p2party 0.14.3 → 0.14.10

package/lib/cryptography/emscripten.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Module-scoped EmscriptenModule and factory types from @types/emscripten
+ * 1.41.5 (DefinitelyTyped). All inherited LibCrypto members are retained.
+ * Keeping these types local avoids a required ambient development dependency
+ * and does not merge with a consumer's global Emscripten declarations.
+ * MIT license, Copyright (c) Microsoft Corporation.
+ * See THIRD_PARTY_NOTICES.md for the full upstream license.
+ */
+/* eslint-disable @typescript-eslint/no-explicit-any -- Preserve upstream API compatibility. */
+
+// Infers the type only in TypeScript environments where GPU types are available
+type MaybeGPUDevice = Navigator extends {
+  gpu: {
+    requestAdapter(...args: any[]): Promise<null | {
+      requestDevice(...args: any[]): Promise<null | infer T>;
+    }>;
+  };
+}
+  ? T
+  : never;
+
+export interface EmscriptenModule {
+  print(str: string): void;
+  printErr(str: string): void;
+  arguments: string[];
+  environment: "WEB" | "NODE" | "SHELL" | "WORKER";
+  preInit: Array<{ (): void }>;
+  preRun: Array<{ (): void }>;
+  postRun: Array<{ (): void }>;
+  onAbort: { (what: any): void };
+  onRuntimeInitialized: { (): void };
+  preinitializedWebGLContext: WebGLRenderingContext;
+  preinitializedWebGPUDevice: MaybeGPUDevice;
+  noInitialRun: boolean;
+  noExitRuntime: boolean;
+  logReadFiles: boolean;
+  filePackagePrefixURL: string;
+  wasmBinary: ArrayBuffer;
+
+  destroy(object: object): void;
+  getPreloadedPackage(
+    remotePackageName: string,
+    remotePackageSize: number,
+  ): ArrayBuffer;
+  instantiateWasm(
+    imports: WebAssembly.Imports,
+    successCallback: (module: WebAssembly.Instance) => void,
+  ): WebAssembly.Exports | undefined;
+  locateFile(url: string, scriptDirectory: string): string;
+  onCustomMessage(event: MessageEvent): void;
+
+  // USE_TYPED_ARRAYS == 1
+  HEAP: Int32Array;
+  IHEAP: Int32Array;
+  FHEAP: Float64Array;
+
+  // USE_TYPED_ARRAYS == 2
+  HEAP8: Int8Array;
+  HEAP16: Int16Array;
+  HEAP32: Int32Array;
+  HEAPU8: Uint8Array;
+  HEAPU16: Uint16Array;
+  HEAPU32: Uint32Array;
+  HEAPF32: Float32Array;
+  HEAPF64: Float64Array;
+  HEAP64: BigInt64Array;
+  HEAPU64: BigUint64Array;
+
+  TOTAL_STACK: number;
+  TOTAL_MEMORY: number;
+  FAST_MEMORY: number;
+
+  addOnPreRun(cb: () => any): void;
+  addOnInit(cb: () => any): void;
+  addOnPreMain(cb: () => any): void;
+  addOnExit(cb: () => any): void;
+  addOnPostRun(cb: () => any): void;
+
+  preloadedImages: any;
+  preloadedAudios: any;
+
+  _malloc(size: number): number;
+  _free(ptr: number): void;
+}
+
+/**
+ * A factory function is generated when setting the `MODULARIZE` build option
+ * to `1` in your Emscripten build. It return a Promise that resolves to an
+ * initialized, ready-to-call `EmscriptenModule` instance.
+ *
+ * By default, the factory function will be named `Module`. It's recommended to
+ * use the `EXPORT_ES6` option, in which the factory function will be the
+ * default export. If used without `EXPORT_ES6`, the factory function will be a
+ * global variable. You can rename the variable using the `EXPORT_NAME` build
+ * option. It's left to you to declare any global variables as needed in your
+ * application's types.
+ * @param moduleOverrides Default properties for the initialized module.
+ */
+export type EmscriptenModuleFactory<
+  T extends EmscriptenModule = EmscriptenModule,
+> = (moduleOverrides?: Partial<T>) => Promise<T>;

