morok-bot-sdk 1.0.1

package/dist/crypto/channel-cipher.js

@@ -0,0 +1,77 @@
+import { webcrypto } from 'node:crypto';
+const subtle = webcrypto.subtle;
+export const CHANNEL_KEY_BYTES = 32;
+export const CHANNEL_IV_BYTES = 12;
+export const CHANNEL_TAG_BYTES = 16;
+export const CHANNEL_MAGIC = new TextEncoder().encode('MOK1');
+export const CHANNEL_MAGIC_BYTES = CHANNEL_MAGIC.length;
+export const CHANNEL_EPOCH_BYTES = 4;
+export const CHANNEL_HEADER_BYTES = CHANNEL_MAGIC_BYTES + CHANNEL_EPOCH_BYTES + CHANNEL_IV_BYTES;
+async function importChannelKey(raw, usages) {
+    if (raw.byteLength !== CHANNEL_KEY_BYTES) {
+        throw new Error(`channel-cipher: key must be ${CHANNEL_KEY_BYTES} bytes; got ${raw.byteLength}`);
+    }
+    return subtle.importKey('raw', raw, { name: 'AES-GCM' }, false, usages);
+}
+export function channelAad(conversationId) {
+    if (!Number.isInteger(conversationId) || conversationId < 1) {
+        throw new Error(`channel-cipher: bad conversationId ${conversationId}`);
+    }
+    return new TextEncoder().encode(`morok-channel-${conversationId}`);
+}
+function writeUint32BE(out, offset, value) {
+    if (!Number.isInteger(value) || value < 0 || value > 0xffffffff) {
+        throw new Error(`channel-cipher: epoch ${value} out of uint32 range`);
+    }
+    new DataView(out.buffer, out.byteOffset, out.byteLength).setUint32(offset, value, false);
+}
+function readUint32BE(buf, offset) {
+    if (offset + 4 > buf.byteLength) {
+        throw new Error(`channel-cipher: readUint32BE past end (offset=${offset}, len=${buf.byteLength})`);
+    }
+    return new DataView(buf.buffer, buf.byteOffset, buf.byteLength).getUint32(offset, false);
+}
+function hasChannelMagic(buf) {
+    if (buf.byteLength < CHANNEL_HEADER_BYTES + CHANNEL_TAG_BYTES)
+        return false;
+    for (let i = 0; i < CHANNEL_MAGIC_BYTES; i++) {
+        if (buf[i] !== CHANNEL_MAGIC[i])
+            return false;
+    }
+    return true;
+}
+export function parseChannelWire(wire) {
+    if (hasChannelMagic(wire)) {
+        const epoch = readUint32BE(wire, CHANNEL_MAGIC_BYTES);
+        const iv = wire.subarray(CHANNEL_MAGIC_BYTES + CHANNEL_EPOCH_BYTES, CHANNEL_HEADER_BYTES);
+        const ct = wire.subarray(CHANNEL_HEADER_BYTES);
+        return { epoch, iv, ct };
+    }
+    if (wire.byteLength < CHANNEL_IV_BYTES + CHANNEL_TAG_BYTES) {
+        throw new Error(`channel-cipher: legacy wire too short (${wire.byteLength} < ${CHANNEL_IV_BYTES + CHANNEL_TAG_BYTES})`);
+    }
+    const iv = wire.subarray(0, CHANNEL_IV_BYTES);
+    const ct = wire.subarray(CHANNEL_IV_BYTES);
+    return { epoch: 0, iv, ct };
+}
+export async function encryptChannelWire(secret, conversationId, epoch, plaintext) {
+    if (!Number.isInteger(epoch) || epoch < 0 || epoch > 0xffffffff) {
+        throw new Error(`channel-cipher: epoch ${epoch} out of uint32 range`);
+    }
+    const key = await importChannelKey(secret, ['encrypt']);
+    const iv = webcrypto.getRandomValues(new Uint8Array(CHANNEL_IV_BYTES));
+    const aad = channelAad(conversationId);
+    const ct = new Uint8Array(await subtle.encrypt({ name: 'AES-GCM', iv, additionalData: aad }, key, plaintext));
+    const wire = new Uint8Array(CHANNEL_HEADER_BYTES + ct.byteLength);
+    wire.set(CHANNEL_MAGIC, 0);
+    writeUint32BE(wire, CHANNEL_MAGIC_BYTES, epoch);
+    wire.set(iv, CHANNEL_MAGIC_BYTES + CHANNEL_EPOCH_BYTES);
+    wire.set(ct, CHANNEL_HEADER_BYTES);
+    return wire;
+}
+export async function decryptChannelWire(secret, conversationId, parsed) {
+    const key = await importChannelKey(secret, ['decrypt']);
+    const aad = channelAad(conversationId);
+    return new Uint8Array(await subtle.decrypt({ name: 'AES-GCM', iv: parsed.iv, additionalData: aad }, key, parsed.ct));
+}
+//# sourceMappingURL=channel-cipher.js.map

