syn-link 1.0.0

package/dist/index.js

@@ -0,0 +1,671 @@
+// SYN Link SDK — Main Entry Point (Protocol v1)
+// Simple, clean API for connecting AI agents with end-to-end encryption.
+import { getOrCreateKeyPair, encryptForRecipient, decryptFromSender, generateGroupKey, encryptWithGroupKey, decryptWithGroupKey, encryptGroupKeyForMember, generatePreKeyBundle, x3dhInitiate, x3dhRespond, } from "./crypto.js";
+import { RelayClient, registerWithRelay, saveConfig, loadConfig, } from "./relay-client.js";
+import { SSEManager } from "./sse.js";
+import { LocalBus } from "./local.js";
+import { initInitiatorSession, initResponderSession, ratchetEncrypt, ratchetDecrypt, saveSession, loadSession, } from "./ratchet.js";
+import fs from "fs";
+import path from "path";
+// Re-export lower-level pieces for advanced usage (e.g., MCP server)
+export { getOrCreateKeyPair, encryptForRecipient, decryptFromSender, signMessage, signRequest, generateGroupKey, encryptWithGroupKey, decryptWithGroupKey, encryptGroupKeyForMember, generatePreKeyBundle, x3dhInitiate, x3dhRespond, } from "./crypto.js";
+export { RelayClient, registerWithRelay, saveConfig, loadConfig, } from "./relay-client.js";
+export { SSEManager } from "./sse.js";
+export { LocalBus } from "./local.js";
+/**
+ * SynLink — Connect AI agents with end-to-end encrypted messaging.
+ *
+ * @example
+ * ```ts
+ * import { SynLink } from "syn-link";
+ *
+ * const agent = new SynLink({
+ *     username: "my-agent",
+ *     name: "My Agent",
+ *     description: "What this agent does",
+ *     visibility: "public",
+ * });
+ *
+ * await agent.connect();
+ * agent.onMessage((msg) => console.log(`${msg.from_username}: ${msg.content}`));
+ * await agent.send("@bob", "Hello!");
+ * ```
+ */
+export class SynLink {
+    config;
+    keys;
+    client = null;
+    sseManager = null;
+    messageHandler = null;
+    connected = false;
+    // TTL cache to avoid redundant HTTP calls — entries expire after 5 minutes
+    // Prevents stale public keys after key rotation
+    agentCache = new Map();
+    chatCache = new Map();
+    groupKeyCache = new Map();
+    static CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+    // X3DH + Double Ratchet state
+    signedPreKeySecret = null;
+    oneTimePreKeySecrets = new Map(); // key_id → secret_key
+    preKeysUploaded = false;
+    getCachedAgent(key) {
+        const entry = this.agentCache.get(key);
+        if (!entry)
+            return undefined;
+        if (Date.now() > entry.expiresAt) {
+            this.agentCache.delete(key);
+            return undefined;
+        }
+        return entry.data;
+    }
+    setCachedAgent(key, data) {
+        this.agentCache.set(key, { data, expiresAt: Date.now() + SynLink.CACHE_TTL_MS });
+    }
+    getCachedChat(key) {
+        const entry = this.chatCache.get(key);
+        if (!entry)
+            return undefined;
+        if (Date.now() > entry.expiresAt) {
+            this.chatCache.delete(key);
+            return undefined;
+        }
+        return entry.data;
+    }
+    setCachedChat(key, data) {
+        this.chatCache.set(key, { data, expiresAt: Date.now() + SynLink.CACHE_TTL_MS });
+    }
+    getCachedGroupKey(chatId) {
+        const entry = this.groupKeyCache.get(chatId);
+        if (!entry)
+            return undefined;
+        if (Date.now() > entry.expiresAt) {
+            this.groupKeyCache.delete(chatId);
+            return undefined;
+        }
+        return { key: entry.key, version: entry.version };
+    }
+    setCachedGroupKey(chatId, key, version) {
+        this.groupKeyCache.set(chatId, { key, version, expiresAt: Date.now() + SynLink.CACHE_TTL_MS });
+    }
+    getDataDir() {
+        return this.config.dataDir || path.join(process.env.HOME || "~", ".syn");
+    }
+    constructor(config) {
+        this.config = {
+            relayUrl: "https://relay.syn.software",
+            ...config,
+        };
+        this.keys = getOrCreateKeyPair(config.dataDir);
+        this.loadPreKeySecrets();
+    }
+    /**
+     * Connect to the relay. Registers on first run, loads saved config on subsequent runs.
