@badzz88/baileys 8.4.6 → 8.4.9

package/src/Utils/tc-token-utils.js

@@ -0,0 +1,161 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.TC_TOKEN_INDEX_KEY = void 0
+exports.readTcTokenIndex = readTcTokenIndex
+exports.buildMergedTcTokenIndexWrite = buildMergedTcTokenIndexWrite
+exports.isTcTokenExpired = isTcTokenExpired
+exports.shouldSendNewTcToken = shouldSendNewTcToken
+exports.resolveTcTokenJid = resolveTcTokenJid
+exports.resolveIssuanceJid = resolveIssuanceJid
+exports.buildTcTokenFromJid = buildTcTokenFromJid
+exports.storeTcTokensFromIqResult = storeTcTokensFromIqResult
+const WABinary_1 = require('../WABinary')
+// Same phone-number pattern as WABinary's isJidBot, applied against the user
+// part so the check is invariant to @c.us ↔ @s.whatsapp.net normalization.
+const BOT_PHONE_REGEX = /^1313555\d{4}$|^131655500\d{2}$/
+/**
+ * Mirrors WA Web's `Wid.isRegularUser()` (user ∧ ¬PSA ∧ ¬Bot). Used to gate tctoken
+ * storage against malformed notifications — WA Web filters server-side but we
+ * defend here for parity with `WAWebSetTcTokenChatAction.handleIncomingTcToken`.
+ * Works for both pre- and post-normalized JIDs (`@c.us` vs `@s.whatsapp.net`).
+ */
+function isRegularUser(jid) {
+	if (!jid) return false
+	const user = jid.split('@')[0] ?? ''
+	if (user === '0') return false // PSA
+	if (BOT_PHONE_REGEX.test(user)) return false // Bot by phone pattern
+	if ((0, WABinary_1.isJidMetaAI)(jid)) return false // MetaAI (@bot server)
+	return !!(
+		(0, WABinary_1.isPnUser)(jid) ||
+		(0, WABinary_1.isLidUser)(jid) ||
+		(0, WABinary_1.isHostedPnUser)(jid) ||
+		(0, WABinary_1.isHostedLidUser)(jid) ||
+		jid.endsWith('@c.us')
+	)
+}
+const TC_TOKEN_BUCKET_DURATION = 604800 // 7 days
+const TC_TOKEN_NUM_BUCKETS = 4 // ~28-day rolling window
+/** Sentinel key under `tctoken` store holding a JSON array of tracked storage JIDs for cross-session pruning. */
+exports.TC_TOKEN_INDEX_KEY = '__index'
+/** Read the persisted tctoken JID index and return its entries (never contains the sentinel key itself). */
+async function readTcTokenIndex(keys) {
+	const data = await keys.get('tctoken', [exports.TC_TOKEN_INDEX_KEY])
+	const entry = data[exports.TC_TOKEN_INDEX_KEY]
+	if (!entry?.token?.length) return []
+	try {
+		const parsed = JSON.parse(Buffer.from(entry.token).toString())
+		if (!Array.isArray(parsed)) return []
+		return parsed.filter(j => typeof j === 'string' && j.length > 0 && j !== exports.TC_TOKEN_INDEX_KEY)
+	} catch {
+		return []
+	}
+}
+/** Build a SignalDataSet fragment that writes the merged index (persisted ∪ added) under the sentinel key. */
+async function buildMergedTcTokenIndexWrite(keys, addedJids) {
+	const persisted = await readTcTokenIndex(keys)
+	const merged = new Set(persisted)
+	for (const jid of addedJids) {
+		if (jid && jid !== exports.TC_TOKEN_INDEX_KEY) merged.add(jid)
+	}
+	return {
+		[exports.TC_TOKEN_INDEX_KEY]: { token: Buffer.from(JSON.stringify([...merged])) }
+	}
+}
+// WA Web has separate sender/receiver AB props for these but they're identical today
+function isTcTokenExpired(timestamp) {
+	if (timestamp === null || timestamp === undefined) return true
+	const ts = typeof timestamp === 'string' ? parseInt(timestamp, 10) : timestamp
+	if (isNaN(ts)) return true
+	const now = Math.floor(Date.now() / 1000)
+	const currentBucket = Math.floor(now / TC_TOKEN_BUCKET_DURATION)
+	const cutoffBucket = currentBucket - (TC_TOKEN_NUM_BUCKETS - 1)
+	const cutoffTimestamp = cutoffBucket * TC_TOKEN_BUCKET_DURATION
+	return ts < cutoffTimestamp
+}
+function shouldSendNewTcToken(senderTimestamp) {
+	if (senderTimestamp === undefined) return true
+	const now = Math.floor(Date.now() / 1000)
+	const currentBucket = Math.floor(now / TC_TOKEN_BUCKET_DURATION)
+	const senderBucket = Math.floor(senderTimestamp / TC_TOKEN_BUCKET_DURATION)
+	return currentBucket > senderBucket
+}
+/** Resolve JID to LID for tctoken storage (WA Web stores under LID) */
+async function resolveTcTokenJid(jid, getLIDForPN) {
