hex characters
+ * key bytes  = the ASCII bytes of that hex     -- 32 bytes, so AES-256
+ * iv         = ASCII bytes of '678025308de70905'
+ * ciphertext = AES-256-CBC, PKCS#7 padded
+ * file body  = base64(ciphertext)
+ * ```
+ *
+ * Two parts of that are counter-intuitive and both are deliberate, because they
+ * mirror what `CryptoJS.AES.encrypt(text, keyWordArray, {iv})` does:
+ *
+ * - **The key is the hex *text*, not the digest bytes.** `md5()` returns a
+ *   32-character string and it is parsed as UTF-8, which lands on 32 bytes and
+ *   therefore AES-256. Using the 16 raw digest bytes instead would be AES-128 and
+ *   would not decrypt.
+ * - **There is no `Salted__` header.** CryptoJS only writes one when it derives a
+ *   key from a passphrase. Given a key directly, as here, its default formatter
+ *   emits bare base64 of the ciphertext.
+ *
+ * Web Crypto applies PKCS#7 padding to AES-CBC itself, which is the same padding
+ * CryptoJS defaults to -- so the outputs are byte-identical.
+ */
+export declare const encryptReceivers: (plaintext: string, secret: string) => Promise<string>;
+/**
+ * The two plaintext encodings a receiver file can hold.
+ *
+ * They are not interchangeable and the reading side picks by campaign type, so
+ * the wrong one produces a file that decrypts cleanly and then parses to
+ * nothing:
+ *
+ * - **`json`** -- `[{waba, custom_fields: [{id, value}]}, …]`. What a bulk
+ *   campaign's single file holds.
+ * - **`table`** -- a `||`-delimited table with a header row. What each bucket of
+ *   a group campaign holds:
+ *
+ *   ```
+ *   waba||first_name||amount
+ *   919000000001||Priya||1299
+ *   919000000002||Ravi||499
+ *   ```
+ *
+ * The table form is narrower than the JSON one: every row has to carry the same
+ * columns in the same order, and a value cannot contain a newline -- so newlines
+ * are stripped from values rather than escaped, which is what the panel did.
+ * Columns are taken from the first receiver, because a header can only be
+ * written once.
+ */
+export type ReceiverEncoding = 'json' | 'table';
+/** The `||` table a group campaign's bucket file holds. */
+export declare const encodeReceiverTable: (receivers: readonly CampaignReceiver[]) => string;
+/**
+ * Turns a receiver list into the encrypted file that gets uploaded.
+ *
+ * The filename is cosmetic: the media service stores the object under a uuid and
+ * keeps only the extension and the display name. The `im_` prefix and `.txt`
+ * extension match what is already in the bucket, so an operator browsing storage
+ * sees one consistent kind of object.
+ */
+export declare const buildReceiverFile: (receivers: CampaignReceiver[], encoding?: ReceiverEncoding) => Promise<ReceiverFile>;

package/dist/internal/receiver-file.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildReceiverFile = exports.encodeReceiverTable = exports.encryptReceivers = exports.generateReceiverSecret = void 0;
+const bytes_1 = require("./bytes");
+const md5_1 = require("./md5");
+/**
+ * The fixed initialisation vector the receiver file format uses.
+ *
+ * A constant IV is a real weakness -- it means two files encrypted under the same
+ * secret have identical leading blocks, so an observer can tell that two
+ * campaigns share a prefix of recipients. It is here because **the reading side
+ * is fixed**: the campaign manager decrypts with exactly this IV, and a file
+ * encrypted any other way is a file nothing can read.
+ *
+ * What makes it tolerable rather than merely unavoidable is that the secret is
+ * fresh per file (see {@link generateReceiverSecret}), so the IV is never reused
+ * under the same key -- which is the specific attack a static IV usually enables.
+ *
+ * If the format is ever revised, the fix is a random IV prepended to the
+ * ciphertext, and it has to land on the manager before it lands here.
+ */
+const FIXED_IV = '678025308de70905';
+/**
+ * A fresh secret for one receiver file.