package/dist/crypto/channel-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-cipher.js","sourceRoot":"","sources":["../../src/crypto/channel-cipher.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAA;AAI/B,MAAM,CAAC,MAAM,iBAAiB,GAAK,EAAE,CAAA;AACrC,MAAM,CAAC,MAAM,gBAAgB,GAAM,EAAE,CAAA;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAK,EAAE,CAAA;AACrC,MAAM,CAAC,MAAM,aAAa,GAAS,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC,MAAM,CAAA;AACvD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAA;AACpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,gBAAgB,CAAA;AAGhG,KAAK,UAAU,gBAAgB,CAAC,GAAe,EAAE,MAAkB;IAC/D,IAAI,GAAG,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,+BAA+B,iBAAiB,eAAe,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;IACpG,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;AAC3E,CAAC;AAGD,MAAM,UAAU,UAAU,CAAC,cAAsB;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,sCAAsC,cAAc,EAAE,CAAC,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,iBAAiB,cAAc,EAAE,CAAC,CAAA;AACtE,CAAC;AAGD,SAAS,aAAa,CAAC,GAAe,EAAE,MAAc,EAAE,KAAa;IACjE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,sBAAsB,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;AAC5F,CAAC;AAGD,SAAS,YAAY,CAAC,GAAe,EAAE,MAAc;IACjD,IAAI,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,SAAS,GAAG,CAAC,UAAU,GAAG,CAAC,CAAA;IACtG,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAC5F,CAAC;AAGD,SAAS,eAAe,CAAC,GAAe;IAEpC,IAAI,GAAG,CAAC,UAAU,GAAG,oBAAoB,GAAG,iBAAiB;QAAE,OAAO,KAAK,CAAA;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IACjD,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC;AAWD,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC7C,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;QACrD,MAAM,EAAE,GAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,GAAG,mBAAmB,EAAE,oBAAoB,CAAC,CAAA;QAC5F,MAAM,EAAE,GAAM,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAA;QACjD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;IAC5B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,GAAG,gBAAgB,GAAG,iBAAiB,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACX,0CAA0C,IAAI,CAAC,UAAU,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,CACzG,CAAA;IACL,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAA;IAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;IAC1C,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;AAC/B,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,MAA0B,EAC1B,cAAsB,EACtB,KAAsB,EACtB,SAA0B;IAE1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,UAAU,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,sBAAsB,CAAC,CAAA;IACzE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IACvD,MAAM,EAAE,GAAI,SAAS,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAA;IACvE,MAAM,GAAG,GAAG,UAAU,CAAC,cAAc,CAAC,CAAA;IACtC,MAAM,EAAE,GAAI,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,OAAO,CAC3C,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,EAC5C,GAAG,EACH,SAAS,CACZ,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,oBAAoB,GAAG,EAAE,CAAC,UAAU,CAAC,CAAA;IACjE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAA;IAC1B,aAAa,CAAC,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,CAAA;IAC/C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,mBAAmB,GAAG,mBAAmB,CAAC,CAAA;IACvD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,oBAAoB,CAAC,CAAA;IAClC,OAAO,IAAI,CAAA;AACf,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,MAA0B,EAC1B,cAAsB,EACtB,MAAiC;IAEjC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IACvD,MAAM,GAAG,GAAG,UAAU,CAAC,cAAc,CAAC,CAAA;IACtC,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,OAAO,CACtC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE,EACvD,GAAG,EACH,MAAM,CAAC,EAAE,CACZ,CAAC,CAAA;AACN,CAAC"}

package/dist/crypto/channel-key-store.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Per-conversation channel-key state on disk at {stateDir}/channel-keys/<conversationId>.json
+ *   { "currentEpoch": N, "keys": { "0": "<base64 32 bytes>", ... } }
+ *
+ * Writes are atomic (tmp + rename). A per-conv in-memory lock serialises read-modify-write so concurrent
+ * mergeEpochs don't lose updates. Corrupt JSON is moved to <id>.json.corrupt-<ts> and the SDK refetches
+ */
+import type { SdkLogger } from '../types.js';
+export interface ChannelKeyState {
+    currentEpoch: number;
+    /** epoch (int as decimal string) -> base64(32 bytes) */
+    keys: Record<string, string>;
+}
+export declare class ChannelKeyStore {
+    private readonly logger?;
+    private readonly dir;
+    private readonly chains;
+    constructor(stateDir: string, logger?: SdkLogger | undefined);
+    /** Ensure dir exists, sweep stale tmp files from a prior crash */
+    init(): Promise<void>;
+    load(conversationId: number): Promise<ChannelKeyState | null>;
+    /** Merge a batch of (epoch, base64-secret) pairs. currentEpoch tracks max. Creates the file if missing */
+    mergeEpochs(conversationId: number, entries: Array<{
+        epoch: number;
+        secretBase64: string;
+    }>): Promise<ChannelKeyState>;
+    /** Returns a fresh 32-byte copy. Caller may mutate / zero it without touching the store's state */
+    getSecret(conversationId: number, epoch: number): Promise<Uint8Array | null>;
+    /** Wipe state for a conversation (called on conversation_kicked) */
+    drop(conversationId: number): Promise<void>;
+    private pathFor;
+    private loadInner;
+    private parseState;
+    private saveInner;
+    private withLock;
+}
+//# sourceMappingURL=channel-key-store.d.ts.map

package/dist/crypto/channel-key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-key-store.d.ts","sourceRoot":"","sources":["../../src/crypto/channel-key-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,SAAS,EAAE,MAA4C,aAAa,CAAA;AAGlF,MAAM,WAAW,eAAe;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B;AAGD,qBAAa,eAAe;IAIM,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAHtD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAQ;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAEjD,QAAQ,EAAE,MAAM,EAAmB,MAAM,CAAC,EAAE,SAAS,YAAA;IAKjE,kEAAkE;IAC5D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAYrB,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAKnE,0GAA0G;IACpG,WAAW,CACb,cAAc,EAAE,MAAM,EACtB,OAAO,EAAS,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,GAC/D,OAAO,CAAC,eAAe,CAAC;IAgC3B,mGAAmG;IAC7F,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAalF,oEAAoE;IAC9D,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjD,OAAO,CAAC,OAAO;YAQD,SAAS;IAuBvB,OAAO,CAAC,UAAU;YAaJ,SAAS;IAWvB,OAAO,CAAC,QAAQ;CAYnB"}

