@modzneverdie/baileys 17.1.1 → 17.1.3

package/lib/Signal/Group/sender-key-state.js

@@ -1,37 +1,31 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SenderKeyState = void 0;
-const sender_chain_key_1 = require("./sender-chain-key");
-const sender_message_key_1 = require("./sender-message-key");
-class SenderKeyState {
+import { SenderChainKey } from './sender-chain-key.js';
+import { SenderMessageKey } from './sender-message-key.js';
+export class SenderKeyState {
     constructor(id, iteration, chainKey, signatureKeyPair, signatureKeyPublic, signatureKeyPrivate, senderKeyStateStructure) {
         this.MAX_MESSAGE_KEYS = 2000;
         if (senderKeyStateStructure) {
-            this.senderKeyStateStructure = senderKeyStateStructure;
+            this.senderKeyStateStructure = {
+                ...senderKeyStateStructure,
+                senderMessageKeys: Array.isArray(senderKeyStateStructure.senderMessageKeys)
+                    ? senderKeyStateStructure.senderMessageKeys
+                    : []
+            };
         }
         else {
             if (signatureKeyPair) {
                 signatureKeyPublic = signatureKeyPair.public;
                 signatureKeyPrivate = signatureKeyPair.private;
             }
-            chainKey = typeof chainKey === 'string' ? Buffer.from(chainKey, 'base64') : chainKey;
-            const senderChainKeyStructure = {
-                iteration: iteration || 0,
-                seed: chainKey || Buffer.alloc(0)
-            };
-            const signingKeyStructure = {
-                public: typeof signatureKeyPublic === 'string'
-                    ? Buffer.from(signatureKeyPublic, 'base64')
-                    : signatureKeyPublic || Buffer.alloc(0)
-            };
-            if (signatureKeyPrivate) {
-                signingKeyStructure.private =
-                    typeof signatureKeyPrivate === 'string' ? Buffer.from(signatureKeyPrivate, 'base64') : signatureKeyPrivate;
-            }
             this.senderKeyStateStructure = {
                 senderKeyId: id || 0,
-                senderChainKey: senderChainKeyStructure,
-                senderSigningKey: signingKeyStructure,
+                senderChainKey: {
+                    iteration: iteration || 0,
+                    seed: Buffer.from(chainKey || [])
+                },
+                senderSigningKey: {
+                    public: Buffer.from(signatureKeyPublic || []),
+                    private: Buffer.from(signatureKeyPrivate || [])
+                },
                 senderMessageKeys: []
             };
         }
@@ -40,7 +34,7 @@ class SenderKeyState {
         return this.senderKeyStateStructure.senderKeyId;
     }
     getSenderChainKey() {
-        return new sender_chain_key_1.SenderChainKey(this.senderKeyStateStructure.senderChainKey.iteration, this.senderKeyStateStructure.senderChainKey.seed);
+        return new SenderChainKey(this.senderKeyStateStructure.senderChainKey.iteration, this.senderKeyStateStructure.senderChainKey.seed);
     }
     setSenderChainKey(chainKey) {
         this.senderKeyStateStructure.senderChainKey = {
@@ -49,26 +43,17 @@ class SenderKeyState {
         };
     }
     getSigningKeyPublic() {
-        const publicKey = this.senderKeyStateStructure.senderSigningKey.public;
-        if (publicKey instanceof Buffer) {
-            return publicKey;
+        const publicKey = Buffer.from(this.senderKeyStateStructure.senderSigningKey.public);
+        if (publicKey.length === 32) {
+            const fixed = Buffer.alloc(33);
+            fixed[0] = 0x05;
+            publicKey.copy(fixed, 1);
+            return fixed;
         }
-        else if (typeof publicKey === 'string') {
-            return Buffer.from(publicKey, 'base64');
-        }
-        return Buffer.from(publicKey || []);
+        return publicKey;
     }
     getSigningKeyPrivate() {
         const privateKey = this.senderKeyStateStructure.senderSigningKey.private;
-        if (!privateKey) {
-            return undefined;
-        }
-        if (privateKey instanceof Buffer) {
-            return privateKey;
-        }
-        else if (typeof privateKey === 'string') {