+ *
+ * Sixteen random bytes as hex -- thirty-two characters, which is the shape
+ * already in the field and what the `hash` field on a stored campaign holds.
+ *
+ * The legacy frontend generated this as 16 random bytes, hex-encoded, then
+ * applied `.toString('base64url').replace(/_/gi,'U').replace(/-/gi,'D')`. That
+ * chain is a **no-op**: `String.prototype.toString` ignores its argument and
+ * returns the string unchanged, and the hex alphabet contains no `_` or `-` for
+ * the replacements to find. So the value that reaches the manager has always been
+ * plain hex, and this produces the identical thing without the dead code.
+ *
+ * One secret per file, never reused. That is what keeps the fixed IV above from
+ * being the flaw it would otherwise be.
+ */
+const generateReceiverSecret = () => (0, bytes_1.toHex)((0, bytes_1.randomBytes)(16));
+exports.generateReceiverSecret = generateReceiverSecret;
+/**
+ * Encrypts the receiver list exactly as the campaign manager expects to read it.
+ *
+ * ```
+ * key        = md5(secret)                     -- 32 lower-case hex characters
+ * key bytes  = the ASCII bytes of that hex     -- 32 bytes, so AES-256
+ * iv         = ASCII bytes of '678025308de70905'
+ * ciphertext = AES-256-CBC, PKCS#7 padded
+ * file body  = base64(ciphertext)
+ * ```
+ *
+ * Two parts of that are counter-intuitive and both are deliberate, because they
+ * mirror what `CryptoJS.AES.encrypt(text, keyWordArray, {iv})` does:
+ *
+ * - **The key is the hex *text*, not the digest bytes.** `md5()` returns a
+ *   32-character string and it is parsed as UTF-8, which lands on 32 bytes and
+ *   therefore AES-256. Using the 16 raw digest bytes instead would be AES-128 and
+ *   would not decrypt.
+ * - **There is no `Salted__` header.** CryptoJS only writes one when it derives a
+ *   key from a passphrase. Given a key directly, as here, its default formatter
+ *   emits bare base64 of the ciphertext.
+ *
+ * Web Crypto applies PKCS#7 padding to AES-CBC itself, which is the same padding
+ * CryptoJS defaults to -- so the outputs are byte-identical.
+ */
+const encryptReceivers = async (plaintext, secret) => {
+    const crypto = (0, bytes_1.subtle)();
+    const key = await crypto.importKey('raw', (0, bytes_1.toArrayBuffer)((0, bytes_1.utf8)((0, md5_1.md5)(secret))), { name: 'AES-CBC' }, false, [
+        'encrypt',
+    ]);
+    const ciphertext = await crypto.encrypt({ name: 'AES-CBC', iv: (0, bytes_1.toArrayBuffer)((0, bytes_1.utf8)(FIXED_IV)) }, key, (0, bytes_1.toArrayBuffer)((0, bytes_1.utf8)(plaintext)));
+    return (0, bytes_1.toBase64)(new Uint8Array(ciphertext));
+};
+exports.encryptReceivers = encryptReceivers;
+const COLUMN_SEPARATOR = '||';
+/** The `||` table a group campaign's bucket file holds. */
+const encodeReceiverTable = (receivers) => {
+    const first = receivers[0];
+    if (!first)
+        return '';
+    const columns = first.custom_fields.map((field) => field.id);
+    const header = ['waba', ...columns].join(COLUMN_SEPARATOR);
+    const rows = receivers.map((receiver) => {
+        // Addressed by column rather than by position: a row whose variables arrived
+        // in a different order would otherwise silently shift every value one place.
+        const byId = new Map(receiver.custom_fields.map((field) => [field.id, field.value]));
+        return [receiver.waba, ...columns.map((column) => flatten(byId.get(column) ?? ''))].join(COLUMN_SEPARATOR);
+    });
+    // Trailing newline: the panel's writer ended every row with one, so the last
+    // line is terminated rather than merely ending.
+    return `${[header, ...rows].join('\n')}\n`;
+};
+exports.encodeReceiverTable = encodeReceiverTable;
+/**
+ * A value as a table cell: no newlines, no separator.
