@oxidezap/baileyrs 0.0.7 → 0.0.8

package/lib/Utils/wrap-legacy-store.js

@@ -11,9 +11,10 @@
  * ```
  */
 import { Buffer } from 'node:buffer';
+import { createHmac } from 'node:crypto';
 import { mkdir, readFile, stat, unlink, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { proto } from '../../WAProto/index.js';
+import { proto } from 'whatsapp-rust-bridge/proto-types';
 const protoLookup = proto;
 const ADVSignedDeviceIdentity = protoLookup.ADVSignedDeviceIdentity ?? protoLookup.AdvSignedDeviceIdentity;
 function warn(msg, err) {
@@ -46,11 +47,20 @@ const STORE_MAP = {
     mutation_mac: 'bridge-mutation-mac',
     meta: 'bridge-meta'
 };
-// Stores where bridge data is passthrough binary (no conversion)
-const BINARY_STORES = new Set(['identity', 'session', 'sender_key']);
-// Bridge-only stores — raw binary persisted through keys interface
+// Stores where bridge data is passthrough binary (no conversion).
+// `sender_key` and `session` are intentionally excluded — both diverge in
+// on-disk format between Rust libsignal (protobuf `SenderKeyRecordStructure`
+// / `RecordStructure`) and JS libsignal (`SenderKeyRecord` UTF-8 JSON /
+// `SessionRecord` plain JS object). They route through converters so the
+// same auth folder remains readable from either implementation, which is
+// the whole point of `wrap-legacy-store`.
+const BINARY_STORES = new Set(['identity']);
+// Bridge-only stores — raw binary persisted through keys interface.
+// `lid_mapping` is intentionally excluded — it has a converter so the
+// `pn:`/`lid:` prefixed bridge keys translate to upstream's bare-userpart
+// `{pnUser}` + `{lidUser}_reverse` shape, letting both libraries share
+// the same on-disk LID↔PN mapping table.
 const BRIDGE_ONLY_STORES = new Set([
-    'lid_mapping',
     'signed_prekey',
     'sender_key_devices',
     'base_key',
@@ -203,8 +213,521 @@ const converters = {
                 return [];
             }
         }
+    },
+    // ── lid_mapping ──
+    // Cross-impl converter for LID ↔ PN device mapping table.
+    //   • Bridge: keyed by `lid:{lidUser}` (value=JSON LidPnMappingEntry
+    //     with phone_number/created_at/updated_at/learning_source) AND
+    //     `pn:{pnUser}` (value=raw bytes of the LID user, UTF-8).
+    //   • Upstream (`Signal/lid-mapping.js`): keyed by bare `{pnUser}`
+    //     (value=string LID user) AND `{lidUser}_reverse` (value=string
+    //     PN user). No timestamps.
+    // Translation goes both ways; metadata fields default to "now" /
+    // "wrap-legacy-store" when reading from upstream-only state since the
+    // JS side doesn't track them.
+    lid_mapping: {
+        toBridge(key, value) {
+            // `value` here is whatever upstream stored: a string
+            // (`pnUser→lidUser` or `lidUser_reverse→pnUser`) — useMultiFile's
+            // BufferJSON.reviver leaves strings as strings.
+            try {
+                if (key.startsWith('pn:')) {
+                    // Bridge wants the raw LID user as bytes.
+                    const lid = typeof value === 'string' ? value : Buffer.from(value).toString('utf-8');
+                    if (!lid)
+                        return null;
+                    return new TextEncoder().encode(lid);
+                }
+                if (key.startsWith('lid:')) {
+                    // Bridge wants the JSON LidPnMappingEntry. Upstream stored
+                    // only the phone number string; reconstruct a synthetic
+                    // entry — bridge tolerates synthetic timestamps + source.
+                    const lidUser = key.slice(4);
+                    const phoneNumber = typeof value === 'string' ? value : Buffer.from(value).toString('utf-8');
+                    if (!phoneNumber)
+                        return null;
+                    const now = Math.floor(Date.now() / 1000);
+                    return toJson({
+                        lid: lidUser,
+                        phone_number: phoneNumber,
+                        created_at: now,
+                        updated_at: now,
+                        learning_source: 'wrap-legacy-store'
+                    });
+                }
+                warn(`lid_mapping.toBridge: unknown key prefix in "${key}"`);
+                return null;
+            }
+            catch (e) {
+                warn('lid_mapping.toBridge failed:', e);
+                return null;
+            }
+        },
+        fromBridge(key, value) {
+            // `value` here is bridge's Uint8Array. We return a string for
+            // upstream to store — useMultiFile's BufferJSON.replacer keeps
+            // strings as strings, which is what `lid-mapping.js` expects to
+            // read back via `keys.get('lid-mapping', […])`.
