ts-mls 1.0.2

package/dist/src/leafNode.d.ts

@@ -0,0 +1,78 @@
+import { Capabilities } from "./capabilities";
+import { Decoder } from "./codec/tlsDecoder";
+import { Encoder } from "./codec/tlsEncoder";
+import { Credential } from "./credential";
+import { Signature } from "./crypto/signature";
+import { Extension } from "./extension";
+import { LeafNodeSourceName } from "./leafNodeSource";
+import { Lifetime } from "./lifetime";
+export type LeafNodeData = {
+    hpkePublicKey: Uint8Array;
+    signaturePublicKey: Uint8Array;
+    credential: Credential;
+    capabilities: Capabilities;
+};
+export declare const encodeLeafNodeData: Encoder<LeafNodeData>;
+export declare const decodeLeafNodeData: Decoder<LeafNodeData>;
+export type LeafNodeInfo = LeafNodeInfoKeyPackage | LeafNodeInfoUpdate | LeafNodeInfoCommit;
+export type LeafNodeInfoKeyPackage = {
+    leafNodeSource: "key_package";
+    lifetime: Lifetime;
+};
+export type LeafNodeInfoUpdate = {
+    leafNodeSource: "update";
+};
+export type LeafNodeInfoCommit = {
+    leafNodeSource: "commit";
+    parentHash: Uint8Array;
+};
+export declare const encodeLeafNodeInfoLifetime: Encoder<LeafNodeInfoKeyPackage>;
+export declare const encodeLeafNodeInfoUpdate: Encoder<LeafNodeInfoUpdate>;
+export declare const encodeLeafNodeInfoCommit: Encoder<LeafNodeInfoCommit>;
+export declare const encodeLeafNodeInfo: Encoder<LeafNodeInfo>;
+export declare const decodeLeafNodeInfoLifetime: Decoder<LeafNodeInfoKeyPackage>;
+export declare const decodeLeafNodeInfoCommit: Decoder<LeafNodeInfoCommit>;
+export declare const decodeLeafNodeInfo: Decoder<LeafNodeInfo>;
+export type LeafNodeExtensions = {
+    extensions: Extension[];
+};
+export declare const encodeLeafNodeExtensions: Encoder<LeafNodeExtensions>;
+export declare const decodeLeafNodeExtensions: Decoder<LeafNodeExtensions>;
+type GroupIdLeafIndex = {
+    leafNodeSource: Exclude<LeafNodeSourceName, "key_package">;
+    groupId: Uint8Array;
+    leafIndex: number;
+};
+export declare const encodeGroupIdLeafIndex: Encoder<GroupIdLeafIndex>;
+export type LeafNodeGroupInfo = GroupIdLeafIndex | {
+    leafNodeSource: "key_package";
+};
+export declare const encodeLeafNodeGroupInfo: Encoder<LeafNodeGroupInfo>;
+export type LeafNodeTBS = LeafNodeData & LeafNodeInfo & LeafNodeExtensions & {
+    info: LeafNodeGroupInfo;
+};
+export type LeafNodeTBSCommit = LeafNodeData & LeafNodeInfoCommit & LeafNodeExtensions & {
+    info: GroupIdLeafIndex;
+};
+export type LeafNodeTBSKeyPackage = LeafNodeData & LeafNodeInfoKeyPackage & LeafNodeExtensions & {
+    info: {
+        leafNodeSource: "key_package";
+    };
+};
+export declare const encodeLeafNodeTBS: Encoder<LeafNodeTBS>;
+export type LeafNode = LeafNodeData & LeafNodeInfo & LeafNodeExtensions & {
+    signature: Uint8Array;
+};
+export declare const encodeLeafNode: Encoder<LeafNode>;
+export declare const decodeLeafNode: Decoder<LeafNode>;
+export type LeafNodeKeyPackage = LeafNode & LeafNodeInfoKeyPackage;
+export declare const decodeLeafNodeKeyPackage: Decoder<LeafNodeKeyPackage>;
+export type LeafNodeCommit = LeafNode & LeafNodeInfoCommit;
+export declare const decodeLeafNodeCommit: Decoder<LeafNodeCommit>;
+export type LeafNodeUpdate = LeafNode & LeafNodeInfoUpdate;
+export declare const decodeLeafNodeUpdate: Decoder<LeafNodeUpdate>;
+export declare function signLeafNodeCommit(tbs: LeafNodeTBSCommit, signaturePrivateKey: Uint8Array, sig: Signature): Promise<LeafNodeCommit>;
+export declare function signLeafNodeKeyPackage(tbs: LeafNodeTBSKeyPackage, signaturePrivateKey: Uint8Array, sig: Signature): Promise<LeafNodeKeyPackage>;
+export declare function verifyLeafNodeSignature(leaf: LeafNode, groupId: Uint8Array, leafIndex: number, sig: Signature): Promise<boolean>;
+export declare function verifyLeafNodeSignatureKeyPackage(leaf: LeafNodeKeyPackage, sig: Signature): Promise<boolean>;
+export {};