package/lib/cryptography/interfaces.d.ts

@@ -11,6 +11,9 @@ export declare const crypto_secretbox_NONCEBYTES: number;
 export declare const crypto_aead_chacha20poly1305_ietf_KEYBYTES: number;
 export declare const crypto_aead_chacha20poly1305_ietf_NPUBBYTES: number;
 export declare const crypto_aead_chacha20poly1305_ietf_ABYTES: number;
+export declare const crypto_aead_xchacha20poly1305_ietf_KEYBYTES: number;
+export declare const crypto_aead_xchacha20poly1305_ietf_NPUBBYTES: number;
+export declare const crypto_aead_xchacha20poly1305_ietf_ABYTES: number;
 export declare const crypto_pwhash_argon2id_SALTBYTES: number;
 export declare const crypto_core_ristretto255_BYTES: number;
 export declare const crypto_core_ristretto255_HASHBYTES: number;

package/lib/cryptography/libcrypto.d.ts

@@ -0,0 +1,181 @@
+import type { EmscriptenModule, EmscriptenModuleFactory } from "./emscripten";
+
+export interface LibCrypto extends EmscriptenModule {
+  wasmMemory: WebAssembly.Memory;
+  /** Web Crypto backed entropy callback supplied by the JavaScript loader. */
+  getRandomValue?(): number;
+
+  _crypto_init(): number;
+
+  _keypair(
+    public_key: number, // Uint8Array,
+    secret_key: number, // Uint8Array
+  ): number;
+
+  _keypair_from_seed(
+    public_key: number, // Uint8Array,
+    secret_key: number, // Uint8Array,
+    seed: number, // Uint8Array,
+  ): number;
+  _keypair_from_secret_key(
+    public_key: number, // Uint8Array,
+    secret_key: number, // Uint8Array,
+  ): number;
+
+  _sign(
+    DATA_LEN: number,
+    data: number, // Uint8Array,
+    secret_key: number, // Uint8Array,
+    signature: number, // Uint8Array,
+  ): number;
+  _verify(
+    DATA_LEN: number,
+    data: number, // Uint8Array,
+    public_key: number, // Uint8Array,
+    signature: number, // Uint8Array,
+  ): number;
+
+  _get_merkle_root(
+    LEAVES_LEN: number,
+    leaves_hashed: number, // Uint8Array.byteOffset
+    root: number, // Uint8Array.byteOffset
+  ): number;
+  _get_merkle_proof(
+    LEAVES_LEN: number,
+    leaves_hashed: number, // Uint8Array.byteOffset
+    element_hash: number, // Uint8Array.byteOffset
+    proof: number, // Uint8Array.byteOffset
+  ): number;
+  _get_merkle_root_from_proof(
+    PROOF_LEN: number,
+    element_hash: number, // Uint8Array.byteOffset
+    proof: number, // Uint8Array.byteOffset
+    root: number, // Uint8Array.byteOffset
+  ): number;
+  _verify_merkle_proof(
+    PROOF_LEN: number,
+    element_hash: number, // Uint8Array.byteOffset
+    root: number, // Uint8Array.byteOffset
+    proof: number, // Uint8Array.byteOffset
+  ): number;
+
+  _argon2(
+    MNEMONIC_LEN: number,
+    seed: number,
+    mnemonic: number,
+    salt: number,
+  ): number;
+
+  // Streaming SHA-512 (plain, no domain separation) — state is a heap
+  // crypto_hash_sha512_state (208 bytes) allocated by JS.
+  _sha512_init(
+    state: number, // Uint8Array.byteOffset (208-byte state)
+  ): number;
+  _sha512_update(
+    state: number, // Uint8Array.byteOffset
+    in_data: number, // Uint8Array.byteOffset