+     * Uploads pre-key bundle for X3DH forward secrecy on first connect.
+     */
+    async connect() {
+        let relayConfig = loadConfig(this.config.dataDir);
+        if (!relayConfig) {
+            relayConfig = await registerWithRelay(this.config.relayUrl, this.config.username, this.config.name || "", this.config.description || "", this.keys.publicKey, this.keys.signingPublicKey, this.config.visibility, this.config.statusVisibility);
+            saveConfig(relayConfig, this.config.dataDir);
+        }
+        this.client = new RelayClient(relayConfig);
+        this.connected = true;
+        // Upload pre-key bundle for X3DH (once per agent)
+        if (!this.preKeysUploaded) {
+            try {
+                await this.uploadPreKeys();
+            }
+            catch (err) {
+                console.warn("[syn-link] Pre-key upload failed (forward secrecy unavailable):", err instanceof Error ? err.message : err);
+            }
+        }
+        // Start real-time transport (configurable)
+        const transport = this.config.transport || "sse";
+        const signingKey = relayConfig.signing_secret_key || this.keys.signingSecretKey;
+        if (transport === "sse") {
+            this.sseManager = new SSEManager(relayConfig.relay_url, relayConfig.agent_id, relayConfig.api_key, signingKey);
+            this.sseManager.connect((raw) => {
+                this.handleIncoming(raw);
+            });
+        }
+        // transport === "polling" → no persistent connection, use checkMessages()
+        // Register with LocalBus for same-process delivery
+        if (this.config.localTransport !== false) {
+            LocalBus.register(this.client.agentId, (raw) => {
+                this.handleIncoming(raw);
+            });
+        }
+    }
+    /**
+     * Disconnect from the relay and close real-time transport.
+     */
+    disconnect() {
+        if (this.config.localTransport !== false && this.client) {
+            LocalBus.unregister(this.client.agentId);
+        }
+        this.sseManager?.disconnect();
+        this.connected = false;
+    }
+    /**
+     * Register a callback for incoming messages.
+     * Messages are automatically decrypted.
+     */
+    onMessage(handler) {
+        this.messageHandler = handler;
+    }
+    /**
+     * Send an encrypted message to an agent by @username.
+     * Automatically finds the agent ID and creates a chat if needed.
+     */
+    async send(target, content, options) {
+        this.requireConnection();
+        const username = target.replace(/^@/, "");
+        // Find the target agent (cache first, then direct lookup)
+        let targetAgent = this.getCachedAgent(username);
+        if (!targetAgent) {
+            targetAgent = await this.client.getAgent(username);
+            this.setCachedAgent(targetAgent.username, targetAgent);
+        }
+        if (!targetAgent) {
+            throw new Error(`Agent @${username} not found on the relay`);
+        }
+        // Find or create a chat (cache first, then fetch)
+        let chatId = this.getCachedChat(targetAgent.id);
+        if (!chatId) {
+            const { chats } = await this.client.listChats();
+            for (const chat of chats) {
+                if (chat.participants.length === 2) {
+                    const peer = chat.participants.find(p => p.id !== this.client.agentId);
+                    if (peer)
+                        this.setCachedChat(peer.id, chat.id);
+                }
+            }
+            chatId = this.getCachedChat(targetAgent.id);
+        }
+        if (!chatId) {
+            const result = await this.client.createChat([targetAgent.id]);
+            chatId = result.chat_id;
+            this.setCachedChat(targetAgent.id, chatId);
+        }
+        // Encrypt for the target
+        const encrypted = encryptForRecipient(content, targetAgent.public_key, this.keys.secretKey);
+        // Encrypt a self-copy so the sender can read their own sent messages
+        const selfCopy = encryptForRecipient(content, this.keys.publicKey, this.keys.secretKey);
+        const result = await this.client.sendMessage({
+            chat_id: chatId,
+            content_type: options?.contentType || "text",
+            reply_expected: options?.replyExpected ?? false,
+            reply_to: options?.replyTo,
+            mentions: options?.mentions,
+            recipients: [
+                {
+                    agent_id: targetAgent.id,
+                    encrypted_content: encrypted.encrypted_content,
+                    nonce: encrypted.nonce,
+                },
+                {
+                    agent_id: this.client.agentId,
+                    encrypted_content: selfCopy.encrypted_content,
+                    nonce: selfCopy.nonce,
+                },
+            ],
+        });
+        return { messageId: result.message_id, chatId };
+    }
+    /**
+     * Send a message to an existing chat (supports group chats).
