@cdteam/cdwa 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 CDTeamMods
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,113 @@
-# Temporary Holding Version
+# CDWA 🚀
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> Uma biblioteca moderna, modular e com foco em alta segurança e criptografia para o protocolo WhatsApp Web Multi-Device, desenhada para o ecossistema Node.js e TypeScript.
+
+[![NPM Version](https://img.shields.io/npm/v/cdwa?color=2ea043&label=npm)](https://www.npmjs.com/package/cdwa)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Build Status](https://img.shields.io/badge/build-passing-brightgreen.svg)](#)
+[![Documentation](https://img.shields.io/badge/docs-GitHub%20Pages-blue)](https://cdteammods.github.io/CDWA/)
+
+---
+
+## 🌐 Site da Documentação Oficial
+
+Acesse nosso portal interativo completo com todos os guias, exemplos e especificações da API no **GitHub Pages**:
+
+👉 **[https://cdteammods.github.io/CDWA/](https://cdteammods.github.io/CDWA/)**
+
+### 📑 Navegação Direta no Site:
+* 🚀 **[Início Rápido](./docs/getting-started.html)**: Instalação, setup e primeiro bot conectado via QR Code.
+* 🔒 **[Arquitetura & Segurança](./docs/architecture.html)**: Noise Protocol Handshake, WABinary e criptografia at-rest.
+* 📩 **[Envio de Mensagens](./docs/sending-messages.html)**: Guia completo para textos, fotos, vídeos, notas de voz (PTT), GPS, contatos e reações.
+* 📡 **[Eventos & Conexão](./docs/events.html)**: Monitoramento de status, reconexão automática e mensagens recebidas.
+* 🔑 **[Autenticação & Estado](./docs/authentication.html)**: Como proteger tokens com AES-256-GCM e chave mestra.
+
+---
+
+## ⚡ Por que escolher o CDWA?
+
+Inspirada e reconstruída a partir dos conceitos pioneiros do [WhiskeySockets/Baileys](https://github.com/WhiskeySockets/Baileys), o **CDWA** soluciona as principais deficiências históricas:
+
+| Recurso | Baileys Clássico | CDWA |
+| :--- | :--- | :--- |
+| **Armazenamento de Credenciais** | JSONs em texto plano no disco (vulnerável) | **Criptografia At-Rest com AES-256-GCM + KDF** |
+| **Primitivas Criptográficas** | Libs legadas e heterogêneas | **`@noble/curves` (X25519) auditado e puro** |
+| **Tipagem TypeScript** | Histórico com muitos tipos `any` | **Modo Estrito (Strict Mode) de ponta a ponta** |
+| **Vazamento de Memória** | Acúmulo de listeners em conexões longas | **Ciclo de vida determinístico e buffers limpos** |
+| **Empacotamento** | CommonJS predominante | **Dual Export moderno (ESM nativo + CJS via tsup)** |
+
+---
+
+## 📦 Instalação
+
+```bash
+npm install cdwa
+```
+
+---
+
+## 🚀 Uso Rápido (JavaScript Puro ou TypeScript)
+
+### Em JavaScript Puro com ES Modules (`import` - arquivo `.js`):
+```javascript
+import makeWASocket, { useSecureAuthState } from 'cdwa'
+
+const auth = await useSecureAuthState('./auth_info', 'senha-secreta')
+const sock = makeWASocket({ auth, printQRInTerminal: true })
+
+sock.on('connection.update', ({ qr, connection }) => {
+  if (qr) console.log('Escaneie o QR Code:', qr)
+  if (connection === 'open') console.log('✅ Conectado via JavaScript Puro!')
+})
+
+await sock.connect()
+```
+
+### Em JavaScript Puro com CommonJS (`require` - arquivo `.cjs`):
+```javascript
+const { default: makeWASocket, useSecureAuthState } = require('cdwa')
+
+async function run() {
+  const auth = await useSecureAuthState('./auth_info', 'senha-secreta')
+  const sock = makeWASocket({ auth, printQRInTerminal: true })
+
+  sock.on('connection.update', ({ qr, connection }) => {
+    if (qr) console.log('Escaneie o QR Code:', qr)
+    if (connection === 'open') console.log('✅ Conectado via CommonJS!')
+  })
+
+  await sock.connect()
+}
+
+run()
+```
+
+---
+
+## 📁 Estrutura do Repositório
+
+```text
+├── docs/              # Site oficial de documentação (GitHub Pages)
+│   ├── index.html     # Portal inicial
+│   ├── style.css      # Design responsivo dark mode
+│   └── *.html         # Guias temáticos interligados
+├── src/
+│   ├── auth/          # Gestão de credenciais e criptografia at-rest (AES-256-GCM)
+│   ├── binary/        # Protocolo binário WABinary (codificação/decodificação de stanzas)
+│   ├── client/        # Fachada pública do cliente (makeWASocket / WhatsAppClient)
+│   ├── crypto/        # Primitivas criptográficas (Curve25519, HKDF, AES-GCM, Noise)
+│   ├── messages/      # Construtor de mensagens (Texto, Mídia, GPS, Contatos, Reações)
+│   ├── signal/        # Implementação do protocolo Signal (Double Ratchet, Pre-keys)
+│   ├── socket/        # Camada de transporte WebSocket resiliente com keep-alive
+│   └── index.ts       # Entry point principal da biblioteca
+├── tests/             # Testes automatizados
+├── examples/          # Exemplos de uso prático
+├── package.json       # Configuração NPM (dual ESM/CJS)
+└── tsup.config.ts     # Bundler otimizado para produção
+```
+
+---
+
+## 📄 Licença
+
+Distribuído sob a licença **MIT**. Veja [LICENSE](LICENSE) para mais informações.

