chapterjs 0.1.1 → 0.1.4

package/dist/voice/session.js

@@ -0,0 +1,405 @@
+// One session with a voice server: its WebSocket (voice gateway v8), its UDP
+// socket, the transport key and the DAVE state. A session lives as long as
+// its token: moving to another channel or losing it makes a new one, while
+// the voice connection users hold stays the same object.
+// https://docs.discord.com/developers/topics/voice-connections
+import { createSocket } from 'node:dgram';
+import { VoiceCloseCode, VoiceOpcode } from '../discord/codes.js';
+import { onSocketEnd } from '../util/websocket.js';
+import { DaveSession } from './dave.js';
+import { pickMode, rtpHeader, TRANSPORT_MODES, TransportEncryptor, } from './transport.js';
+export const VOICE_GATEWAY_VERSION = 8;
+/** The close codes after which Discord says not to reconnect. */
+const ENDED = [
+    VoiceCloseCode.Disconnected,
+    VoiceCloseCode.DisconnectedRateLimited,
+    VoiceCloseCode.DisconnectedCallTerminated,
+];
+/** The session is gone: a new one is needed, from the main gateway. */
+const LOST = [
+    VoiceCloseCode.SessionNoLongerValid,
+    VoiceCloseCode.SessionTimeout,
+    VoiceCloseCode.ServerNotFound,
+];
+/** What these codes mean for the developer. */
+const REFUSED = {
+    [VoiceCloseCode.UnknownOpcode]: 'it received an opcode it does not know',
+    [VoiceCloseCode.FailedToDecodePayload]: 'it could not read what it received',
+    [VoiceCloseCode.NotAuthenticated]: 'it was sent something before Identify',
+    [VoiceCloseCode.AuthenticationFailed]: 'the voice token was refused',
+    [VoiceCloseCode.AlreadyAuthenticated]: 'it was identified twice',
+    [VoiceCloseCode.UnknownProtocol]: 'it does not know the protocol asked',
+    [VoiceCloseCode.UnknownEncryptionMode]: 'it does not know the encryption mode asked',
+    [VoiceCloseCode.E2eeDaveProtocolRequired]: 'the channel requires end-to-end encryption (DAVE)',
+    [VoiceCloseCode.BadRequest]: 'it received a malformed request',
+};
+/** Five frames of silence, sent before stopping. */
+const SILENCE = Buffer.from([0xf8, 0xff, 0xfe]);
+export class VoiceSession {
+    server;
+    #options;
+    dave;
+    #ws = null;
+    #udp = null;
+    #remote = null;
+    #ssrc = 0;
+    #encryptor = null;
+    #sequence = Math.floor(Math.random() * 0xffff);
+    #timestamp = Math.floor(Math.random() * 0xffffffff);
+    #seqAck = -1;
+    #heartbeat = null;
+    #acked = true;
+    #resuming = false;
+    #closed = false;
+    #speaking = false;
+    #ready = null;
+    #retries = 0;
+    /** Packets handed to the socket and not sent yet. */
+    #sending = 0;
+    #afterSends = null;
+    constructor(server, options) {
+        this.server = server;
+        this.#options = options;
+        this.dave = new DaveSession(options.dave, {
+            userId: server.userId,
+            channelId: server.channelId,
+            warn: options.warn,
+            transport: {
+                json: (op, data) => this.#send(op, data),
+                binary: (op, payload) => this.#sendBinary(op, payload),
+            },
+        });
+    }
+    /** Resolves once the session can send audio. */
+    connect() {
+        const timeout = this.#options.timeout ?? 15_000;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => reject(new Error(`The voice server did not answer within ${timeout / 1000} s.`)), timeout);
+            this.#ready = {
+                resolve: () => {
+                    clearTimeout(timer);
+                    resolve();
+                },
+                reject: error => {
+                    clearTimeout(timer);
+                    reject(error);
+                },
+            };
+            this.#open();
+        });
+    }
+    /** Sends one Opus packet that plays `samples` samples. */
+    sendOpus(packet, samples) {
+        const encryptor = this.#encryptor;
+        if (!encryptor || !this.#udp || !this.#remote || this.#closed)
+            return;
+        if (!this.dave.canSend) {
+            // The call is end-to-end encrypted and the bot has no key yet: what
+            // it would send could not be heard. Time goes on all the same.