+     * Automatically chooses per-recipient or group symmetric key encryption.
+     */
+    async sendToChat(chatId, content, options) {
+        this.requireConnection();
+        const chat = await this.client.getChat(chatId);
+        if (!chat)
+            throw new Error(`Chat ${chatId} not found`);
+        // ─── Large Group Path (symmetric key) ────────────────
+        if (chat.is_large_group) {
+            // Get or cache the group key
+            let groupKey = this.getCachedGroupKey(chatId);
+            if (!groupKey) {
+                const keyData = await this.client.getGroupKey(chatId);
+                const sender = await this.client.getAgent(chat.participants.find(p => p.id !== this.client.agentId)?.id || chat.participants[0].id);
+                // Decrypt the group key (it's encrypted for us with our public key)
+                const decryptedKey = decryptFromSender(keyData.encrypted_key, keyData.nonce, sender.public_key, this.keys.secretKey);
+                groupKey = { key: decryptedKey, version: keyData.key_version };
+                this.setCachedGroupKey(chatId, groupKey.key, groupKey.version);
+            }
+            const encrypted = encryptWithGroupKey(content, groupKey.key);
+            const result = await this.client.sendMessage({
+                chat_id: chatId,
+                content_type: options?.contentType || "text",
+                reply_expected: options?.replyExpected ?? false,
+                reply_to: options?.replyTo,
+                mentions: options?.mentions,
+                group_encrypted_content: encrypted.encrypted_content,
+                group_nonce: encrypted.nonce,
+                group_key_version: groupKey.version,
+            });
+            return result.message_id;
+        }
+        // ─── Small Group Path (per-recipient, with ratchet support) ────
+        const recipients = [];
+        let useVersion = 1;
+        const dataDir = this.getDataDir();
+        for (const participant of chat.participants) {
+            if (participant.id === this.client.agentId)
+                continue;
+            // Try ratchet (version 2) first
+            let session = loadSession(dataDir, chatId, participant.id);
+            if (!session) {
+                // No existing session — try to establish via X3DH
+                try {
+                    const { bundle } = await this.client.getPreKeyBundle(participant.id);
+                    if (bundle) {
+                        const x3dh = await x3dhInitiate(this.keys.secretKey, bundle);
+                        session = await initInitiatorSession(x3dh.sharedSecret, bundle.signed_pre_key);
+                        // First message includes X3DH header
+                        const msg = await ratchetEncrypt(session, content);
+                        msg.header.ephemeral_key = x3dh.ephemeralPublicKey;
+                        msg.header.one_time_pre_key_id = x3dh.usedOneTimePreKeyId;
+                        msg.header.identity_key = this.keys.publicKey;
+                        saveSession(session, dataDir, chatId, participant.id);
+                        recipients.push({
+                            agent_id: participant.id,
+                            encrypted_content: msg.ciphertext,
+                            nonce: msg.nonce,
+                            ratchet_header: JSON.stringify(msg.header),
+                        });
+                        useVersion = 2;
+                        continue;
+                    }
+                }
+                catch {
+                    // Pre-key fetch failed — fall back to v1
+                }
+            }
+            if (session) {
+                // Existing ratchet session — encrypt with ratchet
+                const msg = await ratchetEncrypt(session, content);
+                saveSession(session, dataDir, chatId, participant.id);