package/dist/crypto/channel-key-store.js

@@ -0,0 +1,149 @@
+import { mkdir, readFile, rename, writeFile, unlink, readdir } from 'node:fs/promises';
+import { randomBytes } from 'node:crypto';
+import { join, dirname } from 'node:path';
+import { CHANNEL_KEY_BYTES } from './channel-cipher.js';
+export class ChannelKeyStore {
+    logger;
+    dir;
+    chains = new Map();
+    constructor(stateDir, logger) {
+        this.logger = logger;
+        this.dir = join(stateDir, 'channel-keys');
+    }
+    async init() {
+        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+        let entries = [];
+        try {
+            entries = await readdir(this.dir);
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (e.includes('.tmp.')) {
+                try {
+                    await unlink(join(this.dir, e));
+                }
+                catch { }
+            }
+        }
+    }
+    async load(conversationId) {
+        return this.withLock(conversationId, () => this.loadInner(conversationId));
+    }
+    async mergeEpochs(conversationId, entries) {
+        if (entries.length === 0) {
+            const existing = await this.load(conversationId);
+            return existing ?? { currentEpoch: -1, keys: {} };
+        }
+        for (const e of entries) {
+            if (!Number.isInteger(e.epoch) || e.epoch < 0 || e.epoch > 0xffffffff) {
+                throw new Error(`channel-key-store: bad epoch ${e.epoch}`);
+            }
+            const raw = Buffer.from(e.secretBase64, 'base64');
+            if (raw.byteLength !== CHANNEL_KEY_BYTES) {
+                throw new Error(`channel-key-store: secret for epoch ${e.epoch} decodes to ${raw.byteLength} bytes; expected ${CHANNEL_KEY_BYTES}`);
+            }
+        }
+        return this.withLock(conversationId, async () => {
+            const cur = await this.loadInner(conversationId);
+            const next = cur
+                ? { currentEpoch: cur.currentEpoch, keys: { ...cur.keys } }
+                : { currentEpoch: -1, keys: {} };
+            for (const e of entries) {
+                next.keys[String(e.epoch)] = e.secretBase64;
+                if (e.epoch > next.currentEpoch)
+                    next.currentEpoch = e.epoch;
+            }
+            await this.saveInner(conversationId, next);
+            return next;
+        });
+    }
+    async getSecret(conversationId, epoch) {
+        const state = await this.load(conversationId);
+        if (!state)
+            return null;
+        const b64 = state.keys[String(epoch)];
+        if (!b64)
+            return null;
+        const raw = Buffer.from(b64, 'base64');
+        if (raw.byteLength !== CHANNEL_KEY_BYTES)
+            return null;
+        const out = new Uint8Array(CHANNEL_KEY_BYTES);
+        out.set(raw);
+        return out;
+    }
+    async drop(conversationId) {
+        return this.withLock(conversationId, async () => {
+            const p = this.pathFor(conversationId);
+            try {
+                await unlink(p);
+            }
+            catch { }
+        });
+    }
+    pathFor(conversationId) {
+        if (!Number.isInteger(conversationId) || conversationId < 1) {
+            throw new Error(`channel-key-store: bad conversationId ${conversationId}`);
+        }
+        return join(this.dir, `${conversationId}.json`);
+    }
+    async loadInner(conversationId) {
+        const p = this.pathFor(conversationId);
+        let raw;
+        try {
+            raw = await readFile(p, 'utf8');
+        }
+        catch (err) {
+            if (err?.code === 'ENOENT')
+                return null;
+            throw err;
+        }
+        try {
+            return this.parseState(raw);
+        }
+        catch (err) {
+            const quarantined = `${p}.corrupt-${Date.now()}`;
+            try {
+                await rename(p, quarantined);
+            }
+            catch { }
+            this.logger?.warn({ conversationId, err: err.message, quarantined }, '[channel-key-store] quarantined corrupt state');
+            return null;
+        }
+    }
+    parseState(raw) {
+        const obj = JSON.parse(raw);
+        if (!obj || typeof obj !== 'object')
+            throw new Error('not an object');
+        if (typeof obj.currentEpoch !== 'number')
+            throw new Error('missing currentEpoch');
+        if (!obj.keys || typeof obj.keys !== 'object')
+            throw new Error('missing keys');
+        for (const k of Object.keys(obj.keys)) {
+            if (typeof obj.keys[k] !== 'string')
+                throw new Error(`epoch ${k} not a string`);
+        }
+        return obj;
+    }
+    async saveInner(conversationId, state) {
+        const p = this.pathFor(conversationId);
+        const tmp = `${p}.tmp.${randomBytes(4).toString('hex')}`;
+        await mkdir(dirname(p), { recursive: true, mode: 0o700 });
+        const json = JSON.stringify(state);
+        await writeFile(tmp, json, { mode: 0o600 });
+        await rename(tmp, p);
+    }
+    withLock(conversationId, fn) {
+        const prev = this.chains.get(conversationId) ?? Promise.resolve();
+        const next = prev.then(fn, fn);
+        const cleanup = next.finally(() => {
+            if (this.chains.get(conversationId) === cleanup) {
+                this.chains.delete(conversationId);
+            }
+        });
+        this.chains.set(conversationId, cleanup);
+        return next;
+    }
+}
+//# sourceMappingURL=channel-key-store.js.map