+            try {
+                if (key.startsWith('pn:')) {
+                    // Bridge wrote raw LID bytes. Upstream wants the string.
+                    return Buffer.from(value).toString('utf-8');
+                }
+                if (key.startsWith('lid:')) {
+                    // Bridge wrote JSON entry. Upstream wants the phone_number
+                    // string under `{lidUser}_reverse`.
+                    const entry = fromJson(value);
+                    return entry.phone_number ?? '';
+                }
+                warn(`lid_mapping.fromBridge: unknown key prefix in "${key}"`);
+                return Buffer.from(value);
+            }
+            catch (e) {
+                warn('lid_mapping.fromBridge failed:', e);
+                return Buffer.from(value);
+            }
+        }
+    },
+    // ── session ──
+    // Cross-impl converter for pairwise Signal sessions.
+    //   • Rust libsignal (bridge): raw protobuf `RecordStructure` bytes
+    //     (current_session + previous_sessions, each `SessionStructure`).
+    //   • JS  libsignal (upstream): a plain JS object
+    //     `{ _sessions: { [base64BaseKey]: SessionEntry }, version: 'v1' }`
+    //     persisted by upstream's `useMultiFileAuthState` via
+    //     JSON.stringify-with-BufferJSON. The byte fields inside SessionEntry
+    //     are stored as base64 STRINGS (not BufferJSON Buffer wrappers).
+    // We translate at the boundary so the same auth folder works for both.
+    // Note: per-message-counter caches (`messageKeys`) are dropped during
+    // conversion — the two implementations derive them differently (Rust
+    // stores cipher/mac/iv post-split; JS stores the pre-split chain output)
+    // and they're a CACHE, not state — protocol re-derives or asks for retry.
+    session: {
+        toBridge(_key, value) {
+            // Upstream stored: a plain JS object (NOT bytes). Convert → proto bytes.
+            try {
+                if (value == null)
+                    return null; // eslint-disable-line eqeqeq -- intentional null+undefined check
+                return upstreamSessionRecordToProto(value);
+            }
+            catch (e) {
+                warn('session.toBridge encode failed:', e);
+                return null;
+            }
+        },
+        fromBridge(_key, value) {
+            // Bridge wrote: raw proto bytes. Convert → upstream JS object.
+            try {
+                return bridgeSessionProtoToUpstreamRecord(value);
+            }
+            catch (e) {
+                warn('session.fromBridge decode failed:', e);
+                return Buffer.from(value);
+            }
+        }
+    },
+    // ── sender_key ──
+    // Cross-impl converter for group sender keys. Both libraries produce
+    // the same logical record (`SenderKeyRecordStructure`) but persist it
+    // under DIFFERENT bytes:
+    //   • Rust libsignal (bridge): raw protobuf bytes
+    //   • JS  libsignal (upstream): UTF-8 JSON of the record array, with
+    //     each Buffer wrapped as `{ type:'Buffer', data:'<base64>' }`
+    //     (BufferJSON.replacer in upstream's `Utils/generics`).
+    // We translate at the boundary so the same on-disk file is readable
+    // by either implementation — the entire point of `wrap-legacy-store`.
+    sender_key: {
+        toBridge(_key, value) {
+            // Upstream stored: Buffer of UTF-8 JSON. Convert → proto bytes.
+            try {
+                const buf = toBuf(value);
+                if (!buf)
+                    return null;
+                return upstreamSenderKeyJsonToProto(buf);
+            }
+            catch (e) {
+                warn('sender_key.toBridge decode failed:', e);
+                return null;
+            }
+        },
+        fromBridge(_key, value) {
+            // Bridge wrote: raw proto bytes. Convert → upstream JSON Buffer.
+            try {
+                return bridgeSenderKeyProtoToJson(value);
+            }
+            catch (e) {
+                warn('sender_key.fromBridge encode failed:', e);
+                // Fall back to passthrough so we don't drop data on the floor.