-            return Buffer.from(privateKey, 'base64');
-        }
         return Buffer.from(privateKey || []);
     }
     hasSenderMessageKey(iteration) {
@@ -88,7 +73,7 @@ class SenderKeyState {
         if (index !== -1) {
             const messageKey = this.senderKeyStateStructure.senderMessageKeys[index];
             this.senderKeyStateStructure.senderMessageKeys.splice(index, 1);
-            return new sender_message_key_1.SenderMessageKey(messageKey.iteration, messageKey.seed);
+            return new SenderMessageKey(messageKey.iteration, messageKey.seed);
         }
         return null;
     }
@@ -96,4 +81,4 @@ class SenderKeyState {
         return this.senderKeyStateStructure;
     }
 }
-exports.SenderKeyState = SenderKeyState;
+//# sourceMappingURL=sender-key-state.js.map

package/lib/Signal/Group/sender-key-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-key-state.js","sourceRoot":"","sources":["../../../src/Signal/Group/sender-key-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAwBvD,MAAM,OAAO,cAAc;IAI1B,YACC,EAAkB,EAClB,SAAyB,EACzB,QAAqC,EACrC,gBAAuF,EACvF,kBAA+C,EAC/C,mBAAgD,EAChD,uBAAwD;QAVxC,qBAAgB,GAAG,IAAI,CAAA;QAYvC,IAAI,uBAAuB,EAAE,CAAC;YAC7B,IAAI,CAAC,uBAAuB,GAAG;gBAC9B,GAAG,uBAAuB;gBAC1B,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC;oBAC1E,CAAC,CAAC,uBAAuB,CAAC,iBAAiB;oBAC3C,CAAC,CAAC,EAAE;aACL,CAAA;QACF,CAAC;aAAM,CAAC;YACP,IAAI,gBAAgB,EAAE,CAAC;gBACtB,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAA;gBAC5C,mBAAmB,GAAG,gBAAgB,CAAC,OAAO,CAAA;YAC/C,CAAC;YAED,IAAI,CAAC,uBAAuB,GAAG;gBAC9B,WAAW,EAAE,EAAE,IAAI,CAAC;gBACpB,cAAc,EAAE;oBACf,SAAS,EAAE,SAAS,IAAI,CAAC;oBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;iBACjC;gBACD,gBAAgB,EAAE;oBACjB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC;oBAC7C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,EAAE,CAAC;iBAC/C;gBACD,iBAAiB,EAAE,EAAE;aACrB,CAAA;QACF,CAAC;IACF,CAAC;IAEM,QAAQ;QACd,OAAO,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAA;IAChD,CAAC;IAEM,iBAAiB;QACvB,OAAO,IAAI,cAAc,CACxB,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,SAAS,EACrD,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,IAAI,CAChD,CAAA;IACF,CAAC;IAEM,iBAAiB,CAAC,QAAwB;QAChD,IAAI,CAAC,uBAAuB,CAAC,cAAc,GAAG;YAC7C,SAAS,EAAE,QAAQ,CAAC,YAAY,EAAE;YAClC,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE;SACxB,CAAA;IACF,CAAC;IAEM,mBAAmB;QACzB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAEnF,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC9B,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;YACf,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YACxB,OAAO,KAAK,CAAA;QACb,CAAC;QAED,OAAO,SAAS,CAAA;IACjB,CAAC;IAEM,oBAAoB;QAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,gBAAgB,CAAC,OAAO,CAAA;QAExE,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAA;IACrC,CAAC;IAEM,mBAAmB,CAAC,SAAiB;QAC3C,OAAO,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;IAC/F,CAAC;IAEM,mBAAmB,CAAC,gBAAkC;QAC5D,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,IAAI,CAAC;YACnD,SAAS,EAAE,gBAAgB,CAAC,YAAY,EAAE;YAC1C,IAAI,EAAE,gBAAgB,CAAC,OAAO,EAAE;SAChC,CAAC,CAAA;QAEF,IAAI,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACnF,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAA;QACvD,CAAC;IACF,CAAC;IAEM,sBAAsB,CAAC,SAAiB;QAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;QAE1G,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,KAAK,CAAE,CAAA;YACzE,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;YAC/D,OAAO,IAAI,gBAAgB,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;QACnE,CAAC;QAED,OAAO,IAAI,CAAA;IACZ,CAAC;IAEM,YAAY;QAClB,OAAO,IAAI,CAAC,uBAAuB,CAAA;IACpC,CAAC;CACD"}

package/lib/Signal/Group/sender-message-key.d.ts

@@ -9,3 +9,4 @@ export declare class SenderMessageKey {
     getCipherKey(): Uint8Array;
     getSeed(): Uint8Array;
 }
+//# sourceMappingURL=sender-message-key.d.ts.map

package/lib/Signal/Group/sender-message-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-message-key.d.ts","sourceRoot":"","sources":["../../../src/Signal/Group/sender-message-key.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAY;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAY;gBAErB,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU;IAYxC,YAAY,IAAI,MAAM;IAItB,KAAK,IAAI,UAAU;IAInB,YAAY,IAAI,UAAU;IAI1B,OAAO,IAAI,UAAU;CAG5B"}