+    in_len: number,
+  ): number;
+  _sha512_final(
+    state: number, // Uint8Array.byteOffset
+    out: number, // Uint8Array.byteOffset (64 bytes)
+  ): number;
+
+  // v3 PAKE + ratchet primitives (pake_ratchet.c)
+  _cpace_ristretto255_from_hash(out: number, hash: number): void;
+  _cpace_ristretto255_scalarmult(
+    out: number,
+    scalar: number,
+    point: number,
+  ): number;
+  _cpace_ristretto255_scalar_random(out: number): void;
+  _x25519_keypair(pk: number, sk: number): number;
+  _x25519_dh(shared: number, sk: number, pk: number): number;
+  _hkdf_sha512_extract(
+    prk: number,
+    salt: number,
+    salt_len: number,
+    ikm: number,
+    ikm_len: number,
+  ): number;
+  _hkdf_sha512_expand(
+    out: number,
+    out_len: number,
+    prk: number,
+    info: number,
+    info_len: number,
+  ): number;
+  _encrypt_chachapoly_symmetric(
+    out: number,
+    data: number,
+    data_len: number,
+    key: number,
+    nonce: number,
+    aad: number,
+    aad_len: number,
+  ): number;
+  _decrypt_chachapoly_symmetric(
+    out: number,
+    ciphertext: number,
+    ciphertext_len: number,
+    key: number,
+    nonce: number,
+    aad: number,
+    aad_len: number,
+  ): number;
+  _carrier_aead_xchacha20poly1305_encrypt(
+    out: number,
+    data: number,
+    data_len: number,
+    key: number,
+    nonce: number,
+    aad: number,
+    aad_len: number,
+  ): number;
+  _carrier_aead_xchacha20poly1305_decrypt(
+    out: number,
+    ciphertext: number,
+    ciphertext_len: number,
+    key: number,
+    nonce: number,
+    aad: number,
+    aad_len: number,
+  ): number;
+  _receive_message_with_key(
+    decrypted: number,
+    message: number,
+    merkle_root: number,
+    message_key: number,
+  ): number;
+
+  // ML-KEM (FIPS 203), deterministic entry points for all standardized
+  // parameter sets. JavaScript supplies cryptographically secure coins;
+  // zero is success and a negative value is failure.
+  _mlkem512_keypair(pk: number, sk: number, coins64: number): number;
+  _mlkem512_encaps(ct: number, ss: number, pk: number, coins32: number): number;
+  _mlkem512_decaps(ss: number, ct: number, sk: number): number;
+  _mlkem768_keypair(pk: number, sk: number, coins64: number): number;
+  _mlkem768_encaps(ct: number, ss: number, pk: number, coins32: number): number;
+  _mlkem768_decaps(ss: number, ct: number, sk: number): number;
+  _mlkem1024_keypair(pk: number, sk: number, coins64: number): number;
+  _mlkem1024_encaps(
+    ct: number,
+    ss: number,
+    pk: number,
+    coins32: number,
+  ): number;
+  _mlkem1024_decaps(ss: number, ct: number, sk: number): number;
+
+  // P2Party-owned one-shot FIPS 202 boundary backed by the implementation
+  // already compiled into the shared ML-KEM-768 unit.
+  _fips202_shake256(
+    out: number,
+    out_len: number,
+    input: number,
+    input_len: number,
+  ): number;
+  _fips202_sha3_256(out: number, input: number, input_len: number): number;
+}
+
+declare const libcrypto: EmscriptenModuleFactory<LibCrypto>;
+export default libcrypto;