package/dist/src/leafNode.js

@@ -0,0 +1,87 @@
+import { decodeCapabilities, encodeCapabilities } from "./capabilities";
+import { encodeUint32 } from "./codec/number";
+import { mapDecoders, mapDecoder, flatMapDecoder, succeedDecoder, mapDecoderOption } from "./codec/tlsDecoder";
+import { contramapEncoders, contramapEncoder } from "./codec/tlsEncoder";
+import { encodeVarLenData, decodeVarLenData, encodeVarLenType, decodeVarLenType } from "./codec/variableLength";
+import { encodeCredential, decodeCredential } from "./credential";
+import { signWithLabel, verifyWithLabel } from "./crypto/signature";
+import { encodeExtension, decodeExtension } from "./extension";
+import { encodeLeafNodeSource, decodeLeafNodeSource } from "./leafNodeSource";
+import { encodeLifetime, decodeLifetime } from "./lifetime";
+export const encodeLeafNodeData = contramapEncoders([encodeVarLenData, encodeVarLenData, encodeCredential, encodeCapabilities], (data) => [data.hpkePublicKey, data.signaturePublicKey, data.credential, data.capabilities]);
+export const decodeLeafNodeData = mapDecoders([decodeVarLenData, decodeVarLenData, decodeCredential, decodeCapabilities], (hpkePublicKey, signaturePublicKey, credential, capabilities) => ({
+    hpkePublicKey,
+    signaturePublicKey,
+    credential,
+    capabilities,
+}));
+export const encodeLeafNodeInfoLifetime = contramapEncoders([encodeLeafNodeSource, encodeLifetime], (info) => ["key_package", info.lifetime]);
+export const encodeLeafNodeInfoUpdate = contramapEncoder(encodeLeafNodeSource, (i) => i.leafNodeSource);
+export const encodeLeafNodeInfoCommit = contramapEncoders([encodeLeafNodeSource, encodeVarLenData], (info) => ["commit", info.parentHash]);
+export const encodeLeafNodeInfo = (info) => {
+    switch (info.leafNodeSource) {
+        case "key_package":
+            return encodeLeafNodeInfoLifetime(info);
+        case "update":
+            return encodeLeafNodeInfoUpdate(info);
+        case "commit":
+            return encodeLeafNodeInfoCommit(info);
+    }
+};
+export const decodeLeafNodeInfoLifetime = mapDecoder(decodeLifetime, (lifetime) => ({
+    leafNodeSource: "key_package",
+    lifetime,
+}));
+export const decodeLeafNodeInfoCommit = mapDecoders([decodeVarLenData], (parentHash) => ({
+    leafNodeSource: "commit",
+    parentHash,
+}));
+export const decodeLeafNodeInfo = flatMapDecoder(decodeLeafNodeSource, (leafNodeSource) => {
+    switch (leafNodeSource) {
+        case "key_package":
+            return decodeLeafNodeInfoLifetime;
+        case "update":
+            return succeedDecoder({ leafNodeSource });
+        case "commit":
+            return decodeLeafNodeInfoCommit;
+    }
+});
+export const encodeLeafNodeExtensions = contramapEncoder(encodeVarLenType(encodeExtension), (ext) => ext.extensions);
+export const decodeLeafNodeExtensions = mapDecoder(decodeVarLenType(decodeExtension), (extensions) => ({ extensions }));
+export const encodeGroupIdLeafIndex = contramapEncoders([encodeVarLenData, encodeUint32], (g) => [g.groupId, g.leafIndex]);
+export const encodeLeafNodeGroupInfo = (info) => {
+    switch (info.leafNodeSource) {
+        case "key_package":
+            return new Uint8Array();
+        case "update":
+        case "commit":
+            return encodeGroupIdLeafIndex(info);
+    }
+};
+export const encodeLeafNodeTBS = contramapEncoders([encodeLeafNodeData, encodeLeafNodeInfo, encodeLeafNodeExtensions, encodeLeafNodeGroupInfo], (tbs) => [tbs, tbs, tbs, tbs.info]);
+export const encodeLeafNode = contramapEncoders([encodeLeafNodeData, encodeLeafNodeInfo, encodeLeafNodeExtensions, encodeVarLenData], (leafNode) => [leafNode, leafNode, leafNode, leafNode.signature]);
+export const decodeLeafNode = mapDecoders([decodeLeafNodeData, decodeLeafNodeInfo, decodeLeafNodeExtensions, decodeVarLenData], (data, info, extensions, signature) => ({
+    ...data,
+    ...info,
+    ...extensions,
+    signature,
+}));
+export const decodeLeafNodeKeyPackage = mapDecoderOption(decodeLeafNode, (ln) => ln.leafNodeSource === "key_package" ? ln : undefined);
+export const decodeLeafNodeCommit = mapDecoderOption(decodeLeafNode, (ln) => ln.leafNodeSource === "commit" ? ln : undefined);
+export const decodeLeafNodeUpdate = mapDecoderOption(decodeLeafNode, (ln) => ln.leafNodeSource === "update" ? ln : undefined);
+function toTbs(leafNode, groupId, leafIndex) {
+    return { ...leafNode, info: { leafNodeSource: leafNode.leafNodeSource, groupId, leafIndex } };
+}
+export async function signLeafNodeCommit(tbs, signaturePrivateKey, sig) {
+    return { ...tbs, signature: await signWithLabel(signaturePrivateKey, "LeafNodeTBS", encodeLeafNodeTBS(tbs), sig) };
+}
+export async function signLeafNodeKeyPackage(tbs, signaturePrivateKey, sig) {
+    return { ...tbs, signature: await signWithLabel(signaturePrivateKey, "LeafNodeTBS", encodeLeafNodeTBS(tbs), sig) };
+}
+export function verifyLeafNodeSignature(leaf, groupId, leafIndex, sig) {
+    return verifyWithLabel(leaf.signaturePublicKey, "LeafNodeTBS", encodeLeafNodeTBS(toTbs(leaf, groupId, leafIndex)), leaf.signature, sig);
+}
+export function verifyLeafNodeSignatureKeyPackage(leaf, sig) {
+    return verifyWithLabel(leaf.signaturePublicKey, "LeafNodeTBS", encodeLeafNodeTBS({ ...leaf, info: { leafNodeSource: leaf.leafNodeSource } }), leaf.signature, sig);
+}
+//# sourceMappingURL=leafNode.js.map