+            this.#timestamp = (this.#timestamp + samples) >>> 0;
+            return;
+        }
+        if (!this.#speaking)
+            this.setSpeaking(true);
+        const frame = this.dave.encrypt(packet);
+        const header = rtpHeader(this.#sequence, this.#timestamp, this.#ssrc);
+        this.#sequence = (this.#sequence + 1) & 0xffff;
+        this.#timestamp = (this.#timestamp + samples) >>> 0;
+        this.#sending++;
+        this.#udp.send(encryptor.seal(header, frame), this.#remote.port, this.#remote.ip, () => {
+            this.#sending--;
+            if (this.#sending === 0)
+                this.#afterSends?.();
+        });
+    }
+    /** The five frames of silence Discord asks for before a pause. */
+    sendSilence() {
+        for (let i = 0; i < 5; i++)
+            this.sendOpus(SILENCE, 960);
+    }
+    /** Speaking (5): needed before audio, and shown in Discord. */
+    setSpeaking(speaking) {
+        if (speaking === this.#speaking)
+            return;
+        this.#speaking = speaking;
+        this.#send(VoiceOpcode.Speaking, {
+            speaking: speaking ? 1 : 0,
+            delay: 0,
+            ssrc: this.#ssrc,
+        });
+    }
+    /** Closes the session for good. */
+    close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        this.#stopHeartbeat();
+        this.#ws?.close(1000);
+        this.#ws = null;
+        // What was handed to the socket (the silence that ends a song) still
+        // leaves before it closes.
+        const udp = this.#udp;
+        this.#udp = null;
+        if (udp && this.#sending > 0)
+            this.#afterSends = () => udp.close();
+        else
+            udp?.close();
+        this.dave.close();
+        this.#ready?.reject(new Error('The voice connection was closed.'));
+        this.#ready = null;
+    }
+    #open() {
+        const scheme = this.#options.secure === false ? 'ws' : 'wss';
+        const ws = new WebSocket(`${scheme}://${this.server.endpoint}/?v=${VOICE_GATEWAY_VERSION}`);
+        ws.binaryType = 'arraybuffer';
+        this.#ws = ws;
+        ws.addEventListener('message', event => {
+            if (ws !== this.#ws)
+                return;
+            try {
+                if (typeof event.data === 'string')
+                    this.#onJson(event.data);
+                else
+                    this.#onBinary(new Uint8Array(event.data));
+            }
+            catch (error) {
+                this.#options.warn(`a message of the voice server could not be read: ${error.message}`);
+            }
+        });
+        onSocketEnd(ws, code => {
+            if (ws === this.#ws)
+                this.#onClose(code);
+        });
+    }
+    #onJson(text) {
+        const { op, d, seq } = JSON.parse(text);
+        if (typeof seq === 'number')
+            this.#seqAck = seq;
+        const data = d ?? {};
+        switch (op) {
+            case VoiceOpcode.Hello:
+                this.#startHeartbeat(data.heartbeat_interval);
+                if (this.#resuming) {
+                    this.#send(VoiceOpcode.Resume, {
+                        server_id: this.server.guildId,
+                        session_id: this.server.sessionId,
+                        token: this.server.token,
+                        seq_ack: this.#seqAck,
+                    });
+                }
+                else {
+                    this.#send(VoiceOpcode.Identify, {
+                        server_id: this.server.guildId,
+                        user_id: this.server.userId,
+                        session_id: this.server.sessionId,
+                        token: this.server.token,
+                        max_dave_protocol_version: this.dave.maxVersion,
+                    });
+                }
+                break;
+            case VoiceOpcode.Ready:
+                void this.#selectProtocol(data);
+                break;
+            case VoiceOpcode.SessionDescription: {
+                const { mode, secret_key: key, dave_protocol_version: version, } = data;
+                const chosen = pickMode([mode]);
+                if (!chosen) {
+                    this.#fail(new Error(`The voice server chose an encryption mode chapterjs does not know: ${mode}.`));
+                    return;
+                }
+                this.#encryptor = new TransportEncryptor(chosen, Uint8Array.from(key));
+                this.dave.start(version ?? 0);
+                this.#retries = 0;
+                this.#ready?.resolve();
+                this.#ready = null;
+                break;
+            }
+            case VoiceOpcode.HeartbeatAck:
+                this.#acked = true;
+                break;
+            case VoiceOpcode.Resumed:
+                this.#resuming = false;
+                this.#retries = 0;
+                break;
+            case VoiceOpcode.ClientsConnect:
+                this.dave.clientsConnect(data.user_ids ?? []);
+                break;
+            case VoiceOpcode.ClientDisconnect:
+                this.dave.clientDisconnect(data.user_id);
+                break;
+            case VoiceOpcode.DavePrepareTransition:
+                this.dave.prepareTransition(data.transition_id, data.protocol_version);
+                break;
+            case VoiceOpcode.DaveExecuteTransition:
+                this.dave.executeTransition(data.transition_id);
+                break;
+            case VoiceOpcode.DavePrepareEpoch:
+                this.dave.prepareEpoch(data.epoch, data.protocol_version);
+                break;
+            default:
+                // Speaking of others, video, and what the bot does not use.
