@open-wa/decrypt 5.0.0-alpha.0

package/LICENSE.md

@@ -0,0 +1,67 @@
+### Copyright (c) 2020 Mohammed Shah
+
+# Hippocratic + Do Not Harm (H-DNH) Version 1.1
+
+## Preamble
+
+Most software today is developed with little to no thought of how it will be used, or the consequences for our society and planet.
+
+As software developers, we engineer the infrastructure of the 21st century. We recognise that our infrastructure has great power to shape the world and the lives of those we share it with, and we choose to consciously take responsibility for the social and environmental impacts of what we build.
+
+We envisage a world free from injustice, inequality, and the reckless destruction of lives and our planet. We reject slavery in all its forms, whether by force, indebtedness, or by algorithms that hack human vulnerabilities. We seek a world where humankind is at peace with our neighbours, nature, and ourselves. We want our work to enrich the physical, mental and spiritual wellbeing of all society.
+
+We build software to further this vision of a just world, or at the very least, to not put that vision further from reach.
+
+## Terms
+
+Licensor hereby grants permission by this license ("License"), free of charge, to any person or entity (the "Licensee") obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+1. All redistribution of source code or binary form, including any modifications must be under these terms. You must inform recipients that the code is governed by these conditions, and how they can obtain a copy of this license. You may not attempt to alter the conditions of who may/may not use this software.
+
+2. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
+
+3. This software must not be used by any organisation, website, product or service that:
+
+   a) lobbies for, promotes, or derives a majority of income from actions that support or contribute to:
+      * sex trafficking
+      * human trafficking
+      * slavery
+      * indentured servitude
+      * gambling
+      * tobacco
+      * adversely addictive behaviours
+      * nuclear energy
+      * warfare
+      * weapons manufacturing
+      * war crimes
+      * settler colonialism
+      * apartheid
+      * vaccine misinformation
+      * climate misinformation
+      * child endangerment
+      * violence (except when required to protect public safety)
+      * burning of forests
+      * deforestation
+      * hate speech or discrimination based on age, gender, gender identity, race, sexuality, religion, nationality
+
+   b) lobbies against, or derives a majority of income from actions that discourage or frustrate:
+      * peace
+      * access to the rights set out in the Universal Declaration of Human Rights and the Convention on the Rights of the Child
+      * peaceful assembly and association (including worker associations)
+      * a safe environment or action to curtail the use of fossil fuels or prevent climate change
+      * democratic processes
+
+
+4. Compliance with Human Rights Laws and Human Rights Principles:
+
+   a. **Human Rights Laws**. The Software shall not be used by any person or entity for any systems, activities, or other uses that violate any applicable laws, regulations, or rules that protect human, civil, labor, privacy, political, environmental, security, economic,  due process, or similar rights (the "Human Rights Laws"). Where the Human Rights Laws of more than one jurisdiction are applicable to the use of the Software, the Human Rights Laws that are most protective of the individuals or groups harmed shall apply.
+ 
+   b. **Human Rights Principles**. Licensee is advised to consult the articles of the United Nations Universal Declaration of Human Rights (https://www.un.org/en/universal-declaration-human-rights/) and the United Nations Global Compact (https://www.unglobalcompact.org/ what-is-gc/mission/principles) that define recognized principles of international human rights (the "Human Rights Principles"). It is Licensor's express intent that all use of the Software be consistent with Human Rights Principles. If Licensor receives notification  or otherwise learns of an alleged violation of any Human Rights Principles relating to Licensee's use of the Software, Licensor may in its discretion and without obligation (i) (a) notify Licensee of such allegation and (b) allow Licensee 90 days from notification  under (i)(a) to investigate and respond to Licensor regarding the allegation and (ii) (a) after the earlier of 90 days from notification under (i)(a), or Licensee's response under (i)(b), notify Licensee of License termination and (b) allow Licensee an additional 90  days from notification under (ii)(a) to cease use of the Software.
+ 
+   c. **Indemnity**. Licensee shall hold harmless and indemnify Licensor against all losses, damages, liabilities, deficiencies, claims, actions, judgments, settlements, interest, awards, penalties, fines, costs, or expenses of whatever kind, including Licensor's  reasonable attorneys' fees, arising out of or relating to Licensee's non-compliance with this License or use of the Software in violation of Human Rights Laws or Human Rights Principles. 
+
+5. Enforceability: If any portion or provision of this License is determined to be invalid, illegal, or unenforceable by a court of competent jurisdiction, then such invalidity, illegality, or unenforceability shall not affect any other term or provision of this License or invalidate or render unenforceable such term or provision in any other jurisdiction. Upon a determination that any term or provision is invalid, illegal, or unenforceable, to the extent permitted by applicable law, the court may modify this License to affect the original intent of the parties as closely as possible. The section headings are for convenience only and are not intended to affect the construction or interpretation of this License. Any rule of construction to the effect that ambiguities are to be resolved against the drafting party shall not apply in interpreting this License. The language in this License shall be interpreted as to its fair meaning and not strictly for or against any party.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+This license is an extension of the Hippocratic License - an Ethical Source license (https://ethicalsource.dev) and the Do Not Harm License - (https://github.com/raisely/NoHarm)

package/README.md

@@ -0,0 +1,19 @@
+# @open-wa/decrypt
+
+Lightweight WhatsApp media decryption — zero external dependencies
+
+Part of the [@open-wa v5 monorepo](https://github.com/open-wa/wa-automate-nodejs).
+
+## Install
+
+```bash
+pnpm add @open-wa/decrypt
+```
+
+## Documentation
+
+See the [docs site](https://docs.openwa.dev).
+
+## License
+
+[H-DNH V1.0](https://github.com/open-wa/wa-automate-nodejs/blob/main/LICENSE.md) — Hippocratic + Do Not Harm

package/dist/index.cjs

@@ -0,0 +1,163 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let node_crypto = require("node:crypto");
+//#region src/constants.ts
+/** Mapping from message type to WhatsApp's internal media-type key name. */
+const mediaTypes = {
+	IMAGE: "Image",
+	VIDEO: "Video",
+	AUDIO: "Audio",
+	PTT: "Audio",
+	DOCUMENT: "Document",
+	STICKER: "Image"
+};
+/** Message types where a missing `size` field is tolerable. */
+const NON_SIZE_TYPES = ["sticker"];
+/** Thrown when a message is missing fields required for decryption. */
+var MissingCriticalDataError = class extends Error {
+	name = "MissingCriticalDataError";
+	constructor(message) {
+		super(message);
+	}
+};
+//#endregion
+//#region src/crypto.ts
+/**
+* Core crypto routines for WhatsApp media decryption.
+*
+* Uses only `node:crypto` builtins — no external HKDF library needed.
+* `crypto.hkdfSync` landed in Node 15 and is available in Bun.
+*/
+/**
+* Derive the AES-256-CBC key and IV from the media key using HKDF-SHA256,
+* then decrypt the ciphertext.
+*/
+function decryptBuffer(encryptedData, mediaKeyBase64, mediaType, expectedSize, mimetype) {
+	const mediaKeyBytes = Buffer.from(mediaKeyBase64, "base64");
+	const info = `WhatsApp ${mediaTypes[mediaType.toUpperCase()] ?? mediaTypes[Object.keys(mediaTypes).find((t) => mimetype?.includes(t.toLowerCase())) ?? ""]} Keys`;
+	const expanded = Buffer.from((0, node_crypto.hkdfSync)("sha256", mediaKeyBytes, Buffer.alloc(32), info, 112));
+	const iv = expanded.subarray(0, 16);
+	const decipher = (0, node_crypto.createDecipheriv)("aes-256-cbc", expanded.subarray(16, 48), iv);
+	decipher.setAutoPadding(false);
+	const decrypted = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
+	return expectedSize ? fixPadding(decrypted, expectedSize) : decrypted;
+}
+/**
+* Correct PKCS#7-style padding that WhatsApp applies inconsistently.
