AbsoluteJS

@absolutejs/e2ee-mls

@absolutejs/e2ee-mlsv0.5.0betaMessaging

Experimental RFC 9420 MLS messaging provider for @absolutejs/e2ee.

#Installation

BASH
bun add @absolutejs/e2ee-mls

#Capabilities

Overview

Experimental RFC 9420 messaging provider for @absolutejs/e2ee, backed by the pure TypeScript ts-mls@2.0.0-rc.16 engine.

This package exercises the complete AbsoluteJS messaging boundary with real MLS messages: per-device credentials, KeyPackages, Welcome messages, encrypted application data, membership commits, self-updates, and sealed group state. It uses the mandatory-to-implement MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519 ciphersuite.

This provider is not production-approved. ts-mls has not received a formal security audit, and this adapter has not received an independent review. Read SECURITY.md.

Explicit application services

The provider requires an AuthenticationService; it does not accept anonymous or self-asserted device credentials. The service issues credentials bound to the generated MLS signature public key and validates that same binding when a remote KeyPackage or membership change is processed.

KeyPackage directory, delivery, durable state, and recovery services remain the application's responsibility through the contracts in @absolutejs/e2ee. Strict E2EE clients must keep sealed state on participant-controlled devices. stateProtection is required and must encrypt and authenticate exported MLS state using a device-controlled key. A managed recovery authority may wrap that already-sealed result separately.

Remote add, remove, and other sensitive membership proposals fail closed unless authorizeMembershipChange explicitly approves them. Applications should bind that callback to conversation roles and the current verified device roster.

Usage

Create every additional device's KeyPackage, call addMembers(), deliver its returned Welcome exactly once, and deliver the returned handshake to existing members. Authenticated message context must use the local device ID as senderId and the session's current epoch.

Changing between strict-e2ee and managed-recovery requires a new conversation. Never relabel or wrap an existing strict conversation in place. For state-loss recovery, use a request-bound recovery grant and replaceMembers() to add the fresh device and remove the lost leaves in one epoch. Do not restore an old serialized MLS snapshot as a second live client.

Outcomes

What you can build

Build on the supported package contract

Use @absolutejs/e2ee-mls through its supported public entry points.

Hardening checklist

Production guidance

Make every external boundary explicitPin the deployed @absolutejs/e2ee-mls version, replace example or memory-backed dependencies with durable implementations, bound external calls, protect credentials, and emit enough evidence to retry or recover safely.

Follow in order

Troubleshooting path

1
Trace from the first failed boundary
Reproduce the smallest canonical @absolutejs/e2ee-mls example, confirm the supported entry point and version in the API explorer, then inspect the first boundary that did not produce its documented result.

#Usage

Partial snippet

Working example for Usage.

TS
import { createMlsMessagingProvider } from "@absolutejs/e2ee-mls";

const provider = await createMlsMessagingProvider({
  authenticationService,
  stateProtection,
});
const alice = await provider.createDeviceCredential({
  deviceId: "alice-phone",
  identityId: "alice",
});
const conversation = await provider.createConversation({
  conversationId: crypto.randomUUID(),
  creatorCredential: alice,
  securityMode: "strict-e2ee",
});

#Public entry points

Supported entry points declared by this package manifest.

Package entry point declared in package.json.

@absolutejs/e2ee-mls@absolutejs/e2ee-mls/provider-manifest@absolutejs/e2ee-mls/certification@absolutejs/e2ee-mls/manifest@absolutejs/e2ee-mls/manifest.json

#Package commands

Scripts declared by this package manifest.

bun run buildrm -rf dist && bun build src/index.ts src/certification.ts src/provider-manifest.ts src/manifest.ts --outdir dist --root src --sourcemap --target=browser --external @absolutejs/e2ee --external '@absolutejs/e2ee/*' --external @absolutejs/manifest --external @sinclair/typebox --external ts-mls --external 'ts-mls/*' && tsc --project tsconfig.build.json && absolute-manifest emit
bun run check:packagebun run format && bun run typecheck && bun run test && bun run build && bun run verify-package
bun run formatprettier --write "./**/*.{ts,json,md}"
bun run testbun test tests/
bun run typechecktsc --noEmit

#API reference

Search the declarations exported by the current package type files. Expand a symbol to inspect its source-backed signature.

11 symbols
MLS_BROWSER_CERTIFICATION_SCENARIOSexportPermalinkSource
TS
MLS_BROWSER_CERTIFICATION_SCENARIOS
Exported from @absolutejs/e2ee-mls