+                break;
+        }
+    }
+    /** Binary messages: a sequence number, an opcode, then the payload. */
+    #onBinary(bytes) {
+        if (bytes.length < 3)
+            return;
+        this.#seqAck = (bytes[0] << 8) | bytes[1];
+        const op = bytes[2];
+        const payload = bytes.subarray(3);
+        const transition = () => (payload[0] << 8) | payload[1];
+        switch (op) {
+            case VoiceOpcode.DaveMlsExternalSender:
+                this.dave.externalSender(payload);
+                break;
+            case VoiceOpcode.DaveMlsProposals:
+                this.dave.proposals(payload);
+                break;
+            case VoiceOpcode.DaveMlsAnnounceCommitTransition:
+                this.dave.announceCommit(transition(), payload.subarray(2));
+                break;
+            case VoiceOpcode.DaveMlsWelcome:
+                this.dave.welcome(transition(), payload.subarray(2));
+                break;
+            default:
+                break;
+        }
+    }
+    async #selectProtocol(ready) {
+        const mode = pickMode(ready.modes);
+        if (!mode) {
+            this.#fail(new Error(`The voice server offers none of the encryption modes chapterjs speaks (${TRANSPORT_MODES.join(', ')}): it offered ${ready.modes.join(', ')}.`));
+            return;
+        }
+        this.#ssrc = ready.ssrc;
+        this.dave.setSsrc(ready.ssrc);
+        this.#remote = { ip: ready.ip, port: ready.port };
+        try {
+            const self = await this.#discover(ready);
+            this.#send(VoiceOpcode.SelectProtocol, {
+                protocol: 'udp',
+                data: { address: self.ip, port: self.port, mode },
+            });
+        }
+        catch (error) {
+            this.#fail(error);
+        }
+    }
+    /**
+     * IP Discovery: asks the voice server which address and port it sees the
+     * bot from, through the socket audio will go through.
+     * https://docs.discord.com/developers/topics/voice-connections#ip-discovery
+     */
+    #discover(ready) {
+        this.#udp?.close();
+        const udp = createSocket('udp4');
+        this.#udp = udp;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                udp.off('message', onMessage);
+                reject(new Error(`The voice server did not answer over UDP (${ready.ip}:${ready.port}): a firewall may block it.`));
+            }, 5000);
+            const onMessage = (message) => {
+                if (message.length < 74 || message.readUInt16BE(0) !== 2)
+                    return;
+                clearTimeout(timer);
+                udp.off('message', onMessage);
+                const end = message.indexOf(0, 8);
+                resolve({
+                    ip: message.toString('utf8', 8, end > 8 && end < 72 ? end : 72),
+                    port: message.readUInt16BE(72),
+                });
+            };
+            udp.on('message', onMessage);
+            udp.on('error', error => {
+                clearTimeout(timer);
+                reject(error);
+            });
+            const request = Buffer.alloc(74);
+            request.writeUInt16BE(1, 0);
+            request.writeUInt16BE(70, 2);
+            request.writeUInt32BE(ready.ssrc >>> 0, 4);
+            udp.send(request, ready.port, ready.ip);
+        });
+    }
+    #onClose(code) {
+        this.#stopHeartbeat();
+        this.#ws = null;
+        if (this.#closed)
+            return;
+        if (ENDED.includes(code))
+            return this.#end({ type: 'ended', code });
+        if (LOST.includes(code))
+            return this.#end({ type: 'lost', code });
+        const reason = REFUSED[code];
+        if (reason)
+            return this.#end({ type: 'refused', code, reason });
+        // Anything else (a network error, a crash of the voice server, a
+        // missing heartbeat ACK): resume, waiting longer each time.