+*/
+function fixPadding(data, expectedSize) {
+	const padding = 16 - expectedSize % 16 & 15;
+	if (padding > 0) {
+		if (expectedSize + padding === data.length) return data.subarray(0, data.length - padding);
+		if (data.length + padding === expectedSize) {
+			const pad = Buffer.alloc(padding, padding);
+			return Buffer.concat([data, pad]);
+		}
+	}
+	return data;
+}
+//#endregion
+//#region src/download.ts
+/**
+* Download encrypted media from WhatsApp CDN using native fetch.
+*
+* Replaces the legacy axios-based downloader.
+*/
+function buildUserAgent(override) {
+	let ua = override ?? "WhatsApp/2.16.352 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36";
+	if (!ua.includes("WhatsApp")) ua = `WhatsApp/2.16.352 ${ua}`;
+	return ua;
+}
+/**
+* Download an encrypted media blob from the given URL.
+* Uses the global `fetch` API (Bun native / Node 18+).
+*/
+async function downloadEncryptedMedia(url, options) {
+	const { useragent, maxRetries = 3, retryDelay = 2e3 } = options ?? {};
+	const headers = {
+		"User-Agent": buildUserAgent(useragent),
+		DNT: "1",
+		"Upgrade-Insecure-Requests": "1",
+		Origin: "https://web.whatsapp.com/",
+		Referer: "https://web.whatsapp.com/"
+	};
+	for (let attempt = 0; attempt < maxRetries; attempt++) {
+		const res = await fetch(url, { headers });
+		if (res.ok) return new Uint8Array(await res.arrayBuffer());
+		if (res.status === 404) throw new Error("This media does not exist or is no longer available on the server. See: https://docs.openwa.dev/pages/How%20to/decrypt-media.html#40439d");
+		if (attempt < maxRetries - 1) await new Promise((r) => setTimeout(r, retryDelay));
+	}
+	throw new Error(`Failed to download media after ${maxRetries} attempts`);
+}
+//#endregion
+//#region src/decrypt.ts
+/**
+* Main decryptMedia entry point.
+*
+* Downloads the encrypted blob → decrypts with AES-256-CBC via HKDF-derived keys.
+*/
+/**
+* Download and decrypt a WhatsApp media message.
+*
+* @param message — A message object with at least the required decryption fields.
+* @param optionsOrUa — Either a {@link DecryptOptions} object or a legacy user-agent string.
+* @returns The decrypted media as a Buffer.
+*
+* @example
+* ```ts
+* import { decryptMedia } from '@open-wa/decrypt';
+*
+* const buffer = await decryptMedia(message);
+* ```
+*/
+async function decryptMedia(message, optionsOrUa) {
+	const opts = typeof optionsOrUa === "string" ? { useragent: optionsOrUa } : optionsOrUa ?? {};
+	validateMessage(message);
+	return decryptBuffer(await downloadEncryptedMedia((message.deprecatedMms3Url ?? message.clientUrl).trim(), opts), message.mediaKey, message.type, message.size, message.mimetype);
+}
+function validateMessage(message) {
+	const missing = [];
+	if (!message.mediaKey) missing.push("mediaKey");
+	if (!message.filehash) missing.push("filehash");
+	if (!message.mimetype) missing.push("mimetype");
+	if (!message.type) missing.push("type");
+	if (!message.size) missing.push("size");
+	if (missing.length === 0) return;
+	if (missing.length === 1 && missing[0] === "size") {
+		if (!NON_SIZE_TYPES.includes(message.type)) console.warn("@open-wa/decrypt: size property is missing. File will fail an integrity check.");
+		return;
+	}
+	throw new MissingCriticalDataError(`Message is missing critical data: ${missing.join(", ")}`);
+}
+//#endregion
+//#region src/bleach.ts
+/**
+* Strip a message down to the minimum fields needed for decryption.
+*
+* Useful for minimizing sensitive data in transit — removes sender info,
+* chat context, etc.
+*/
+const BLEACH_KEEP = new Set([
+	"type",
+	"clientUrl",
+	"mimetype",
+	"mediaKey",
+	"size",
+	"filehash",
+	"uploadhash",
+	"deprecatedMms3Url"
+]);
+/**
+* Return a copy of the message containing only the fields required for decryption.
+*/
+function bleachMessage(message) {
+	const result = {};
+	for (const key of Object.keys(message)) if (BLEACH_KEEP.has(key)) result[key] = message[key];
+	return result;
+}
+//#endregion
+exports.MissingCriticalDataError = MissingCriticalDataError;
+exports.bleachMessage = bleachMessage;
+exports.decryptMedia = decryptMedia;
+exports.mediaTypes = mediaTypes;
+
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../src/constants.ts","../src/crypto.ts","../src/download.ts","../src/decrypt.ts","../src/bleach.ts"],"sourcesContent":["/** Mapping from message type to WhatsApp's internal media-type key name. */\nexport const mediaTypes: Record<string, string> = {\n  IMAGE: 'Image',\n  VIDEO: 'Video',\n  AUDIO: 'Audio',\n  PTT: 'Audio',\n  DOCUMENT: 'Document',\n  STICKER: 'Image',\n} as const;\n\n/** Message types where a missing `size` field is tolerable. */\nexport const NON_SIZE_TYPES = ['sticker'] as const;\n\n/** The default user-agent used for fetching encrypted media blobs. */\nexport const DEFAULT_USER_AGENT =\n  'WhatsApp/2.16.352 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36';\n\n/** Thrown when a message is missing fields required for decryption. */\nexport class MissingCriticalDataError extends Error {\n  override readonly name = 'MissingCriticalDataError';\n\n  constructor(message: string) {\n    super(message);\n  }\n}\n","/**\n * Core crypto routines for WhatsApp media decryption.\n *\n * Uses only `node:crypto` builtins — no external HKDF library needed.\n * `crypto.hkdfSync` landed in Node 15 and is available in Bun.\n */\nimport { createDecipheriv, hkdfSync } from 'node:crypto';\n\nimport { mediaTypes } from './constants.js';\n\n/**\n * Derive the AES-256-CBC key and IV from the media key using HKDF-SHA256,\n * then decrypt the ciphertext.