+	if ((0, WABinary_1.isLidUser)(jid)) return jid
+	const lid = await getLIDForPN(jid)
+	return lid ?? jid
+}
+/** Resolve target JID for issuing privacy token based on AB prop 14303 */
+async function resolveIssuanceJid(jid, issueToLid, getLIDForPN, getPNForLID) {
+	if (issueToLid) {
+		if ((0, WABinary_1.isLidUser)(jid)) return jid
+		const lid = await getLIDForPN(jid)
+		return lid ?? jid
+	}
+	if (!(0, WABinary_1.isLidUser)(jid)) return jid
+	if (getPNForLID) {
+		const pn = await getPNForLID(jid)
+		return pn ?? jid
+	}
+	return jid
+}
+async function buildTcTokenFromJid({ authState, jid, baseContent = [], getLIDForPN }) {
+	try {
+		const storageJid = await resolveTcTokenJid(jid, getLIDForPN)
+		const tcTokenData = await authState.keys.get('tctoken', [storageJid])
+		const entry = tcTokenData?.[storageJid]
+		const tcTokenBuffer = entry?.token
+		if (!tcTokenBuffer?.length || isTcTokenExpired(entry?.timestamp)) {
+			if (tcTokenBuffer) {
+				// Preserve senderTimestamp so shouldSendNewTcToken() keeps its dedupe state
+				// after we drop the unusable peer token. Only wipe the record entirely when
+				// there's nothing worth keeping.
+				const cleared =
+					entry?.senderTimestamp !== undefined
+						? { token: Buffer.alloc(0), senderTimestamp: entry.senderTimestamp }
+						: null
+				await authState.keys.set({ tctoken: { [storageJid]: cleared } })
+			}
+			return baseContent.length > 0 ? baseContent : undefined
+		}
+		baseContent.push({
+			tag: 'tctoken',
+			attrs: {},
+			content: tcTokenBuffer
+		})
+		return baseContent
+	} catch (error) {
+		return baseContent.length > 0 ? baseContent : undefined
+	}
+}
+async function storeTcTokensFromIqResult({ result, fallbackJid, keys, getLIDForPN, onNewJidStored }) {
+	const tokensNode = (0, WABinary_1.getBinaryNodeChild)(result, 'tokens')
+	if (!tokensNode) return
+	const tokenNodes = (0, WABinary_1.getBinaryNodeChildren)(tokensNode, 'token')
+	for (const tokenNode of tokenNodes) {
+		if (tokenNode.attrs.type !== 'trusted_contact' || !(tokenNode.content instanceof Uint8Array)) {
+			continue
+		}
+		// In notifications tokenNode.attrs.jid is your own device JID, not the sender's
+		const rawJid = (0, WABinary_1.jidNormalizedUser)(fallbackJid || tokenNode.attrs.jid)
+		if (!isRegularUser(rawJid)) continue
+		const storageJid = await resolveTcTokenJid(rawJid, getLIDForPN)
+		const existingTcData = await keys.get('tctoken', [storageJid])
+		const existingEntry = existingTcData[storageJid]
+		const existingTs = existingEntry?.timestamp ? Number(existingEntry.timestamp) : 0
+		const incomingTs = tokenNode.attrs.t ? Number(tokenNode.attrs.t) : 0
+		// timestamp-less tokens would be immediately expired
+		if (!incomingTs) continue
+		if (existingTs > 0 && existingTs > incomingTs) continue
+		await keys.set({
+			tctoken: {
+				[storageJid]: {
+					...existingEntry,
+					token: Buffer.from(tokenNode.content),
+					timestamp: tokenNode.attrs.t
+				}
+			}
+		})
+		onNewJidStored?.(storageJid)
+	}
+}

package/src/Utils/use-multi-file-auth-state.js

@@ -0,0 +1,121 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.useMultiFileAuthState = void 0
+const async_mutex_1 = require('async-mutex')
+const promises_1 = require('fs/promises')
+const path_1 = require('path')
+const index_js_1 = require('../../WAProto/index.js')
+const auth_utils_1 = require('./auth-utils')
+const generics_1 = require('./generics')
+// We need to lock files due to the fact that we are using async functions to read and write files
+// https://github.com/WhiskeySockets/Baileys/issues/794
+// https://github.com/nodejs/node/issues/26338
+// Use a Map to store mutexes for each file path
+const fileLocks = new Map()
+// Get or create a mutex for a specific file path
+const getFileLock = path => {
+	let mutex = fileLocks.get(path)
+	if (!mutex) {
+		mutex = new async_mutex_1.Mutex()
+		fileLocks.set(path, mutex)
+	}
+	return mutex
+}
+/**
+ * stores the full authentication state in a single folder.
