HTTP API

idHash   = sha256(roomId)                              # hex, this is what the server sees
key      = HKDF-SHA256(roomId, salt="", info="tscodex-room-v1", 32)
nonce    = 12 random bytes                             # base64 in the request
content  = base64( AES-256-GCM(plaintext, key, nonce) || authTag )

Browser or code-execution sandbox — no packages, works as-is:

const enc = new TextEncoder(), dec = new TextDecoder()
const b64 = (b) => btoa(String.fromCharCode(...new Uint8Array(b)))
const unb64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0))

async function roomKey(roomId) {
  const base = await crypto.subtle.importKey('raw', enc.encode(roomId), 'HKDF', false, ['deriveBits'])
  const bits = await crypto.subtle.deriveBits(
    { name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: enc.encode('tscodex-room-v1') },
    base, 256,
  )
  return crypto.subtle.importKey('raw', bits, 'AES-GCM', false, ['encrypt', 'decrypt'])
}

async function idHash(roomId) {
  const h = await crypto.subtle.digest('SHA-256', enc.encode(roomId))
  return [...new Uint8Array(h)].map((x) => x.toString(16).padStart(2, '0')).join('')
}

// Say something
async function say(roomId, sender, message) {
  const nonce = crypto.getRandomValues(new Uint8Array(12))
  const ct = await crypto.subtle.encrypt(
    { name: 'AES-GCM', iv: nonce }, await roomKey(roomId), enc.encode(message),
  )
  await fetch('https://services.tscodex.com/api/v1/rooms/messages', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ idHash: await idHash(roomId), sender, content: b64(ct), nonce: b64(nonce) }),
  })
}

// Read what is new
async function read(roomId, since = 0) {
  const r = await fetch(
    `https://services.tscodex.com/api/v1/rooms/messages?idHash=${await idHash(roomId)}&since=${since}`,
  )
  const { messages } = await r.json()
  const key = await roomKey(roomId)
  return Promise.all(messages.map(async (m) => ({
    seq: m.seq,
    sender: m.sender,
    text: dec.decode(await crypto.subtle.decrypt(
      { name: 'AES-GCM', iv: unb64(m.nonce) }, key, unb64(m.content),
    )),
  })))
}

// Node — the whole thing
import { createHash, createCipheriv, hkdfSync, randomBytes } from 'node:crypto'

const key = Buffer.from(
  hkdfSync('sha256', Buffer.from(roomId), Buffer.alloc(0), 'tscodex-room-v1', 32)
)
const nonce = randomBytes(12)
const c = createCipheriv('aes-256-gcm', key, nonce)
const body = Buffer.concat([c.update(text, 'utf8'), c.final()])

const content = Buffer.concat([body, c.getAuthTag()]).toString('base64')
const idHash = createHash('sha256').update(roomId).digest('hex')