\n */\nexport function decryptBuffer(\n  encryptedData: Uint8Array,\n  mediaKeyBase64: string,\n  mediaType: string,\n  expectedSize?: number,\n  mimetype?: string,\n): Buffer {\n  const mediaKeyBytes = Buffer.from(mediaKeyBase64, 'base64');\n\n  // Resolve the info string: \"WhatsApp <Type> Keys\"\n  const typeKey =\n    mediaTypes[mediaType.toUpperCase()] ??\n    mediaTypes[\n      Object.keys(mediaTypes).find((t) =>\n        mimetype?.includes(t.toLowerCase()),\n      ) ?? ''\n    ];\n\n  const info = `WhatsApp ${typeKey} Keys`;\n\n  // HKDF expand to 112 bytes (iv=16 + cipherKey=32 + macKey=32 + refKey=32)\n  const expanded = Buffer.from(\n    hkdfSync('sha256', mediaKeyBytes, Buffer.alloc(32), info, 112),\n  );\n\n  const iv = expanded.subarray(0, 16);\n  const cipherKey = expanded.subarray(16, 48);\n\n  const decipher = createDecipheriv('aes-256-cbc', cipherKey, iv);\n  // WhatsApp handles padding manually — disable OpenSSL auto-padding\n  decipher.setAutoPadding(false);\n  const decrypted = Buffer.concat([\n    decipher.update(encryptedData),\n    decipher.final(),\n  ]);\n\n  return expectedSize ? fixPadding(decrypted, expectedSize) : decrypted;\n}\n\n/**\n * Correct PKCS#7-style padding that WhatsApp applies inconsistently.\n */\nfunction fixPadding(data: Buffer, expectedSize: number): Buffer {\n  const padding = (16 - (expectedSize % 16)) & 0xf;\n  if (padding > 0) {\n    if (expectedSize + padding === data.length) {\n      // Trim trailing padding bytes\n      return data.subarray(0, data.length - padding);\n    }\n    if (data.length + padding === expectedSize) {\n      // Append missing padding\n      const pad = Buffer.alloc(padding, padding);\n      return Buffer.concat([data, pad]);\n    }\n  }\n  return data;\n}\n","/**\n * Download encrypted media from WhatsApp CDN using native fetch.\n *\n * Replaces the legacy axios-based downloader.\n */\nimport {\n  DEFAULT_USER_AGENT,\n} from './constants.js';\n\nfunction buildUserAgent(override?: string): string {\n  let ua = override ?? DEFAULT_USER_AGENT;\n  if (!ua.includes('WhatsApp')) ua = `WhatsApp/2.16.352 ${ua}`;\n  return ua;\n}\n\n/**\n * Download an encrypted media blob from the given URL.\n * Uses the global `fetch` API (Bun native / Node 18+).\n */\nexport async function downloadEncryptedMedia(\n  url: string,\n  options?: { useragent?: string; maxRetries?: number; retryDelay?: number },\n): Promise<Uint8Array> {\n  const { useragent, maxRetries = 3, retryDelay = 2_000 } = options ?? {};\n\n  const headers: Record<string, string> = {\n    'User-Agent': buildUserAgent(useragent),\n    DNT: '1',\n    'Upgrade-Insecure-Requests': '1',\n    Origin: 'https://web.whatsapp.com/',\n    Referer: 'https://web.whatsapp.com/',\n  };\n\n  for (let attempt = 0; attempt < maxRetries; attempt++) {\n    const res = await fetch(url, { headers });\n\n    if (res.ok) {\n      return new Uint8Array(await res.arrayBuffer());\n    }\n\n    if (res.status === 404) {\n      throw new Error(\n        'This media does not exist or is no longer available on the server. ' +\n          'See: https://docs.openwa.dev/pages/How%20to/decrypt-media.html#40439d',\n      );\n    }\n\n    // Retry on transient errors\n    if (attempt < maxRetries - 1) {\n      await new Promise((r) => setTimeout(r, retryDelay));\n    }\n  }\n\n  throw new Error(`Failed to download media after ${maxRetries} attempts`);\n}\n","/**\n * Main decryptMedia entry point.\n *\n * Downloads the encrypted blob → decrypts with AES-256-CBC via HKDF-derived keys.\n */\nimport { MissingCriticalDataError, NON_SIZE_TYPES } from './constants.js';\nimport { decryptBuffer } from './crypto.js';\nimport { downloadEncryptedMedia } from './download.js';\nimport type { DecryptableMessage, DecryptOptions } from './types.js';\n\n/**\n * Download and decrypt a WhatsApp media message.\n *\n * @param message — A message object with at least the required decryption fields.\n * @param optionsOrUa — Either a {@link DecryptOptions} object or a legacy user-agent string.\n * @returns The decrypted media as a Buffer.\n *\n * @example\n * ```ts\n * import { decryptMedia } from '@open-wa/decrypt';\n *\n * const buffer = await decryptMedia(message);\n * ```\n */\nexport async function decryptMedia(\n  message: DecryptableMessage,\n  optionsOrUa?: DecryptOptions | string,\n): Promise<Buffer> {\n  // Normalise options — accept legacy string signature for backward compat\n  const opts: DecryptOptions =\n    typeof optionsOrUa === 'string'\n      ? { useragent: optionsOrUa }\n      : optionsOrUa ?? {};\n\n  validateMessage(message);\n\n  const url = (message.deprecatedMms3Url ?? message.clientUrl)!.trim();\n  const encrypted = await downloadEncryptedMedia(url, opts);\n\n  return decryptBuffer(\n    encrypted,\n    message.mediaKey,\n    message.type,\n    message.size,\n    message.mimetype,\n  );\n}\n\nfunction validateMessage(message: DecryptableMessage): void {\n  const missing: string[] = [];\n\n  if (!message.mediaKey) missing.push('mediaKey');\n  if (!message.filehash) missing.push('filehash');\n  if (!message.mimetype) missing.push('mimetype');\n  if (!message.type) missing.push('type');\n  if (!message.size) missing.push('size');\n\n  if (missing.length === 0) return;\n\n  // Size-only omission is a warning for non-sticker types, not an error\n  if (missing.length === 1 && missing[0] === 'size') {\n    if (!NON_SIZE_TYPES.includes(message.type as (typeof NON_SIZE_TYPES)[number])) {\n      console.warn(\n        '@open-wa/decrypt: size property is missing. File will fail an integrity check.',\n      );\n    }\n    return;\n  }\n\n  throw new MissingCriticalDataError(\n    `Message is missing critical data: ${missing.join(', ')}`,\n  );\n}\n","/**\n * Strip a message down to the minimum fields needed for decryption.