+ * Far more efficient than singlefileauthstate
+ *
+ * Again, I wouldn't endorse this for any production level use other than perhaps a bot.
+ * Would recommend writing an auth state for use with a proper SQL or No-SQL DB
+ * */
+const useMultiFileAuthState = async folder => {
+	// eslint-disable-next-line @typescript-eslint/no-explicit-any
+	const writeData = async (data, file) => {
+		const filePath = (0, path_1.join)(folder, fixFileName(file))
+		const mutex = getFileLock(filePath)
+		return mutex.acquire().then(async release => {
+			try {
+				await (0, promises_1.writeFile)(filePath, JSON.stringify(data, generics_1.BufferJSON.replacer))
+			} finally {
+				release()
+			}
+		})
+	}
+	const readData = async file => {
+		try {
+			const filePath = (0, path_1.join)(folder, fixFileName(file))
+			const mutex = getFileLock(filePath)
+			return await mutex.acquire().then(async release => {
+				try {
+					const data = await (0, promises_1.readFile)(filePath, { encoding: 'utf-8' })
+					return JSON.parse(data, generics_1.BufferJSON.reviver)
+				} finally {
+					release()
+				}
+			})
+		} catch (error) {
+			return null
+		}
+	}
+	const removeData = async file => {
+		try {
+			const filePath = (0, path_1.join)(folder, fixFileName(file))
+			const mutex = getFileLock(filePath)
+			return mutex.acquire().then(async release => {
+				try {
+					await (0, promises_1.unlink)(filePath)
+				} catch {
+				} finally {
+					release()
+				}
+			})
+		} catch {}
+	}
+	const folderInfo = await (0, promises_1.stat)(folder).catch(() => {})
+	if (folderInfo) {
+		if (!folderInfo.isDirectory()) {
+			throw new Error(
+				`found something that is not a directory at ${folder}, either delete it or specify a different location`
+			)
+		}
+	} else {
+		await (0, promises_1.mkdir)(folder, { recursive: true })
+	}
+	const fixFileName = file => file?.replace(/\//g, '__')?.replace(/:/g, '-')
+	const creds = (await readData('creds.json')) || (0, auth_utils_1.initAuthCreds)()
+	return {
+		state: {
+			creds,
+			keys: {
+				get: async (type, ids) => {
+					const data = {}
+					await Promise.all(
+						ids.map(async id => {
+							let value = await readData(`${type}-${id}.json`)
+							if (type === 'app-state-sync-key' && value) {
+								value = index_js_1.proto.Message.AppStateSyncKeyData.fromObject(value)
+							}
+							data[id] = value
+						})
+					)
+					return data
+				},
+				set: async data => {
+					const tasks = []
+					for (const category in data) {
+						for (const id in data[category]) {
+							const value = data[category][id]
+							const file = `${category}-${id}.json`
+							tasks.push(value ? writeData(value, file) : removeData(file))
+						}
+					}
+					await Promise.all(tasks)
+				}
+			}
+		},
+		saveCreds: async () => {
+			return writeData(creds, 'creds.json')
+		}
+	}
+}
+exports.useMultiFileAuthState = useMultiFileAuthState

package/src/Utils/validate-connection.js

@@ -0,0 +1,248 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.encodeSignedDeviceIdentity =
+	exports.configureSuccessfulPairing =
+	exports.generateRegistrationNode =
+	exports.generateLoginNode =
+		void 0