package/dist/src/leafNode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leafNode.js","sourceRoot":"","sources":["../../src/leafNode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC7C,OAAO,EAAW,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACvH,OAAO,EAAW,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAC/G,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAc,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAa,aAAa,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAC9E,OAAO,EAAa,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAsB,MAAM,kBAAkB,CAAA;AACjG,OAAO,EAAY,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AASrE,MAAM,CAAC,MAAM,kBAAkB,GAA0B,iBAAiB,CACxE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,EAC1E,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAU,CACrG,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAA0B,WAAW,CAClE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,EAC1E,CAAC,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;IAChE,aAAa;IACb,kBAAkB;IAClB,UAAU;IACV,YAAY;CACb,CAAC,CACH,CAAA;AAOD,MAAM,CAAC,MAAM,0BAA0B,GAAoC,iBAAiB,CAC1F,CAAC,oBAAoB,EAAE,cAAc,CAAC,EACtC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAU,CAClD,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAgC,gBAAgB,CACnF,oBAAoB,EACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CACxB,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAgC,iBAAiB,CACpF,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,EACxC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAU,CAC/C,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAA0B,CAAC,IAAI,EAAE,EAAE;IAChE,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,KAAK,aAAa;YAChB,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAA;QACzC,KAAK,QAAQ;YACX,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAA;QACvC,KAAK,QAAQ;YACX,OAAO,wBAAwB,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAoC,UAAU,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACnH,cAAc,EAAE,aAAa;IAC7B,QAAQ;CACT,CAAC,CAAC,CAAA;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAgC,WAAW,CAAC,CAAC,gBAAgB,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACpH,cAAc,EAAE,QAAQ;IACxB,UAAU;CACX,CAAC,CAAC,CAAA;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAA0B,cAAc,CACrE,oBAAoB,EACpB,CAAC,cAAc,EAAyB,EAAE;IACxC,QAAQ,cAAc,EAAE,CAAC;QACvB,KAAK,aAAa;YAChB,OAAO,0BAA0B,CAAA;QACnC,KAAK,QAAQ;YACX,OAAO,cAAc,CAAC,EAAE,cAAc,EAAE,CAAC,CAAA;QAC3C,KAAK,QAAQ;YACX,OAAO,wBAAwB,CAAA;IACnC,CAAC;AACH,CAAC,CACF,CAAA;AAID,MAAM,CAAC,MAAM,wBAAwB,GAAgC,gBAAgB,CACnF,gBAAgB,CAAC,eAAe,CAAC,EACjC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CACxB,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAgC,UAAU,CAC7E,gBAAgB,CAAC,eAAe,CAAC,EACjC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CACjC,CAAA;AAQD,MAAM,CAAC,MAAM,sBAAsB,GAA8B,iBAAiB,CAChF,CAAC,gBAAgB,EAAE,YAAY,CAAC,EAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAU,CACzC,CAAA;AAID,MAAM,CAAC,MAAM,uBAAuB,GAA+B,CAAC,IAAI,EAAE,EAAE;IAC1E,QAAQ,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,KAAK,aAAa;YAChB,OAAO,IAAI,UAAU,EAAE,CAAA;QACzB,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAA;IACvC,CAAC;AACH,CAAC,CAAA;AAUD,MAAM,CAAC,MAAM,iBAAiB,GAAyB,iBAAiB,CACtE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,uBAAuB,CAAC,EAC3F,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAU,CAC5C,CAAA;AAID,MAAM,CAAC,MAAM,cAAc,GAAsB,iBAAiB,CAChE,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,gBAAgB,CAAC,EACpF,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAU,CAC1E,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAsB,WAAW,CAC1D,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,gBAAgB,CAAC,EACpF,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACtC,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,UAAU;IACb,SAAS;CACV,CAAC,CACH,CAAA;AAID,MAAM,CAAC,MAAM,wBAAwB,GAAgC,gBAAgB,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3G,EAAE,CAAC,cAAc,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CACrD,CAAA;AAID,MAAM,CAAC,MAAM,oBAAoB,GAA4B,gBAAgB,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CACnG,EAAE,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAChD,CAAA;AAID,MAAM,CAAC,MAAM,oBAAoB,GAA4B,gBAAgB,CAAC,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CACnG,EAAE,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAChD,CAAA;AAED,SAAS,KAAK,CAAC,QAAkB,EAAE,OAAmB,EAAE,SAAiB;IACvE,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAA;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAsB,EACtB,mBAA+B,EAC/B,GAAc;IAEd,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;AACpH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAA0B,EAC1B,mBAA+B,EAC/B,GAAc;IAEd,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC,mBAAmB,EAAE,aAAa,EAAE,iBAAiB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAA;AACpH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAc,EACd,OAAmB,EACnB,SAAiB,EACjB,GAAc;IAEd,OAAO,eAAe,CACpB,IAAI,CAAC,kBAAkB,EACvB,aAAa,EACb,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,EAClD,IAAI,CAAC,SAAS,EACd,GAAG,CACJ,CAAA;AACH,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,IAAwB,EAAE,GAAc;IACxF,OAAO,eAAe,CACpB,IAAI,CAAC,kBAAkB,EACvB,aAAa,EACb,iBAAiB,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,EAC7E,IAAI,CAAC,SAAS,EACd,GAAG,CACJ,CAAA;AACH,CAAC"}

package/dist/src/leafNodeSource.d.ts

@@ -0,0 +1,12 @@
+import { Decoder } from "./codec/tlsDecoder";
+import { Encoder } from "./codec/tlsEncoder";
+declare const leafNodeSources: {
+    readonly key_package: 1;
+    readonly update: 2;
+    readonly commit: 3;
+};
+export type LeafNodeSourceName = keyof typeof leafNodeSources;
+export type LeafNodeSourceValue = (typeof leafNodeSources)[LeafNodeSourceName];
+export declare const encodeLeafNodeSource: Encoder<LeafNodeSourceName>;
+export declare const decodeLeafNodeSource: Decoder<LeafNodeSourceName>;
+export {};