package/lib/Signal/Group/sender-message-key.js

@@ -1,10 +1,7 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SenderMessageKey = void 0;
-const crypto_1 = require("libsignal/src/crypto");
-class SenderMessageKey {
+import { deriveSecrets } from 'libsignal/src/crypto.js';
+export class SenderMessageKey {
     constructor(iteration, seed) {
-        const derivative = (0, crypto_1.deriveSecrets)(seed, Buffer.alloc(32), Buffer.from('WhisperGroup'));
+        const derivative = deriveSecrets(seed, Buffer.alloc(32), Buffer.from('WhisperGroup'));
         const keys = new Uint8Array(32);
         keys.set(new Uint8Array(derivative[0].slice(16)));
         keys.set(new Uint8Array(derivative[1].slice(0, 16)), 16);
@@ -26,4 +23,4 @@ class SenderMessageKey {
         return this.seed;
     }
 }
-exports.SenderMessageKey = SenderMessageKey;
+//# sourceMappingURL=sender-message-key.js.map

package/lib/Signal/Group/sender-message-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sender-message-key.js","sourceRoot":"","sources":["../../../src/Signal/Group/sender-message-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEvD,MAAM,OAAO,gBAAgB;IAM5B,YAAY,SAAiB,EAAE,IAAgB;QAC9C,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA;QACrF,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;QAC/B,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAExD,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACzC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IACjB,CAAC;IAEM,YAAY;QAClB,OAAO,IAAI,CAAC,SAAS,CAAA;IACtB,CAAC;IAEM,KAAK;QACX,OAAO,IAAI,CAAC,EAAE,CAAA;IACf,CAAC;IAEM,YAAY;QAClB,OAAO,IAAI,CAAC,SAAS,CAAA;IACtB,CAAC;IAEM,OAAO;QACb,OAAO,IAAI,CAAC,IAAI,CAAA;IACjB,CAAC;CACD"}

package/lib/Signal/libsignal.d.ts

@@ -1,3 +1,5 @@
-import { SignalAuthState } from '../Types';
-import { SignalRepository } from '../Types/Signal';
-export declare function makeLibSignalRepository(auth: SignalAuthState): SignalRepository;
+import type { LIDMapping, SignalAuthState } from '../Types/index.js';
+import type { SignalRepositoryWithLIDStore } from '../Types/Signal.js';
+import type { ILogger } from '../Utils/logger.js';
+export declare function makeLibSignalRepository(auth: SignalAuthState, logger: ILogger, pnToLIDFunc?: (jids: string[]) => Promise<LIDMapping[] | undefined>): SignalRepositoryWithLIDStore;
+//# sourceMappingURL=libsignal.d.ts.map

package/lib/Signal/libsignal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"libsignal.d.ts","sourceRoot":"","sources":["../../src/Signal/libsignal.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAiC,MAAM,UAAU,CAAA;AAC1F,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAA;AAEnE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAyC9C,wBAAgB,uBAAuB,CACtC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,OAAO,EACf,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,UAAU,EAAE,GAAG,SAAS,CAAC,GACjE,4BAA4B,CA8T9B"}

package/lib/Signal/libsignal.js

@@ -1,135 +1,363 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
+// @ts-ignore
+import * as libsignal from 'libsignal';
+// @ts-ignore
+import { PreKeyWhisperMessage } from 'libsignal/src/protobufs.js';
+import { LRUCache } from 'lru-cache';
+import { generateSignalPubKey } from '../Utils/index.js';
+import { isHostedLidUser, isHostedPnUser, isLidUser, isPnUser, jidDecode, transferDevice, WAJIDDomains } from '../WABinary/index.js';
+import { SenderKeyName } from './Group/sender-key-name.js';
+import { SenderKeyRecord } from './Group/sender-key-record.js';
+import { GroupCipher, GroupSessionBuilder, SenderKeyDistributionMessage } from './Group/index.js';
+import { LIDMappingStore } from './lid-mapping.js';
+/** Extract identity key from PreKeyWhisperMessage for identity change detection */
+function extractIdentityFromPkmsg(ciphertext) {
+    try {
+        if (!ciphertext || ciphertext.length < 2) {
+            return undefined;
+        }
+        // Version byte check (version 3)
+        const version = ciphertext[0];
+        if ((version & 0xf) !== 3) {
+            return undefined;
+        }