package/dist/crypto/channel-key-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-key-store.js","sourceRoot":"","sources":["../../src/crypto/channel-key-store.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACtF,OAAO,EAAE,WAAW,EAAE,MAA+C,aAAa,CAAA;AAClF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAA6C,WAAW,CAAA;AAEhF,OAAO,EAAE,iBAAiB,EAAE,MAAyC,qBAAqB,CAAA;AAW1F,MAAM,OAAO,eAAe;IAIuB;IAH9B,GAAG,CAAQ;IACX,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAA;IAE7D,YAAY,QAAgB,EAAmB,MAAkB;QAAlB,WAAM,GAAN,MAAM,CAAY;QAC7D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;IAC7C,CAAC;IAID,KAAK,CAAC,IAAI;QACN,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACvD,IAAI,OAAO,GAAa,EAAE,CAAA;QAC1B,IAAI,CAAC;YAAC,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAM;QAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC;oBAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAc,CAAC;YAClE,CAAC;QACL,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,IAAI,CAAC,cAAsB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAA;IAC9E,CAAC;IAID,KAAK,CAAC,WAAW,CACb,cAAsB,EACtB,OAA8D;QAE9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;YAChD,OAAO,QAAQ,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;QACrD,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,UAAU,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;YACjD,IAAI,GAAG,CAAC,UAAU,KAAK,iBAAiB,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACX,uCAAuC,CAAC,CAAC,KAAK,eAAe,GAAG,CAAC,UAAU,oBAAoB,iBAAiB,EAAE,CACrH,CAAA;YACL,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,CAAA;YAChD,MAAM,IAAI,GAAoB,GAAG;gBAC7B,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE;gBAC3D,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;YACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,CAAA;gBAC3C,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY;oBAAE,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAA;YAChE,CAAC;YACD,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QACf,CAAC,CAAC,CAAA;IACN,CAAC;IAID,KAAK,CAAC,SAAS,CAAC,cAAsB,EAAE,KAAa;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;QACrC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAA;QACrB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACtC,IAAI,GAAG,CAAC,UAAU,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAA;QACrD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAA;QAC7C,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACZ,OAAO,GAAG,CAAA;IACd,CAAC;IAID,KAAK,CAAC,IAAI,CAAC,cAAsB;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;YACtC,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,CAAC,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAuB,CAAC;QAC3D,CAAC,CAAC,CAAA;IACN,CAAC;IAKO,OAAO,CAAC,cAAsB;QAClC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,yCAAyC,cAAc,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,OAAO,CAAC,CAAA;IACnD,CAAC;IAGO,KAAK,CAAC,SAAS,CAAC,cAAsB;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;QACtC,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,IAAK,GAAyB,EAAE,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAC9D,MAAM,GAAG,CAAA;QACb,CAAC;QACD,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;YAChD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAmB,CAAC;YAChE,IAAI,CAAC,MAAM,EAAE,IAAI,CACb,EAAE,cAAc,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,WAAW,EAAE,EAC5D,+CAA+C,CAClD,CAAA;YACD,OAAO,IAAI,CAAA;QACf,CAAC;IACL,CAAC;IAGO,UAAU,CAAC,GAAW;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;QACrE,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACjF,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;QAE9E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;QACnF,CAAC;QACD,OAAO,GAAsB,CAAA;IACjC,CAAC;IAGO,KAAK,CAAC,SAAS,CAAC,cAAsB,EAAE,KAAsB;QAClE,MAAM,CAAC,GAAK,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAA;QACxC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;QACxD,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QAClC,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAE3C,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACxB,CAAC;IAGO,QAAQ,CAAI,cAAsB,EAAE,EAAoB;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAA;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAC9B,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;YACtC,CAAC;QACL,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;QACxC,OAAO,IAAI,CAAA;IACf,CAAC;CACJ"}

package/dist/crypto/cross-signing.d.ts

@@ -0,0 +1,57 @@
+/**
+ * D cross-signing primitives for the bot SDK, the headless counterpart to frontend/src/signal/cross-signing.ts
+ * with the server mirror in src/routes/prekeys.ts. All three must produce byte-identical canonical messages
+ * and use the same XEdDSA (Curve25519), or certificates won't verify across ends
+ *
+ * signDeviceCert signs a cert over the bot's own device identity key under the account signing key (XSK)
+ * from the .morokbot file, then POSTs it to /crypto/cross-signing (see bot.ts:ensureCrossSigning)
+ * Without the cert the bot stays an uncertified legacy device and users can't derive a cross-signed safety number
+ *
+ * verifyPeerCert is the encrypt-side gate wired into signal.ts:processPreKeyBundle
+ * When a peer bundle carries both an XSK and a device cert, the cert is verified before opening a session
+ * Present-but-invalid is the one hard-reject case (tampered bundle, server identity injection)
+ * NULL on either side falls back to TOFU, since most peers may legitimately be uncertified
+ * and rejecting NULL is a lock-out trap
+ *
+ * Canonical message (mirror, a change here means changing the other two):
+ *   SHA-256( userId u64-BE || deviceId u32-BE || identity_key raw bytes )
+ * identity_key is the libsignal-serialised public key (33-byte, 0x05-prefixed)
+ * exactly as the server stored it in devices.identity_key
+ * The 32-byte digest is the message that is signed and verified directly, with no second hashing
+ *
+ * Primitive: Curve25519Wrapper, the same WASM library libsignal, the server, and the FE use
+ * Sign with the 32-byte XSK private, verify with signatureIsValid, NEVER verify (it returns true on invalid signatures)
+ *
+ * A one-time self-test at wrapper init, a valid round-trip + tamper-reject + wrong-key-reject
+ * over a full canonicalCrossSignMessage cycle, tripwires an encoding regression or a broken wrapper
+ * before it can silently reject every valid peer cert or mint a cert that fails server-side
+ * On failure getWrapper throws and verifyPeerCert maps it to 'uncertified' (TOFU)
+ * so a crypto fault degrades the bot and never cuts it off from every peer
+ */
+import type { SdkLogger } from '../types.js';
+/**
+ * Canonical bytes the device cert is signed over, byte-identical to the server's and the FE's
+ * The 32-byte SHA-256 digest is the message that is signed and verified directly, no second hashing
+ */
+export declare function canonicalCrossSignMessage(userId: number, deviceId: number, identityKeyB64: string): Uint8Array;
+/**
+ * Signs the canonical message for (userId, deviceId, identityKeyB64) under the 32-byte XSK private key
+ * Returns base64 of the 64-byte XEdDSA signature, passed as `deviceCertificate` to POST /crypto/cross-signing
+ */
+export declare function signDeviceCert(xskPrivB64: string, userId: number, deviceId: number, identityKeyB64: string): Promise<string>;
+/** verifyPeerCert result. Mirrors the FE's PeerDeviceCertStatus */
+export type PeerCertStatus = 'verified' | 'uncertified' | 'invalid';
+/**
+ * Encrypt-side gate. Verifies a peer device's cert over the canonical message
+ * NULL-tolerant, a missing XSK or cert means 'uncertified' (caller proceeds with TOFU)
+ * Present-but-unverifiable returns 'invalid' and the caller hard-rejects the session
+ * Never throws. If the curve wrapper is unavailable it returns 'uncertified' and logs, degrading the bot to TOFU
+ */
+export declare function verifyPeerCert(args: {
+    userId: number;
+    deviceId: number;
+    identityKeyB64: string;
+    accountSigningKey?: string | null;
+    deviceCertificate?: string | null;
+}, logger?: SdkLogger): Promise<PeerCertStatus>;
+//# sourceMappingURL=cross-signing.d.ts.map