\n *\n * Useful for minimizing sensitive data in transit — removes sender info,\n * chat context, etc.\n */\n\nconst BLEACH_KEEP = new Set([\n  'type',\n  'clientUrl',\n  'mimetype',\n  'mediaKey',\n  'size',\n  'filehash',\n  'uploadhash',\n  'deprecatedMms3Url',\n]);\n\n/**\n * Return a copy of the message containing only the fields required for decryption.\n */\nexport function bleachMessage<T extends Record<string, unknown>>(\n  message: T,\n): Partial<T> {\n  const result: Record<string, unknown> = {};\n  for (const key of Object.keys(message)) {\n    if (BLEACH_KEEP.has(key)) {\n      result[key] = message[key];\n    }\n  }\n  return result as Partial<T>;\n}\n"],"mappings":";;;;AACA,MAAa,aAAqC;CAChD,OAAO;CACP,OAAO;CACP,OAAO;CACP,KAAK;CACL,UAAU;CACV,SAAS;CACV;;AAGD,MAAa,iBAAiB,CAAC,UAAU;;AAOzC,IAAa,2BAAb,cAA8C,MAAM;CAClD,OAAyB;CAEzB,YAAY,SAAiB;AAC3B,QAAM,QAAQ;;;;;;;;;;;;;;;ACRlB,SAAgB,cACd,eACA,gBACA,WACA,cACA,UACQ;CACR,MAAM,gBAAgB,OAAO,KAAK,gBAAgB,SAAS;CAW3D,MAAM,OAAO,YAPX,WAAW,UAAU,aAAa,KAClC,WACE,OAAO,KAAK,WAAW,CAAC,MAAM,MAC5B,UAAU,SAAS,EAAE,aAAa,CAAC,CACpC,IAAI,IAGwB;CAGjC,MAAM,WAAW,OAAO,MAAA,GAAA,YAAA,UACb,UAAU,eAAe,OAAO,MAAM,GAAG,EAAE,MAAM,IAAI,CAC/D;CAED,MAAM,KAAK,SAAS,SAAS,GAAG,GAAG;CAGnC,MAAM,YAAA,GAAA,YAAA,kBAA4B,eAFhB,SAAS,SAAS,IAAI,GAAG,EAEiB,GAAG;AAE/D,UAAS,eAAe,MAAM;CAC9B,MAAM,YAAY,OAAO,OAAO,CAC9B,SAAS,OAAO,cAAc,EAC9B,SAAS,OAAO,CACjB,CAAC;AAEF,QAAO,eAAe,WAAW,WAAW,aAAa,GAAG;;;;;AAM9D,SAAS,WAAW,MAAc,cAA8B;CAC9D,MAAM,UAAW,KAAM,eAAe,KAAO;AAC7C,KAAI,UAAU,GAAG;AACf,MAAI,eAAe,YAAY,KAAK,OAElC,QAAO,KAAK,SAAS,GAAG,KAAK,SAAS,QAAQ;AAEhD,MAAI,KAAK,SAAS,YAAY,cAAc;GAE1C,MAAM,MAAM,OAAO,MAAM,SAAS,QAAQ;AAC1C,UAAO,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC;;;AAGrC,QAAO;;;;;;;;;AC5DT,SAAS,eAAe,UAA2B;CACjD,IAAI,KAAK,YAAA;AACT,KAAI,CAAC,GAAG,SAAS,WAAW,CAAE,MAAK,qBAAqB;AACxD,QAAO;;;;;;AAOT,eAAsB,uBACpB,KACA,SACqB;CACrB,MAAM,EAAE,WAAW,aAAa,GAAG,aAAa,QAAU,WAAW,EAAE;CAEvE,MAAM,UAAkC;EACtC,cAAc,eAAe,UAAU;EACvC,KAAK;EACL,6BAA6B;EAC7B,QAAQ;EACR,SAAS;EACV;AAED,MAAK,IAAI,UAAU,GAAG,UAAU,YAAY,WAAW;EACrD,MAAM,MAAM,MAAM,MAAM,KAAK,EAAE,SAAS,CAAC;AAEzC,MAAI,IAAI,GACN,QAAO,IAAI,WAAW,MAAM,IAAI,aAAa,CAAC;AAGhD,MAAI,IAAI,WAAW,IACjB,OAAM,IAAI,MACR,2IAED;AAIH,MAAI,UAAU,aAAa,EACzB,OAAM,IAAI,SAAS,MAAM,WAAW,GAAG,WAAW,CAAC;;AAIvD,OAAM,IAAI,MAAM,kCAAkC,WAAW,WAAW;;;;;;;;;;;;;;;;;;;;;;;AC7B1E,eAAsB,aACpB,SACA,aACiB;CAEjB,MAAM,OACJ,OAAO,gBAAgB,WACnB,EAAE,WAAW,aAAa,GAC1B,eAAe,EAAE;AAEvB,iBAAgB,QAAQ;AAKxB,QAAO,cAFW,MAAM,wBADX,QAAQ,qBAAqB,QAAQ,WAAY,MAAM,EAChB,KAAK,EAIvD,QAAQ,UACR,QAAQ,MACR,QAAQ,MACR,QAAQ,SACT;;AAGH,SAAS,gBAAgB,SAAmC;CAC1D,MAAM,UAAoB,EAAE;AAE5B,KAAI,CAAC,QAAQ,SAAU,SAAQ,KAAK,WAAW;AAC/C,KAAI,CAAC,QAAQ,SAAU,SAAQ,KAAK,WAAW;AAC/C,KAAI,CAAC,QAAQ,SAAU,SAAQ,KAAK,WAAW;AAC/C,KAAI,CAAC,QAAQ,KAAM,SAAQ,KAAK,OAAO;AACvC,KAAI,CAAC,QAAQ,KAAM,SAAQ,KAAK,OAAO;AAEvC,KAAI,QAAQ,WAAW,EAAG;AAG1B,KAAI,QAAQ,WAAW,KAAK,QAAQ,OAAO,QAAQ;AACjD,MAAI,CAAC,eAAe,SAAS,QAAQ,KAAwC,CAC3E,SAAQ,KACN,iFACD;AAEH;;AAGF,OAAM,IAAI,yBACR,qCAAqC,QAAQ,KAAK,KAAK,GACxD;;;;;;;;;;AChEH,MAAM,cAAc,IAAI,IAAI;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;;;AAKF,SAAgB,cACd,SACY;CACZ,MAAM,SAAkC,EAAE;AAC1C,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,YAAY,IAAI,IAAI,CACtB,QAAO,OAAO,QAAQ;AAG1B,QAAO"}

package/dist/index.d.cts

@@ -0,0 +1,77 @@
+//#region src/types.d.ts
+/**
+ * Type definitions for decryptable WhatsApp media messages.
+ *
+ * Self-contained — no external type deps like type-fest or wa-automate-types-only.
+ */
+/**
+ * Utility type: at least one of the specified keys must be present.
+ * Replaces the `type-fest` RequireAtLeastOne import.
+ */
+type RequireAtLeastOne<T, Keys extends keyof T = keyof T> = Pick<T, Exclude<keyof T, Keys>> & { [K in Keys]-?: Required<Pick<T, K>> & Partial<Pick<T, Exclude<Keys, K>>> }[Keys];
+/** The absolute minimum fields needed for decryption. */
+interface RequiredDecryptionMessage {
+  mediaKey: string;
+  filehash: string;
+  mimetype: string;
+  type: string;
+  size: number;
+}
+/**
+ * A message with enough data to download + decrypt the media attachment.
+ * At least one of `clientUrl` or `deprecatedMms3Url` must be present.
+ */
+type DecryptableMessage = RequireAtLeastOne<{
+  clientUrl?: string;
+  deprecatedMms3Url?: string;
+}, 'clientUrl' | 'deprecatedMms3Url'> & RequiredDecryptionMessage;
+/** Options for the decryptMedia function. */
+interface DecryptOptions {
+  /** Custom User-Agent header for the download request. */
+  useragent?: string;
+  /** Maximum number of retry attempts for the download (default: 3). */
+  maxRetries?: number;
+  /** Delay in ms between retries (default: 2000). */
+  retryDelay?: number;
+}
+//#endregion
+//#region src/decrypt.d.ts
+/**
+ * Download and decrypt a WhatsApp media message.
+ *
+ * @param message — A message object with at least the required decryption fields.
+ * @param optionsOrUa — Either a {@link DecryptOptions} object or a legacy user-agent string.
+ * @returns The decrypted media as a Buffer.
+ *
+ * @example
+ * ```ts
+ * import { decryptMedia } from '@open-wa/decrypt';
+ *
+ * const buffer = await decryptMedia(message);
+ * ```
+ */
+declare function decryptMedia(message: DecryptableMessage, optionsOrUa?: DecryptOptions | string): Promise<Buffer>;
+//#endregion
+//#region src/bleach.d.ts
+/**
+ * Strip a message down to the minimum fields needed for decryption.
+ *
+ * Useful for minimizing sensitive data in transit — removes sender info,
+ * chat context, etc.