package/lib/cryptography/mlkem.d.ts

@@ -45,6 +45,15 @@ export declare const ML_KEM_SUITES: Readonly<{
     1024: Readonly<MlKemSuiteDescriptor<1024>>;
 }>;
 export declare const getMlKemSuite: <P extends MlKemParameterSet>(parameterSet: P) => Readonly<MlKemSuiteDescriptor<P>>;
+/**
+ * FIPS 203 Section 7.2 modulus check for one encoded encapsulation key.
+ *
+ * Each three-byte group in the encoded polynomial vector contains two
+ * little-endian 12-bit coefficients, both of which must be below q=3329.
+ * The final 32-byte public seed is unrestricted. This pure check is shared by
+ * every composed KEM so canonical ML-KEM public-key encoding has one SSOT.
+ */
+export declare const mlKemPublicKeyHasCanonicalEncoding: (publicKey: unknown, parameterSet: MlKemParameterSet) => boolean;
 type MlKemKeyPairFunction = (publicKey: number, secretKey: number, coins64: number) => number;
 type MlKemEncapsFunction = (ciphertext: number, sharedSecret: number, publicKey: number, coins32: number) => number;
 type MlKemDecapsFunction = (sharedSecret: number, ciphertext: number, secretKey: number) => number;
@@ -104,12 +113,29 @@ export interface MlKemBackend<P extends MlKemParameterSet = MlKemParameterSet> {
     encapsulate(publicKey: Uint8Array): Promise<MlKemEncapsulation>;
     decapsulate(ciphertext: Uint8Array, secretKey: Uint8Array): Promise<MlKemDecapsulation>;
 }
+/**
+ * Real-WASM ML-KEM backend with the explicit deterministic inputs required by
+ * composed, version-pinned KEMs. The ordinary backend remains the narrower
+ * seam used by protocol state machines and test doubles.
+ */
+export interface DeterministicMlKemBackend<P extends MlKemParameterSet = MlKemParameterSet> extends MlKemBackend<P> {
+    /**
+     * FIPS 203 KeyGen_internal with the caller-supplied 64-byte d || z seed.
+     * The seed is borrowed; this method snapshots but never wipes caller bytes.
+     */
+    deriveKeyPair(seed: Uint8Array): Promise<MlKemKeyPair>;
+    /**
+     * FIPS 203 Encaps_internal with caller-supplied 32-byte randomness.
+     * Inputs are borrowed; this method snapshots but never wipes caller bytes.
+     */
+    encapsulateDeterministically(publicKey: Uint8Array, randomness: Uint8Array): Promise<MlKemEncapsulation>;
+}
 /** Compatibility aliases for the currently shipped ML-KEM-768 handshake. */
 export type MlKem768KeyPair = MlKemKeyPair;
 export type MlKem768Encapsulation = MlKemEncapsulation;
 export type MlKem768Decapsulation = MlKemDecapsulation;
 export type MlKem768Backend = MlKemBackend<768>;
-export declare const createMlKemBackend: <P extends MlKemParameterSet>(module: LibCrypto, suite: Readonly<MlKemSuiteDescriptor<P>>) => MlKemBackend<P>;
+export declare const createMlKemBackend: <P extends MlKemParameterSet>(module: LibCrypto, suite: Readonly<MlKemSuiteDescriptor<P>>) => DeterministicMlKemBackend<P>;
 /**
  * Temporary compatibility factory for the protocol-v3 ML-KEM-768 wire suite.
  */