+        if (this.#ready || !this.#encryptor) {
+            // Not even ready yet: there is nothing to resume.
+            return this.#end({ type: 'lost', code });
+        }
+        this.#resuming = true;
+        const delay = Math.min(1000 * 2 ** this.#retries, 30_000);
+        this.#retries++;
+        setTimeout(() => {
+            if (!this.#closed)
+                this.#open();
+        }, delay).unref();
+    }
+    #end(end) {
+        const ready = this.#ready;
+        this.close();
+        if (ready) {
+            ready.reject(new Error(end.type === 'refused'
+                ? `The voice server refused the bot (${end.code}): ${end.reason}.`
+                : `The voice server closed the connection (${end.code}).`));
+        }
+        this.#options.onEnd(end);
+    }
+    #fail(error) {
+        const ready = this.#ready;
+        this.#ready = null;
+        this.close();
+        ready?.reject(error);
+        if (!ready)
+            this.#options.onEnd({ type: 'lost', code: 0 });
+    }
+    #startHeartbeat(interval) {
+        this.#stopHeartbeat();
+        this.#acked = true;
+        this.#heartbeat = setInterval(() => {
+            if (!this.#acked) {
+                // No answer to the last one: the connection is dead.
+                this.#ws?.close(4000);
+                return;
+            }
+            this.#acked = false;
+            this.#send(VoiceOpcode.Heartbeat, {
+                t: Date.now(),
+                seq_ack: this.#seqAck,
+            });
+        }, interval);
+        this.#heartbeat.unref();
+    }
+    #stopHeartbeat() {
+        if (this.#heartbeat)
+            clearInterval(this.#heartbeat);
+        this.#heartbeat = null;
+    }
+    #send(op, d) {
+        if (this.#ws?.readyState === WebSocket.OPEN) {
+            this.#ws.send(JSON.stringify({ op, d }));
+        }
+    }
+    #sendBinary(op, payload) {
+        if (this.#ws?.readyState !== WebSocket.OPEN)
+            return;
+        const message = new Uint8Array(payload.length + 1);
+        message[0] = op;
+        message.set(payload, 1);
+        this.#ws.send(message);
+    }
+}

package/dist/voice/source.d.ts

@@ -0,0 +1,22 @@
+import { type AssetFile } from '../assets/asset.js';
+import type { Attachment } from '../structures/message.js';
+/**
+ * What `play()` takes: a file of `public/` (`asset('music/intro.ogg')`), a
+ * file sent on Discord (the `attachment` option of a command, or one of
+ * `message.attachments`), or a link starting with `https://`.
+ */
+export type AudioSource = AssetFile | Attachment | string;
+/** Opus packets being read, and how to stop reading them. */
+export interface OpusStream {
+    readonly packets: AsyncIterable<Buffer>;
+    /** What is played, as the developer named it. */
+    readonly name: string;
+    close(): void;
+}
+/** The container of a file, from its first bytes. */
+export declare function sniff(head: Buffer): 'ogg' | 'webm' | null;
+/**
+ * Opens what is to be played. Fails before anything is sent when the file
+ * is missing, or when ffmpeg is needed and is not installed.
+ */
+export declare function openAudio(source: AudioSource): Promise<OpusStream>;

package/dist/voice/source.js

@@ -0,0 +1,195 @@
+// What `play()` takes, turned into Opus packets: a file of `public/`, a
+// link or a file sent on Discord that is already Opus is read as is;
+// anything else is converted by ffmpeg, when it is installed.