package/dist/src/leafNodeSource.js

@@ -0,0 +1,12 @@
+import { decodeUint8, encodeUint8 } from "./codec/number";
+import { mapDecoderOption } from "./codec/tlsDecoder";
+import { contramapEncoder } from "./codec/tlsEncoder";
+import { enumNumberToKey } from "./util/enumHelpers";
+const leafNodeSources = {
+    key_package: 1,
+    update: 2,
+    commit: 3,
+};
+export const encodeLeafNodeSource = contramapEncoder(encodeUint8, (t) => leafNodeSources[t]);
+export const decodeLeafNodeSource = mapDecoderOption(decodeUint8, enumNumberToKey(leafNodeSources));
+//# sourceMappingURL=leafNodeSource.js.map

package/dist/src/leafNodeSource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leafNodeSource.js","sourceRoot":"","sources":["../../src/leafNodeSource.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACzD,OAAO,EAAW,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAW,MAAM,oBAAoB,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD,MAAM,eAAe,GAAG;IACtB,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,CAAC;IACT,MAAM,EAAE,CAAC;CACD,CAAA;AAKV,MAAM,CAAC,MAAM,oBAAoB,GAAgC,gBAAgB,CAC/E,WAAW,EACX,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAC1B,CAAA;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAgC,gBAAgB,CAC/E,WAAW,EACX,eAAe,CAAC,eAAe,CAAC,CACjC,CAAA"}

package/dist/src/lifetime.d.ts

@@ -0,0 +1,9 @@
+import { Encoder } from "./codec/tlsEncoder";
+import { Decoder } from "./codec/tlsDecoder";
+export type Lifetime = {
+    notBefore: bigint;
+    notAfter: bigint;
+};
+export declare const encodeLifetime: Encoder<Lifetime>;
+export declare const decodeLifetime: Decoder<Lifetime>;
+export declare const defaultLifetime: Lifetime;

package/dist/src/lifetime.js

@@ -0,0 +1,13 @@
+import { encodeUint64, decodeUint64 } from "./codec/number";
+import { contramapEncoders } from "./codec/tlsEncoder";
+import { mapDecoders } from "./codec/tlsDecoder";
+export const encodeLifetime = contramapEncoders([encodeUint64, encodeUint64], (lt) => [lt.notBefore, lt.notAfter]);
+export const decodeLifetime = mapDecoders([decodeUint64, decodeUint64], (notBefore, notAfter) => ({
+    notBefore,
+    notAfter,
+}));
+export const defaultLifetime = {
+    notBefore: 0n,
+    notAfter: 9223372036854775807n,
+};
+//# sourceMappingURL=lifetime.js.map

package/dist/src/lifetime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifetime.js","sourceRoot":"","sources":["../../src/lifetime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAC3D,OAAO,EAAW,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAW,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAIzD,MAAM,CAAC,MAAM,cAAc,GAAsB,iBAAiB,CAChE,CAAC,YAAY,EAAE,YAAY,CAAC,EAC5B,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAU,CAC7C,CAAA;AAED,MAAM,CAAC,MAAM,cAAc,GAAsB,WAAW,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IACnH,SAAS;IACT,QAAQ;CACT,CAAC,CAAC,CAAA;AACH,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,SAAS,EAAE,EAAE;IACb,QAAQ,EAAE,oBAAoB;CAC/B,CAAA"}

package/dist/src/lifetimeConfig.d.ts

@@ -0,0 +1,5 @@
+export type LifetimeConfig = {
+    maximumTotalLifetime: bigint;
+    validateLifetimeOnReceive: boolean;
+};
+export declare const defaultLifetimeConfig: LifetimeConfig;

package/dist/src/lifetimeConfig.js

@@ -0,0 +1,5 @@
+export const defaultLifetimeConfig = {
+    maximumTotalLifetime: 2628000n, // 1 month
+    validateLifetimeOnReceive: false,
+};
+//# sourceMappingURL=lifetimeConfig.js.map

package/dist/src/lifetimeConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifetimeConfig.js","sourceRoot":"","sources":["../../src/lifetimeConfig.ts"],"names":[],"mappings":"AAKA,MAAM,CAAC,MAAM,qBAAqB,GAAmB;IACnD,oBAAoB,EAAE,QAAQ,EAAE,UAAU;IAC1C,yBAAyB,EAAE,KAAK;CACjC,CAAA"}

package/dist/src/message.d.ts

@@ -0,0 +1,42 @@
+import { Decoder } from "./codec/tlsDecoder";
+import { Encoder } from "./codec/tlsEncoder";
+import { GroupInfo } from "./groupInfo";
+import { KeyPackage } from "./keyPackage";
+import { PrivateMessage } from "./privateMessage";
+import { ProtocolVersionName } from "./protocolVersion";
+import { PublicMessage } from "./publicMessage";
+import { Welcome } from "./welcome";
+export type MLSMessage = MlsMessageProtocol & MlsMessageContent;
+export type MlsMessageProtocol = {
+    version: ProtocolVersionName;
+};
+export type MlsMessageContent = MlsWelcome | MlsPrivateMessage | MlsGroupInfo | MlsKeyPackage | MlsPublicMessage;
+export type MlsWelcome = {
+    wireformat: "mls_welcome";
+    welcome: Welcome;
+};
+export type MlsPrivateMessage = {
+    wireformat: "mls_private_message";
+    privateMessage: PrivateMessage;
+};
+export type MlsGroupInfo = {
+    wireformat: "mls_group_info";
+    groupInfo: GroupInfo;
+};
+export type MlsKeyPackage = {
+    wireformat: "mls_key_package";
+    keyPackage: KeyPackage;
+};
+export type MlsPublicMessage = {
+    wireformat: "mls_public_message";
+    publicMessage: PublicMessage;
+};
+export declare const encodeMlsMessageContent: Encoder<MlsMessageContent>;
+export declare const encodeMlsPublicMessage: Encoder<MlsPublicMessage>;
+export declare const encodeMlsWelcome: Encoder<MlsWelcome>;
+export declare const encodeMlsPrivateMessage: Encoder<MlsPrivateMessage>;
+export declare const encodeMlsGroupInfo: Encoder<MlsGroupInfo>;
+export declare const encodeMlsKeyPackage: Encoder<MlsKeyPackage>;
+export declare const decodeMlsMessageContent: Decoder<MlsMessageContent>;
+export declare const encodeMlsMessage: Encoder<MLSMessage>;
+export declare const decodeMlsMessage: Decoder<MLSMessage>;