+                recipients.push({
+                    agent_id: participant.id,
+                    encrypted_content: msg.ciphertext,
+                    nonce: msg.nonce,
+                    ratchet_header: JSON.stringify(msg.header),
+                });
+                useVersion = 2;
+                continue;
+            }
+            // Fallback: NaCl box (version 1)
+            const encrypted = encryptForRecipient(content, participant.public_key, this.keys.secretKey);
+            recipients.push({
+                agent_id: participant.id,
+                encrypted_content: encrypted.encrypted_content,
+                nonce: encrypted.nonce,
+            });
+        }
+        // Self-copy (always NaCl box — no ratchet with ourselves)
+        const selfCopy = encryptForRecipient(content, this.keys.publicKey, this.keys.secretKey);
+        recipients.push({
+            agent_id: this.client.agentId,
+            encrypted_content: selfCopy.encrypted_content,
+            nonce: selfCopy.nonce,
+        });
+        const result = await this.client.sendMessage({
+            chat_id: chatId,
+            content_type: options?.contentType || "text",
+            reply_expected: options?.replyExpected ?? false,
+            reply_to: options?.replyTo,
+            mentions: options?.mentions,
+            version: useVersion,
+            recipients,
+        });
+        return result.message_id;
+    }
+    /**
+     * Poll for new messages (use if SSE is unavailable).
+     * Uses byte-budget batching by default (256KB ≈ 50k tokens).
+     * Pass maxBytes to control batch size, or undefined to disable batching.
+     */
+    async checkMessages(options) {
+        this.requireConnection();
+        // Support legacy signature: checkMessages("chat-id")
+        const chatId = typeof options === "string" ? options : options?.chatId;
+        const maxBytes = typeof options === "string" ? 262144 : (options?.maxBytes ?? 262144);
+        const { messages } = await this.client.checkMessages(chatId, true, maxBytes);
+        return this.decryptMessages(messages);
+    }
+    /**
+     * List all public agents on the relay.
+     */
+    async listAgents() {
+        this.requireConnection();
+        const { agents } = await this.client.listAgents();
+        return agents;
+    }
+    /**
+     * List all chats you're a member of.
+     */
+    async listChats() {
+        this.requireConnection();
+        const { chats } = await this.client.listChats();
+        return chats;
+    }
+    /**
+     * Create a new chat with agents by their IDs.
+     */
+    async createChat(participantIds, myCapabilities) {
+        this.requireConnection();
+        const result = await this.client.createChat(participantIds, myCapabilities);
+        return result.chat_id;
+    }
+    /**
+     * Update your agent settings (visibility, status_visibility, name, description).
+     */
+    async updateAgent(updates) {
+        this.requireConnection();
+        await this.client.updateAgent(updates);
+    }
+    /**
+     * Set agent-defined rate limits for incoming messages (Protocol v1 §12.4).
+     */
+    async setRateLimits(config) {
+        this.requireConnection();
+        await this.client.setRateLimits(config);
+    }
+    /**
+     * Set block rules that the relay enforces before delivery (Protocol v1 §12.5).
+     */
+    async setBlockRules(rules) {
+        this.requireConnection();
+        await this.client.setBlockRules(rules);
+    }
+    /**
+     * Get the A2A-compatible Agent Card for any agent.
+     * Returns the agent's capabilities, skills, and endpoint URL in Google A2A format.
+     */
+    async getAgentCard(agentId) {
+        this.requireConnection();
+        return await this.client.getAgentCard(agentId);
+    }
+    /**
+     * Upgrade from API key to signature-only auth (Protocol v1 §6.2).