+                return Buffer.from(value);
+            }
+        }
+    }
+};
+const bufferReplacerForSenderKey = (_k, v) => {
+    if (Buffer.isBuffer(v) || v instanceof Uint8Array || v?.type === 'Buffer') {
+        const data = v?.data ?? v;
+        return { type: 'Buffer', data: Buffer.from(data).toString('base64') };
+    }
+    return v;
+};
+const bufferReviverForSenderKey = (_k, v) => {
+    if (typeof v === 'object' && v !== null) {
+        const obj = v;
+        if (obj.type === 'Buffer' && typeof obj.data === 'string') {
+            return Buffer.from(obj.data, 'base64');
+        }
     }
+    return v;
 };
+function bridgeSenderKeyProtoToJson(protoBytes) {
+    const struct = proto.SenderKeyRecordStructure.decode(Buffer.from(protoBytes));
+    const states = (struct.senderKeyStates ?? []).map(s => ({
+        senderKeyId: s.senderKeyId ?? 0,
+        senderChainKey: {
+            iteration: s.senderChainKey?.iteration ?? 0,
+            seed: Buffer.from(s.senderChainKey?.seed ?? new Uint8Array())
+        },
+        senderSigningKey: {
+            public: Buffer.from(s.senderSigningKey?.public ?? new Uint8Array()),
+            private: Buffer.from(s.senderSigningKey?.private ?? new Uint8Array())
+        },
+        senderMessageKeys: (s.senderMessageKeys ?? []).map(mk => ({
+            iteration: mk.iteration ?? 0,
+            seed: Buffer.from(mk.seed ?? new Uint8Array())
+        }))
+    }));
+    return Buffer.from(JSON.stringify(states, bufferReplacerForSenderKey), 'utf-8');
+}
+function upstreamSenderKeyJsonToProto(jsonBuf) {
+    const text = Buffer.from(jsonBuf).toString('utf-8');
+    const states = JSON.parse(text, bufferReviverForSenderKey);
+    const senderKeyStates = states.map(s => ({
+        senderKeyId: s.senderKeyId ?? 0,
+        senderChainKey: {
+            iteration: s.senderChainKey?.iteration ?? 0,
+            seed: s.senderChainKey?.seed ? new Uint8Array(Buffer.from(s.senderChainKey.seed)) : new Uint8Array()
+        },
+        senderSigningKey: {
+            public: s.senderSigningKey?.public ? new Uint8Array(Buffer.from(s.senderSigningKey.public)) : new Uint8Array(),
+            private: s.senderSigningKey?.private ? new Uint8Array(Buffer.from(s.senderSigningKey.private)) : new Uint8Array()
+        },
+        senderMessageKeys: (s.senderMessageKeys ?? []).map(mk => ({
+            iteration: mk.iteration ?? 0,
+            seed: mk.seed ? new Uint8Array(Buffer.from(mk.seed)) : new Uint8Array()
+        }))
+    }));
+    const struct = proto.SenderKeyRecordStructure.create({ senderKeyStates });
+    return proto.SenderKeyRecordStructure.encode(struct).finish();
+}
+// ── sender_key key translator ──
+// Bridge `cache_key`: `{groupJid}:{user}[:jidDev]@{server}.{signalDev}`
+//   e.g. "120363@g.us:100000037037034@lid.0"
+//   e.g. "120363@g.us:559980000003:5@s.whatsapp.net.0"
+// Upstream `SenderKeyName.serialize()`: `{groupJid}::{signalUser}::{deviceId}`
+//   where signalUser = `${user}` for s.whatsapp.net (domainType 0)
+//                    = `${user}_${domainType}` for LID (1) / hosted (2) / hosted.lid (3)
+function bridgeSenderKeyToUpstream(bridgeKey) {
+    // Group JIDs are `{digits}@g.us` — they never contain `:` — so the
+    // FIRST `:` in cache_key cleanly separates group from sender address.