+        // Parse protobuf (skip version byte)
+        const preKeyProto = PreKeyWhisperMessage.decode(ciphertext.slice(1));
+        if (preKeyProto.identityKey?.length === 33) {
+            return new Uint8Array(preKeyProto.identityKey);
+        }
+        return undefined;
     }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.makeLibSignalRepository = makeLibSignalRepository;
-const libsignal = __importStar(require("libsignal"));
-const Utils_1 = require("../Utils");
-const WABinary_1 = require("../WABinary");
-const sender_key_name_1 = require("./Group/sender-key-name");
-const sender_key_record_1 = require("./Group/sender-key-record");
-const Group_1 = require("./Group");
-function makeLibSignalRepository(auth) {
-    const storage = signalStorage(auth);
-    return {
+    catch {
+        return undefined;
+    }
+}
+export function makeLibSignalRepository(auth, logger, pnToLIDFunc) {
+    const lidMapping = new LIDMappingStore(auth.keys, logger, pnToLIDFunc);
+    const storage = signalStorage(auth, lidMapping);
+    const parsedKeys = auth.keys;
+    const migratedSessionCache = new LRUCache({
+        ttl: 3 * 24 * 60 * 60 * 1000, // 7 days
+        ttlAutopurge: true,
+        updateAgeOnGet: true
+    });
+    const repository = {
         decryptGroupMessage({ group, authorJid, msg }) {
             const senderName = jidToSignalSenderKeyName(group, authorJid);
-            const cipher = new Group_1.GroupCipher(storage, senderName);
-            return cipher.decrypt(msg);
+            const cipher = new GroupCipher(storage, senderName);
+            // Use transaction to ensure atomicity
+            return parsedKeys.transaction(async () => {
+                return cipher.decrypt(msg);
+            }, group);
         },
         async processSenderKeyDistributionMessage({ item, authorJid }) {
-            const builder = new Group_1.GroupSessionBuilder(storage);
+            const builder = new GroupSessionBuilder(storage);
             if (!item.groupId) {
                 throw new Error('Group ID is required for sender key distribution message');
             }
             const senderName = jidToSignalSenderKeyName(item.groupId, authorJid);
-            const senderMsg = new Group_1.SenderKeyDistributionMessage(null, null, null, null, item.axolotlSenderKeyDistributionMessage);
+            const senderMsg = new SenderKeyDistributionMessage(null, null, null, null, item.axolotlSenderKeyDistributionMessage);
             const senderNameStr = senderName.toString();
             const { [senderNameStr]: senderKey } = await auth.keys.get('sender-key', [senderNameStr]);
             if (!senderKey) {
-                await storage.storeSenderKey(senderName, new sender_key_record_1.SenderKeyRecord());
+                await storage.storeSenderKey(senderName, new SenderKeyRecord());
             }
-            await builder.process(senderName, senderMsg);
+            return parsedKeys.transaction(async () => {
+                const { [senderNameStr]: senderKey } = await auth.keys.get('sender-key', [senderNameStr]);
+                if (!senderKey) {
+                    await storage.storeSenderKey(senderName, new SenderKeyRecord());
+                }
+                await builder.process(senderName, senderMsg);
+            }, item.groupId);
         },
         async decryptMessage({ jid, type, ciphertext }) {
             const addr = jidToSignalProtocolAddress(jid);
             const session = new libsignal.SessionCipher(storage, addr);
-            let result;
-            switch (type) {
-                case 'pkmsg':
-                    result = await session.decryptPreKeyWhisperMessage(ciphertext);
-                    break;
-                case 'msg':
-                    result = await session.decryptWhisperMessage(ciphertext);
-                    break;
-                default:
-                    throw new Error(`Unknown message type: ${type}`);
-            }
-            return result;
+            // Extract and save sender's identity key before decryption for identity change detection
+            if (type === 'pkmsg') {
+                const identityKey = extractIdentityFromPkmsg(ciphertext);