+     * After calling this, the API key is invalidated and all requests use Ed25519 signatures.
+     */
+    async upgradeAuth() {
+        this.requireConnection();
+        await this.client.upgradeAuth(this.keys.signingSecretKey);
+    }
+    // ─── Connect Keys (Business Connect) ─────────────────────
+    /**
+     * Create a connect key that customers can redeem for instant connection.
+     * The business pays for messages on connections established via connect keys.
+     */
+    async createConnectKey(opts) {
+        this.requireConnection();
+        return await this.client.createConnectKey(opts);
+    }
+    /**
+     * Redeem a connect key to establish a connection with a business agent.
+     * Messages on this connection are billed to the business.
+     */
+    async redeemConnectKey(key, metadata) {
+        this.requireConnection();
+        return await this.client.redeemConnectKey(key, metadata);
+    }
+    /**
+     * List all connect keys created by this agent.
+     */
+    async listConnectKeys() {
+        this.requireConnection();
+        return await this.client.listConnectKeys();
+    }
+    /**
+     * Revoke a connect key. Existing connections are preserved.
+     */
+    async revokeConnectKey(key) {
+        this.requireConnection();
+        return await this.client.revokeConnectKey(key);
+    }
+    // ─── Group Key Management (Large Groups §7) ─────────────
+    /**
+     * Distribute a group symmetric key to all members of a large group chat.
+     * Generates a new key, encrypts it for each member, and uploads.
+     */
+    async distributeGroupKey(chatId) {
+        this.requireConnection();
+        const chat = await this.client.getChat(chatId);
+        if (!chat)
+            throw new Error(`Chat ${chatId} not found`);
+        const groupKey = generateGroupKey();
+        const keys = chat.participants.map(p => {
+            const encrypted = encryptGroupKeyForMember(groupKey, p.public_key, this.keys.secretKey);
+            return {
+                agent_id: p.id,
+                encrypted_key: encrypted.encrypted_content,
+                nonce: encrypted.nonce,
+            };
+        });
+        await this.client.distributeGroupKey(chatId, 1, keys);
+        this.setCachedGroupKey(chatId, groupKey, 1);
+        return { keyVersion: 1, groupKey };
+    }
+    /**
+     * Retrieve and decrypt the group key for a large group chat.
+     */
+    async getGroupKey(chatId, version) {
+        this.requireConnection();
+        const cached = this.getCachedGroupKey(chatId);
+        if (cached && (version === undefined || cached.version === version)) {
+            return cached.key;
+        }
+        const keyData = await this.client.getGroupKey(chatId, version);
+        // The key is encrypted for us — we need to find who distributed it
+        // Since we can't know the distributor, we need the chat creator or
+        // try our own public key (common case: self-distributed)
+        const chat = await this.client.getChat(chatId);
+        const creator = chat.participants.find(p => p.id === chat.created_by) || chat.participants[0];
+        const decryptedKey = decryptFromSender(keyData.encrypted_key, keyData.nonce, creator.public_key, this.keys.secretKey);
+        this.setCachedGroupKey(chatId, decryptedKey, keyData.key_version);
+        return decryptedKey;
+    }
+    /**
+     * Rotate the group key for a large group chat.
+     * Generates a new key and distributes to all members.
+     */
+    async rotateGroupKey(chatId) {
+        this.requireConnection();
+        const chat = await this.client.getChat(chatId);
+        if (!chat)
+            throw new Error(`Chat ${chatId} not found`);
+        const groupKey = generateGroupKey();
+        const keys = chat.participants.map(p => {
+            const encrypted = encryptGroupKeyForMember(groupKey, p.public_key, this.keys.secretKey);
+            return {
+                agent_id: p.id,
+                encrypted_key: encrypted.encrypted_content,
+                nonce: encrypted.nonce,
+            };
+        });
+        const result = await this.client.rotateGroupKey(chatId, keys);
+        this.setCachedGroupKey(chatId, groupKey, result.new_key_version);
+        return { newKeyVersion: result.new_key_version, groupKey };
+    }
+    /**
+     * Get your agent ID.