+    const sep = bridgeKey.indexOf(':');
+    if (sep < 0)
+        return null;
+    const groupJid = bridgeKey.slice(0, sep);
+    const addrStr = bridgeKey.slice(sep + 1);
+    const dotIdx = addrStr.lastIndexOf('.');
+    if (dotIdx < 0)
+        return null;
+    const jidPart = addrStr.slice(0, dotIdx); // strip the always-zero signalDev suffix
+    const atIdx = jidPart.indexOf('@');
+    if (atIdx < 0)
+        return null;
+    const userPart = jidPart.slice(0, atIdx);
+    const server = jidPart.slice(atIdx + 1);
+    let user;
+    let jidDev;
+    if (userPart.includes(':')) {
+        const [u, d] = userPart.split(':');
+        user = u;
+        jidDev = parseInt(d, 10) || 0;
+    }
+    else {
+        user = userPart;
+        jidDev = 0;
+    }
+    const domainType = DOMAIN_TYPE_MAP[server];
+    if (domainType === undefined)
+        return null;
+    const signalUser = domainType !== 0 ? `${user}_${domainType}` : user;
+    return `${groupJid}::${signalUser}::${jidDev}`;
+}
+const CHAIN_TYPE_SENDING = 1;
+const CHAIN_TYPE_RECEIVING = 2;
+const BASE_KEY_TYPE_OURS = 1;
+const BASE_KEY_TYPE_THEIRS = 2;
+const b64 = (b) => b ? Buffer.from(b).toString('base64') : Buffer.alloc(0).toString('base64');
+const fromB64 = (s) => (s ? Buffer.from(s, 'base64') : Buffer.alloc(0));
+/**
+ * Derive Rust libsignal's per-message split (cipher_key + mac_key + iv) from
+ * the JS libsignal `messageKey` seed. The two impls store the cache at
+ * different points in the derivation:
+ *
+ *   • JS: stores the 32-byte HMAC(chainKey, [1]) seed; splits on decrypt
+ *     via `deriveSecrets(seed, ZEROS_32, "WhisperMessageKeys")`.
+ *   • Rust: stores the post-split `MessageKeys { cipher_key:[u8;32],
+ *     mac_key:[u8;32], iv:[u8;16] }` directly.
+ *
+ * Both call HKDF-SHA256 with salt=[0u8;32] and info="WhisperMessageKeys"
+ * (Rust passes `None` salt which HKDF defines as a zero-byte string of
+ * HashLen=32), so the derivation is byte-identical. We can recover Rust's
+ * format from JS's seed losslessly. The reverse (Rust → JS) is impossible
+ * because HKDF is one-way — those keys are dropped on Rust→JS conversion.
+ */
+function deriveProtoMessageKey(seed, counter) {
+    // HKDF-Extract: PRK = HMAC-SHA256(salt=ZEROS_32, ikm=seed)
+    const salt = Buffer.alloc(32);
+    const prk = createHmac('sha256', salt).update(seed).digest();
+    const info = Buffer.from('WhisperMessageKeys');
+    // HKDF-Expand: T(1)=HMAC(PRK, info||0x01); T(N)=HMAC(PRK, T(N-1)||info||N).
+    // We need 80 bytes total (cipher 32 + mac 32 + iv 16) → 3 chunks.
+    const t1 = createHmac('sha256', prk)
+        .update(Buffer.concat([info, Buffer.from([0x01])]))
+        .digest();
+    const t2 = createHmac('sha256', prk)
+        .update(Buffer.concat([t1, info, Buffer.from([0x02])]))
+        .digest();
+    const t3 = createHmac('sha256', prk)
+        .update(Buffer.concat([t2, info, Buffer.from([0x03])]))
+        .digest();
+    return {
+        index: counter,
+        cipherKey: new Uint8Array(t1), // 32
+        macKey: new Uint8Array(t2), // 32
+        iv: new Uint8Array(t3.subarray(0, 16)) // first 16 of T(3)
+    };
+}
+/** Convert all entries in a JS chain's messageKeys cache into Rust's
+ * post-split `MessageKey` proto form. Empty/missing → empty array. */
+function jsChainMessageKeysToProto(messageKeys) {
+    if (!messageKeys)
+        return [];
+    const out = [];
+    for (const [counterStr, seedB64] of Object.entries(messageKeys)) {
+        const counter = parseInt(counterStr, 10);
+        if (!Number.isFinite(counter))
+            continue;
+        const seed = fromB64(seedB64);
+        if (seed.length === 0)
+            continue;
+        out.push(deriveProtoMessageKey(seed, counter));
+    }
+    return out;
+}
+function sessionStructureToEntry(session, closedTs) {
+    if (!session.senderChain || !session.rootKey)
+        return null;
+    // `aliceBaseKey` is populated by Rust libsignal in BOTH directions of
+    // a session: when we're Alice it stores our own ephemeral pubkey, when
+    // we're Bob it stores Alice's ephemeral pubkey from the incoming
+    // PreKeySignalMessage. So presence alone doesn't tell us which side
+    // we are — we use `pendingPreKey` instead (set on Alice until the first
+    // reply from Bob clears it; never set on Bob).