+                if (identityKey) {
+                    const addrStr = addr.toString();
+                    const identityChanged = await storage.saveIdentity(addrStr, identityKey);
+                    if (identityChanged) {
+                        logger.info({ jid, addr: addrStr }, 'identity key changed or new contact, session will be re-established');
+                    }
+                }
+            }
+            async function doDecrypt() {
+                let result;
+                switch (type) {
+                    case 'pkmsg':
+                        result = await session.decryptPreKeyWhisperMessage(ciphertext);
+                        break;
+                    case 'msg':
+                        result = await session.decryptWhisperMessage(ciphertext);
+                        break;
+                }
+                return result;
+            }
+            // If it's not a sync message, we need to ensure atomicity
+            // For regular messages, we use a transaction to ensure atomicity
+            return parsedKeys.transaction(async () => {
+                return await doDecrypt();
+            }, jid);
         },
         async encryptMessage({ jid, data }) {
             const addr = jidToSignalProtocolAddress(jid);
             const cipher = new libsignal.SessionCipher(storage, addr);
-            const { type: sigType, body } = await cipher.encrypt(data);
-            const type = sigType === 3 ? 'pkmsg' : 'msg';
-            return { type, ciphertext: Buffer.from(body, 'binary') };
+            // Use transaction to ensure atomicity
+            return parsedKeys.transaction(async () => {
+                const { type: sigType, body } = await cipher.encrypt(data);
+                const type = sigType === 3 ? 'pkmsg' : 'msg';
+                return { type, ciphertext: Buffer.from(body, 'binary') };
+            }, jid);
         },
         async encryptGroupMessage({ group, meId, data }) {
             const senderName = jidToSignalSenderKeyName(group, meId);
-            const builder = new Group_1.GroupSessionBuilder(storage);
+            const builder = new GroupSessionBuilder(storage);
             const senderNameStr = senderName.toString();
-            const { [senderNameStr]: senderKey } = await auth.keys.get('sender-key', [senderNameStr]);
-            if (!senderKey) {
-                await storage.storeSenderKey(senderName, new sender_key_record_1.SenderKeyRecord());
-            }
-            const senderKeyDistributionMessage = await builder.create(senderName);
-            const session = new Group_1.GroupCipher(storage, senderName);
-            const ciphertext = await session.encrypt(data);
-            return {
-                ciphertext,
-                senderKeyDistributionMessage: senderKeyDistributionMessage.serialize()
-            };
+            return parsedKeys.transaction(async () => {
+                const { [senderNameStr]: senderKey } = await auth.keys.get('sender-key', [senderNameStr]);
+                if (!senderKey) {
+                    await storage.storeSenderKey(senderName, new SenderKeyRecord());
+                }
+                const senderKeyDistributionMessage = await builder.create(senderName);
+                const session = new GroupCipher(storage, senderName);
+                const ciphertext = await session.encrypt(data);
+                return {
+                    ciphertext,
+                    senderKeyDistributionMessage: senderKeyDistributionMessage.serialize()
+                };
+            }, group);
         },
         async injectE2ESession({ jid, session }) {
+            logger.trace({ jid }, 'injecting E2EE session');
             const cipher = new libsignal.SessionBuilder(storage, jidToSignalProtocolAddress(jid));
-            await cipher.initOutgoing(session);
+            return parsedKeys.transaction(async () => {
+                await cipher.initOutgoing(session);
+            }, jid);
         },
         jidToSignalProtocolAddress(jid) {
             return jidToSignalProtocolAddress(jid).toString();
+        },
+        // Optimized direct access to LID mapping store