package/dist/crypto/cross-signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-signing.d.ts","sourceRoot":"","sources":["../../src/crypto/cross-signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAa,aAAa,CAAA;AAyBnD;;;GAGG;AACH,wBAAgB,yBAAyB,CACrC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GACzD,UAAU,CAgBZ;AAgDD;;;GAGG;AACH,wBAAsB,cAAc,CAChC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAC7E,OAAO,CAAC,MAAM,CAAC,CAYjB;AAGD,mEAAmE;AACnE,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAA;AAGnE;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACvC,MAAM,EAAc,MAAM,CAAA;IAC1B,QAAQ,EAAY,MAAM,CAAA;IAC1B,cAAc,EAAM,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACpC,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,CAAC,CA0B9C"}

package/dist/crypto/cross-signing.js

@@ -0,0 +1,111 @@
+import { createHash } from 'node:crypto';
+import { Curve25519Wrapper } from '@privacyresearch/curve25519-typescript';
+import { KeyHelper } from '@privacyresearch/libsignal-protocol-typescript';
+const DJB_PREFIX_BYTE = 0x05;
+const PUBKEY_RAW_BYTES = 32;
+const PUBKEY_PREFIXED = 33;
+const PRIVKEY_BYTES = 32;
+const SIGNATURE_BYTES = 64;
+function toArrayBuffer(u8) {
+    const out = new ArrayBuffer(u8.byteLength);
+    new Uint8Array(out).set(u8);
+    return out;
+}
+function stripDjbPrefix(bytes) {
+    if (bytes.length === PUBKEY_RAW_BYTES)
+        return bytes;
+    if (bytes.length === PUBKEY_PREFIXED && bytes[0] === DJB_PREFIX_BYTE)
+        return bytes.subarray(1);
+    return null;
+}
+export function canonicalCrossSignMessage(userId, deviceId, identityKeyB64) {
+    if (!Number.isInteger(userId) || userId < 1) {
+        throw new Error('canonicalCrossSignMessage: bad userId');
+    }
+    if (!Number.isInteger(deviceId) || deviceId < 1) {
+        throw new Error('canonicalCrossSignMessage: bad deviceId');
+    }
+    const identity = Buffer.from(identityKeyB64, 'base64');
+    if (identity.length === 0) {
+        throw new Error('canonicalCrossSignMessage: empty identity');
+    }
+    const buf = Buffer.alloc(8 + 4 + identity.length);
+    buf.writeBigUInt64BE(BigInt(userId), 0);
+    buf.writeUInt32BE(deviceId, 8);
+    identity.copy(buf, 12);
+    return new Uint8Array(createHash('sha256').update(buf).digest());
+}
+let wrapperPromise = null;
+function getWrapper() {
+    if (!wrapperPromise) {
+        wrapperPromise = (async () => {
+            const w = await Curve25519Wrapper.create();
+            await selfTest(w);
+            return w;
+        })().catch(err => {
+            wrapperPromise = null;
+            throw err;
+        });
+    }
+    return wrapperPromise;
+}
+async function selfTest(w) {
+    const kp = await KeyHelper.generateIdentityKeyPair();
+    const wrongKp = await KeyHelper.generateIdentityKeyPair();
+    const pubRaw = new Uint8Array(kp.pubKey).slice(1);
+    const wrongRaw = new Uint8Array(wrongKp.pubKey).slice(1);
+    const identityB64 = Buffer.from(new Uint8Array(kp.pubKey)).toString('base64');
+    const msg = canonicalCrossSignMessage(424242, 7, identityB64);
+    const sig = w.sign(kp.privKey, toArrayBuffer(msg));
+    if (!w.signatureIsValid(toArrayBuffer(pubRaw), toArrayBuffer(msg), sig)) {
+        throw new Error('cross-signing self-test FAIL: valid signature verifies false (wrapper broken or encoding regression)');
+    }
+    const tampered = new Uint8Array(sig);
+    tampered[0] ^= 0x01;
+    if (w.signatureIsValid(toArrayBuffer(pubRaw), toArrayBuffer(msg), toArrayBuffer(tampered))) {
+        throw new Error('cross-signing self-test FAIL: tampered signature verifies true (signatureIsValid replaced with legacy verify?)');
+    }
+    if (w.signatureIsValid(toArrayBuffer(wrongRaw), toArrayBuffer(msg), sig)) {
+        throw new Error('cross-signing self-test FAIL: signature verifies under the wrong public key (wrapper broken)');
+    }
+}
+export async function signDeviceCert(xskPrivB64, userId, deviceId, identityKeyB64) {
+    const priv = Buffer.from(xskPrivB64, 'base64');
+    if (priv.length !== PRIVKEY_BYTES) {
+        throw new Error(`signDeviceCert: bad XSK private length ${priv.length} (expected ${PRIVKEY_BYTES})`);
+    }
+    const w = await getWrapper();
+    const msg = canonicalCrossSignMessage(userId, deviceId, identityKeyB64);
+    const sig = new Uint8Array(w.sign(toArrayBuffer(new Uint8Array(priv)), toArrayBuffer(msg)));
+    if (sig.length !== SIGNATURE_BYTES) {
+        throw new Error(`signDeviceCert: unexpected signature length ${sig.length}`);
+    }
+    return Buffer.from(sig).toString('base64');
+}
+export async function verifyPeerCert(args, logger) {
+    if (!args.accountSigningKey || !args.deviceCertificate)
+        return 'uncertified';
+    let w;
+    try {
+        w = await getWrapper();
+    }
+    catch (err) {
+        logger?.warn({ err: err.message, peer: `${args.userId}.${args.deviceId}` }, '[cross-signing] curve unavailable; treating peer cert as uncertified (TOFU)');
+        return 'uncertified';
+    }
+    try {
+        const pubRaw = stripDjbPrefix(new Uint8Array(Buffer.from(args.accountSigningKey, 'base64')));
+        if (!pubRaw)
+            return 'invalid';
+        const sig = new Uint8Array(Buffer.from(args.deviceCertificate, 'base64'));
+        if (sig.length !== SIGNATURE_BYTES)
+            return 'invalid';
+        const msg = canonicalCrossSignMessage(args.userId, args.deviceId, args.identityKeyB64);
+        const ok = w.signatureIsValid(toArrayBuffer(pubRaw), toArrayBuffer(msg), toArrayBuffer(sig));
+        return ok ? 'verified' : 'invalid';
+    }
+    catch {
+        return 'invalid';
+    }
+}
+//# sourceMappingURL=cross-signing.js.map