package/dist/auth/index.cjs

@@ -0,0 +1,191 @@
+'use strict';
+
+var crypto = require('crypto');
+var ed25519 = require('@noble/curves/ed25519');
+var hkdf = require('@noble/hashes/hkdf');
+var sha256 = require('@noble/hashes/sha256');
+var aes = require('@noble/ciphers/aes');
+var fs = require('fs');
+var path = require('path');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var path__default = /*#__PURE__*/_interopDefault(path);
+
+// src/auth/index.ts
+
+// src/crypto/index.ts
+var CryptoEngine = class {
+  /**
+   * Gera um novo par de chaves Curve25519 (Diffie-Hellman)
+   */
+  static generateKeyPair() {
+    const priv = crypto.randomBytes(32);
+    const pub = ed25519.x25519.getPublicKey(priv);
+    return {
+      private: new Uint8Array(priv),
+      public: new Uint8Array(pub)
+    };
+  }
+  /**
+   * Executa Diffie-Hellman compartilhado (Shared Secret) usando Curve25519
+   */
+  static sharedKey(privateKey, publicKey) {
+    return ed25519.x25519.getSharedSecret(privateKey, publicKey);
+  }
+  /**
+   * HKDF baseado em SHA-256 para derivação segura de chaves (RFC 5869)
+   */
+  static deriveKey(secret, info, salt, length = 32) {
+    const infoBytes = typeof info === "string" ? new TextEncoder().encode(info) : info;
+    return hkdf.hkdf(sha256.sha256, secret, salt, infoBytes, length);
+  }
+  /**
+   * Encriptação autenticada com AES-256-GCM
+   */
+  static aesGcmEncrypt(key, plaintext, iv, additionalData) {
+    const cipher = aes.gcm(key, iv, additionalData);
+    return cipher.encrypt(plaintext);
+  }
+  /**
+   * Decriptação autenticada com AES-256-GCM
+   */
+  static aesGcmDecrypt(key, ciphertext, iv, additionalData) {
+    const cipher = aes.gcm(key, iv, additionalData);
+    return cipher.decrypt(ciphertext);
+  }
+  /**
+   * Encripta um payload com uma senha mestra (para proteger credenciais at-rest)
+   */
+  static encryptAtRest(payload, masterPassphrase) {
+    const salt = crypto.randomBytes(16);
+    const iv = crypto.randomBytes(12);
+    const key = hkdf.hkdf(sha256.sha256, new TextEncoder().encode(masterPassphrase), salt, new TextEncoder().encode("cdwa-at-rest"), 32);
+    const encrypted = this.aesGcmEncrypt(key, payload, iv);
+    return {
+      salt: Buffer.from(salt).toString("hex"),
+      iv: Buffer.from(iv).toString("hex"),
+      data: Buffer.from(encrypted).toString("base64")
+    };
+  }
+  /**
+   * Decripta um payload protegido com a senha mestra
+   */
+  static decryptAtRest(encryptedBundle, masterPassphrase) {
+    const salt = Buffer.from(encryptedBundle.salt, "hex");
+    const iv = Buffer.from(encryptedBundle.iv, "hex");
+    const data = Buffer.from(encryptedBundle.data, "base64");
+    const key = hkdf.hkdf(sha256.sha256, new TextEncoder().encode(masterPassphrase), salt, new TextEncoder().encode("cdwa-at-rest"), 32);
+    return this.aesGcmDecrypt(key, data, iv);
+  }
+};
+function initAuthCreds() {
+  const identityKeyPair = CryptoEngine.generateKeyPair();
+  const noiseKey = CryptoEngine.generateKeyPair();
+  const pairingEphemeral = CryptoEngine.generateKeyPair();
+  const signedPreKey = CryptoEngine.generateKeyPair();
+  const signedSignature = CryptoEngine.sharedKey(identityKeyPair.private, signedPreKey.public);
+  return {
+    noiseKey,
+    pairingEphemeralKeyPair: pairingEphemeral,
+    signedIdentityKey: identityKeyPair,
+    signedPreKey: {
+      ...signedPreKey,
+      keyId: 1,
+      signature: signedSignature
+    },
+    registrationId: Math.floor(Math.random() * 16384),
+    advSecretKey: Buffer.from(crypto.randomBytes(32)).toString("base64"),
+    firstUnuploadedPreKeyId: 1,
+    nextPreKeyId: 1
+  };
+}
+var EncryptedFileAuthState = class {
+  folderPath;
+  passphrase;
+  constructor(folderPath, passphrase) {
+    this.folderPath = folderPath;
+    this.passphrase = passphrase;
+  }
+  async ensureDir() {
+    await fs.promises.mkdir(this.folderPath, { recursive: true });
+  }
+  getFilePath(filename) {
+    return path__default.default.join(this.folderPath, `${filename}.json`);
+  }
+  async save(key, data) {
+    await this.ensureDir();
+    const filePath = this.getFilePath(key);
+    const jsonString = JSON.stringify(data, (_, value) => {
+      if (value instanceof Uint8Array) {
+        return { __type: "Buffer", data: Buffer.from(value).toString("base64") };
+      }
+      return value;
+    });
+    if (this.passphrase) {
+      const encrypted = CryptoEngine.encryptAtRest(new TextEncoder().encode(jsonString), this.passphrase);
+      await fs.promises.writeFile(filePath, JSON.stringify(encrypted), "utf-8");
+    } else {
+      await fs.promises.writeFile(filePath, jsonString, "utf-8");
+    }
+  }
+  async load(key) {
+    const filePath = this.getFilePath(key);
+    try {
+      const content = await fs.promises.readFile(filePath, "utf-8");
+      let jsonString = content;
+      if (this.passphrase) {
+        const bundle = JSON.parse(content);
+        const decryptedBytes = CryptoEngine.decryptAtRest(bundle, this.passphrase);
+        jsonString = new TextDecoder().decode(decryptedBytes);
+      }
+      return JSON.parse(jsonString, (_, value) => {
+        if (value && value.__type === "Buffer") {
+          return new Uint8Array(Buffer.from(value.data, "base64"));
+        }
+        return value;
+      });
+    } catch {
+      return null;
+    }
+  }
+  createKeyStore() {
+    return {
+      get: async (type, ids) => {
+        const result = {};
+        for (const id of ids) {
+          const item = await this.load(`${type}-${id}`);
+          if (item) {
+            result[id] = item;
+          }
+        }
+        return result;
+      },
+      set: async (data) => {
+        for (const [type, entries] of Object.entries(data)) {
+          for (const [id, value] of Object.entries(entries)) {
+            await this.save(`${type}-${id}`, value);
+          }
+        }
+      }
+    };
+  }
+};
+async function useSecureAuthState(folderPath, passphrase) {
+  const storage = new EncryptedFileAuthState(folderPath, passphrase);
+  let creds = await storage.load("creds");