+import { spawn } from 'node:child_process';
+import { createReadStream } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { assetPath, isAssetFile, missingAsset, } from '../assets/asset.js';
+import { oggOpusPackets, webmOpusPackets } from './opus.js';
+/** How much of a file tells what it holds. */
+const HEAD = 4096;
+/** The container of a file, from its first bytes. */
+export function sniff(head) {
+    if (head.toString('latin1', 0, 4) === 'OggS' &&
+        head.includes('OpusHead', 0, 'latin1')) {
+        return 'ogg';
+    }
+    if (head.readUInt32BE(0) === 0x1a45dfa3 && head.includes('A_OPUS')) {
+        return 'webm';
+    }
+    return null;
+}
+/**
+ * Opens what is to be played. Fails before anything is sent when the file
+ * is missing, or when ffmpeg is needed and is not installed.
+ */
+export async function openAudio(source) {
+    if (isAssetFile(source)) {
+        const path = assetPath(source);
+        const name = `public/${source.path}`;
+        let head;
+        try {
+            const handle = await open(path, 'r');
+            try {
+                const buffer = Buffer.alloc(4096);
+                const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+                head = buffer.subarray(0, bytesRead);
+            }
+            finally {
+                await handle.close();
+            }
+        }
+        catch (error) {
+            throw missingAsset(source, error);
+        }
+        const container = head.length >= 4 ? sniff(head) : null;
+        if (container) {
+            const stream = createReadStream(path);
+            // Reading reports what goes wrong; a stream never read must not.
+            stream.on('error', () => { });
+            const demux = container === 'ogg' ? oggOpusPackets : webmOpusPackets;
+            return {
+                name,
+                packets: demux(stream),
+                close: () => stream.destroy(),
+            };
+        }
+        return ffmpeg(path, name);
+    }
+    if (isAttachment(source))
+        return openLink(source.url, source.filename);
+    if (typeof source === 'string' && /^https?:\/\//i.test(source)) {
+        return openLink(source, source);
+    }
+    throw new TypeError(`play() takes a file of public/, like play(asset('music/intro.ogg')), a file sent on Discord, or a link starting with https://. Got ${JSON.stringify(source) ?? String(source)}.`);
+}
+/** A file sent on Discord, as a command option or a message gives it. */
+function isAttachment(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.url === 'string' &&
+        typeof value.filename === 'string');
+}
+/**
+ * A link: downloaded as it plays. Its first bytes say whether it is Opus,
+ * read as is, or something ffmpeg converts.
+ */
+async function openLink(url, name) {
+    let response;
+    try {
+        response = await fetch(url);
+    }
+    catch (error) {
+        throw new Error(`${name} could not be downloaded: ${error.message}.`);
+    }
+    if (!response.ok || !response.body) {
+        throw new Error(`${name} could not be downloaded: the server answered ${response.status}.`);
+    }
+    // A page (YouTube, a site): what plays is not at this address.
+    if (response.headers.get('content-type')?.startsWith('text/html')) {
+        void response.body.cancel().catch(() => { });
+        throw new Error(`${name} is a web page, not a sound: give the link of an audio file or of a stream, or send the file.`);
+    }
+    const reader = response.body.getReader();
+    const start = [];
+    let length = 0;
+    let ended = false;
+    while (length < HEAD) {
+        const next = await reader.read();
+        if (next.done) {
+            ended = true;
+            break;
+        }
+        start.push(next.value);
+        length += next.value.length;
+    }
+    const head = Buffer.concat(start);
+    const container = head.length >= 4 ? sniff(head) : null;
+    if (!container) {
+        // ffmpeg downloads it itself.
+        void reader.cancel().catch(() => { });
+        return ffmpeg(url, name);
+    }
+    let closed = false;
+    const body = async function* () {
+        yield head;
+        if (ended)
+            return;
+        while (!closed) {
+            const next = await reader.read();
+            if (next.done)
+                return;
+            yield next.value;
+        }
+    };
+    const demux = container === 'ogg' ? oggOpusPackets : webmOpusPackets;
+    return {
+        name,
+        packets: demux(body()),
+        close: () => {
+            closed = true;
+            void reader.cancel().catch(() => { });
+        },
+    };
+}
+/**
+ * Converts anything ffmpeg reads into Ogg Opus, 48 kHz stereo in frames
+ * of 20 ms: what Discord expects.