+ */
+/**
+ * Return a copy of the message containing only the fields required for decryption.
+ */
+declare function bleachMessage<T extends Record<string, unknown>>(message: T): Partial<T>;
+//#endregion
+//#region src/constants.d.ts
+/** Mapping from message type to WhatsApp's internal media-type key name. */
+declare const mediaTypes: Record<string, string>;
+/** Thrown when a message is missing fields required for decryption. */
+declare class MissingCriticalDataError extends Error {
+  readonly name = "MissingCriticalDataError";
+  constructor(message: string);
+}
+//#endregion
+export { type DecryptOptions, type DecryptableMessage, MissingCriticalDataError, type RequiredDecryptionMessage, bleachMessage, decryptMedia, mediaTypes };
+//# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/types.ts","../src/decrypt.ts","../src/bleach.ts","../src/constants.ts"],"mappings":";;;;;;;;;;KAUK,iBAAA,uBAAwC,CAAA,SAAU,CAAA,IAAK,IAAA,CAC1D,CAAA,EACA,OAAA,OAAc,CAAA,EAAG,IAAA,aAGT,IAAA,KAAS,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,CAAA,KAAM,OAAA,CAAQ,IAAA,CAAK,CAAA,EAAG,OAAA,CAAQ,IAAA,EAAM,CAAA,MACpE,IAAA;;UAGa,yBAAA;EACf,QAAA;EACA,QAAA;EACA,QAAA;EACA,IAAA;EACA,IAAA;AAAA;;;;;KAOU,kBAAA,GAAqB,iBAAA;EAE7B,SAAA;EACA,iBAAA;AAAA,wCAIF,yBAAA;;UAGe,cAAA;EA9Bf;EAgCA,SAAA;EA/Bc;EAiCd,UAAA;EA9BG;EAgCH,UAAA;AAAA;;;;;;;;;;;;;;;;;iBCvBoB,YAAA,CACpB,OAAA,EAAS,kBAAA,EACT,WAAA,GAAc,cAAA,YACb,OAAA,CAAQ,MAAA;;;;;;;;;;;;iBCNK,aAAA,WAAwB,MAAA,kBAAA,CACtC,OAAA,EAAS,CAAA,GACR,OAAA,CAAQ,CAAA;;;;cCtBE,UAAA,EAAY,MAAA;;cAiBZ,wBAAA,SAAiC,KAAA;EAAA,SAC1B,IAAA;cAEN,OAAA;AAAA"}

package/dist/index.d.mts

@@ -0,0 +1,77 @@
+//#region src/types.d.ts
+/**
+ * Type definitions for decryptable WhatsApp media messages.
+ *
+ * Self-contained — no external type deps like type-fest or wa-automate-types-only.
+ */
+/**
+ * Utility type: at least one of the specified keys must be present.
+ * Replaces the `type-fest` RequireAtLeastOne import.
+ */
+type RequireAtLeastOne<T, Keys extends keyof T = keyof T> = Pick<T, Exclude<keyof T, Keys>> & { [K in Keys]-?: Required<Pick<T, K>> & Partial<Pick<T, Exclude<Keys, K>>> }[Keys];
+/** The absolute minimum fields needed for decryption. */
+interface RequiredDecryptionMessage {
+  mediaKey: string;
+  filehash: string;
+  mimetype: string;
+  type: string;
+  size: number;
+}
+/**
+ * A message with enough data to download + decrypt the media attachment.
+ * At least one of `clientUrl` or `deprecatedMms3Url` must be present.
+ */
+type DecryptableMessage = RequireAtLeastOne<{
+  clientUrl?: string;
+  deprecatedMms3Url?: string;
+}, 'clientUrl' | 'deprecatedMms3Url'> & RequiredDecryptionMessage;
+/** Options for the decryptMedia function. */
+interface DecryptOptions {
+  /** Custom User-Agent header for the download request. */
+  useragent?: string;
+  /** Maximum number of retry attempts for the download (default: 3). */
+  maxRetries?: number;
+  /** Delay in ms between retries (default: 2000). */
+  retryDelay?: number;
+}
+//#endregion
+//#region src/decrypt.d.ts
+/**
+ * Download and decrypt a WhatsApp media message.
+ *
+ * @param message — A message object with at least the required decryption fields.
+ * @param optionsOrUa — Either a {@link DecryptOptions} object or a legacy user-agent string.
+ * @returns The decrypted media as a Buffer.
+ *
+ * @example
+ * ```ts
+ * import { decryptMedia } from '@open-wa/decrypt';
+ *
+ * const buffer = await decryptMedia(message);
+ * ```
+ */
+declare function decryptMedia(message: DecryptableMessage, optionsOrUa?: DecryptOptions | string): Promise<Buffer>;
+//#endregion
+//#region src/bleach.d.ts
+/**
+ * Strip a message down to the minimum fields needed for decryption.
+ *
+ * Useful for minimizing sensitive data in transit — removes sender info,
+ * chat context, etc.
+ */
+/**
+ * Return a copy of the message containing only the fields required for decryption.
+ */
+declare function bleachMessage<T extends Record<string, unknown>>(message: T): Partial<T>;
+//#endregion
+//#region src/constants.d.ts
+/** Mapping from message type to WhatsApp's internal media-type key name. */
+declare const mediaTypes: Record<string, string>;
+/** Thrown when a message is missing fields required for decryption. */
+declare class MissingCriticalDataError extends Error {
+  readonly name = "MissingCriticalDataError";
+  constructor(message: string);
+}
+//#endregion
+export { type DecryptOptions, type DecryptableMessage, MissingCriticalDataError, type RequiredDecryptionMessage, bleachMessage, decryptMedia, mediaTypes };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/decrypt.ts","../src/bleach.ts","../src/constants.ts"],"mappings":";;;;;;;;;;KAUK,iBAAA,uBAAwC,CAAA,SAAU,CAAA,IAAK,IAAA,CAC1D,CAAA,EACA,OAAA,OAAc,CAAA,EAAG,IAAA,aAGT,IAAA,KAAS,QAAA,CAAS,IAAA,CAAK,CAAA,EAAG,CAAA,KAAM,OAAA,CAAQ,IAAA,CAAK,CAAA,EAAG,OAAA,CAAQ,IAAA,EAAM,CAAA,MACpE,IAAA;;UAGa,yBAAA;EACf,QAAA;EACA,QAAA;EACA,QAAA;EACA,IAAA;EACA,IAAA;AAAA;;;;;KAOU,kBAAA,GAAqB,iBAAA;EAE7B,SAAA;EACA,iBAAA;AAAA,wCAIF,yBAAA;;UAGe,cAAA;EA9Bf;EAgCA,SAAA;EA/Bc;EAiCd,UAAA;EA9BG;EAgCH,UAAA;AAAA;;;;;;;;;;;;;;;;;iBCvBoB,YAAA,CACpB,OAAA,EAAS,kBAAA,EACT,WAAA,GAAc,cAAA,YACb,OAAA,CAAQ,MAAA;;;;;;;;;;;;iBCNK,aAAA,WAAwB,MAAA,kBAAA,CACtC,OAAA,EAAS,CAAA,GACR,OAAA,CAAQ,CAAA;;;;cCtBE,UAAA,EAAY,MAAA;;cAiBZ,wBAAA,SAAiC,KAAA;EAAA,SAC1B,IAAA;cAEN,OAAA;AAAA"}

package/dist/index.mjs

@@ -0,0 +1,159 @@
+import { createDecipheriv, hkdfSync } from "node:crypto";
+//#region src/constants.ts
+/** Mapping from message type to WhatsApp's internal media-type key name. */
+const mediaTypes = {
+	IMAGE: "Image",
+	VIDEO: "Video",
+	AUDIO: "Audio",
+	PTT: "Audio",
+	DOCUMENT: "Document",
+	STICKER: "Image"
+};
+/** Message types where a missing `size` field is tolerable. */
+const NON_SIZE_TYPES = ["sticker"];
+/** Thrown when a message is missing fields required for decryption. */
+var MissingCriticalDataError = class extends Error {
+	name = "MissingCriticalDataError";
+	constructor(message) {
+		super(message);
+	}
+};
+//#endregion
+//#region src/crypto.ts
+/**
+* Core crypto routines for WhatsApp media decryption.