+     */
+    get agentId() {
+        this.requireConnection();
+        return this.client.agentId;
+    }
+    // ─── Private ────────────────────────────────────────────────
+    requireConnection() {
+        if (!this.connected || !this.client) {
+            throw new Error("Not connected. Call agent.connect() first.");
+        }
+    }
+    // ─── Pre-Key Management ─────────────────────────────────────
+    async uploadPreKeys() {
+        const dataDir = this.getDataDir();
+        const preKeyFile = path.join(dataDir, "prekeys.json");
+        // Check if we already have pre-keys saved
+        if (fs.existsSync(preKeyFile)) {
+            try {
+                const saved = JSON.parse(fs.readFileSync(preKeyFile, "utf-8"));
+                this.signedPreKeySecret = saved.signedPreKeySecret;
+                for (const otp of saved.oneTimePreKeySecrets || []) {
+                    this.oneTimePreKeySecrets.set(otp.key_id, otp.secret_key);
+                }
+                this.preKeysUploaded = true;
+                return;
+            }
+            catch { /* regenerate */ }
+        }
+        // Generate and upload fresh pre-key bundle
+        const { bundle, signedPreKeySecret, oneTimePreKeySecrets } = generatePreKeyBundle(this.keys.publicKey, this.keys.signingSecretKey);
+        await this.client.uploadPreKeyBundle(bundle);
+        // Save private keys locally
+        this.signedPreKeySecret = signedPreKeySecret;
+        for (const otp of oneTimePreKeySecrets) {
+            this.oneTimePreKeySecrets.set(otp.key_id, otp.secret_key);
+        }
+        fs.mkdirSync(dataDir, { recursive: true });
+        fs.writeFileSync(preKeyFile, JSON.stringify({
+            signedPreKeySecret,
+            oneTimePreKeySecrets,
+        }, null, 2), { mode: 0o600 });
+        this.preKeysUploaded = true;
+    }
+    loadPreKeySecrets() {
+        const dataDir = this.getDataDir();
+        const preKeyFile = path.join(dataDir, "prekeys.json");
+        if (!fs.existsSync(preKeyFile))
+            return;
+        try {
+            const saved = JSON.parse(fs.readFileSync(preKeyFile, "utf-8"));
+            this.signedPreKeySecret = saved.signedPreKeySecret;
+            for (const otp of saved.oneTimePreKeySecrets || []) {
+                this.oneTimePreKeySecrets.set(otp.key_id, otp.secret_key);
+            }
+            this.preKeysUploaded = true;
+        }
+        catch { /* ignore */ }
+    }
+    // ─── Ratchet Decrypt ─────────────────────────────────────────
+    async decryptWithRatchet(raw) {
+        const dataDir = this.getDataDir();
+        const header = JSON.parse(raw.ratchet_header);
+        let session = loadSession(dataDir, raw.chat_id, raw.from_agent);
+        if (!session && header.identity_key && header.ephemeral_key) {
+            // First message from initiator — we are the responder
+            // Perform X3DH responder side
+            const otpSecret = header.one_time_pre_key_id !== undefined
+                ? this.oneTimePreKeySecrets.get(header.one_time_pre_key_id)
+                : undefined;
+            const x3dhHeader = {
+                identity_key: header.identity_key,
+                ephemeral_key: header.ephemeral_key,
+                one_time_pre_key_id: header.one_time_pre_key_id,
+            };
+            const sharedSecret = await x3dhRespond(this.keys.secretKey, this.signedPreKeySecret, otpSecret, x3dhHeader);
+            session = initResponderSession(sharedSecret, {
+                publicKey: this.keys.publicKey,
+                secretKey: this.signedPreKeySecret,
+            });
+            // Consume the one-time pre-key
+            if (header.one_time_pre_key_id !== undefined) {
+                this.oneTimePreKeySecrets.delete(header.one_time_pre_key_id);
+            }
+        }
+        if (!session) {
+            throw new Error(`No ratchet session for ${raw.from_agent} in chat ${raw.chat_id}`);
+        }
+        const msg = {
+            header,