+        lidMapping,
+        async validateSession(jid) {
+            try {
+                const addr = jidToSignalProtocolAddress(jid);
+                const session = await storage.loadSession(addr.toString());
+                if (!session) {
+                    return { exists: false, reason: 'no session' };
+                }
+                if (!session.haveOpenSession()) {
+                    return { exists: false, reason: 'no open session' };
+                }
+                return { exists: true };
+            }
+            catch (error) {
+                return { exists: false, reason: 'validation error' };
+            }
+        },
+        async deleteSession(jids) {
+            if (!jids.length)
+                return;
+            // Convert JIDs to signal addresses and prepare for bulk deletion
+            const sessionUpdates = {};
+            jids.forEach(jid => {
+                const addr = jidToSignalProtocolAddress(jid);
+                sessionUpdates[addr.toString()] = null;
+            });
+            // Single transaction for all deletions
+            return parsedKeys.transaction(async () => {
+                await auth.keys.set({ session: sessionUpdates });
+            }, `delete-${jids.length}-sessions`);
+        },
+        async migrateSession(fromJid, toJid) {
+            // TODO: use usync to handle this entire mess
+            if (!fromJid || (!isLidUser(toJid) && !isHostedLidUser(toJid)))
+                return { migrated: 0, skipped: 0, total: 0 };
+            // Only support PN to LID migration
+            if (!isPnUser(fromJid) && !isHostedPnUser(fromJid)) {
+                return { migrated: 0, skipped: 0, total: 1 };
+            }
+            const { user } = jidDecode(fromJid);
+            logger.debug({ fromJid }, 'bulk device migration - loading all user devices');
+            // Get user's device list from storage
+            const { [user]: userDevices } = await parsedKeys.get('device-list', [user]);
+            if (!userDevices) {
+                return { migrated: 0, skipped: 0, total: 0 };
+            }
+            const { device: fromDevice } = jidDecode(fromJid);
+            const fromDeviceStr = fromDevice?.toString() || '0';
+            if (!userDevices.includes(fromDeviceStr)) {
+                userDevices.push(fromDeviceStr);
+            }
+            // Filter out cached devices before database fetch
+            const uncachedDevices = userDevices.filter(device => {
+                const deviceKey = `${user}.${device}`;
+                return !migratedSessionCache.has(deviceKey);
+            });
+            // Bulk check session existence only for uncached devices
+            const deviceSessionKeys = uncachedDevices.map(device => `${user}.${device}`);
+            const existingSessions = await parsedKeys.get('session', deviceSessionKeys);
+            // Step 3: Convert existing sessions to JIDs (only migrate sessions that exist)
+            const deviceJids = [];
+            for (const [sessionKey, sessionData] of Object.entries(existingSessions)) {
+                if (sessionData) {
+                    // Session exists in storage
+                    const deviceStr = sessionKey.split('.')[1];
+                    if (!deviceStr)
+                        continue;
+                    const deviceNum = parseInt(deviceStr);
+                    let jid = deviceNum === 0 ? `${user}@s.whatsapp.net` : `${user}:${deviceNum}@s.whatsapp.net`;
+                    if (deviceNum === 99) {
+                        jid = `${user}:99@hosted`;
+                    }
+                    deviceJids.push(jid);
+                }
+            }
+            logger.debug({
+                fromJid,
+                totalDevices: userDevices.length,
+                devicesWithSessions: deviceJids.length,
+                devices: deviceJids
+            }, 'bulk device migration complete - all user devices processed');
+            // Single transaction for all migrations
+            return parsedKeys.transaction(async () => {
+                const migrationOps = deviceJids.map(jid => {