+*
+* Uses only `node:crypto` builtins — no external HKDF library needed.
+* `crypto.hkdfSync` landed in Node 15 and is available in Bun.
+*/
+/**
+* Derive the AES-256-CBC key and IV from the media key using HKDF-SHA256,
+* then decrypt the ciphertext.
+*/
+function decryptBuffer(encryptedData, mediaKeyBase64, mediaType, expectedSize, mimetype) {
+	const mediaKeyBytes = Buffer.from(mediaKeyBase64, "base64");
+	const info = `WhatsApp ${mediaTypes[mediaType.toUpperCase()] ?? mediaTypes[Object.keys(mediaTypes).find((t) => mimetype?.includes(t.toLowerCase())) ?? ""]} Keys`;
+	const expanded = Buffer.from(hkdfSync("sha256", mediaKeyBytes, Buffer.alloc(32), info, 112));
+	const iv = expanded.subarray(0, 16);
+	const decipher = createDecipheriv("aes-256-cbc", expanded.subarray(16, 48), iv);
+	decipher.setAutoPadding(false);
+	const decrypted = Buffer.concat([decipher.update(encryptedData), decipher.final()]);
+	return expectedSize ? fixPadding(decrypted, expectedSize) : decrypted;
+}
+/**
+* Correct PKCS#7-style padding that WhatsApp applies inconsistently.
+*/
+function fixPadding(data, expectedSize) {
+	const padding = 16 - expectedSize % 16 & 15;
+	if (padding > 0) {
+		if (expectedSize + padding === data.length) return data.subarray(0, data.length - padding);
+		if (data.length + padding === expectedSize) {
+			const pad = Buffer.alloc(padding, padding);
+			return Buffer.concat([data, pad]);
+		}
+	}
+	return data;
+}
+//#endregion
+//#region src/download.ts
+/**
+* Download encrypted media from WhatsApp CDN using native fetch.
+*
+* Replaces the legacy axios-based downloader.
+*/
+function buildUserAgent(override) {
+	let ua = override ?? "WhatsApp/2.16.352 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36";
+	if (!ua.includes("WhatsApp")) ua = `WhatsApp/2.16.352 ${ua}`;
+	return ua;
+}
+/**
+* Download an encrypted media blob from the given URL.
+* Uses the global `fetch` API (Bun native / Node 18+).
+*/
+async function downloadEncryptedMedia(url, options) {
+	const { useragent, maxRetries = 3, retryDelay = 2e3 } = options ?? {};
+	const headers = {
+		"User-Agent": buildUserAgent(useragent),
+		DNT: "1",
+		"Upgrade-Insecure-Requests": "1",
+		Origin: "https://web.whatsapp.com/",
+		Referer: "https://web.whatsapp.com/"
+	};
+	for (let attempt = 0; attempt < maxRetries; attempt++) {
+		const res = await fetch(url, { headers });
+		if (res.ok) return new Uint8Array(await res.arrayBuffer());
+		if (res.status === 404) throw new Error("This media does not exist or is no longer available on the server. See: https://docs.openwa.dev/pages/How%20to/decrypt-media.html#40439d");
+		if (attempt < maxRetries - 1) await new Promise((r) => setTimeout(r, retryDelay));
+	}
+	throw new Error(`Failed to download media after ${maxRetries} attempts`);
+}
+//#endregion
+//#region src/decrypt.ts
+/**
+* Main decryptMedia entry point.
+*
+* Downloads the encrypted blob → decrypts with AES-256-CBC via HKDF-derived keys.
+*/
+/**
+* Download and decrypt a WhatsApp media message.
+*
+* @param message — A message object with at least the required decryption fields.
+* @param optionsOrUa — Either a {@link DecryptOptions} object or a legacy user-agent string.
+* @returns The decrypted media as a Buffer.
+*
+* @example
+* ```ts
+* import { decryptMedia } from '@open-wa/decrypt';
+*
+* const buffer = await decryptMedia(message);
+* ```
+*/
+async function decryptMedia(message, optionsOrUa) {
+	const opts = typeof optionsOrUa === "string" ? { useragent: optionsOrUa } : optionsOrUa ?? {};
+	validateMessage(message);
+	return decryptBuffer(await downloadEncryptedMedia((message.deprecatedMms3Url ?? message.clientUrl).trim(), opts), message.mediaKey, message.type, message.size, message.mimetype);
+}
+function validateMessage(message) {
+	const missing = [];
+	if (!message.mediaKey) missing.push("mediaKey");
+	if (!message.filehash) missing.push("filehash");
+	if (!message.mimetype) missing.push("mimetype");
+	if (!message.type) missing.push("type");
+	if (!message.size) missing.push("size");
+	if (missing.length === 0) return;
+	if (missing.length === 1 && missing[0] === "size") {
+		if (!NON_SIZE_TYPES.includes(message.type)) console.warn("@open-wa/decrypt: size property is missing. File will fail an integrity check.");
+		return;
+	}
+	throw new MissingCriticalDataError(`Message is missing critical data: ${missing.join(", ")}`);
+}
+//#endregion
+//#region src/bleach.ts
+/**
+* Strip a message down to the minimum fields needed for decryption.
+*
+* Useful for minimizing sensitive data in transit — removes sender info,
+* chat context, etc.
+*/
+const BLEACH_KEEP = new Set([
+	"type",
+	"clientUrl",
+	"mimetype",
+	"mediaKey",
+	"size",
+	"filehash",
+	"uploadhash",
+	"deprecatedMms3Url"
+]);
+/**
+* Return a copy of the message containing only the fields required for decryption.