+ *
+ * Newlines are stripped because the format has no escape for them -- one would
+ * end the row early and shift every later value into the wrong column. The
+ * separator is stripped for the same reason. Both are replaced by a space rather
+ * than removed, so two words do not run together.
+ */
+const flatten = (value) => value.replace(/[\r\n]+/g, ' ').split(COLUMN_SEPARATOR).join(' ');
+/**
+ * Turns a receiver list into the encrypted file that gets uploaded.
+ *
+ * The filename is cosmetic: the media service stores the object under a uuid and
+ * keeps only the extension and the display name. The `im_` prefix and `.txt`
+ * extension match what is already in the bucket, so an operator browsing storage
+ * sees one consistent kind of object.
+ */
+const buildReceiverFile = async (receivers, encoding = 'json') => {
+    const secret = (0, exports.generateReceiverSecret)();
+    const plaintext = encoding === 'table' ? (0, exports.encodeReceiverTable)(receivers) : JSON.stringify(receivers);
+    const body = await (0, exports.encryptReceivers)(plaintext, secret);
+    return {
+        body,
+        secret,
+        filename: `im_${Date.now().toString(36)}${(0, bytes_1.toHex)((0, bytes_1.randomBytes)(4))}.txt`,
+        contentType: 'text/plain',
+        // The ciphertext is base64, so every character is one byte. Measuring the
+        // string rather than re-encoding it is exact here, and the upload signature
+        // covers this number.
+        size: body.length,
+        receivers: receivers.length,
+    };
+};
+exports.buildReceiverFile = buildReceiverFile;
+//# sourceMappingURL=receiver-file.js.map

package/dist/internal/receiver-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receiver-file.js","sourceRoot":"","sources":["../../src/internal/receiver-file.ts"],"names":[],"mappings":";;;AAAA,mCAAoF;AACpF,+BAA4B;AAE5B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AA4BpC;;;;;;;;;;;;;;;GAeG;AACI,MAAM,sBAAsB,GAAG,GAAW,EAAE,CAAC,IAAA,aAAK,EAAC,IAAA,mBAAW,EAAC,EAAE,CAAC,CAAC,CAAC;AAA9D,QAAA,sBAAsB,0BAAwC;AAE3E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACI,MAAM,gBAAgB,GAAG,KAAK,EAAE,SAAiB,EAAE,MAAc,EAAmB,EAAE;IAC3F,MAAM,MAAM,GAAG,IAAA,cAAM,GAAE,CAAC;IAExB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAA,qBAAa,EAAC,IAAA,YAAI,EAAC,IAAA,SAAG,EAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;QACtG,SAAS;KACV,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,OAAO,CACrC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAA,qBAAa,EAAC,IAAA,YAAI,EAAC,QAAQ,CAAC,CAAC,EAAE,EACtD,GAAG,EACH,IAAA,qBAAa,EAAC,IAAA,YAAI,EAAC,SAAS,CAAC,CAAC,CAC/B,CAAC;IAEF,OAAO,IAAA,gBAAQ,EAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;AAC9C,CAAC,CAAC;AAbW,QAAA,gBAAgB,oBAa3B;AA4BF,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,2DAA2D;AACpD,MAAM,mBAAmB,GAAG,CAAC,SAAsC,EAAU,EAAE;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE3D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtC,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAErF,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,gDAAgD;IAChD,OAAO,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7C,CAAC,CAAC;AAlBW,QAAA,mBAAmB,uBAkB9B;AAEF;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE5G;;;;;;;GAOG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,SAA6B,EAC7B,WAA6B,MAAM,EACZ,EAAE;IACzB,MAAM,MAAM,GAAG,IAAA,8BAAsB,GAAE,CAAC;IACxC,MAAM,SAAS,GAAG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAA,2BAAmB,EAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,MAAM,IAAA,wBAAgB,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAEvD,OAAO;QACL,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,IAAA,aAAK,EAAC,IAAA,mBAAW,EAAC,CAAC,CAAC,CAAC,MAAM;QACrE,WAAW,EAAE,YAAY;QACzB,0EAA0E;QAC1E,4EAA4E;QAC5E,sBAAsB;QACtB,IAAI,EAAE,IAAI,CAAC,MAAM;QACjB,SAAS,EAAE,SAAS,CAAC,MAAM;KAC5B,CAAC;AACJ,CAAC,CAAC;AAnBW,QAAA,iBAAiB,qBAmB5B"}

package/dist/realtime/client.d.ts

@@ -0,0 +1,85 @@
+import { type Socket } from 'socket.io-client';
+import type { InboxPushName, InboxPushes, InboxRequestName, InboxRequests } from './events';
+import type { MediaUploader } from '../types/inbox';
+export interface InboxClientOptions {
+    /**
+     * Where the inbox socket listens. Its own origin, not the REST gateway's: the
+     * gateway proxies HTTP only and forwards no upgrade.