package/lib/cryptography/mnemonic.d.ts

@@ -1,4 +1,41 @@
 import type { LibCrypto } from "./libcrypto";
+/**
+ * The result of a mnemonic check, shaped for a form field: `reason` is a
+ * displayable sentence naming the first problem found, and is absent when the
+ * phrase is usable.
+ */
+export interface MnemonicValidation {
+    ok: boolean;
+    reason?: string;
+}
+/**
+ * The canonical form of a recovery phrase, and part of the derivation
+ * contract: NFKD, then any run of whitespace collapsed to a single space,
+ * trimmed, lowercased.
+ *
+ * A phrase is transcribed by a human from paper, a password manager or a
+ * screenshot, so it arrives with a trailing newline, a double space, a soft
+ * wrap, or a capital first letter from a keyboard's autocapitalisation. All of
+ * those used to be rejected outright by the wordlist lookup. Normalising them
+ * away here means `"  Adapt  patrol "` and `"adapt patrol"` are the same
+ * phrase everywhere: for validation, and for the argon2id input that produces
+ * the seed. Every phrase that derived a key before this normalisation existed
+ * was already in canonical form, so no backup changes what it restores.
+ */
+export declare const normalizeMnemonic: (mnemonic: string) => string;
+/**
+ * Derive an argon2id seed from a passphrase.
+ *
+ * This is the low-level KDF: it applies NFKD only, because an arbitrary
+ * passphrase is not a mnemonic and must not be lowercased. Callers that hash a
+ * recovery phrase pass it through `normalizeMnemonic` first, as
+ * `keyPairFromMnemonic` does.
+ *
+ * @param mnemonic - Passphrase to stretch
+ * @param salt - Optional salt; a random one is generated when omitted
+ * @param module - Optional preloaded WASM module, otherwise one is loaded
+ * @returns The argon2id seed. The caller owns it and should wipe it.
+ */
 export declare const argon2: (mnemonic: string, salt?: Uint8Array, module?: LibCrypto) => Promise<Uint8Array>;
 /**
  * Generates a sequence of words chosen from a prespecified wordlist
@@ -15,6 +52,27 @@ export declare const argon2: (mnemonic: string, salt?: Uint8Array, module?: LibC
 export declare const generateMnemonic: (strength?: 128 | 160 | 192 | 224 | 256 | 288 | 320 | 352 | 384 | 416 | 448 | 480 | 512) => Promise<string>;
 export declare const mnemonicToEntropy: (mnemonic: string) => Promise<boolean>;
 export declare const validateMnemonic: (mnemonic: string) => Promise<boolean>;
+/**
+ * Everything about a recovery phrase that can be checked without hashing:
+ * word count and membership of the wordlist. Synchronous, so a form can call
+ * it on every keystroke and tell the user which word they mistyped.
+ *
+ * The checksum is deliberately not checked here — SHA-512 is only available
+ * asynchronously through Web Crypto. Use `validateMnemonicPhrase` (or
+ * `validateMnemonic`) once the phrase is structurally complete.
+ *
+ * @param words - The phrase as typed; normalisation is applied for you
+ * @returns `{ ok }`, plus a displayable `reason` for the first problem found
+ */
+export declare const validateMnemonicWords: (words: string) => MnemonicValidation;
+/**
+ * The full check: `validateMnemonicWords` plus the checksum, reported in the
+ * same shape so a form can show one message wherever the phrase went wrong.
+ *
+ * @param words - The phrase as typed; normalisation is applied for you
+ * @returns `{ ok }`, plus a displayable `reason` when the phrase is unusable
+ */
+export declare const validateMnemonicPhrase: (words: string) => Promise<MnemonicValidation>;
 /**
  * Generates an Ed25519 key pair from the provided mnemonic.
  * Optionally, you can strenthen the generation with a password.
@@ -22,8 +80,14 @@ export declare const validateMnemonic: (mnemonic: string) => Promise<boolean>;
  * The password is used as a salt for argon2id.
  * From the generated seed we extract the key pair.
  *
+ * The phrase is normalised first (see `normalizeMnemonic`), so how it was
+ * typed does not change the identity it restores. Nothing here is persisted:
+ * the seed, the salt and the encoded password are wiped before returning, and
+ * the phrase itself stays the caller's to forget.
+ *
  * @param mnemonic - Sequence of words from the predefined wordlist
  * @param password - Optional salt for the seed derivation
+ * @param module - Optional preloaded WASM module, otherwise one is loaded
  * @returns An Ed25519 key pair
  */
-export declare const keyPairFromMnemonic: (mnemonic: string, password?: string) => Promise<import("./interfaces").SignKeyPair>;
+export declare const keyPairFromMnemonic: (mnemonic: string, password?: string, module?: LibCrypto) => Promise<import("./interfaces").SignKeyPair>;