package/dist/crypto/cross-signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-signing.js","sourceRoot":"","sources":["../../src/crypto/cross-signing.ts"],"names":[],"mappings":"AA+BA,OAAO,EAAE,UAAU,EAAE,MAAiB,aAAa,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAU,wCAAwC,CAAA;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAkB,gDAAgD,CAAA;AAItF,MAAM,eAAe,GAAG,IAAI,CAAA;AAC5B,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,MAAM,eAAe,GAAI,EAAE,CAAA;AAC3B,MAAM,aAAa,GAAM,EAAE,CAAA;AAC3B,MAAM,eAAe,GAAI,EAAE,CAAA;AAG3B,SAAS,aAAa,CAAC,EAAc;IACjC,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;IAC1C,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC3B,OAAO,GAAG,CAAA;AACd,CAAC;AAID,SAAS,cAAc,CAAC,KAAiB;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,KAAK,CAAA;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC9F,OAAO,IAAI,CAAA;AACf,CAAC;AAOD,MAAM,UAAU,yBAAyB,CACrC,MAAc,EAAE,QAAgB,EAAE,cAAsB;IAExD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IAC5D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAChE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACjD,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACvC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACtB,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AACpE,CAAC;AAGD,IAAI,cAAc,GAAsC,IAAI,CAAA;AAE5D,SAAS,UAAU;IACf,IAAI,CAAC,cAAc,EAAE,CAAC;QAClB,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,CAAA;YAC1C,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAA;YACjB,OAAO,CAAC,CAAA;QACZ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAGb,cAAc,GAAG,IAAI,CAAA;YACrB,MAAM,GAAG,CAAA;QACb,CAAC,CAAC,CAAA;IACN,CAAC;IACD,OAAO,cAAc,CAAA;AACzB,CAAC;AAMD,KAAK,UAAU,QAAQ,CAAC,CAAoB;IACxC,MAAM,EAAE,GAAU,MAAM,SAAS,CAAC,uBAAuB,EAAE,CAAA;IAC3D,MAAM,OAAO,GAAK,MAAM,SAAS,CAAC,uBAAuB,EAAE,CAAA;IAC3D,MAAM,MAAM,GAAM,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAI,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IACzD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC7E,MAAM,GAAG,GAAS,yBAAyB,CAAC,MAAM,EAAE,CAAC,EAAE,WAAW,CAAC,CAAA;IACnE,MAAM,GAAG,GAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAA;IAExD,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAA;IAC3H,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IACnB,IAAI,CAAC,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,gHAAgH,CAAC,CAAA;IACrI,CAAC;IACD,IAAI,CAAC,CAAC,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAA;IACnH,CAAC;AACL,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,UAAkB,EAAE,MAAc,EAAE,QAAgB,EAAE,cAAsB;IAE5E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAC9C,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,CAAC,MAAM,cAAc,aAAa,GAAG,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,CAAC,GAAK,MAAM,UAAU,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,yBAAyB,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;IACvE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3F,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC9C,CAAC;AAaD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAMpC,EAAE,MAAkB;IACjB,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAAE,OAAO,aAAa,CAAA;IAE5E,IAAI,CAAoB,CAAA;IACxB,IAAI,CAAC;QACD,CAAC,GAAG,MAAM,UAAU,EAAE,CAAA;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,EAAE,IAAI,CACR,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,EACxE,6EAA6E,CAChF,CAAA;QACD,OAAO,aAAa,CAAA;IACxB,CAAC;IAED,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;QAC5F,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC,CAAA;QACzE,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO,SAAS,CAAA;QACpD,MAAM,GAAG,GAAG,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAEtF,MAAM,EAAE,GAAG,CAAC,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5F,OAAO,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,SAAS,CAAA;IACpB,CAAC;AACL,CAAC"}