+const boom_1 = require('@hapi/boom')
+const crypto_1 = require('crypto')
+const rb = require('whatsapp-rust-bridge-baron')
+const index_js_1 = require('../../WAProto/index.js')
+const Defaults_1 = require('../Defaults')
+const WABinary_1 = require('../WABinary')
+const crypto_2 = require('./crypto')
+const generics_1 = require('./generics')
+const signal_1 = require('./signal')
+const MOBILE_PLATFORMS = new Set(['Android', 'iOS'])
+const getUserAgent = config => {
+	const os = config.browser[0]
+	let platform, device, osVersion
+	if (os === 'Android') {
+		platform = index_js_1.proto.ClientPayload.UserAgent.Platform.ANDROID
+		device = 'Android'
+		osVersion = config.browser[2] || '15.0.0'
+	} else if (os === 'iOS') {
+		platform = index_js_1.proto.ClientPayload.UserAgent.Platform.IOS
+		device = 'iPhone'
+		osVersion = config.browser[2] || '18.0'
+	} else {
+		platform = index_js_1.proto.ClientPayload.UserAgent.Platform.WEB
+		device = 'Desktop'
+		osVersion = '0.1'
+	}
+	return {
+		appVersion: {
+			primary: config.version[0],
+			secondary: config.version[1],
+			tertiary: config.version[2]
+		},
+		platform,
+		releaseChannel: index_js_1.proto.ClientPayload.UserAgent.ReleaseChannel.DEBUG,
+		osVersion,
+		device,
+		osBuildNumber: '0.1',
+		localeLanguageIso6391: 'en',
+		mnc: '000',
+		mcc: '000',
+		localeCountryIso31661Alpha2: config.countryCode
+	}
+}
+const PLATFORM_MAP = {
+	'Mac OS': index_js_1.proto.ClientPayload.WebInfo.WebSubPlatform.DARWIN,
+	Windows: index_js_1.proto.ClientPayload.WebInfo.WebSubPlatform.WIN32,
+	Android: index_js_1.proto.ClientPayload.WebInfo.WebSubPlatform.WEB_BROWSER,
+	iOS: index_js_1.proto.ClientPayload.WebInfo.WebSubPlatform.WEB_BROWSER
+}
+const getWebInfo = config => {
+	let webSubPlatform = index_js_1.proto.ClientPayload.WebInfo.WebSubPlatform.WEB_BROWSER
+	if (config.syncFullHistory && PLATFORM_MAP[config.browser[0]] && config.browser[1] === 'Desktop') {
+		webSubPlatform = PLATFORM_MAP[config.browser[0]]
+	}
+	return { webSubPlatform }
+}
+const getClientPayload = config => {
+	const payload = {
+		connectType: index_js_1.proto.ClientPayload.ConnectType.WIFI_UNKNOWN,
+		connectReason: index_js_1.proto.ClientPayload.ConnectReason.USER_ACTIVATED,
+		userAgent: getUserAgent(config)
+	}
+	if (!MOBILE_PLATFORMS.has(config.browser[0])) {
+		payload.webInfo = getWebInfo(config)
+	}
+	return payload
+}
+const generateLoginNode = (userJid, config, creds) => {
+	const { user, device } = (0, WABinary_1.jidDecode)(userJid)
+	// masqueradeAsPrimary: connect as device 0 so the WA server (and interop bridges)
+	// route primary-device traffic — including interop messages — to this session.
+	// Trade-off: the real phone (device 0 on TCP) may be kicked or see a conflict.
+	const effectiveDevice = config.masqueradeAsPrimary ? 0 : device
+	const payload = {
+		...getClientPayload(config),
+		passive: !config.masqueradeAsPrimary,
+		pull: !config.masqueradeAsPrimary,
+		username: +user,
+		device: effectiveDevice,
+		lidDbMigrated: false
+	}
+	// InteropData is required for Meta/FB-linked accounts (AccountType = HOSTED).
+	// Populated from creds when present so the server routes interop traffic correctly.