package/dist/src/message.js

@@ -0,0 +1,45 @@
+import { flatMapDecoder, mapDecoder, mapDecoders } from "./codec/tlsDecoder";
+import { contramapEncoders } from "./codec/tlsEncoder";
+import { decodeGroupInfo, encodeGroupInfo } from "./groupInfo";
+import { decodeKeyPackage, encodeKeyPackage } from "./keyPackage";
+import { decodePrivateMessage, encodePrivateMessage } from "./privateMessage";
+import { decodeProtocolVersion, encodeProtocolVersion } from "./protocolVersion";
+import { decodePublicMessage, encodePublicMessage } from "./publicMessage";
+import { decodeWelcome, encodeWelcome } from "./welcome";
+import { decodeWireformat, encodeWireformat } from "./wireformat";
+export const encodeMlsMessageContent = (mc) => {
+    switch (mc.wireformat) {
+        case "mls_public_message":
+            return encodeMlsPublicMessage(mc);
+        case "mls_welcome":
+            return encodeMlsWelcome(mc);
+        case "mls_private_message":
+            return encodeMlsPrivateMessage(mc);
+        case "mls_group_info":
+            return encodeMlsGroupInfo(mc);
+        case "mls_key_package":
+            return encodeMlsKeyPackage(mc);
+    }
+};
+export const encodeMlsPublicMessage = contramapEncoders([encodeWireformat, encodePublicMessage], (msg) => [msg.wireformat, msg.publicMessage]);
+export const encodeMlsWelcome = contramapEncoders([encodeWireformat, encodeWelcome], (wm) => [wm.wireformat, wm.welcome]);
+export const encodeMlsPrivateMessage = contramapEncoders([encodeWireformat, encodePrivateMessage], (pm) => [pm.wireformat, pm.privateMessage]);
+export const encodeMlsGroupInfo = contramapEncoders([encodeWireformat, encodeGroupInfo], (gi) => [gi.wireformat, gi.groupInfo]);
+export const encodeMlsKeyPackage = contramapEncoders([encodeWireformat, encodeKeyPackage], (kp) => [kp.wireformat, kp.keyPackage]);
+export const decodeMlsMessageContent = flatMapDecoder(decodeWireformat, (wireformat) => {
+    switch (wireformat) {
+        case "mls_public_message":
+            return mapDecoder(decodePublicMessage, (publicMessage) => ({ wireformat, publicMessage }));
+        case "mls_welcome":
+            return mapDecoder(decodeWelcome, (welcome) => ({ wireformat, welcome }));
+        case "mls_private_message":
+            return mapDecoder(decodePrivateMessage, (privateMessage) => ({ wireformat, privateMessage }));
+        case "mls_group_info":
+            return mapDecoder(decodeGroupInfo, (groupInfo) => ({ wireformat, groupInfo }));
+        case "mls_key_package":
+            return mapDecoder(decodeKeyPackage, (keyPackage) => ({ wireformat, keyPackage }));
+    }
+});
+export const encodeMlsMessage = contramapEncoders([encodeProtocolVersion, encodeMlsMessageContent], (w) => [w.version, w]);
+export const decodeMlsMessage = mapDecoders([decodeProtocolVersion, decodeMlsMessageContent], (version, mc) => ({ ...mc, version }));
+//# sourceMappingURL=message.js.map

package/dist/src/message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.js","sourceRoot":"","sources":["../../src/message.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrF,OAAO,EAAE,iBAAiB,EAAW,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAa,MAAM,aAAa,CAAA;AACzE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAc,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAkB,MAAM,kBAAkB,CAAA;AAC7F,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAuB,MAAM,mBAAmB,CAAA;AACrG,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAiB,MAAM,iBAAiB,CAAA;AACzF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAW,MAAM,WAAW,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAajE,MAAM,CAAC,MAAM,uBAAuB,GAA+B,CAAC,EAAE,EAAE,EAAE;IACxE,QAAQ,EAAE,CAAC,UAAU,EAAE,CAAC;QACtB,KAAK,oBAAoB;YACvB,OAAO,sBAAsB,CAAC,EAAE,CAAC,CAAA;QACnC,KAAK,aAAa;YAChB,OAAO,gBAAgB,CAAC,EAAE,CAAC,CAAA;QAC7B,KAAK,qBAAqB;YACxB,OAAO,uBAAuB,CAAC,EAAE,CAAC,CAAA;QACpC,KAAK,gBAAgB;YACnB,OAAO,kBAAkB,CAAC,EAAE,CAAC,CAAA;QAC/B,KAAK,iBAAiB;YACpB,OAAO,mBAAmB,CAAC,EAAE,CAAC,CAAA;IAClC,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAA8B,iBAAiB,CAChF,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,EACvC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAU,CACtD,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAwB,iBAAiB,CACpE,CAAC,gBAAgB,EAAE,aAAa,CAAC,EACjC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAU,CAC7C,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA+B,iBAAiB,CAClF,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,EACxC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,cAAc,CAAU,CACpD,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAA0B,iBAAiB,CACxE,CAAC,gBAAgB,EAAE,eAAe,CAAC,EACnC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAU,CAC/C,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAA2B,iBAAiB,CAC1E,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,EACpC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAU,CAChD,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAA+B,cAAc,CAC/E,gBAAgB,EAChB,CAAC,UAAU,EAA8B,EAAE;IACzC,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,oBAAoB;YACvB,OAAO,UAAU,CAAC,mBAAmB,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC,CAAA;QAC5F,KAAK,aAAa;YAChB,OAAO,UAAU,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;QAC1E,KAAK,qBAAqB;YACxB,OAAO,UAAU,CAAC,oBAAoB,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;QAC/F,KAAK,gBAAgB;YACnB,OAAO,UAAU,CAAC,eAAe,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;QAChF,KAAK,iBAAiB;YACpB,OAAO,UAAU,CAAC,gBAAgB,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC,CAAA;IACrF,CAAC;AACH,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAwB,iBAAiB,CACpE,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,EAChD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAU,CAC/B,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAwB,WAAW,CAC9D,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,EAChD,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CACtC,CAAA"}