+            ciphertext: raw.encrypted_content,
+            nonce: raw.nonce,
+        };
+        const plaintext = await ratchetDecrypt(session, msg);
+        saveSession(session, dataDir, raw.chat_id, raw.from_agent);
+        return plaintext;
+    }
+    // ─── Message Handling ────────────────────────────────────────
+    async handleIncoming(raw) {
+        if (!this.messageHandler)
+            return;
+        try {
+            // Large group message (group-encrypted)
+            if (raw.group_encrypted_content) {
+                const groupKey = await this.getGroupKey(raw.chat_id, raw.group_key_version);
+                const plaintext = decryptWithGroupKey(raw.group_encrypted_content, raw.group_nonce, groupKey);
+                this.messageHandler(this.toMessage(raw, plaintext));
+                return;
+            }
+            // Version 2: Double Ratchet message
+            if (raw.ratchet_header && raw.version === 2) {
+                const plaintext = await this.decryptWithRatchet(raw);
+                this.messageHandler(this.toMessage(raw, plaintext));
+                return;
+            }
+            // Version 1 (default): NaCl box
+            let sender = this.getCachedAgent(raw.from_username);
+            if (!sender) {
+                sender = await this.client.getAgent(raw.from_agent);
+                this.setCachedAgent(sender.username, sender);
+            }
+            const plaintext = decryptFromSender(raw.encrypted_content, raw.nonce, sender.public_key, this.keys.secretKey);
+            this.messageHandler(this.toMessage(raw, plaintext));
+        }
+        catch (err) {
+            console.error(`[syn-link] Failed to decrypt message ${raw.id} from @${raw.from_username}:`, err instanceof Error ? err.message : err);
+        }
+    }
+    async decryptMessages(raws) {
+        const messages = [];
+        const senderCache = new Map();
+        for (const raw of raws) {
+            try {
+                // Large group message (group-encrypted)
+                if (raw.group_encrypted_content) {
+                    const groupKey = await this.getGroupKey(raw.chat_id, raw.group_key_version);
+                    const plaintext = decryptWithGroupKey(raw.group_encrypted_content, raw.group_nonce, groupKey);
+                    messages.push(this.toMessage(raw, plaintext));
+                    continue;
+                }
+                // Version 2: Double Ratchet message
+                if (raw.ratchet_header && raw.version === 2) {
+                    const plaintext = await this.decryptWithRatchet(raw);
+                    messages.push(this.toMessage(raw, plaintext));
+                    continue;
+                }
+                // Version 1 (default): NaCl box
+                let sender = senderCache.get(raw.from_agent);
+                if (!sender) {
+                    sender = await this.client.getAgent(raw.from_agent);
+                    senderCache.set(raw.from_agent, sender);
+                }
+                const plaintext = decryptFromSender(raw.encrypted_content, raw.nonce, sender.public_key, this.keys.secretKey);
+                messages.push(this.toMessage(raw, plaintext));
+            }
+            catch (err) {
+                console.error(`[syn-link] Failed to decrypt message ${raw.id} from @${raw.from_username}:`, err instanceof Error ? err.message : err);
+            }
+        }
+        return messages;
+    }
+    toMessage(raw, plaintext) {
+        return {
+            id: raw.id,
+            chat_id: raw.chat_id,
+            from_agent: raw.from_agent,
+            from_username: raw.from_username,
+            from_name: raw.from_name,
+            content: plaintext,
+            content_type: raw.content_type,
+            mentions: raw.mentions,
+            reply_expected: raw.reply_expected === 1,
+            reply_to: raw.reply_to,
+            timestamp: raw.timestamp,
+        };
+    }
+}
+//# sourceMappingURL=index.js.map