package/lib/db/outboxTypes.d.ts

@@ -0,0 +1,135 @@
+import type { Chunk, MessageData } from "./types";
+/** Durable resend metadata; secrets remain exclusively in the ratchet vault. */
+export interface OutboxLease {
+    transferId: string;
+    owner: string;
+    fence: number;
+}
+export interface OutboxRecipient {
+    peerId: string;
+    publicKey: string;
+    delivered: boolean;
+    cancelled?: boolean;
+}
+export interface OutboxManifest {
+    transferId: string;
+    senderPublicKey: string;
+    identityRevision: bigint;
+    roomId: string;
+    roomUrl: string;
+    policyHex: string;
+    channelLabel: string;
+    filename: string;
+    totalSize: number;
+    totalChunks: number;
+    stagedBytes: number;
+    writtenBytes: number;
+    localBytes: number;
+    createdAt: number;
+    updatedAt: number;
+    expiresAt: number;
+    phase: "staging" | "pending" | "sending";
+    merkleRootHex: string;
+    hashHex: string;
+    recipients: OutboxRecipient[];
+    owner: string;
+    fence: number;
+    leaseUntil: number;
+    lastError?: string;
+}
+export interface OutboxCreate {
+    transferId: string;
+    senderPublicKey: string;
+    roomId: string;
+    roomUrl: string;
+    policyHex: string;
+    channelLabel: string;
+    filename: string;
+    totalSize: number;
+    totalChunks: number;
+    stagedBytes: number;
+    recipients: Array<{
+        peerId: string;
+        publicKey: string;
+    }>;
+    owner: string;
+}
+export interface OutboxReceipt {
+    roomId: string;
+    peerId: string;
+    peerPublicKey: string;
+    transferId: string;
+    merkleRootHex: string;
+    chunkIndex?: number;
+    cancelled?: boolean;
+}
+export interface OutboxAckRecord {
+    transferId: string;
+    publicKey: string;
+    bitmap: Uint8Array;
+}
+export type OutboxRequest = {
+    kind: "create";
+    input: OutboxCreate;
+} | {
+    kind: "publish";
+    lease: OutboxLease;
+    merkleRootHex: string;
+    hashHex: string;
+    chunkHashes: ArrayBuffer;
+} | {
+    kind: "claim";
+    transferId: string;
+    owner: string;
+    senderPublicKey: string;
+    roomId: string;
+    roomUrl: string;
+    policyHex: string;
+} | {
+    kind: "selfChunk";
+    lease: OutboxLease;
+    chunk: Chunk;
+} | {
+    kind: "selfMessage";
+    lease: OutboxLease;
+    message: MessageData;
+} | {
+    kind: "renew";
+    lease: OutboxLease;
+} | {
+    kind: "release";
+    lease: OutboxLease;
+    lastError?: string;
+} | {
+    kind: "receipt";
+    receipt: OutboxReceipt;
+} | {
+    kind: "list";
+    senderPublicKey: string;
+    roomId?: string;
+} | {
+    kind: "remove";
+    transferId?: string;
+    roomId?: string;
+    lease?: OutboxLease;
+} | {
+    kind: "sweep";
+};
+export interface OutboxResponse {
+    accepted: boolean;
+    manifest?: OutboxManifest;
+    manifests?: OutboxManifest[];
+    lease?: OutboxLease;
+    chunkHashes?: ArrayBuffer;
+    acknowledgments?: OutboxAckRecord[];
+}
+export interface ReceiveActivity {
+    merkleRoot: string;
+    roomId: string;
+    fromPeerId: string;
+    lastActivityAt: number;
+    /** Deletion fences work queued before the terminal operation. */
+    deletedAt?: number;
+    writeToken?: string;
+    leaseUntil?: number;
+}