+*/
+function bleachMessage(message) {
+	const result = {};
+	for (const key of Object.keys(message)) if (BLEACH_KEEP.has(key)) result[key] = message[key];
+	return result;
+}
+//#endregion
+export { MissingCriticalDataError, bleachMessage, decryptMedia, mediaTypes };
+
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/constants.ts","../src/crypto.ts","../src/download.ts","../src/decrypt.ts","../src/bleach.ts"],"sourcesContent":["/** Mapping from message type to WhatsApp's internal media-type key name. */\nexport const mediaTypes: Record<string, string> = {\n  IMAGE: 'Image',\n  VIDEO: 'Video',\n  AUDIO: 'Audio',\n  PTT: 'Audio',\n  DOCUMENT: 'Document',\n  STICKER: 'Image',\n} as const;\n\n/** Message types where a missing `size` field is tolerable. */\nexport const NON_SIZE_TYPES = ['sticker'] as const;\n\n/** The default user-agent used for fetching encrypted media blobs. */\nexport const DEFAULT_USER_AGENT =\n  'WhatsApp/2.16.352 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.92 Safari/537.36';\n\n/** Thrown when a message is missing fields required for decryption. */\nexport class MissingCriticalDataError extends Error {\n  override readonly name = 'MissingCriticalDataError';\n\n  constructor(message: string) {\n    super(message);\n  }\n}\n","/**\n * Core crypto routines for WhatsApp media decryption.\n *\n * Uses only `node:crypto` builtins — no external HKDF library needed.\n * `crypto.hkdfSync` landed in Node 15 and is available in Bun.\n */\nimport { createDecipheriv, hkdfSync } from 'node:crypto';\n\nimport { mediaTypes } from './constants.js';\n\n/**\n * Derive the AES-256-CBC key and IV from the media key using HKDF-SHA256,\n * then decrypt the ciphertext.\n */\nexport function decryptBuffer(\n  encryptedData: Uint8Array,\n  mediaKeyBase64: string,\n  mediaType: string,\n  expectedSize?: number,\n  mimetype?: string,\n): Buffer {\n  const mediaKeyBytes = Buffer.from(mediaKeyBase64, 'base64');\n\n  // Resolve the info string: \"WhatsApp <Type> Keys\"\n  const typeKey =\n    mediaTypes[mediaType.toUpperCase()] ??\n    mediaTypes[\n      Object.keys(mediaTypes).find((t) =>\n        mimetype?.includes(t.toLowerCase()),\n      ) ?? ''\n    ];\n\n  const info = `WhatsApp ${typeKey} Keys`;\n\n  // HKDF expand to 112 bytes (iv=16 + cipherKey=32 + macKey=32 + refKey=32)\n  const expanded = Buffer.from(\n    hkdfSync('sha256', mediaKeyBytes, Buffer.alloc(32), info, 112),\n  );\n\n  const iv = expanded.subarray(0, 16);\n  const cipherKey = expanded.subarray(16, 48);\n\n  const decipher = createDecipheriv('aes-256-cbc', cipherKey, iv);\n  // WhatsApp handles padding manually — disable OpenSSL auto-padding\n  decipher.setAutoPadding(false);\n  const decrypted = Buffer.concat([\n    decipher.update(encryptedData),\n    decipher.final(),\n  ]);\n\n  return expectedSize ? fixPadding(decrypted, expectedSize) : decrypted;\n}\n\n/**\n * Correct PKCS#7-style padding that WhatsApp applies inconsistently.\n */\nfunction fixPadding(data: Buffer, expectedSize: number): Buffer {\n  const padding = (16 - (expectedSize % 16)) & 0xf;\n  if (padding > 0) {\n    if (expectedSize + padding === data.length) {\n      // Trim trailing padding bytes\n      return data.subarray(0, data.length - padding);\n    }\n    if (data.length + padding === expectedSize) {\n      // Append missing padding\n      const pad = Buffer.alloc(padding, padding);\n      return Buffer.concat([data, pad]);\n    }\n  }\n  return data;\n}\n","/**\n * Download encrypted media from WhatsApp CDN using native fetch.\n *\n * Replaces the legacy axios-based downloader.\n */\nimport {\n  DEFAULT_USER_AGENT,\n} from './constants.js';\n\nfunction buildUserAgent(override?: string): string {\n  let ua = override ?? DEFAULT_USER_AGENT;\n  if (!ua.includes('WhatsApp')) ua = `WhatsApp/2.16.352 ${ua}`;\n  return ua;\n}\n\n/**\n * Download an encrypted media blob from the given URL.\n * Uses the global `fetch` API (Bun native / Node 18+).\n */\nexport async function downloadEncryptedMedia(\n  url: string,\n  options?: { useragent?: string; maxRetries?: number; retryDelay?: number },\n): Promise<Uint8Array> {\n  const { useragent, maxRetries = 3, retryDelay = 2_000 } = options ?? {};\n\n  const headers: Record<string, string> = {\n    'User-Agent': buildUserAgent(useragent),\n    DNT: '1',\n    'Upgrade-Insecure-Requests': '1',\n    Origin: 'https://web.whatsapp.com/',\n    Referer: 'https://web.whatsapp.com/',\n  };\n\n  for (let attempt = 0; attempt < maxRetries; attempt++) {\n    const res = await fetch(url, { headers });\n\n    if (res.ok) {\n      return new Uint8Array(await res.arrayBuffer());\n    }\n\n    if (res.status === 404) {\n      throw new Error(\n        'This media does not exist or is no longer available on the server. ' +\n          'See: https://docs.openwa.dev/pages/How%20to/decrypt-media.html#40439d',\n      );\n    }\n\n    // Retry on transient errors\n    if (attempt < maxRetries - 1) {\n      await new Promise((r) => setTimeout(r, retryDelay));\n    }\n  }\n\n  throw new Error(`Failed to download media after ${maxRetries} attempts`);\n}\n","/**\n * Main decryptMedia entry point.\n *\n * Downloads the encrypted blob → decrypts with AES-256-CBC via HKDF-derived keys.\n */\nimport { MissingCriticalDataError, NON_SIZE_TYPES } from './constants.js';\nimport { decryptBuffer } from './crypto.js';\nimport { downloadEncryptedMedia } from './download.js';\nimport type { DecryptableMessage, DecryptOptions } from './types.js';\n\n/**\n * Download and decrypt a WhatsApp media message.\n *\n * @param message — A message object with at least the required decryption fields.\n * @param optionsOrUa — Either a {@link DecryptOptions} object or a legacy user-agent string.\n * @returns The decrypted media as a Buffer.