+ */
+async function ffmpeg(input, name) {
+    const child = spawn('ffmpeg', [
+        '-hide_banner',
+        '-loglevel',
+        'error',
+        '-i',
+        input,
+        '-vn',
+        '-c:a',
+        'libopus',
+        '-ar',
+        '48000',
+        '-ac',
+        '2',
+        '-b:a',
+        '128k',
+        '-frame_duration',
+        '20',
+        '-f',
+        'ogg',
+        'pipe:1',
+    ], { stdio: ['ignore', 'pipe', 'pipe'] });
+    await new Promise((resolve, reject) => {
+        child.once('spawn', resolve);
+        child.once('error', error => {
+            reject(error.code === 'ENOENT'
+                ? new Error(`${name} is not an Opus file (.ogg or .webm), and ffmpeg is not installed to convert it. Install ffmpeg (https://ffmpeg.org/download.html), or convert the file to .ogg Opus.`)
+                : error);
+        });
+    });
+    let errors = '';
+    child.stderr.setEncoding('utf8');
+    child.stderr.on('data', (text) => {
+        errors = (errors + text).slice(-2000);
+    });
+    const exited = new Promise(resolve => child.once('close', code => resolve(code)));
+    const packets = (async function* () {
+        let count = 0;
+        for await (const packet of oggOpusPackets(child.stdout)) {
+            count++;
+            yield packet;
+        }
+        const code = await exited;
+        if (code !== 0 && code !== null && count === 0) {
+            const reason = errors.trim().split('\n').at(-1) ?? `exit code ${code}`;
+            throw new Error(`ffmpeg could not read ${name}: ${reason}`);
+        }
+    })();
+    return {
+        name,
+        packets,
+        close: () => {
+            if (child.exitCode === null)
+                child.kill();
+        },
+    };
+}

package/dist/voice/transport.d.ts

@@ -0,0 +1,43 @@
+/** The transport encryption modes, best first. */
+export declare const TRANSPORT_MODES: readonly ['aead_aes256_gcm_rtpsize', 'aead_xchacha20_poly1305_rtpsize'];
+export type TransportMode = (typeof TRANSPORT_MODES)[number];
+/**
+ * The mode to use among the ones the voice server offers: AES256-GCM when
+ * it is there (Discord asks to prefer it), XChaCha20-Poly1305 otherwise
+ * (always offered); `null` when neither is.
+ * https://docs.discord.com/developers/topics/voice-connections#transport-encryption-modes
+ */
+export declare function pickMode(offered: readonly string[]): TransportMode | null;
+/** Audio sampled at 48 kHz: what an RTP timestamp counts. */
+export declare const SAMPLE_RATE = 48000;
+/**
+ * The RTP header of a voice packet: version 2, payload type 0x78, then
+ * sequence, timestamp and SSRC, big endian.
+ * https://docs.discord.com/developers/topics/voice-connections#transport-encryption-modes-voice-packet-structure
+ */
+export declare function rtpHeader(sequence: number, timestamp: number, ssrc: number): Buffer;
+/**
+ * HChaCha20: derives the key XChaCha20 uses for a 24-byte nonce, from the
+ * key and the first 16 bytes of that nonce.
+ * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha#section-2.2
+ */
+export declare function hchacha20(key: Uint8Array, nonce16: Uint8Array): Buffer;
+/**
+ * XChaCha20-Poly1305: ChaCha20-Poly1305 (which Node has) with the key
+ * HChaCha20 derives and the last 8 bytes of the 24-byte nonce.
+ * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-xchacha#section-2.3
+ */
+export declare function xchacha20poly1305Seal(key: Uint8Array, nonce24: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Buffer;
+/**
+ * Encrypts packets for one voice session. In the `rtpsize` modes the RTP
+ * header stays clear and authenticated, and a 32-bit counter, appended to
+ * the packet, is the nonce: the first 4 bytes of a nonce that is zero
+ * otherwise.
+ */
+export declare class TransportEncryptor {
+    #private;
+    constructor(mode: TransportMode, key: Uint8Array);
+    get mode(): TransportMode;
+    /** A whole packet: the clear header, the sealed audio, the counter. */
+    seal(header: Buffer, payload: Uint8Array): Buffer;
+}