package/dist/src/messageProtection.d.ts

@@ -0,0 +1,36 @@
+import { AuthenticatedContent } from "./authenticatedContent";
+import { CiphersuiteImpl } from "./crypto/ciphersuite";
+import { GroupContext } from "./groupContext";
+import { Proposal } from "./proposal";
+import { PrivateMessage, PrivateMessageContent } from "./privateMessage";
+import { SecretTree } from "./secretTree";
+import { RatchetTree } from "./ratchetTree";
+import { SenderData } from "./sender";
+import { KeyRetentionConfig } from "./keyRetentionConfig";
+import { MlsError } from "./mlsError";
+import { PaddingConfig } from "./paddingConfig";
+export type ProtectApplicationDataResult = {
+    privateMessage: PrivateMessage;
+    newSecretTree: SecretTree;
+};
+export declare function protectApplicationData(signKey: Uint8Array, senderDataSecret: Uint8Array, applicationData: Uint8Array, authenticatedData: Uint8Array, groupContext: GroupContext, secretTree: SecretTree, leafIndex: number, paddingConfig: PaddingConfig, cs: CiphersuiteImpl): Promise<ProtectApplicationDataResult>;
+export type ProtectProposalResult = {
+    privateMessage: PrivateMessage;
+    newSecretTree: SecretTree;
+    proposalRef: Uint8Array;
+};
+export declare function protectProposal(signKey: Uint8Array, senderDataSecret: Uint8Array, p: Proposal, authenticatedData: Uint8Array, groupContext: GroupContext, secretTree: SecretTree, leafIndex: number, paddingConfig: PaddingConfig, cs: CiphersuiteImpl): Promise<ProtectProposalResult>;
+export type ProtectResult = {
+    privateMessage: PrivateMessage;
+    tree: SecretTree;
+};
+export declare function protect(senderDataSecret: Uint8Array, authenticatedData: Uint8Array, groupContext: GroupContext, secretTree: SecretTree, content: PrivateMessageContent, leafIndex: number, config: PaddingConfig, cs: CiphersuiteImpl): Promise<{
+    privateMessage: PrivateMessage;
+    tree: SecretTree;
+}>;
+export type UnprotectResult = {
+    content: AuthenticatedContent;
+    tree: SecretTree;
+};
+export declare function unprotectPrivateMessage(senderDataSecret: Uint8Array, msg: PrivateMessage, secretTree: SecretTree, ratchetTree: RatchetTree, groupContext: GroupContext, config: KeyRetentionConfig, cs: CiphersuiteImpl, overrideSignatureKey?: Uint8Array): Promise<UnprotectResult>;
+export declare function validateSenderData(senderData: SenderData, tree: RatchetTree): MlsError | undefined;