package/dist/crypto/file-cipher.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Per-file AES-256-GCM, byte-identical to frontend/src/lib/crypto-utils.ts
+ * Any drift on this layout breaks decryption on the peer with an AES-GCM tag error
+ *
+ * Single-shot wire (packSealed): [ iv (12) || ct+tag (plaintext + 16) ], total plaintext + 28
+ * Chunked: each chunk packed with its own IV and AAD "morok-chunk-${index}-of-${total}", same layout
+ */
+import { webcrypto } from 'node:crypto';
+type CryptoKey = webcrypto.CryptoKey;
+export interface SealedData {
+    iv: Uint8Array;
+    ct: Uint8Array;
+}
+export declare const AES_IV_BYTES = 12;
+export declare const AES_TAG_BYTES = 16;
+/** Fresh AES-256-GCM key, extractable so callers can serialise the raw 32 bytes into the message envelope */
+export declare function generateAesKey(): Promise<CryptoKey>;
+/** Returns the raw 32 bytes. Throws on a non-extractable key */
+export declare function exportKeyRaw(key: CryptoKey): Promise<Uint8Array>;
+/** Re-import a raw 32-byte key for decrypt. Non-extractable */
+export declare function importKeyForDecrypt(rawKey: Uint8Array): Promise<CryptoKey>;
+/**
+ * Encrypt under `key` with a random IV. Optional `aad` binds extra bytes into the tag,
+ * the chunked path uses it to make chunks non-reorderable
+ */
+export declare function aesGcmEncrypt(key: CryptoKey, plaintext: Uint8Array, aad?: Uint8Array): Promise<SealedData>;
+/** Decrypt. Throws "decryption failed" on tag mismatch (same wording as the FE so log greps line up) */
+export declare function aesGcmDecrypt(key: CryptoKey, sealed: SealedData, aad?: Uint8Array): Promise<Uint8Array>;
+/** [ iv(12) || ct+tag ] */
+export declare function packSealed(s: SealedData): Uint8Array;
+/** Reverse of packSealed. Returns subarrays (views, no copy) */
+export declare function unpackSealed(packed: Uint8Array): SealedData;
+/** AAD for chunked uploads. Matches FE chunkAad */
+export declare function chunkAad(index: number, total: number): Uint8Array;
+export {};
+//# sourceMappingURL=file-cipher.d.ts.map

package/dist/crypto/file-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-cipher.d.ts","sourceRoot":"","sources":["../../src/crypto/file-cipher.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAe,SAAS,EAAE,MAAM,aAAa,CAAA;AAGpD,KAAK,SAAS,GAAG,SAAS,CAAC,SAAS,CAAA;AAIpC,MAAM,WAAW,UAAU;IACvB,EAAE,EAAE,UAAU,CAAA;IACd,EAAE,EAAE,UAAU,CAAA;CACjB;AAED,eAAO,MAAM,YAAY,KAAM,CAAA;AAC/B,eAAO,MAAM,aAAa,KAAK,CAAA;AAG/B,6GAA6G;AAC7G,wBAAsB,cAAc,IAAI,OAAO,CAAC,SAAS,CAAC,CAMzD;AAED,gEAAgE;AAChE,wBAAsB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAEtE;AAED,+DAA+D;AAC/D,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAWhF;AAGD;;;GAGG;AACH,wBAAsB,aAAa,CAC/B,GAAG,EAAQ,SAAS,EACpB,SAAS,EAAE,UAAU,EACrB,GAAG,CAAC,EAAO,UAAU,GACtB,OAAO,CAAC,UAAU,CAAC,CAYrB;AAED,wGAAwG;AACxG,wBAAsB,aAAa,CAC/B,GAAG,EAAK,SAAS,EACjB,MAAM,EAAE,UAAU,EAClB,GAAG,CAAC,EAAI,UAAU,GACnB,OAAO,CAAC,UAAU,CAAC,CAerB;AAGD,2BAA2B;AAC3B,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,GAAG,UAAU,CAQpD;AAED,gEAAgE;AAChE,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAS3D;AAGD,mDAAmD;AACnD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAEjE"}

package/dist/crypto/file-cipher.js

@@ -0,0 +1,61 @@
+import { randomBytes, webcrypto } from 'node:crypto';
+const subtle = webcrypto.subtle;
+export const AES_IV_BYTES = 12;
+export const AES_TAG_BYTES = 16;
+export async function generateAesKey() {
+    return subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+}
+export async function exportKeyRaw(key) {
+    return new Uint8Array(await subtle.exportKey('raw', key));
+}
+export async function importKeyForDecrypt(rawKey) {
+    if (rawKey.byteLength !== 32) {
+        throw new Error(`AES key must be 32 bytes, got ${rawKey.byteLength}`);
+    }
+    return subtle.importKey('raw', rawKey, { name: 'AES-GCM' }, false, ['decrypt']);
+}
+export async function aesGcmEncrypt(key, plaintext, aad) {
+    const iv = randomBytes(AES_IV_BYTES);
+    const ct = await subtle.encrypt({
+        name: 'AES-GCM',
+        iv: iv,
+        ...(aad ? { additionalData: aad } : {}),
+    }, key, plaintext);
+    return { iv: new Uint8Array(iv), ct: new Uint8Array(ct) };
+}
+export async function aesGcmDecrypt(key, sealed, aad) {
+    try {
+        const pt = await subtle.decrypt({
+            name: 'AES-GCM',
+            iv: sealed.iv,
+            ...(aad ? { additionalData: aad } : {}),
+        }, key, sealed.ct);
+        return new Uint8Array(pt);
+    }
+    catch {
+        throw new Error('decryption failed');
+    }
+}
+export function packSealed(s) {
+    if (s.iv.byteLength !== AES_IV_BYTES) {
+        throw new Error(`packSealed: iv must be ${AES_IV_BYTES} bytes, got ${s.iv.byteLength}`);
+    }
+    const out = new Uint8Array(s.iv.byteLength + s.ct.byteLength);
+    out.set(s.iv, 0);
+    out.set(s.ct, s.iv.byteLength);
+    return out;
+}
+export function unpackSealed(packed) {
+    const min = AES_IV_BYTES + AES_TAG_BYTES;
+    if (packed.byteLength < min) {
+        throw new Error(`unpackSealed: too short (need >= ${min} bytes, got ${packed.byteLength})`);
+    }
+    return {
+        iv: packed.subarray(0, AES_IV_BYTES),
+        ct: packed.subarray(AES_IV_BYTES),
+    };
+}
+export function chunkAad(index, total) {
+    return new TextEncoder().encode(`morok-chunk-${index}-of-${total}`);
+}
+//# sourceMappingURL=file-cipher.js.map