+  if (!creds) {
+    creds = initAuthCreds();
+    await storage.save("creds", creds);
+  }
+  return {
+    creds,
+    keys: storage.createKeyStore()
+  };
+}
+
+exports.EncryptedFileAuthState = EncryptedFileAuthState;
+exports.initAuthCreds = initAuthCreds;
+exports.useSecureAuthState = useSecureAuthState;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/auth/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/crypto/index.ts","../../src/auth/index.ts"],"names":["randomBytes","x25519","hkdf","sha256","gcm","fs","path"],"mappings":";;;;;;;;;;;;;;;;;AAWO,IAAM,eAAN,MAAmB;AAAA;AAAA;AAAA;AAAA,EAIxB,OAAO,eAAA,GAA2B;AAChC,IAAA,MAAM,IAAA,GAAOA,mBAAY,EAAE,CAAA;AAC3B,IAAA,MAAM,GAAA,GAAMC,cAAA,CAAO,YAAA,CAAa,IAAI,CAAA;AACpC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAI,UAAA,CAAW,IAAI,CAAA;AAAA,MAC5B,MAAA,EAAQ,IAAI,UAAA,CAAW,GAAG;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,SAAA,CAAU,UAAA,EAAwB,SAAA,EAAmC;AAC1E,IAAA,OAAOA,cAAA,CAAO,eAAA,CAAgB,UAAA,EAAY,SAAS,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,SAAA,CACL,MAAA,EACA,IAAA,EACA,IAAA,EACA,SAAS,EAAA,EACG;AACZ,IAAA,MAAM,SAAA,GAAY,OAAO,IAAA,KAAS,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,GAAI,IAAA;AAC9E,IAAA,OAAOC,SAAA,CAAKC,aAAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,WAAW,MAAM,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAA,CACL,GAAA,EACA,SAAA,EACA,IACA,cAAA,EACY;AACZ,IAAA,MAAM,MAAA,GAASC,OAAA,CAAI,GAAA,EAAK,EAAA,EAAI,cAAc,CAAA;AAC1C,IAAA,OAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAA,CACL,GAAA,EACA,UAAA,EACA,IACA,cAAA,EACY;AACZ,IAAA,MAAM,MAAA,GAASA,OAAA,CAAI,GAAA,EAAK,EAAA,EAAI,cAAc,CAAA;AAC1C,IAAA,OAAO,MAAA,CAAO,QAAQ,UAAU,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAA,CAAc,OAAA,EAAqB,gBAAA,EAAsE;AAC9G,IAAA,MAAM,IAAA,GAAOJ,mBAAY,EAAE,CAAA;AAC3B,IAAA,MAAM,EAAA,GAAKA,mBAAY,EAAE,CAAA;AACzB,IAAA,MAAM,MAAME,SAAA,CAAKC,aAAAA,EAAQ,IAAI,WAAA,GAAc,MAAA,CAAO,gBAAgB,CAAA,EAAG,IAAA,EAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,cAAc,GAAG,EAAE,CAAA;AACvH,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,aAAA,CAAc,GAAA,EAAK,SAAS,EAAE,CAAA;AAErD,IAAA,OAAO;AAAA,MACL,MAAM,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,MACtC,IAAI,MAAA,CAAO,IAAA,CAAK,EAAE,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,MAClC,MAAM,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,QAAQ;AAAA,KAChD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAA,CACL,eAAA,EACA,gBAAA,EACY;AACZ,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,eAAA,CAAgB,MAAM,KAAK,CAAA;AACpD,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,eAAA,CAAgB,IAAI,KAAK,CAAA;AAChD,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,eAAA,CAAgB,MAAM,QAAQ,CAAA;AACvD,IAAA,MAAM,MAAMD,SAAA,CAAKC,aAAAA,EAAQ,IAAI,WAAA,GAAc,MAAA,CAAO,gBAAgB,CAAA,EAAG,IAAA,EAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,cAAc,GAAG,EAAE,CAAA;AAEvH,IAAA,OAAO,IAAA,CAAK,aAAA,CAAc,GAAA,EAAK,IAAA,EAAM,EAAE,CAAA;AAAA,EACzC;AACF,CAAA;AC3FO,SAAS,aAAA,GAAqC;AACnD,EAAA,MAAM,eAAA,GAAkB,aAAa,eAAA,EAAgB;AACrD,EAAA,MAAM,QAAA,GAAW,aAAa,eAAA,EAAgB;AAC9C,EAAA,MAAM,gBAAA,GAAmB,aAAa,eAAA,EAAgB;AACtD,EAAA,MAAM,YAAA,GAAe,aAAa,eAAA,EAAgB;AAIlD,EAAA,MAAM,kBAAkB,YAAA,CAAa,SAAA,CAAU,eAAA,CAAgB,OAAA,EAAS,aAAa,MAAM,CAAA;AAE3F,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,uBAAA,EAAyB,gBAAA;AAAA,IACzB,iBAAA,EAAmB,eAAA;AAAA,IACnB,YAAA,EAAc;AAAA,MACZ,GAAG,YAAA;AAAA,MACH,KAAA,EAAO,CAAA;AAAA,MACP,SAAA,EAAW;AAAA,KACb;AAAA,IACA,gBAAgB,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,KAAK,CAAA;AAAA,IAChD,YAAA,EAAc,OAAO,IAAA,CAAKH,kBAAAA,CAAY,EAAE,CAAC,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,IAC5D,uBAAA,EAAyB,CAAA;AAAA,IACzB,YAAA,EAAc;AAAA,GAChB;AACF;AAKO,IAAM,yBAAN,MAA6B;AAAA,EAC1B,UAAA;AAAA,EACA,UAAA;AAAA,EAER,WAAA,CAAY,YAAoB,UAAA,EAAqB;AACnD,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAAA,EACpB;AAAA,EAEA,MAAc,SAAA,GAAY;AACxB,IAAA,MAAMK,YAAG,KAAA,CAAM,IAAA,CAAK,YAAY,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,EACrD;AAAA,EAEQ,YAAY,QAAA,EAA0B;AAC5C,IAAA,OAAOC,sBAAK,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,CAAA,EAAG,QAAQ,CAAA,KAAA,CAAO,CAAA;AAAA,EACtD;AAAA,EAEA,MAAM,IAAA,CAAK,GAAA,EAAa,IAAA,EAA8B;AACpD,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACrC,IAAA,MAAM,aAAa,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,CAAC,GAAG,KAAA,KAAU;AACpD,MAAA,IAAI,iBAAiB,UAAA,EAAY;AAC/B,QAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,MAAA,CAAO,KAAK,KAAK,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,EAAE;AAAA,MACzE;AACA,MAAA,OAAO,KAAA;AAAA,IACT,CAAC,CAAA;AAED,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,MAAM,SAAA,GAAY,YAAA,CAAa,aAAA,CAAc,IAAI,WAAA,GAAc,MAAA,CAAO,UAAU,CAAA,EAAG,IAAA,CAAK,UAAU,CAAA;AAClG,MAAA,MAAMD,YAAG,SAAA,CAAU,QAAA,EAAU,KAAK,SAAA,CAAU,SAAS,GAAG,OAAO,CAAA;AAAA,IACjE,CAAA,MAAO;AACL,MAAA,MAAMA,WAAA,CAAG,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,OAAO,CAAA;AAAA,IAClD;AAAA,EACF;AAAA,EAEA,MAAM,KAAQ,GAAA,EAAgC;AAC5C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAMA,WAAA,CAAG,QAAA,CAAS,UAAU,OAAO,CAAA;AACnD,MAAA,IAAI,UAAA,GAAa,OAAA;AAEjB,MAAA,IAAI,KAAK,UAAA,EAAY;AACnB,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACjC,QAAA,MAAM,cAAA,GAAiB,YAAA,CAAa,aAAA,CAAc,MAAA,EAAQ,KAAK,UAAU,CAAA;AACzE,QAAA,UAAA,GAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,cAAc,CAAA;AAAA,MACtD;AAEA,MAAA,OAAO,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY,CAAC,GAAG,KAAA,KAAU;AAC1C,QAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,KAAW,QAAA,EAAU;AACtC,UAAA,OAAO,IAAI,UAAA,CAAW,MAAA,CAAO,KAAK,KAAA,CAAM,IAAA,EAAM,QAAQ,CAAC,CAAA;AAAA,QACzD;AACA,QAAA,OAAO,KAAA;AAAA,MACT,CAAC,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,cAAA,GAAiC;AAC/B,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,OAAU,IAAA,EAAc,GAAA,KAA8C;AACzE,QAAA,MAAM,SAA4B,EAAC;AACnC,QAAA,KAAA,MAAW,MAAM,GAAA,EAAK;AACpB,UAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAQ,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAC/C,UAAA,IAAI,IAAA,EAAM;AACR,YAAA,MAAA,CAAO,EAAE,CAAA,GAAI,IAAA;AAAA,UACf;AAAA,QACF;AACA,QAAA,OAAO,MAAA;AAAA,MACT,CAAA;AAAA,MACA,GAAA,EAAK,OAAO,IAAA,KAAiE;AAC3E,QAAA,KAAA,MAAW,CAAC,IAAA,EAAM,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,EAAG;AAClD,UAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AACjD,YAAA,MAAM,KAAK,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,KAAK,CAAA;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAAA,KACF;AAAA,EACF;AACF;AAKA,eAAsB,kBAAA,CACpB,YACA,UAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,IAAI,sBAAA,CAAuB,UAAA,EAAY,UAAU,CAAA;AACjE,EAAA,IAAI,KAAA,GAAQ,MAAM,OAAA,CAAQ,IAAA,CAA0B,OAAO,CAAA;AAE3D,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,KAAA,GAAQ,aAAA,EAAc;AACtB,IAAA,MAAM,OAAA,CAAQ,IAAA,CAAK,OAAA,EAAS,KAAK,CAAA;AAAA,EACnC;AAEA,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,IAAA,EAAM,QAAQ,cAAA;AAAe,GAC/B;AACF","file":"index.cjs","sourcesContent":["import { x25519 } from '@noble/curves/ed25519'\nimport { hkdf } from '@noble/hashes/hkdf'\nimport { sha256 } from '@noble/hashes/sha256'\nimport { gcm } from '@noble/ciphers/aes'\nimport { randomBytes } from 'crypto'\nimport type { KeyPair } from '../types/index.js'\n\n/**\n * Utilitários criptográficos de alta performance e segurança para o protocolo WhatsApp\n */\n\nexport class CryptoEngine {\n  /**\n   * Gera um novo par de chaves Curve25519 (Diffie-Hellman)\n   */\n  static generateKeyPair(): KeyPair {\n    const priv = randomBytes(32)\n    const pub = x25519.getPublicKey(priv)\n    return {\n      private: new Uint8Array(priv),\n      public: new Uint8Array(pub),\n    }\n  }\n\n  /**\n   * Executa Diffie-Hellman compartilhado (Shared Secret) usando Curve25519\n   */\n  static sharedKey(privateKey: Uint8Array, publicKey: Uint8Array): Uint8Array {\n    return x25519.getSharedSecret(privateKey, publicKey)\n  }\n\n  /**\n   * HKDF baseado em SHA-256 para derivação segura de chaves (RFC 5869)\n   */\n  static deriveKey(\n    secret: Uint8Array,\n    info: string | Uint8Array,\n    salt?: Uint8Array,\n    length = 32\n  ): Uint8Array {\n    const infoBytes = typeof info === 'string' ? new TextEncoder().encode(info) : info\n    return hkdf(sha256, secret, salt, infoBytes, length)\n  }\n\n  /**\n   * Encriptação autenticada com AES-256-GCM\n   */\n  static aesGcmEncrypt(\n    key: Uint8Array,\n    plaintext: Uint8Array,\n    iv: Uint8Array,\n    additionalData?: Uint8Array\n  ): Uint8Array {\n    const cipher = gcm(key, iv, additionalData)\n    return cipher.encrypt(plaintext)\n  }\n\n  /**\n   * Decriptação autenticada com AES-256-GCM\n   */\n  static aesGcmDecrypt(\n    key: Uint8Array,\n    ciphertext: Uint8Array,\n    iv: Uint8Array,\n    additionalData?: Uint8Array\n  ): Uint8Array {\n    const cipher = gcm(key, iv, additionalData)\n    return cipher.decrypt(ciphertext)\n  }\n\n  /**\n   * Encripta um payload com uma senha mestra (para proteger credenciais at-rest)\n   */\n  static encryptAtRest(payload: Uint8Array, masterPassphrase: string): { iv: string; salt: string; data: string } {\n    const salt = randomBytes(16)\n    const iv = randomBytes(12)\n    const key = hkdf(sha256, new TextEncoder().encode(masterPassphrase), salt, new TextEncoder().encode('cdwa-at-rest'), 32)\n    const encrypted = this.aesGcmEncrypt(key, payload, iv)\n\n    return {\n      salt: Buffer.from(salt).toString('hex'),\n      iv: Buffer.from(iv).toString('hex'),\n      data: Buffer.from(encrypted).toString('base64'),\n    }\n  }\n\n  /**\n   * Decripta um payload protegido com a senha mestra\n   */\n  static decryptAtRest(\n    encryptedBundle: { iv: string; salt: string; data: string },\n    masterPassphrase: string\n  ): Uint8Array {\n    const salt = Buffer.from(encryptedBundle.salt, 'hex')\n    const iv = Buffer.from(encryptedBundle.iv, 'hex')\n    const data = Buffer.from(encryptedBundle.data, 'base64')\n    const key = hkdf(sha256, new TextEncoder().encode(masterPassphrase), salt, new TextEncoder().encode('cdwa-at-rest'), 32)\n\n    return this.aesGcmDecrypt(key, data, iv)\n  }\n}\n\nexport * from './noise.js'\n\n","import { randomBytes } from 'crypto'\nimport { CryptoEngine } from '../crypto/index.js'\nimport type { AuthenticationCreds, AuthenticationState, SignalKeyStore } from '../types/index.js'\nimport { promises as fs } from 'fs'\nimport path from 'path'\n\n/**\n * Cria credenciais limpas para uma nova sessão Multi-Device\n */\nexport function initAuthCreds(): AuthenticationCreds {\n  const identityKeyPair = CryptoEngine.generateKeyPair()\n  const noiseKey = CryptoEngine.generateKeyPair()\n  const pairingEphemeral = CryptoEngine.generateKeyPair()\n  const signedPreKey = CryptoEngine.generateKeyPair()\n\n  // Assinatura da pré-chave com a chave de identidade\n  // No WhatsApp, isso garante autenticidade contra MITM no protocolo Signal\n  const signedSignature = CryptoEngine.sharedKey(identityKeyPair.private, signedPreKey.public)\n\n  return {\n    noiseKey,\n    pairingEphemeralKeyPair: pairingEphemeral,\n    signedIdentityKey: identityKeyPair,\n    signedPreKey: {\n      ...signedPreKey,\n      keyId: 1,\n      signature: signedSignature,\n    },\n    registrationId: Math.floor(Math.random() * 16384),\n    advSecretKey: Buffer.from(randomBytes(32)).toString('base64'),\n    firstUnuploadedPreKeyId: 1,\n    nextPreKeyId: 1,\n  }\n}\n\n/**\n * Gerenciador de estado de autenticação com suporte opcional a encriptação at-rest\n */\nexport class EncryptedFileAuthState {\n  private folderPath: string\n  private passphrase?: string\n\n  constructor(folderPath: string, passphrase?: string) {\n    this.folderPath = folderPath\n    this.passphrase = passphrase\n  }\n\n  private async ensureDir() {\n    await fs.mkdir(this.folderPath, { recursive: true })\n  }\n\n  private getFilePath(filename: string): string {\n    return path.join(this.folderPath, `${filename}.json`)\n  }\n\n  async save(key: string, data: unknown): Promise<void> {\n    await this.ensureDir()\n    const filePath = this.getFilePath(key)\n    const jsonString = JSON.stringify(data, (_, value) => {\n      if (value instanceof Uint8Array) {\n        return { __type: 'Buffer', data: Buffer.from(value).toString('base64') }\n      }\n      return value\n    })\n\n    if (this.passphrase) {\n      const encrypted = CryptoEngine.encryptAtRest(new TextEncoder().encode(jsonString), this.passphrase)\n      await fs.writeFile(filePath, JSON.stringify(encrypted), 'utf-8')\n    } else {\n      await fs.writeFile(filePath, jsonString, 'utf-8')\n    }\n  }\n\n  async load<T>(key: string): Promise<T | null> {\n    const filePath = this.getFilePath(key)\n    try {\n      const content = await fs.readFile(filePath, 'utf-8')\n      let jsonString = content\n\n      if (this.passphrase) {\n        const bundle = JSON.parse(content)\n        const decryptedBytes = CryptoEngine.decryptAtRest(bundle, this.passphrase)\n        jsonString = new TextDecoder().decode(decryptedBytes)\n      }\n\n      return JSON.parse(jsonString, (_, value) => {\n        if (value && value.