+     */
+    url: string;
+    /**
+     * Ecosystem bearer token, or a function returning one. A function is called on
+     * every connect, so a reconnect after an expiry picks up a fresh token instead
+     * of retrying with the one that just failed.
+     */
+    token: string | (() => string | Promise<string>);
+    /** Your ecosystem client id. Sent on the handshake, as on every REST call. */
+    clientId: string;
+    /** Socket.IO path, if the deployment moved it. */
+    path?: string;
+    /** How long a request waits for its acknowledgement. Default 20s. */
+    timeout?: number;
+    /** Connect on construction. Default `true`. */
+    autoConnect?: boolean;
+    /** Extra socket.io options, merged last. */
+    socketOptions?: Record<string, unknown>;
+    /**
+     * How to upload a file, for `messages.sendMedia({ file })`.
+     *
+     * A socket cannot presign -- the ticket comes from the REST API -- so this is
+     * the seam between the two. Satisfied by
+     * `crm.inboxMedia.upload.bind(crm.inboxMedia)`.
+     *
+     * Optional, and a function rather than a client, so an app that only ever sends
+     * an already-uploaded `link` pulls in none of the REST surface.
+     */
+    uploadMedia?: MediaUploader;
+}
+/**
+ * The live-chat inbox over a socket.
+ *
+ * Requests are promises: each emit carries an acknowledgement callback, so two
+ * concurrent reads of different threads cannot be confused for one another. The
+ * server also emits replies under the request's own event name for older clients
+ * -- {@link InboxClient.on} sees those too, which is why a handler for
+ * `chat.action` receives both your own actions and other agents'.
+ *
+ * Credentials travel in `auth`, not in a header: a browser cannot set headers on
+ * a WebSocket upgrade, so a header-based handshake only works for as long as the
+ * connection stays on long-polling.
+ */
+export declare class InboxClient {
+    private readonly options;
+    private readonly socket;
+    private readonly timeout;
+    /**
+     * The uploader this client was built with, if any.
+     *
+     * Read by `messages.sendMedia` when it is handed a file rather than a link.
+     */
+    get uploadMedia(): MediaUploader | undefined;
+    constructor(options: InboxClientOptions);
+    /** Resolved per connect, so a reconnect never reuses an expired token. */
+    private credentials;
+    /** The underlying socket, for lifecycle events and anything not wrapped here. */
+    get raw(): Socket;
+    get connected(): boolean;
+    connect(): this;
+    disconnect(): this;
+    /** Resolves once connected, or rejects with the handshake's reason. */
+    ready(): Promise<void>;
+    /**
+     * Sends one request and waits for its answer.
+     *
+     * A refusal rejects with a {@link CrmApiError} carrying the same code and status
+     * the REST API would have returned, so one error path covers both transports.
+     */
+    request<E extends InboxRequestName>(event: E, payload: InboxRequests[E]['payload']): Promise<InboxRequests[E]['result']>;
+    /**
+     * Listens for a pushed event. Returns the unsubscribe function, so a component
+     * can tear its own listener down without knowing what else is attached.
+     */
+    on<E extends InboxPushName>(event: E, handler: (payload: InboxPushes[E]) => void): () => void;
+    /** Fires once, then unsubscribes. */
+    once<E extends InboxPushName>(event: E, handler: (payload: InboxPushes[E]) => void): void;
+}