package/dist/src/messageProtection.js

@@ -0,0 +1,128 @@
+import { makeProposalRef } from "./authenticatedContent";
+import { signFramedContentApplicationOrProposal, verifyFramedContentSignature, } from "./framedContent";
+import { decodePrivateMessageContent, decryptSenderData, encodePrivateContentAAD, encodePrivateMessageContent, encryptSenderData, toAuthenticatedContent, } from "./privateMessage";
+import { consumeRatchet, ratchetToGeneration } from "./secretTree";
+import { getSignaturePublicKeyFromLeafIndex } from "./ratchetTree";
+import { leafToNodeIndex } from "./treemath";
+import { CryptoVerificationError, CodecError, ValidationError, InternalError } from "./mlsError";
+export async function protectApplicationData(signKey, senderDataSecret, applicationData, authenticatedData, groupContext, secretTree, leafIndex, paddingConfig, cs) {
+    const tbs = {
+        protocolVersion: groupContext.version,
+        wireformat: "mls_private_message",
+        content: {
+            contentType: "application",
+            applicationData,
+            groupId: groupContext.groupId,
+            epoch: groupContext.epoch,
+            sender: {
+                senderType: "member",
+                leafIndex: leafIndex,
+            },
+            authenticatedData,
+        },
+        senderType: "member",
+        context: groupContext,
+    };
+    const auth = await signFramedContentApplicationOrProposal(signKey, tbs, cs);
+    const content = {
+        ...tbs.content,
+        auth,
+    };
+    const result = await protect(senderDataSecret, authenticatedData, groupContext, secretTree, content, leafIndex, paddingConfig, cs);
+    return { newSecretTree: result.tree, privateMessage: result.privateMessage };
+}
+export async function protectProposal(signKey, senderDataSecret, p, authenticatedData, groupContext, secretTree, leafIndex, paddingConfig, cs) {
+    const tbs = {
+        protocolVersion: groupContext.version,
+        wireformat: "mls_private_message",
+        content: {
+            contentType: "proposal",
+            proposal: p,
+            groupId: groupContext.groupId,
+            epoch: groupContext.epoch,
+            sender: {
+                senderType: "member",
+                leafIndex,
+            },
+            authenticatedData,
+        },
+        senderType: "member",
+        context: groupContext,
+    };
+    const auth = await signFramedContentApplicationOrProposal(signKey, tbs, cs);
+    const content = { ...tbs.content, auth };
+    const privateMessage = await protect(senderDataSecret, authenticatedData, groupContext, secretTree, content, leafIndex, paddingConfig, cs);
+    const newSecretTree = privateMessage.tree;
+    const authenticatedContent = {
+        wireformat: "mls_private_message",
+        content,
+        auth,
+    };
+    const proposalRef = await makeProposalRef(authenticatedContent, cs.hash);
+    return { privateMessage: privateMessage.privateMessage, newSecretTree, proposalRef };
+}
+export async function protect(senderDataSecret, authenticatedData, groupContext, secretTree, content, leafIndex, config, cs) {
+    const node = secretTree[leafToNodeIndex(leafIndex)];
+    if (node === undefined)
+        throw new InternalError("Bad node index for secret tree");
+    const { newTree, generation, reuseGuard, nonce, key } = await consumeRatchet(secretTree, leafToNodeIndex(leafIndex), content.contentType, cs);
+    const aad = {
+        groupId: groupContext.groupId,
+        epoch: groupContext.epoch,
+        contentType: content.contentType,
+        authenticatedData: authenticatedData,
+    };
+    const ciphertext = await cs.hpke.encryptAead(key, nonce, encodePrivateContentAAD(aad), encodePrivateMessageContent(config)(content));
+    const senderData = {
+        leafIndex,
+        generation,
+        reuseGuard,
+    };
+    const senderAad = {
+        groupId: groupContext.groupId,
+        epoch: groupContext.epoch,
+        contentType: content.contentType,
+    };
+    const encryptedSenderData = await encryptSenderData(senderDataSecret, senderData, senderAad, ciphertext, cs);
+    return {
+        privateMessage: {
+            groupId: groupContext.groupId,
+            epoch: groupContext.epoch,
+            encryptedSenderData,
+            contentType: content.contentType,
+            authenticatedData,
+            ciphertext,
+        },
+        tree: newTree,
+    };
+}
+export async function unprotectPrivateMessage(senderDataSecret, msg, secretTree, ratchetTree, groupContext, config, cs, overrideSignatureKey) {
+    const senderData = await decryptSenderData(msg, senderDataSecret, cs);
+    if (senderData === undefined)
+        throw new CodecError("Could not decode senderdata");
+    validateSenderData(senderData, ratchetTree);
+    const { key, nonce, newTree } = await ratchetToGeneration(secretTree, senderData, msg.contentType, config, cs);
+    const aad = {
+        groupId: msg.groupId,
+        epoch: msg.epoch,
+        contentType: msg.contentType,
+        authenticatedData: msg.authenticatedData,
+    };
+    const decrypted = await cs.hpke.decryptAead(key, nonce, encodePrivateContentAAD(aad), msg.ciphertext);
+    const pmc = decodePrivateMessageContent(msg.contentType)(decrypted, 0)?.[0];
+    if (pmc === undefined)
+        throw new CodecError("Could not decode PrivateMessageContent");
+    const content = toAuthenticatedContent(pmc, msg, senderData.leafIndex);
+    const signaturePublicKey = overrideSignatureKey !== undefined
+        ? overrideSignatureKey
+        : getSignaturePublicKeyFromLeafIndex(ratchetTree, senderData.leafIndex);
+    const signatureValid = await verifyFramedContentSignature(signaturePublicKey, "mls_private_message", content.content, content.auth, groupContext, cs.signature);
+    if (!signatureValid)
+        throw new CryptoVerificationError("Signature invalid");
+    return { tree: newTree, content };
+}
+export function validateSenderData(senderData, tree) {
+    if (tree[leafToNodeIndex(senderData.leafIndex)]?.nodeType !== "leaf")
+        return new ValidationError("SenderData did not point to a non-blank leaf node");
+}
+//# sourceMappingURL=messageProtection.js.map