__type === 'Buffer') {\n          return new Uint8Array(Buffer.from(value.data, 'base64'))\n        }\n        return value\n      }) as T\n    } catch {\n      return null\n    }\n  }\n\n  createKeyStore(): SignalKeyStore {\n    return {\n      get: async <T>(type: string, ids: string[]): Promise<Record<string, T>> => {\n        const result: Record<string, T> = {}\n        for (const id of ids) {\n          const item = await this.load<T>(`${type}-${id}`)\n          if (item) {\n            result[id] = item\n          }\n        }\n        return result\n      },\n      set: async (data: Record<string, Record<string, unknown>>): Promise<void> => {\n        for (const [type, entries] of Object.entries(data)) {\n          for (const [id, value] of Object.entries(entries)) {\n            await this.save(`${type}-${id}`, value)\n          }\n        }\n      },\n    }\n  }\n}\n\n/**\n * Cria um estado de autenticação persistente com segurança reforçada\n */\nexport async function useSecureAuthState(\n  folderPath: string,\n  passphrase?: string\n): Promise<AuthenticationState> {\n  const storage = new EncryptedFileAuthState(folderPath, passphrase)\n  let creds = await storage.load<AuthenticationCreds>('creds')\n\n  if (!creds) {\n    creds = initAuthCreds()\n    await storage.save('creds', creds)\n  }\n\n  return {\n    creds,\n    keys: storage.createKeyStore(),\n  }\n}\n"]}

package/dist/auth/index.d.cts

@@ -0,0 +1,25 @@
+import { S as SignalKeyStore, A as AuthenticationCreds, a as AuthenticationState } from '../index-CcMoHfPz.cjs';
+
+/**
+ * Cria credenciais limpas para uma nova sessão Multi-Device
+ */
+declare function initAuthCreds(): AuthenticationCreds;
+/**
+ * Gerenciador de estado de autenticação com suporte opcional a encriptação at-rest
+ */
+declare class EncryptedFileAuthState {
+    private folderPath;
+    private passphrase?;
+    constructor(folderPath: string, passphrase?: string);
+    private ensureDir;
+    private getFilePath;
+    save(key: string, data: unknown): Promise<void>;
+    load<T>(key: string): Promise<T | null>;
+    createKeyStore(): SignalKeyStore;
+}
+/**
+ * Cria um estado de autenticação persistente com segurança reforçada
+ */
+declare function useSecureAuthState(folderPath: string, passphrase?: string): Promise<AuthenticationState>;
+
+export { EncryptedFileAuthState, initAuthCreds, useSecureAuthState };

package/dist/auth/index.d.ts

@@ -0,0 +1,25 @@
+import { S as SignalKeyStore, A as AuthenticationCreds, a as AuthenticationState } from '../index-CcMoHfPz.js';
+
+/**
+ * Cria credenciais limpas para uma nova sessão Multi-Device
+ */
+declare function initAuthCreds(): AuthenticationCreds;
+/**
+ * Gerenciador de estado de autenticação com suporte opcional a encriptação at-rest
+ */
+declare class EncryptedFileAuthState {
+    private folderPath;
+    private passphrase?;
+    constructor(folderPath: string, passphrase?: string);
+    private ensureDir;
+    private getFilePath;
+    save(key: string, data: unknown): Promise<void>;
+    load<T>(key: string): Promise<T | null>;
+    createKeyStore(): SignalKeyStore;
+}
+/**
+ * Cria um estado de autenticação persistente com segurança reforçada
+ */
+declare function useSecureAuthState(folderPath: string, passphrase?: string): Promise<AuthenticationState>;
+
+export { EncryptedFileAuthState, initAuthCreds, useSecureAuthState };

package/dist/auth/index.js

@@ -0,0 +1,183 @@
+import { randomBytes } from 'crypto';
+import { x25519 } from '@noble/curves/ed25519';
+import { hkdf } from '@noble/hashes/hkdf';
+import { sha256 } from '@noble/hashes/sha256';
+import { gcm } from '@noble/ciphers/aes';
+import { promises } from 'fs';
+import path from 'path';
+
+// src/auth/index.ts
+
+// src/crypto/index.ts
+var CryptoEngine = class {
+  /**
+   * Gera um novo par de chaves Curve25519 (Diffie-Hellman)
+   */
+  static generateKeyPair() {
+    const priv = randomBytes(32);
+    const pub = x25519.getPublicKey(priv);
+    return {
+      private: new Uint8Array(priv),
+      public: new Uint8Array(pub)
+    };
+  }
+  /**
+   * Executa Diffie-Hellman compartilhado (Shared Secret) usando Curve25519
+   */
+  static sharedKey(privateKey, publicKey) {
+    return x25519.getSharedSecret(privateKey, publicKey);
+  }
+  /**
+   * HKDF baseado em SHA-256 para derivação segura de chaves (RFC 5869)
+   */
+  static deriveKey(secret, info, salt, length = 32) {
+    const infoBytes = typeof info === "string" ? new TextEncoder().encode(info) : info;
+    return hkdf(sha256, secret, salt, infoBytes, length);
+  }
+  /**
+   * Encriptação autenticada com AES-256-GCM
+   */
+  static aesGcmEncrypt(key, plaintext, iv, additionalData) {
+    const cipher = gcm(key, iv, additionalData);
+    return cipher.encrypt(plaintext);
+  }
+  /**
+   * Decriptação autenticada com AES-256-GCM
+   */
+  static aesGcmDecrypt(key, ciphertext, iv, additionalData) {
+    const cipher = gcm(key, iv, additionalData);
+    return cipher.decrypt(ciphertext);
+  }
+  /**
+   * Encripta um payload com uma senha mestra (para proteger credenciais at-rest)
+   */
+  static encryptAtRest(payload, masterPassphrase) {
+    const salt = randomBytes(16);
+    const iv = randomBytes(12);
+    const key = hkdf(sha256, new TextEncoder().encode(masterPassphrase), salt, new TextEncoder().encode("cdwa-at-rest"), 32);