+    const baseKeyBytes = session.aliceBaseKey ?? session.senderChain.senderRatchetKey;
+    if (!baseKeyBytes)
+        return null;
+    const weAreAlice = !!session.pendingPreKey?.baseKey;
+    const baseKeyType = weAreAlice ? BASE_KEY_TYPE_OURS : BASE_KEY_TYPE_THEIRS;
+    // lastRemoteEphemeralKey: the most recent peer ratchet step. Order of
+    // preference:
+    //   1. tail of `receiverChains` — established session, peer has replied
+    //   2. `aliceBaseKey` when we're Bob — peer's original ephemeral was
+    //      our `lastRemoteEphemeralKey` at session creation (matches JS
+    //      `session_builder.initSession` line 128)
+    //   3. empty buffer — degenerate fallback. CANNOT use senderRatchetKey
+    //      as a placeholder: it collides with the SENDER chain in `_chains`,
+    //      and upstream's `maybeStepRatchet` would call
+    //      `delete previousRatchet.chainKey.key` on the sender chain when
+    //      the peer ratchets, corrupting outbound encryption.
+    const receiverChains = session.receiverChains ?? [];
+    const lastReceiver = receiverChains[receiverChains.length - 1];
+    let lastRemoteEph;
+    if (lastReceiver?.senderRatchetKey && lastReceiver.senderRatchetKey.length > 0) {
+        lastRemoteEph = lastReceiver.senderRatchetKey;
+    }
+    else if (!weAreAlice && session.aliceBaseKey && session.aliceBaseKey.length > 0) {
+        lastRemoteEph = session.aliceBaseKey;
+    }
+    else {
+        lastRemoteEph = new Uint8Array();
+    }
+    const senderRatchetPub = session.senderChain.senderRatchetKey ?? new Uint8Array();
+    const senderRatchetPriv = session.senderChain.senderRatchetKeyPrivate ?? new Uint8Array();
+    const _chains = {};
+    // Sender chain: keyed by our own ratchet pubkey base64.
+    if (session.senderChain.chainKey?.key && senderRatchetPub.length > 0) {
+        _chains[b64(senderRatchetPub)] = {
+            chainKey: {
+                counter: session.senderChain.chainKey.index ?? 0,
+                key: b64(session.senderChain.chainKey.key)
+            },
+            chainType: CHAIN_TYPE_SENDING,
+            messageKeys: {}
+        };
+    }
+    // Receiver chains: keyed by peer ratchet pubkey base64.
+    for (const rc of receiverChains) {
+        if (!rc.chainKey?.key || !rc.senderRatchetKey || rc.senderRatchetKey.length === 0)
+            continue;
+        _chains[b64(rc.senderRatchetKey)] = {
+            chainKey: {
+                counter: rc.chainKey.index ?? 0,
+                key: b64(rc.chainKey.key)
+            },
+            chainType: CHAIN_TYPE_RECEIVING,
+            messageKeys: {}
+        };
+    }
+    const now = Date.now();
+    const entry = {
+        registrationId: session.remoteRegistrationId ?? 0,
+        currentRatchet: {
+            ephemeralKeyPair: { pubKey: b64(senderRatchetPub), privKey: b64(senderRatchetPriv) },
+            lastRemoteEphemeralKey: b64(lastRemoteEph),
+            previousCounter: session.previousCounter ?? 0,
+            rootKey: b64(session.rootKey)
+        },
+        indexInfo: {
+            baseKey: b64(baseKeyBytes),
+            baseKeyType,
+            closed: closedTs,
+            used: now,
+            created: now,
+            remoteIdentityKey: b64(session.remoteIdentityPublic ?? new Uint8Array())
+        },
+        _chains
+    };
+    if (session.pendingPreKey?.baseKey) {
+        entry.pendingPreKey = {
+            preKeyId: session.pendingPreKey.preKeyId ?? undefined,
+            signedKeyId: session.pendingPreKey.signedPreKeyId ?? undefined,
+            baseKey: b64(session.pendingPreKey.baseKey)
+        };
+    }
+    return entry;
+}
+function bridgeSessionProtoToUpstreamRecord(protoBytes) {
+    const record = proto.RecordStructure.decode(Buffer.from(protoBytes));
+    const _sessions = {};
+    const current = record.currentSession ? sessionStructureToEntry(record.currentSession, -1) : null;
+    if (current)
+        _sessions[current.indexInfo.baseKey] = current;
+    // Closed sessions: assign descending timestamps so removeOldSessions
+    // has something to sort by. Use `1` as the floor (anything > 0 is
+    // "closed"; -1 is "open").