package/dist/src/messageProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messageProtection.js","sourceRoot":"","sources":["../../src/messageProtection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAE9E,OAAO,EAEL,sCAAsC,EACtC,4BAA4B,GAC7B,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,uBAAuB,EACvB,2BAA2B,EAC3B,iBAAiB,EAIjB,sBAAsB,GACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAc,MAAM,cAAc,CAAA;AAC9E,OAAO,EAAE,kCAAkC,EAAe,MAAM,eAAe,CAAA;AAE/E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,eAAe,EAAY,aAAa,EAAE,MAAM,YAAY,CAAA;AAK1G,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAmB,EACnB,gBAA4B,EAC5B,eAA2B,EAC3B,iBAA6B,EAC7B,YAA0B,EAC1B,UAAsB,EACtB,SAAiB,EACjB,aAA4B,EAC5B,EAAmB;IAEnB,MAAM,GAAG,GAA0C;QACjD,eAAe,EAAE,YAAY,CAAC,OAAO;QACrC,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE;YACP,WAAW,EAAE,aAAa;YAC1B,eAAe;YACf,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,MAAM,EAAE;gBACN,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,SAAS;aACrB;YACD,iBAAiB;SAClB;QACD,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,YAAY;KACtB,CAAA;IAED,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IAE3E,MAAM,OAAO,GAAG;QACd,GAAG,GAAG,CAAC,OAAO;QACd,IAAI;KACL,CAAA;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,OAAO,EACP,SAAS,EACT,aAAa,EACb,EAAE,CACH,CAAA;IAED,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAA;AAC9E,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAmB,EACnB,gBAA4B,EAC5B,CAAW,EACX,iBAA6B,EAC7B,YAA0B,EAC1B,UAAsB,EACtB,SAAiB,EACjB,aAA4B,EAC5B,EAAmB;IAEnB,MAAM,GAAG,GAAG;QACV,eAAe,EAAE,YAAY,CAAC,OAAO;QACrC,UAAU,EAAE,qBAA8B;QAC1C,OAAO,EAAE;YACP,WAAW,EAAE,UAAmB;YAChC,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,MAAM,EAAE;gBACN,UAAU,EAAE,QAAiB;gBAC7B,SAAS;aACV;YACD,iBAAiB;SAClB;QACD,UAAU,EAAE,QAAiB;QAC7B,OAAO,EAAE,YAAY;KACtB,CAAA;IAED,MAAM,IAAI,GAAG,MAAM,sCAAsC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAA;IAExC,MAAM,cAAc,GAAG,MAAM,OAAO,CAClC,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,OAAO,EACP,SAAS,EACT,aAAa,EACb,EAAE,CACH,CAAA;IAED,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAA;IAEzC,MAAM,oBAAoB,GAAG;QAC3B,UAAU,EAAE,qBAA8B;QAC1C,OAAO;QACP,IAAI;KACL,CAAA;IACD,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,oBAAoB,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;IAExE,OAAO,EAAE,cAAc,EAAE,cAAc,CAAC,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,CAAA;AACtF,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,gBAA4B,EAC5B,iBAA6B,EAC7B,YAA0B,EAC1B,UAAsB,EACtB,OAA8B,EAC9B,SAAiB,EACjB,MAAqB,EACrB,EAAmB;IAEnB,MAAM,IAAI,GAAG,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAA;IACnD,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,aAAa,CAAC,gCAAgC,CAAC,CAAA;IAEjF,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,MAAM,cAAc,CAC1E,UAAU,EACV,eAAe,CAAC,SAAS,CAAC,EAC1B,OAAO,CAAC,WAAW,EACnB,EAAE,CACH,CAAA;IAED,MAAM,GAAG,GAAsB;QAC7B,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,iBAAiB,EAAE,iBAAiB;KACrC,CAAA;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAC1C,GAAG,EACH,KAAK,EACL,uBAAuB,CAAC,GAAG,CAAC,EAC5B,2BAA2B,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAC7C,CAAA;IAED,MAAM,UAAU,GAAe;QAC7B,SAAS;QACT,UAAU;QACV,UAAU;KACX,CAAA;IAED,MAAM,SAAS,GAAkB;QAC/B,OAAO,EAAE,YAAY,CAAC,OAAO;QAC7B,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAA;IAED,MAAM,mBAAmB,GAAG,MAAM,iBAAiB,CAAC,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;IAE5G,OAAO;QACL,cAAc,EAAE;YACd,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,mBAAmB;YACnB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,iBAAiB;YACjB,UAAU;SACX;QACD,IAAI,EAAE,OAAO;KACd,CAAA;AACH,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,gBAA4B,EAC5B,GAAmB,EACnB,UAAsB,EACtB,WAAwB,EACxB,YAA0B,EAC1B,MAA0B,EAC1B,EAAmB,EACnB,oBAAiC;IAEjC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAA;IAErE,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,6BAA6B,CAAC,CAAA;IAEjF,kBAAkB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAE3C,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAE9G,MAAM,GAAG,GAAsB;QAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;KACzC,CAAA;IAED,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;IAErG,MAAM,GAAG,GAAG,2BAA2B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAE3E,IAAI,GAAG,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,wCAAwC,CAAC,CAAA;IAErF,MAAM,OAAO,GAAG,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;IAEtE,MAAM,kBAAkB,GACtB,oBAAoB,KAAK,SAAS;QAChC,CAAC,CAAC,oBAAoB;QACtB,CAAC,CAAC,kCAAkC,CAAC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;IAE3E,MAAM,cAAc,GAAG,MAAM,4BAA4B,CACvD,kBAAkB,EAClB,qBAAqB,EACrB,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,IAAI,EACZ,YAAY,EACZ,EAAE,CAAC,SAAS,CACb,CAAA;IAED,IAAI,CAAC,cAAc;QAAE,MAAM,IAAI,uBAAuB,CAAC,mBAAmB,CAAC,CAAA;IAE3E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,UAAsB,EAAE,IAAiB;IAC1E,IAAI,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,KAAK,MAAM;QAClE,OAAO,IAAI,eAAe,CAAC,mDAAmD,CAAC,CAAA;AACnF,CAAC"}

package/dist/src/messageProtectionPublic.d.ts

@@ -0,0 +1,17 @@
+import { AuthenticatedContent, AuthenticatedContentProposalOrCommit } from "./authenticatedContent";
+import { CiphersuiteImpl } from "./crypto/ciphersuite";
+import { GroupContext } from "./groupContext";
+import { Proposal } from "./proposal";
+import { PublicMessage } from "./publicMessage";
+import { RatchetTree } from "./ratchetTree";
+import { SenderNonMember } from "./sender";
+export type ProtectProposalPublicResult = {
+    publicMessage: PublicMessage;
+};
+export declare function protectProposalPublic(signKey: Uint8Array, membershipKey: Uint8Array, groupContext: GroupContext, authenticatedData: Uint8Array, proposal: Proposal, leafIndex: number, cs: CiphersuiteImpl): Promise<ProtectProposalPublicResult>;
+export declare function protectExternalProposalPublic(signKey: Uint8Array, groupContext: GroupContext, authenticatedData: Uint8Array, proposal: Proposal, sender: SenderNonMember, cs: CiphersuiteImpl): Promise<ProtectProposalPublicResult>;
+export declare function protectPublicMessage(membershipKey: Uint8Array, groupContext: GroupContext, content: AuthenticatedContent, cs: CiphersuiteImpl): Promise<PublicMessage>;
+export type ProtectCommitPublicResult = {
+    publicMessage: PublicMessage;
+};
+export declare function unprotectPublicMessage(membershipKey: Uint8Array, groupContext: GroupContext, ratchetTree: RatchetTree, msg: PublicMessage, cs: CiphersuiteImpl, overrideSignatureKey?: Uint8Array): Promise<AuthenticatedContentProposalOrCommit>;