package/dist/crypto/file-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-cipher.js","sourceRoot":"","sources":["../../src/crypto/file-cipher.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEpD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAA;AAU/B,MAAM,CAAC,MAAM,YAAY,GAAI,EAAE,CAAA;AAC/B,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAA;AAI/B,MAAM,CAAC,KAAK,UAAU,cAAc;IAChC,OAAO,MAAM,CAAC,WAAW,CACrB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,IAAI,EACJ,CAAC,SAAS,EAAE,SAAS,CAAC,CACzB,CAAA;AACL,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAc;IAC7C,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;AAC7D,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAkB;IACxD,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,MAAM,CAAC,SAAS,CACnB,KAAK,EACL,MAAsB,EACtB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,SAAS,CAAC,CACd,CAAA;AACL,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,GAAoB,EACpB,SAAqB,EACrB,GAAqB;IAErB,MAAM,EAAE,GAAG,WAAW,CAAC,YAAY,CAAC,CAAA;IACpC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAC3B;QACI,IAAI,EAAE,SAAS;QACf,EAAE,EAAI,EAAkB;QACxB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,EACD,GAAG,EACH,SAAyB,CAC5B,CAAA;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,CAAA;AAC7D,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,GAAiB,EACjB,MAAkB,EAClB,GAAkB;IAElB,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAC3B;YACI,IAAI,EAAE,SAAS;YACf,EAAE,EAAI,MAAM,CAAC,EAAkB;YAC/B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,EACD,GAAG,EACH,MAAM,CAAC,EAAkB,CAC5B,CAAA;QACD,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACxC,CAAC;AACL,CAAC;AAID,MAAM,UAAU,UAAU,CAAC,CAAa;IACpC,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,YAAY,eAAe,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;IAC7D,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IAChB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAA;IAC9B,OAAO,GAAG,CAAA;AACd,CAAC;AAGD,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC3C,MAAM,GAAG,GAAG,YAAY,GAAG,aAAa,CAAA;IACxC,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,eAAe,MAAM,CAAC,UAAU,GAAG,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO;QACH,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,YAAY,CAAC;QACpC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;KACpC,CAAA;AACL,CAAC;AAID,MAAM,UAAU,QAAQ,CAAC,KAAa,EAAE,KAAa;IACjD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,KAAK,OAAO,KAAK,EAAE,CAAC,CAAA;AACvE,CAAC"}

package/dist/crypto/group-secret-cipher.d.ts

@@ -0,0 +1,49 @@
+/**
+ * AES-256-GCM seal/unseal for the "sealed-to-group-secret" bundles served alongside per-device
+ * channel-key wraps in GET /channel-key
+ * A member holding the group_secret of a version can unwrap any epoch sealed under it
+ * Byte-identical to frontend/src/signal/group-secret.ts
+ *
+ * Wire:
+ *   aad       = "morok-group-secret-${conv}-v${version}" (utf-8)
+ *   iv        = 12 random bytes
+ *   plaintext = 32 bytes (legacy) OR [uint32 BE epoch (4) || key (32)]
+ *   ct        = AES-256-GCM(plaintext, key=group_secret(version), iv, aad)
+ *
+ * The version goes into the AAD, so a bundle sealed under v=5 can't be relabelled as v=6 on the wire
+ */
+export declare const GROUP_SECRET_BYTES = 32;
+export declare const GROUP_SECRET_IV_BYTES = 12;
+export declare const GROUP_SECRET_EPOCH_HEADER = 4;
+export declare function groupSecretAad(conversationId: number, version: number): Uint8Array;
+/**
+ * Seal a 32-byte epoch key under group_secret(version). Plaintext is [uint32 BE predictedEpoch || epochKey] (36 bytes)
+ * The inner epoch claim binds the bundle to one epoch, a relabel on the wire fails the inner check on unseal
+ *
+ * predictedEpoch is the bot's guess at what the server will assign (usually localMax + 1)
+ * If it's wrong the receiver's inner check throws and ignores the bundle, the per-device wraps still land
+ */
+export declare function sealEpochKey(args: {
+    epochKey: Uint8Array;
+    groupSecret: Uint8Array;
+    conversationId: number;
+    version: number;
+    predictedEpoch: number;
+}): Promise<{
+    ciphertext: string;
+    iv: string;
+}>;
+/**
+ * Unseal an epoch bundle. AAD binds conversationId + version. With expectedEpoch and a new-format bundle
+ * (36 bytes) the inner epoch is verified, legacy 32-byte bundles skip that check
+ * Throws on wrong secret size, wrong iv size, AES-GCM tag fail, unknown plaintext length, inner-epoch mismatch
+ */
+export declare function unsealEpochKey(args: {
+    ciphertextBase64: string;
+    ivBase64: string;
+    groupSecret: Uint8Array;
+    conversationId: number;
+    version: number;
+    expectedEpoch?: number;
+}): Promise<Uint8Array>;
+//# sourceMappingURL=group-secret-cipher.d.ts.map

package/dist/crypto/group-secret-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group-secret-cipher.d.ts","sourceRoot":"","sources":["../../src/crypto/group-secret-cipher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,eAAO,MAAM,kBAAkB,KAAY,CAAA;AAC3C,eAAO,MAAM,qBAAqB,KAAS,CAAA;AAC3C,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAG1C,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAQlF;AAWD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACrC,QAAQ,EAAQ,UAAU,CAAA;IAC1B,WAAW,EAAK,UAAU,CAAA;IAC1B,cAAc,EAAE,MAAM,CAAA;IACtB,OAAO,EAAS,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;CACzB,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAyB9C;AAGD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACvC,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAU,MAAM,CAAA;IACxB,WAAW,EAAO,UAAU,CAAA;IAC5B,cAAc,EAAI,MAAM,CAAA;IACxB,OAAO,EAAW,MAAM,CAAA;IACxB,aAAa,CAAC,EAAI,MAAM,CAAA;CAC3B,GAAG,OAAO,CAAC,UAAU,CAAC,CAuCtB"}