+    const encrypted = this.aesGcmEncrypt(key, payload, iv);
+    return {
+      salt: Buffer.from(salt).toString("hex"),
+      iv: Buffer.from(iv).toString("hex"),
+      data: Buffer.from(encrypted).toString("base64")
+    };
+  }
+  /**
+   * Decripta um payload protegido com a senha mestra
+   */
+  static decryptAtRest(encryptedBundle, masterPassphrase) {
+    const salt = Buffer.from(encryptedBundle.salt, "hex");
+    const iv = Buffer.from(encryptedBundle.iv, "hex");
+    const data = Buffer.from(encryptedBundle.data, "base64");
+    const key = hkdf(sha256, new TextEncoder().encode(masterPassphrase), salt, new TextEncoder().encode("cdwa-at-rest"), 32);
+    return this.aesGcmDecrypt(key, data, iv);
+  }
+};
+function initAuthCreds() {
+  const identityKeyPair = CryptoEngine.generateKeyPair();
+  const noiseKey = CryptoEngine.generateKeyPair();
+  const pairingEphemeral = CryptoEngine.generateKeyPair();
+  const signedPreKey = CryptoEngine.generateKeyPair();
+  const signedSignature = CryptoEngine.sharedKey(identityKeyPair.private, signedPreKey.public);
+  return {
+    noiseKey,
+    pairingEphemeralKeyPair: pairingEphemeral,
+    signedIdentityKey: identityKeyPair,
+    signedPreKey: {
+      ...signedPreKey,
+      keyId: 1,
+      signature: signedSignature
+    },
+    registrationId: Math.floor(Math.random() * 16384),
+    advSecretKey: Buffer.from(randomBytes(32)).toString("base64"),
+    firstUnuploadedPreKeyId: 1,
+    nextPreKeyId: 1
+  };
+}
+var EncryptedFileAuthState = class {
+  folderPath;
+  passphrase;
+  constructor(folderPath, passphrase) {
+    this.folderPath = folderPath;
+    this.passphrase = passphrase;
+  }
+  async ensureDir() {
+    await promises.mkdir(this.folderPath, { recursive: true });
+  }
+  getFilePath(filename) {
+    return path.join(this.folderPath, `${filename}.json`);
+  }
+  async save(key, data) {
+    await this.ensureDir();
+    const filePath = this.getFilePath(key);
+    const jsonString = JSON.stringify(data, (_, value) => {
+      if (value instanceof Uint8Array) {
+        return { __type: "Buffer", data: Buffer.from(value).toString("base64") };
+      }
+      return value;
+    });
+    if (this.passphrase) {
+      const encrypted = CryptoEngine.encryptAtRest(new TextEncoder().encode(jsonString), this.passphrase);
+      await promises.writeFile(filePath, JSON.stringify(encrypted), "utf-8");
+    } else {
+      await promises.writeFile(filePath, jsonString, "utf-8");
+    }
+  }
+  async load(key) {
+    const filePath = this.getFilePath(key);
+    try {
+      const content = await promises.readFile(filePath, "utf-8");
+      let jsonString = content;
+      if (this.passphrase) {
+        const bundle = JSON.parse(content);
+        const decryptedBytes = CryptoEngine.decryptAtRest(bundle, this.passphrase);
+        jsonString = new TextDecoder().decode(decryptedBytes);
+      }
+      return JSON.parse(jsonString, (_, value) => {
+        if (value && value.__type === "Buffer") {
+          return new Uint8Array(Buffer.from(value.data, "base64"));
+        }
+        return value;
+      });
+    } catch {
+      return null;
+    }
+  }
+  createKeyStore() {
+    return {
+      get: async (type, ids) => {
+        const result = {};
+        for (const id of ids) {
+          const item = await this.load(`${type}-${id}`);
+          if (item) {
+            result[id] = item;
+          }
+        }
+        return result;
+      },
+      set: async (data) => {
+        for (const [type, entries] of Object.entries(data)) {
+          for (const [id, value] of Object.entries(entries)) {
+            await this.save(`${type}-${id}`, value);
+          }
+        }
+      }
+    };
+  }
+};
+async function useSecureAuthState(folderPath, passphrase) {
+  const storage = new EncryptedFileAuthState(folderPath, passphrase);
+  let creds = await storage.load("creds");
+  if (!creds) {
+    creds = initAuthCreds();
+    await storage.save("creds", creds);
+  }
+  return {
+    creds,
+    keys: storage.createKeyStore()
+  };
+}
+
+export { EncryptedFileAuthState, initAuthCreds, useSecureAuthState };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/crypto/index.ts","../../src/auth/index.ts"],"names":["sha256","randomBytes","fs"],"mappings":";;;;;;;;;;;AAWO,IAAM,eAAN,MAAmB;AAAA;AAAA;AAAA;AAAA,EAIxB,OAAO,eAAA,GAA2B;AAChC,IAAA,MAAM,IAAA,GAAO,YAAY,EAAE,CAAA;AAC3B,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,YAAA,CAAa,IAAI,CAAA;AACpC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAI,UAAA,CAAW,IAAI,CAAA;AAAA,MAC5B,MAAA,EAAQ,IAAI,UAAA,CAAW,GAAG;AAAA,KAC5B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,SAAA,CAAU,UAAA,EAAwB,SAAA,EAAmC;AAC1E,IAAA,OAAO,MAAA,CAAO,eAAA,CAAgB,UAAA,EAAY,SAAS,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,SAAA,CACL,MAAA,EACA,IAAA,EACA,IAAA,EACA,SAAS,EAAA,EACG;AACZ,IAAA,MAAM,SAAA,GAAY,OAAO,IAAA,KAAS,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,IAAI,CAAA,GAAI,IAAA;AAC9E,IAAA,OAAO,IAAA,CAAKA,MAAAA,EAAQ,MAAA,EAAQ,IAAA,EAAM,WAAW,MAAM,CAAA;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAA,CACL,GAAA,EACA,SAAA,EACA,IACA,cAAA,EACY;AACZ,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,GAAA,EAAK,EAAA,EAAI,cAAc,CAAA;AAC1C,IAAA,OAAO,MAAA,CAAO,QAAQ,SAAS,CAAA;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAA,CACL,GAAA,EACA,UAAA,EACA,IACA,cAAA,EACY;AACZ,IAAA,MAAM,MAAA,GAAS,GAAA,CAAI,GAAA,EAAK,EAAA,EAAI,cAAc,CAAA;AAC1C,IAAA,OAAO,MAAA,CAAO,QAAQ,UAAU,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAA,CAAc,OAAA,EAAqB,gBAAA,EAAsE;AAC9G,IAAA,MAAM,IAAA,GAAO,YAAY,EAAE,CAAA;AAC3B,IAAA,MAAM,EAAA,GAAK,YAAY,EAAE,CAAA;AACzB,IAAA,MAAM,MAAM,IAAA,CAAKA,MAAAA,EAAQ,IAAI,WAAA,GAAc,MAAA,CAAO,gBAAgB,CAAA,EAAG,IAAA,EAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,cAAc,GAAG,EAAE,CAAA;AACvH,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,aAAA,CAAc,GAAA,EAAK,SAAS,EAAE,CAAA;AAErD,IAAA,OAAO;AAAA,MACL,MAAM,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,MACtC,IAAI,MAAA,CAAO,IAAA,CAAK,EAAE,CAAA,CAAE,SAAS,KAAK,CAAA;AAAA,MAClC,MAAM,MAAA,CAAO,IAAA,CAAK,SAAS,CAAA,CAAE,SAAS,QAAQ;AAAA,KAChD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,aAAA,CACL,eAAA,EACA,gBAAA,EACY;AACZ,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,eAAA,CAAgB,MAAM,KAAK,CAAA;AACpD,IAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,eAAA,CAAgB,IAAI,KAAK,CAAA;AAChD,IAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,eAAA,CAAgB,MAAM,QAAQ,CAAA;AACvD,IAAA,MAAM,MAAM,IAAA,CAAKA,MAAAA,EAAQ,IAAI,WAAA,GAAc,MAAA,CAAO,gBAAgB,CAAA,EAAG,IAAA,EAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,cAAc,GAAG,EAAE,CAAA;AAEvH,IAAA,OAAO,IAAA,CAAK,aAAA,CAAc,GAAA,EAAK,IAAA,EAAM,EAAE,CAAA;AAAA,EACzC;AACF,CAAA;AC3FO,SAAS,aAAA,GAAqC;AACnD,EAAA,MAAM,eAAA,GAAkB,aAAa,eAAA,EAAgB;AACrD,EAAA,MAAM,QAAA,GAAW,aAAa,eAAA,EAAgB;AAC9C,EAAA,MAAM,gBAAA,GAAmB,aAAa,eAAA,EAAgB;AACtD,EAAA,MAAM,YAAA,GAAe,aAAa,eAAA,EAAgB;AAIlD,EAAA,MAAM,kBAAkB,YAAA,CAAa,SAAA,CAAU,eAAA,CAAgB,OAAA,EAAS,aAAa,MAAM,CAAA;AAE3F,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,uBAAA,EAAyB,gBAAA;AAAA,IACzB,iBAAA,EAAmB,eAAA;AAAA,IACnB,YAAA,EAAc;AAAA,MACZ,GAAG,YAAA;AAAA,MACH,KAAA,EAAO,CAAA;AAAA,MACP,SAAA,EAAW;AAAA,KACb;AAAA,IACA,gBAAgB,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,MAAA,KAAW,KAAK,CAAA;AAAA,IAChD,YAAA,EAAc,OAAO,IAAA,CAAKC,WAAAA,CAAY,EAAE,CAAC,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,IAC5D,uBAAA,EAAyB,CAAA;AAAA,IACzB,YAAA,EAAc;AAAA,GAChB;AACF;AAKO,IAAM,yBAAN,MAA6B;AAAA,EAC1B,UAAA;AAAA,EACA,UAAA;AAAA,EAER,WAAA,CAAY,YAAoB,UAAA,EAAqB;AACnD,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAClB,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAAA,EACpB;AAAA,EAEA,MAAc,SAAA,GAAY;AACxB,IAAA,MAAMC,SAAG,KAAA,CAAM,IAAA,CAAK,YAAY,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,EACrD;AAAA,EAEQ,YAAY,QAAA,EAA0B;AAC5C,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAK,UAAA,EAAY,CAAA,EAAG,QAAQ,CAAA,KAAA,CAAO,CAAA;AAAA,EACtD;AAAA,EAEA,MAAM,IAAA,CAAK,GAAA,EAAa,IAAA,EAA8B;AACpD,IAAA,MAAM,KAAK,SAAA,EAAU;AACrB,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACrC,IAAA,MAAM,aAAa,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,CAAC,GAAG,KAAA,KAAU;AACpD,MAAA,IAAI,iBAAiB,UAAA,EAAY;AAC/B,QAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,MAAA,CAAO,KAAK,KAAK,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAA,EAAE;AAAA,MACzE;AACA,MAAA,OAAO,KAAA;AAAA,IACT,CAAC,CAAA;AAED,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,MAAM,SAAA,GAAY,YAAA,CAAa,aAAA,CAAc,IAAI,WAAA,GAAc,MAAA,CAAO,UAAU,CAAA,EAAG,IAAA,CAAK,UAAU,CAAA;AAClG,MAAA,MAAMA,SAAG,SAAA,CAAU,QAAA,EAAU,KAAK,SAAA,CAAU,SAAS,GAAG,OAAO,CAAA;AAAA,IACjE,CAAA,MAAO;AACL,MAAA,MAAMA,QAAA,CAAG,SAAA,CAAU,QAAA,EAAU,UAAA,EAAY,OAAO,CAAA;AAAA,IAClD;AAAA,EACF;AAAA,EAEA,MAAM,KAAQ,GAAA,EAAgC;AAC5C,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACrC,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,MAAMA,QAAA,CAAG,QAAA,CAAS,UAAU,OAAO,CAAA;AACnD,MAAA,IAAI,UAAA,GAAa,OAAA;AAEjB,MAAA,IAAI,KAAK,UAAA,EAAY;AACnB,QAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,OAAO,CAAA;AACjC,QAAA,MAAM,cAAA,GAAiB,YAAA,CAAa,aAAA,CAAc,MAAA,EAAQ,KAAK,UAAU,CAAA;AACzE,QAAA,UAAA,GAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,cAAc,CAAA;AAAA,MACtD;AAEA,MAAA,OAAO,IAAA,CAAK,KAAA,CAAM,UAAA,EAAY,CAAC,GAAG,KAAA,KAAU;AAC1C,QAAA,IAAI,KAAA,IAAS,KAAA,CAAM,MAAA,KAAW,QAAA,EAAU;AACtC,UAAA,OAAO,IAAI,UAAA,CAAW,MAAA,CAAO,KAAK,KAAA,CAAM,IAAA,EAAM,QAAQ,CAAC,CAAA;AAAA,QACzD;AACA,QAAA,OAAO,KAAA;AAAA,MACT,CAAC,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AAAA,EAEA,cAAA,GAAiC;AAC/B,IAAA,OAAO;AAAA,MACL,GAAA,EAAK,OAAU,IAAA,EAAc,GAAA,KAA8C;AACzE,QAAA,MAAM,SAA4B,EAAC;AACnC,QAAA,KAAA,MAAW,MAAM,GAAA,EAAK;AACpB,UAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,IAAA,CAAQ,GAAG,IAAI,CAAA,CAAA,EAAI,EAAE,CAAA,CAAE,CAAA;AAC/C,UAAA,IAAI,IAAA,EAAM;AACR,YAAA,MAAA,CAAO,EAAE,CAAA,GAAI,IAAA;AAAA,UACf;AAAA,QACF;AACA,QAAA,OAAO,MAAA;AAAA,MACT,CAAA;AAAA,MACA,GAAA,EAAK,OAAO,IAAA,KAAiE;AAC3E,QAAA,KAAA,MAAW,CAAC,IAAA,EAAM,OAAO,KAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,EAAG;AAClD,UAAA,KAAA,MAAW,CAAC,EAAA,EAAI,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAA,EAAG;AACjD,YAAA,MAAM,KAAK,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,EAAE,IAAI,KAAK,CAAA;AAAA,UACxC;AAAA,QACF;AAAA,MACF;AAAA,KACF;AAAA,EACF;AACF;AAKA,eAAsB,kBAAA,CACpB,YACA,UAAA,EAC8B;AAC9B,EAAA,MAAM,OAAA,GAAU,IAAI,sBAAA,CAAuB,UAAA,EAAY,UAAU,CAAA;AACjE,EAAA,IAAI,KAAA,GAAQ,MAAM,OAAA,CAAQ,IAAA,CAA0B,OAAO,CAAA;AAE3D,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,KAAA,GAAQ,aAAA,EAAc;AACtB,IAAA,MAAM,OAAA,CAAQ,IAAA,CAAK,OAAA,EAAS,KAAK,CAAA;AAAA,EACnC;AAEA,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,IAAA,EAAM,QAAQ,cAAA;AAAe,GAC/B;AACF","file":"index.js","sourcesContent":["import { x25519 } from '@noble/curves/ed25519'\nimport { hkdf } from '@noble/hashes/hkdf'\nimport { sha256 } from '@noble/hashes/sha256'\nimport { gcm } from '@noble/ciphers/aes'\nimport { randomBytes } from 'crypto'\nimport type { KeyPair } from '../types/index.js'\n\n/**\n * Utilitários criptográficos de alta performance e segurança para o protocolo WhatsApp\n */\n\nexport class CryptoEngine {\n  /**\n   * Gera um novo par de chaves Curve25519 (Diffie-Hellman)\n   */\n  static generateKeyPair(): KeyPair {\n    const priv = randomBytes(32)\n    const pub = x25519.getPublicKey(priv)\n    return {\n      private: new Uint8Array(priv),\n      public: new Uint8Array(pub),\n    }\n  }\n\n  /**\n   * Executa Diffie-Hellman compartilhado (Shared Secret) usando Curve25519\n   */\n  static sharedKey(privateKey: Uint8Array, publicKey: Uint8Array): Uint8Array {\n    return x25519.getSharedSecret(privateKey, publicKey)\n  }\n\n  /**\n   * HKDF baseado em SHA-256 para derivação segura de chaves (RFC 5869)\n   */\n  static deriveKey(\n    secret: Uint8Array,\n    info: string | Uint8Array,\n    salt?: Uint8Array,\n    length = 32\n  ): Uint8Array {\n    const infoBytes = typeof info === 'string' ? new TextEncoder().encode(info) : info\n    return hkdf(sha256, secret, salt, infoBytes, length)\n  }\n\n  /**\n   * Encriptação autenticada com AES-256-GCM\n   */\n  static aesGcmEncrypt(\n    key: Uint8Array,\n    plaintext: Uint8Array,\n    iv: Uint8Array,\n    additionalData?: Uint8Array\n  ): Uint8Array {\n    const cipher = gcm(key, iv, additionalData)\n    return cipher.encrypt(plaintext)\n  }\n\n  /**\n   * Decriptação autenticada com AES-256-GCM\n   */\n  static aesGcmDecrypt(\n    key: Uint8Array,\n    ciphertext: Uint8Array,\n    iv: Uint8Array,\n    additionalData?: Uint8Array\n  ): Uint8Array {\n    const cipher = gcm(key, iv, additionalData)\n    return cipher.decrypt(ciphertext)\n  }\n\n  /**\n   * Encripta um payload com uma senha mestra (para proteger credenciais at-rest)\n   */\n  static encryptAtRest(payload: Uint8Array, masterPassphrase: string): { iv: string; salt: string; data: string } {\n    const salt = randomBytes(16)\n    const iv = randomBytes(12)\n    const key = hkdf(sha256, new TextEncoder().encode(masterPassphrase), salt, new TextEncoder().encode('cdwa-at-rest'), 32)\n    const encrypted = this.aesGcmEncrypt(key, payload, iv)\n\n    return {\n      salt: Buffer.from(salt).toString('hex'),\n      iv: Buffer.from(iv).toString('hex'),\n      data: Buffer.from(encrypted).toString('base64'),\n    }\n  }\n\n  /**\n   * Decripta um payload protegido com a senha mestra\n   */\n  static decryptAtRest(\n    encryptedBundle: { iv: string; salt: string; data: string },\n    masterPassphrase: string\n  ): Uint8Array {\n    const salt = Buffer.from(encryptedBundle.salt, 'hex')\n    const iv = Buffer.from(encryptedBundle.iv, 'hex')\n    const data = Buffer.from(encryptedBundle.data, 'base64')\n    const key = hkdf(sha256, new TextEncoder().encode(masterPassphrase), salt, new TextEncoder().encode('cdwa-at-rest'), 32)\n\n    return this.aesGcmDecrypt(key, data, iv)\n  }\n}\n\nexport * from './noise.js'\n\n","import { randomBytes } from 'crypto'\nimport { CryptoEngine } from '../crypto/index.js'\nimport type { AuthenticationCreds, AuthenticationState, SignalKeyStore } from '../types/index.js'\nimport { promises as fs } from 'fs'\nimport path from 'path'\n\n/**\n * Cria credenciais limpas para uma nova sessão Multi-Device\n */\nexport function initAuthCreds(): AuthenticationCreds {\n  const identityKeyPair = CryptoEngine.generateKeyPair()\n  const noiseKey = CryptoEngine.generateKeyPair()\n  const pairingEphemeral = CryptoEngine.generateKeyPair()\n  const signedPreKey = CryptoEngine.generateKeyPair()\n\n  // Assinatura da pré-chave com a chave de identidade\n  // No WhatsApp, isso garante autenticidade contra MITM no protocolo Signal\n  const signedSignature = CryptoEngine.sharedKey(identityKeyPair.private, signedPreKey.public)\n\n  return {\n    noiseKey,\n    pairingEphemeralKeyPair: pairingEphemeral,\n    signedIdentityKey: identityKeyPair,\n    signedPreKey: {\n      ...signedPreKey,\n      keyId: 1,\n      signature: signedSignature,\n    },\n    registrationId: Math.floor(Math.random() * 16384),\n    advSecretKey: Buffer.from(randomBytes(32)).toString('base64'),\n    firstUnuploadedPreKeyId: 1,\n    nextPreKeyId: 1,\n  }\n}\n\n/**\n * Gerenciador de estado de autenticação com suporte opcional a encriptação at-rest\n */\nexport class EncryptedFileAuthState {\n  private folderPath: string\n  private passphrase?: string\n\n  constructor(folderPath: string, passphrase?: string) {\n    this.folderPath = folderPath\n    this.passphrase = passphrase\n  }\n\n  private async ensureDir() {\n    await fs.mkdir(this.folderPath, { recursive: true })\n  }\n\n  private getFilePath(filename: string): string {\n    return path.join(this.folderPath, `${filename}.json`)\n  }\n\n  async save(key: string, data: unknown): Promise<void> {\n    await this.ensureDir()\n    const filePath = this.getFilePath(key)\n    const jsonString = JSON.stringify(data, (_, value) => {\n      if (value instanceof Uint8Array) {\n        return { __type: 'Buffer', data: Buffer.from(value).toString('base64') }\n      }\n      return value\n    })\n\n    if (this.passphrase) {\n      const encrypted = CryptoEngine.encryptAtRest(new TextEncoder().encode(jsonString), this.passphrase)\n      await fs.writeFile(filePath, JSON.stringify(encrypted), 'utf-8')\n    } else {\n      await fs.writeFile(filePath, jsonString, 'utf-8')\n    }\n  }\n\n  async load<T>(key: string): Promise<T | null> {\n    const filePath = this.getFilePath(key)\n    try {\n      const content = await fs.readFile(filePath, 'utf-8')\n      let jsonString = content\n\n      if (this.passphrase) {\n        const bundle = JSON.parse(content)\n        const decryptedBytes = CryptoEngine.decryptAtRest(bundle, this.passphrase)\n        jsonString = new TextDecoder().decode(decryptedBytes)\n      }\n\n      return JSON.parse(jsonString, (_, value) => {\n        if (value && value.__type === 'Buffer') {\n          return new Uint8Array(Buffer.from(value.data, 'base64'))\n        }\n        return value\n      }) as T\n    } catch {\n      return null\n    }\n  }\n\n  createKeyStore(): SignalKeyStore {\n    return {\n      get: async <T>(type: string, ids: string[]): Promise<Record<string, T>> => {\n        const result: Record<string, T> = {}\n        for (const id of ids) {\n          const item = await this.load<T>(`${type}-${id}`)\n          if (item) {\n            result[id] = item\n          }\n        }\n        return result\n      },\n      set: async (data: Record<string, Record<string, unknown>>): Promise<void> => {\n        for (const [type, entries] of Object.entries(data)) {\n          for (const [id, value] of Object.entries(entries)) {\n            await this.save(`${type}-${id}`, value)\n          }\n        }\n      },\n    }\n  }\n}\n\n/**\n * Cria um estado de autenticação persistente com segurança reforçada\n */\nexport async function useSecureAuthState(\n  folderPath: string,\n  passphrase?: string\n): Promise<AuthenticationState> {\n  const storage = new EncryptedFileAuthState(folderPath, passphrase)\n  let creds = await storage.load<AuthenticationCreds>('creds')\n\n  if (!creds) {\n    creds = initAuthCreds()\n    await storage.save('creds', creds)\n  }\n\n  return {\n    creds,\n    keys: storage.createKeyStore(),\n  }\n}\n"]}