+                    const lidWithDevice = transferDevice(jid, toJid);
+                    const fromDecoded = jidDecode(jid);
+                    const toDecoded = jidDecode(lidWithDevice);
+                    return {
+                        fromJid: jid,
+                        toJid: lidWithDevice,
+                        pnUser: fromDecoded.user,
+                        lidUser: toDecoded.user,
+                        deviceId: fromDecoded.device || 0,
+                        fromAddr: jidToSignalProtocolAddress(jid),
+                        toAddr: jidToSignalProtocolAddress(lidWithDevice)
+                    };
+                });
+                const totalOps = migrationOps.length;
+                let migratedCount = 0;
+                // Bulk fetch PN sessions - already exist (verified during device discovery)
+                const pnAddrStrings = Array.from(new Set(migrationOps.map(op => op.fromAddr.toString())));
+                const pnSessions = await parsedKeys.get('session', pnAddrStrings);
+                // Prepare bulk session updates (PN → LID migration + deletion)
+                const sessionUpdates = {};
+                for (const op of migrationOps) {
+                    const pnAddrStr = op.fromAddr.toString();
+                    const lidAddrStr = op.toAddr.toString();
+                    const pnSession = pnSessions[pnAddrStr];
+                    if (pnSession) {
+                        // Session exists (guaranteed from device discovery)
+                        const fromSession = libsignal.SessionRecord.deserialize(pnSession);
+                        if (fromSession.haveOpenSession()) {
+                            // Queue for bulk update: copy to LID, delete from PN
+                            sessionUpdates[lidAddrStr] = fromSession.serialize();
+                            sessionUpdates[pnAddrStr] = null;
+                            migratedCount++;
+                        }
+                    }
+                }
+                // Single bulk session update for all migrations
+                if (Object.keys(sessionUpdates).length > 0) {
+                    await parsedKeys.set({ session: sessionUpdates });
+                    logger.debug({ migratedSessions: migratedCount }, 'bulk session migration complete');
+                    // Cache device-level migrations
+                    for (const op of migrationOps) {
+                        if (sessionUpdates[op.toAddr.toString()]) {
+                            const deviceKey = `${op.pnUser}.${op.deviceId}`;
+                            migratedSessionCache.set(deviceKey, true);
+                        }
+                    }
+                }
+                const skippedCount = totalOps - migratedCount;
+                return { migrated: migratedCount, skipped: skippedCount, total: totalOps };
+            }, `migrate-${deviceJids.length}-sessions-${jidDecode(toJid)?.user}`);
         }
     };
+    return repository;
 }
 const jidToSignalProtocolAddress = (jid) => {
-    const { user, device } = (0, WABinary_1.jidDecode)(jid);
-    return new libsignal.ProtocolAddress(user, device || 0);
+    const decoded = jidDecode(jid);
+    const { user, device, server, domainType } = decoded;
+    if (!user) {
+        throw new Error(`JID decoded but user is empty: "${jid}" -> user: "${user}", server: "${server}", device: ${device}`);
+    }
+    const signalUser = domainType !== WAJIDDomains.WHATSAPP ? `${user}_${domainType}` : user;
+    const finalDevice = device || 0;
+    if (device === 99 && decoded.server !== 'hosted' && decoded.server !== 'hosted.lid') {
+        throw new Error('Unexpected non-hosted device JID with device 99. This ID seems invalid. ID:' + jid);
+    }
+    return new libsignal.ProtocolAddress(signalUser, finalDevice);
 };
 const jidToSignalSenderKeyName = (group, user) => {
-    return new sender_key_name_1.SenderKeyName(group, jidToSignalProtocolAddress(user));
+    return new SenderKeyName(group, jidToSignalProtocolAddress(user));
 };
-function signalStorage({ creds, keys }) {
+function signalStorage({ creds, keys }, lidMapping) {
+    // Shared function to resolve PN signal address to LID if mapping exists