+	if (creds?.interopData?.accountId) {
+		payload.interopData = {
+			accountId: creds.interopData.accountId,
+			token: creds.interopData.token,
+			enableReadReceipts: creds.interopData.enableReadReceipts ?? true
+		}
+	}
+	return index_js_1.proto.ClientPayload.fromObject(payload)
+}
+exports.generateLoginNode = generateLoginNode
+const getPlatformType = platform => {
+	const platformType = platform.toUpperCase()
+	return index_js_1.proto.DeviceProps.PlatformType[platformType] || index_js_1.proto.DeviceProps.PlatformType.CHROME
+}
+const generateRegistrationNode = ({ registrationId, signedPreKey, signedIdentityKey }, config) => {
+	// the app version needs to be md5 hashed
+	// and passed in
+	const appVersionBuf = Buffer.from(rb.md5(Buffer.from(config.version.join('.'))))
+	const companion = {
+		os: config.browser[0],
+		platformType: getPlatformType(config.browser[1]),
+		requireFullSync: config.syncFullHistory,
+		historySyncConfig: {
+			fullSyncDaysLimit: undefined,
+			fullSyncSizeMbLimit: undefined,
+			storageQuotaMb: 10240,
+			inlineInitialPayloadInE2EeMsg: true,
+			recentSyncDaysLimit: undefined,
+			supportCallLogHistory: true,
+			supportBotUserAgentChatHistory: true,
+			supportCagReactionsAndPolls: true,
+			supportBizHostedMsg: true,
+			supportRecentSyncChunkMessageCountTuning: true,
+			supportHostedGroupMsg: true,
+			supportFbidBotChatHistory: true,
+			supportAddOnHistorySyncMigration: undefined,
+			supportMessageAssociation: true,
+			supportGroupHistory: true,
+			onDemandReady: undefined,
+			supportGuestChat: true,
+			completeOnDemandReady: undefined,
+			thumbnailSyncDaysLimit: undefined,
+			initialSyncMaxMessagesPerChat: undefined,
+			supportManusHistory: true,
+			supportHatchHistory: true,
+			supportedBotChannelFbids: undefined,
+			supportInlineContacts: true
+		},
+		version: {
+			primary: 10,
+			secondary: 15,
+			tertiary: 7
+		}
+	}
+	const companionProto = index_js_1.proto.DeviceProps.encode(companion).finish()
+	const registerPayload = {
+		...getClientPayload(config),
+		passive: false,
+		pull: false,
+		devicePairingData: {
+			buildHash: appVersionBuf,
+			deviceProps: companionProto,
+			eRegid: (0, generics_1.encodeBigEndian)(registrationId),
+			eKeytype: Defaults_1.KEY_BUNDLE_TYPE,
+			eIdent: signedIdentityKey.public,
+			eSkeyId: (0, generics_1.encodeBigEndian)(signedPreKey.keyId, 3),
+			eSkeyVal: signedPreKey.keyPair.public,
+			eSkeySig: signedPreKey.signature
+		}
+	}
+	return index_js_1.proto.ClientPayload.fromObject(registerPayload)
+}
+exports.generateRegistrationNode = generateRegistrationNode
+const configureSuccessfulPairing = (stanza, { advSecretKey, signedIdentityKey, signalIdentities }) => {
+	const msgId = stanza.attrs.id
+	const pairSuccessNode = (0, WABinary_1.getBinaryNodeChild)(stanza, 'pair-success')
+	const deviceIdentityNode = (0, WABinary_1.getBinaryNodeChild)(pairSuccessNode, 'device-identity')
+	const platformNode = (0, WABinary_1.getBinaryNodeChild)(pairSuccessNode, 'platform')
+	const deviceNode = (0, WABinary_1.getBinaryNodeChild)(pairSuccessNode, 'device')
+	const businessNode = (0, WABinary_1.getBinaryNodeChild)(pairSuccessNode, 'biz')
+	if (!deviceIdentityNode || !deviceNode) {
+		throw new boom_1.Boom('Missing device-identity or device in pair success node', { data: stanza })
+	}
+	const bizName = businessNode?.attrs.name
+	const jid = deviceNode.attrs.jid
+	const lid = deviceNode.attrs.lid
+	const { details, hmac, accountType } = index_js_1.proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content)