\n *\n * @example\n * ```ts\n * import { decryptMedia } from '@open-wa/decrypt';\n *\n * const buffer = await decryptMedia(message);\n * ```\n */\nexport async function decryptMedia(\n  message: DecryptableMessage,\n  optionsOrUa?: DecryptOptions | string,\n): Promise<Buffer> {\n  // Normalise options — accept legacy string signature for backward compat\n  const opts: DecryptOptions =\n    typeof optionsOrUa === 'string'\n      ? { useragent: optionsOrUa }\n      : optionsOrUa ?? {};\n\n  validateMessage(message);\n\n  const url = (message.deprecatedMms3Url ?? message.clientUrl)!.trim();\n  const encrypted = await downloadEncryptedMedia(url, opts);\n\n  return decryptBuffer(\n    encrypted,\n    message.mediaKey,\n    message.type,\n    message.size,\n    message.mimetype,\n  );\n}\n\nfunction validateMessage(message: DecryptableMessage): void {\n  const missing: string[] = [];\n\n  if (!message.mediaKey) missing.push('mediaKey');\n  if (!message.filehash) missing.push('filehash');\n  if (!message.mimetype) missing.push('mimetype');\n  if (!message.type) missing.push('type');\n  if (!message.size) missing.push('size');\n\n  if (missing.length === 0) return;\n\n  // Size-only omission is a warning for non-sticker types, not an error\n  if (missing.length === 1 && missing[0] === 'size') {\n    if (!NON_SIZE_TYPES.includes(message.type as (typeof NON_SIZE_TYPES)[number])) {\n      console.warn(\n        '@open-wa/decrypt: size property is missing. File will fail an integrity check.',\n      );\n    }\n    return;\n  }\n\n  throw new MissingCriticalDataError(\n    `Message is missing critical data: ${missing.join(', ')}`,\n  );\n}\n","/**\n * Strip a message down to the minimum fields needed for decryption.\n *\n * Useful for minimizing sensitive data in transit — removes sender info,\n * chat context, etc.\n */\n\nconst BLEACH_KEEP = new Set([\n  'type',\n  'clientUrl',\n  'mimetype',\n  'mediaKey',\n  'size',\n  'filehash',\n  'uploadhash',\n  'deprecatedMms3Url',\n]);\n\n/**\n * Return a copy of the message containing only the fields required for decryption.\n */\nexport function bleachMessage<T extends Record<string, unknown>>(\n  message: T,\n): Partial<T> {\n  const result: Record<string, unknown> = {};\n  for (const key of Object.keys(message)) {\n    if (BLEACH_KEEP.has(key)) {\n      result[key] = message[key];\n    }\n  }\n  return result as Partial<T>;\n}\n"],"mappings":";;;AACA,MAAa,aAAqC;CAChD,OAAO;CACP,OAAO;CACP,OAAO;CACP,KAAK;CACL,UAAU;CACV,SAAS;CACV;;AAGD,MAAa,iBAAiB,CAAC,UAAU;;AAOzC,IAAa,2BAAb,cAA8C,MAAM;CAClD,OAAyB;CAEzB,YAAY,SAAiB;AAC3B,QAAM,QAAQ;;;;;;;;;;;;;;;ACRlB,SAAgB,cACd,eACA,gBACA,WACA,cACA,UACQ;CACR,MAAM,gBAAgB,OAAO,KAAK,gBAAgB,SAAS;CAW3D,MAAM,OAAO,YAPX,WAAW,UAAU,aAAa,KAClC,WACE,OAAO,KAAK,WAAW,CAAC,MAAM,MAC5B,UAAU,SAAS,EAAE,aAAa,CAAC,CACpC,IAAI,IAGwB;CAGjC,MAAM,WAAW,OAAO,KACtB,SAAS,UAAU,eAAe,OAAO,MAAM,GAAG,EAAE,MAAM,IAAI,CAC/D;CAED,MAAM,KAAK,SAAS,SAAS,GAAG,GAAG;CAGnC,MAAM,WAAW,iBAAiB,eAFhB,SAAS,SAAS,IAAI,GAAG,EAEiB,GAAG;AAE/D,UAAS,eAAe,MAAM;CAC9B,MAAM,YAAY,OAAO,OAAO,CAC9B,SAAS,OAAO,cAAc,EAC9B,SAAS,OAAO,CACjB,CAAC;AAEF,QAAO,eAAe,WAAW,WAAW,aAAa,GAAG;;;;;AAM9D,SAAS,WAAW,MAAc,cAA8B;CAC9D,MAAM,UAAW,KAAM,eAAe,KAAO;AAC7C,KAAI,UAAU,GAAG;AACf,MAAI,eAAe,YAAY,KAAK,OAElC,QAAO,KAAK,SAAS,GAAG,KAAK,SAAS,QAAQ;AAEhD,MAAI,KAAK,SAAS,YAAY,cAAc;GAE1C,MAAM,MAAM,OAAO,MAAM,SAAS,QAAQ;AAC1C,UAAO,OAAO,OAAO,CAAC,MAAM,IAAI,CAAC;;;AAGrC,QAAO;;;;;;;;;AC5DT,SAAS,eAAe,UAA2B;CACjD,IAAI,KAAK,YAAA;AACT,KAAI,CAAC,GAAG,SAAS,WAAW,CAAE,MAAK,qBAAqB;AACxD,QAAO;;;;;;AAOT,eAAsB,uBACpB,KACA,SACqB;CACrB,MAAM,EAAE,WAAW,aAAa,GAAG,aAAa,QAAU,WAAW,EAAE;CAEvE,MAAM,UAAkC;EACtC,cAAc,eAAe,UAAU;EACvC,KAAK;EACL,6BAA6B;EAC7B,QAAQ;EACR,SAAS;EACV;AAED,MAAK,IAAI,UAAU,GAAG,UAAU,YAAY,WAAW;EACrD,MAAM,MAAM,MAAM,MAAM,KAAK,EAAE,SAAS,CAAC;AAEzC,MAAI,IAAI,GACN,QAAO,IAAI,WAAW,MAAM,IAAI,aAAa,CAAC;AAGhD,MAAI,IAAI,WAAW,IACjB,OAAM,IAAI,MACR,2IAED;AAIH,MAAI,UAAU,aAAa,EACzB,OAAM,IAAI,SAAS,MAAM,WAAW,GAAG,WAAW,CAAC;;AAIvD,OAAM,IAAI,MAAM,kCAAkC,WAAW,WAAW;;;;;;;;;;;;;;;;;;;;;;;AC7B1E,eAAsB,aACpB,SACA,aACiB;CAEjB,MAAM,OACJ,OAAO,gBAAgB,WACnB,EAAE,WAAW,aAAa,GAC1B,eAAe,EAAE;AAEvB,iBAAgB,QAAQ;AAKxB,QAAO,cAFW,MAAM,wBADX,QAAQ,qBAAqB,QAAQ,WAAY,MAAM,EAChB,KAAK,EAIvD,QAAQ,UACR,QAAQ,MACR,QAAQ,MACR,QAAQ,SACT;;AAGH,SAAS,gBAAgB,SAAmC;CAC1D,MAAM,UAAoB,EAAE;AAE5B,KAAI,CAAC,QAAQ,SAAU,SAAQ,KAAK,WAAW;AAC/C,KAAI,CAAC,QAAQ,SAAU,SAAQ,KAAK,WAAW;AAC/C,KAAI,CAAC,QAAQ,SAAU,SAAQ,KAAK,WAAW;AAC/C,KAAI,CAAC,QAAQ,KAAM,SAAQ,KAAK,OAAO;AACvC,KAAI,CAAC,QAAQ,KAAM,SAAQ,KAAK,OAAO;AAEvC,KAAI,QAAQ,WAAW,EAAG;AAG1B,KAAI,QAAQ,WAAW,KAAK,QAAQ,OAAO,QAAQ;AACjD,MAAI,CAAC,eAAe,SAAS,QAAQ,KAAwC,CAC3E,SAAQ,KACN,iFACD;AAEH;;AAGF,OAAM,IAAI,yBACR,qCAAqC,QAAQ,KAAK,KAAK,GACxD;;;;;;;;;;AChEH,MAAM,cAAc,IAAI,IAAI;CAC1B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;;;;AAKF,SAAgB,cACd,SACY;CACZ,MAAM,SAAkC,EAAE;AAC1C,MAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,CACpC,KAAI,YAAY,IAAI,IAAI,CACtB,QAAO,OAAO,QAAQ;AAG1B,QAAO"}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@open-wa/decrypt",
+  "version": "5.0.0-alpha.0",
+  "description": "Lightweight WhatsApp media decryption — zero external dependencies",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^25.9.1",
+    "typescript": "^6.0.3",
+    "vitest": "4.1.2",
+    "@open-wa/schema": "5.0.0-alpha.0"
+  },
+  "peerDependencies": {
+    "@open-wa/schema": "5.0.0-alpha.0"
+  },
+  "peerDependenciesMeta": {
+    "@open-wa/schema": {
+      "optional": true
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "open-wa",
+    "whatsapp",
+    "decrypt",
+    "media"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/open-wa/wa-automate-nodejs.git"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "dev": "tsdown --watch",
+    "test": "vitest run",
+    "lint": "oxlint src",
+    "typecheck": "tsc --noEmit"
+  }
+}