+    const resolveLIDSignalAddress = async (id) => {
+        if (id.includes('.')) {
+            const [deviceId, device] = id.split('.');
+            const [user, domainType_] = deviceId.split('_');
+            const domainType = parseInt(domainType_ || '0');
+            if (domainType === WAJIDDomains.LID || domainType === WAJIDDomains.HOSTED_LID)
+                return id;
+            const pnJid = `${user}${device !== '0' ? `:${device}` : ''}@${domainType === WAJIDDomains.HOSTED ? 'hosted' : 's.whatsapp.net'}`;
+            const lidForPN = await lidMapping.getLIDForPN(pnJid);
+            if (lidForPN) {
+                const lidAddr = jidToSignalProtocolAddress(lidForPN);
+                return lidAddr.toString();
+            }
+        }
+        return id;
+    };
     return {
         loadSession: async (id) => {
-            const { [id]: sess } = await keys.get('session', [id]);
-            if (sess) {
-                return libsignal.SessionRecord.deserialize(sess);
+            try {
+                const wireJid = await resolveLIDSignalAddress(id);
+                const { [wireJid]: sess } = await keys.get('session', [wireJid]);
+                if (sess) {
+                    return libsignal.SessionRecord.deserialize(sess);
+                }
+            }
+            catch (e) {
+                return null;
             }
+            return null;
         },
         storeSession: async (id, session) => {
-            await keys.set({ session: { [id]: session.serialize() } });
+            const wireJid = await resolveLIDSignalAddress(id);
+            await keys.set({ session: { [wireJid]: session.serialize() } });
         },
         isTrustedIdentity: () => {
-            return true;
+            return true; // TOFU - Trust on First Use (same as WhatsApp Web)
+        },
+        loadIdentityKey: async (id) => {
+            const wireJid = await resolveLIDSignalAddress(id);
+            const { [wireJid]: key } = await keys.get('identity-key', [wireJid]);
+            return key || undefined;
+        },
+        saveIdentity: async (id, identityKey) => {
+            const wireJid = await resolveLIDSignalAddress(id);
+            const { [wireJid]: existingKey } = await keys.get('identity-key', [wireJid]);
+            const keysMatch = existingKey &&
+                existingKey.length === identityKey.length &&
+                existingKey.every((byte, i) => byte === identityKey[i]);
+            if (existingKey && !keysMatch) {
+                // Identity changed - clear session and update key
+                await keys.set({
+                    session: { [wireJid]: null },
+                    'identity-key': { [wireJid]: identityKey }
+                });
+                return true;
+            }
+            if (!existingKey) {
+                // New contact - Trust on First Use (TOFU)
+                await keys.set({ 'identity-key': { [wireJid]: identityKey } });
+                return true;
+            }
+            return false;
         },
         loadPreKey: async (id) => {
             const keyId = id.toString();
@@ -153,9 +381,9 @@ function signalStorage({ creds, keys }) {
             const keyId = senderKeyName.toString();
             const { [keyId]: key } = await keys.get('sender-key', [keyId]);
             if (key) {
-                return sender_key_record_1.SenderKeyRecord.deserialize(key);
+                return SenderKeyRecord.deserialize(key);
             }
-            return new sender_key_record_1.SenderKeyRecord();
+            return new SenderKeyRecord();
         },
         storeSenderKey: async (senderKeyName, key) => {
             const keyId = senderKeyName.toString();
@@ -167,8 +395,9 @@ function signalStorage({ creds, keys }) {
             const { signedIdentityKey } = creds;
             return {
                 privKey: Buffer.from(signedIdentityKey.private),
-                pubKey: (0, Utils_1.generateSignalPubKey)(signedIdentityKey.public)
+                pubKey: Buffer.from(generateSignalPubKey(signedIdentityKey.public))
             };
         }
     };
 }
+//# sourceMappingURL=libsignal.js.map