+    const previous = record.previousSessions ?? [];
+    for (let i = 0; i < previous.length; i++) {
+        const entry = sessionStructureToEntry(previous[i], Math.max(1, Date.now() - i));
+        if (!entry)
+            continue;
+        // Don't overwrite an existing baseKey (current takes precedence).
+        if (!_sessions[entry.indexInfo.baseKey])
+            _sessions[entry.indexInfo.baseKey] = entry;
+    }
+    return { _sessions, version: 'v1' };
+}
+function entryToSessionStructure(entry) {
+    const ratchet = entry.currentRatchet;
+    const senderRatchetPub = fromB64(ratchet.ephemeralKeyPair.pubKey);
+    const senderRatchetPriv = fromB64(ratchet.ephemeralKeyPair.privKey);
+    const senderKeyB64 = senderRatchetPub.toString('base64');
+    const senderChainEntry = entry._chains[senderKeyB64];
+    const senderChain = {
+        senderRatchetKey: new Uint8Array(senderRatchetPub),
+        senderRatchetKeyPrivate: new Uint8Array(senderRatchetPriv),
+        chainKey: senderChainEntry
+            ? { index: senderChainEntry.chainKey.counter, key: new Uint8Array(fromB64(senderChainEntry.chainKey.key)) }
+            : { index: 0, key: new Uint8Array() },
+        // Sender chain has no skipped-key cache in either impl — sending
+        // is sequential — so this stays empty regardless.
+        messageKeys: []
+    };
+    const receiverChains = [];
+    for (const [k, ch] of Object.entries(entry._chains)) {
+        if (ch.chainType !== CHAIN_TYPE_RECEIVING)
+            continue;
+        const ratchetPub = fromB64(k);
+        receiverChains.push({
+            senderRatchetKey: new Uint8Array(ratchetPub),
+            chainKey: { index: ch.chainKey.counter, key: new Uint8Array(fromB64(ch.chainKey.key)) },
+            // Recover skipped-key cache: JS holds 32-byte HMAC seeds, Rust
+            // holds the post-HKDF cipher/mac/iv split. HKDF is deterministic,
+            // so JS→Rust is a lossless one-shot derivation. See
+            // `deriveProtoMessageKey` for the algo + cross-impl proof.
+            messageKeys: jsChainMessageKeysToProto(ch.messageKeys)
+        });
+    }
+    const session = {
+        rootKey: new Uint8Array(fromB64(ratchet.rootKey)),
+        previousCounter: ratchet.previousCounter,
+        senderChain,
+        receiverChains,
+        remoteIdentityPublic: new Uint8Array(fromB64(entry.indexInfo.remoteIdentityKey)),
+        remoteRegistrationId: entry.registrationId ?? 0,
+        // `indexInfo.baseKey` IS the alice base key from the X3DH handshake
+        // regardless of which side we are: when we're Alice it's our own
+        // ephemeral pubkey, when we're Bob it's the peer's ephemeral pubkey
+        // from the incoming PreKeySignalMessage (`session_builder.js:135`).
+        // Rust libsignal populates `aliceBaseKey` symmetrically, so we
+        // always restore it — losing it would break Rust's
+        // `find_matching_previous_session_index` lookup on subsequent
+        // PreKeySignal arrivals.
+        aliceBaseKey: new Uint8Array(fromB64(entry.indexInfo.baseKey))
+    };
+    if (entry.pendingPreKey?.baseKey) {
+        session.pendingPreKey = {
+            preKeyId: entry.pendingPreKey.preKeyId ?? null,
+            signedPreKeyId: entry.pendingPreKey.signedKeyId ?? null,
+            baseKey: new Uint8Array(fromB64(entry.pendingPreKey.baseKey))
+        };
+    }
+    return session;
+}
+function upstreamSessionRecordToProto(record) {
+    const r = record;
+    const sessions = r?._sessions ?? {};
+    let currentSession = null;
+    const previousSessions = [];
+    // Pick the first OPEN session as `current_session`; everything else
+    // goes to `previous_sessions`. Both libraries should agree there is
+    // at most one open session per peer.