+	let hmacPrefix = Buffer.from([])
+	if (accountType !== undefined && accountType === index_js_1.proto.ADVEncryptionType.HOSTED) {
+		hmacPrefix = Defaults_1.WA_ADV_HOSTED_ACCOUNT_SIG_PREFIX
+	}
+	const advSign = (0, crypto_2.hmacSign)(Buffer.concat([hmacPrefix, details]), Buffer.from(advSecretKey, 'base64'))
+	if (Buffer.compare(hmac, advSign) !== 0) {
+		throw new boom_1.Boom('Invalid account signature')
+	}
+	const account = index_js_1.proto.ADVSignedDeviceIdentity.decode(details)
+	const { accountSignatureKey, accountSignature, details: deviceDetails } = account
+	const deviceIdentity = index_js_1.proto.ADVDeviceIdentity.decode(deviceDetails)
+	const accountSignaturePrefix =
+		deviceIdentity.deviceType === index_js_1.proto.ADVEncryptionType.HOSTED
+			? Defaults_1.WA_ADV_HOSTED_ACCOUNT_SIG_PREFIX
+			: Defaults_1.WA_ADV_ACCOUNT_SIG_PREFIX
+	const accountMsg = Buffer.concat([accountSignaturePrefix, deviceDetails, signedIdentityKey.public])
+	if (!crypto_2.Curve.verify(accountSignatureKey, accountMsg, accountSignature)) {
+		throw new boom_1.Boom('Failed to verify account signature')
+	}
+	const deviceMsg = Buffer.concat([
+		Defaults_1.WA_ADV_DEVICE_SIG_PREFIX,
+		deviceDetails,
+		signedIdentityKey.public,
+		accountSignatureKey
+	])
+	account.deviceSignature = crypto_2.Curve.sign(signedIdentityKey.private, deviceMsg)
+	const identity = (0, signal_1.createSignalIdentity)(lid, accountSignatureKey)
+	const accountEnc = (0, exports.encodeSignedDeviceIdentity)(account, false)
+	const reply = {
+		tag: 'iq',
+		attrs: {
+			to: WABinary_1.S_WHATSAPP_NET,
+			type: 'result',
+			id: msgId
+		},
+		content: [
+			{
+				tag: 'pair-device-sign',
+				attrs: {},
+				content: [
+					{
+						tag: 'device-identity',
+						attrs: { 'key-index': deviceIdentity.keyIndex.toString() },
+						content: accountEnc
+					}
+				]
+			}
+		]
+	}
+	const authUpdate = {
+		account,
+		me: { id: jid, name: bizName, lid },
+		signalIdentities: [...(signalIdentities || []), identity],
+		platform: platformNode?.attrs.name
+	}
+	return {
+		creds: authUpdate,
+		reply
+	}
+}
+exports.configureSuccessfulPairing = configureSuccessfulPairing
+const encodeSignedDeviceIdentity = (account, includeSignatureKey) => {
+	account = { ...account }
+	// set to null if we are not to include the signature key
+	// or if we are including the signature key but it is empty
+	if (!includeSignatureKey || !account.accountSignatureKey?.length) {
+		account.accountSignatureKey = null
+	}
+	return index_js_1.proto.ADVSignedDeviceIdentity.encode(account).finish()
+}
+exports.encodeSignedDeviceIdentity = encodeSignedDeviceIdentity

package/src/Utils/voip-rekey.js

@@ -0,0 +1,22 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.decodeE2eRekeyPayload = void 0
+const index_js_1 = require('../../WAProto/index.js')
+const REKEY_TYPE_NAMES = {
+	[index_js_1.proto.RekeyKeyType.REKEY_KEY_AUDIO]: 'REKEY_KEY_AUDIO',
+	[index_js_1.proto.RekeyKeyType.REKEY_KEY_VIDEO]: 'REKEY_KEY_VIDEO',
+	[index_js_1.proto.RekeyKeyType.REKEY_KEY_APPDATA]: 'REKEY_KEY_APPDATA'
+}
+const decodeE2eRekeyPayload = buffer => {
+	if (!Buffer.isBuffer(buffer) && !(buffer instanceof Uint8Array)) {
+		throw new TypeError('decodeE2eRekeyPayload: buffer must be Buffer or Uint8Array')
+	}
+	const decoded = index_js_1.proto.E2eRekeyPayload.decode(buffer)
+	return {
+		keys: (decoded.keys || []).map(entry => ({
+			type: REKEY_TYPE_NAMES[entry.type] ?? entry.type,
+			key: entry.key ? Buffer.from(entry.key) : Buffer.alloc(0)
+		}))
+	}
+}
+exports.decodeE2eRekeyPayload = decodeE2eRekeyPayload