+    for (const entry of Object.values(sessions)) {
+        const ss = entryToSessionStructure(entry);
+        if (!currentSession && entry.indexInfo.closed === -1) {
+            currentSession = ss;
+        }
+        else {
+            previousSessions.push(ss);
+        }
+    }
+    // `BridgeSessionProto` is a structural mirror of `ISessionStructure`
+    // from `whatsapp-rust-bridge/proto-types`; the differences are nullable
+    // vs optional fields. We cast at the boundary to avoid pulling the full
+    // proto class types into our internal shape.
+    const recordOut = proto.RecordStructure.create({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        currentSession: (currentSession ?? undefined),
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        previousSessions: previousSessions
+    });
+    return proto.RecordStructure.encode(recordOut).finish();
+}
+// ── session key translator ──
+// Bridge protocol address: `{user}[:jidDev]@{server}.{signalDev}`
+// Upstream session key:    `{signalUser}.{deviceId}` (where deviceId is
+//   the JID device for `:jidDev` cases, else the signal device suffix).
+// `bridgeAddrToBaileysAddr` already does this exact transformation —
+// it's just been unused for the session path because sessions were
+// passthrough binary. Now that sessions go through a converter, we
+// route through `translateKey` → `bridgeAddrToBaileysAddr`.
 // ---- Device/Creds ----
 /** Parse a JID string into { user, device, server } */
 function parseJid(jid) {
@@ -259,6 +782,21 @@ function credsToDeviceJson(creds) {
         next_pre_key_id: creds.nextPreKeyId ?? 1
     });
 }
+/**
+ * Decode a `[priv(32)…pub(32)]` byte array (the bridge's `kp` shape) back into
+ * the upstream Baileys `{public, private}` keypair. Returns `undefined` for
+ * absent / all-zero arrays so callers can use `??` to keep prior values.
+ */
+function numArrayToKeyPair(arr) {
+    if (!Array.isArray(arr) || arr.length < 64)
+        return undefined;
+    if (arr.every(b => b === 0))
+        return undefined;
+    return {
+        private: new Uint8Array(arr.slice(0, 32)),
+        public: new Uint8Array(arr.slice(32, 64))
+    };
+}
 function updateCredsFromDevice(bytes, creds) {
     try {
         const d = fromJson(bytes);
@@ -293,6 +831,29 @@ function updateCredsFromDevice(bytes, creds) {
                 creds.advSecretKey = buf.toString('base64');
             }
         }
+        // Hydrate the noise / identity / signed pre-key material so the next
+        // `credsToDeviceJson(creds)` round-trip emits real bytes instead of
+        // zero-filled placeholders. Without this, a paired session looks
+        // half-valid on the next process start (`me.id` set, but key slots
+        // all zero) and the bridge's noise handshake gets rejected by the
+        // server with stream-error precondition-required.
+        const noise = numArrayToKeyPair(d.noise_key);
+        if (noise)
+            creds.noiseKey = noise;
+        const identity = numArrayToKeyPair(d.identity_key);
+        if (identity)
+            creds.signedIdentityKey = identity;
+        const signedPreKeyPair = numArrayToKeyPair(d.signed_pre_key);
+        if (signedPreKeyPair &&
+            Array.isArray(d.signed_pre_key_signature) &&
+            d.signed_pre_key_signature.length === 64 &&
+            d.signed_pre_key_signature.some(b => b !== 0)) {
+            creds.signedPreKey = {
+                keyPair: signedPreKeyPair,
+                keyId: d.signed_pre_key_id ?? 1,
+                signature: new Uint8Array(d.signed_pre_key_signature)
+            };
+        }
     }
     catch (e) {
         warn('updateCredsFromDevice failed:', e);
@@ -444,22 +1005,58 @@ export async function wrapLegacyStore(state, saveCreds, logger) {
         }, 100);
     };
     /** Route a store to its handler */
-    const resolve = (store) => {
-        if (store === 'device')
+    const resolve = (storeName) => {
+        if (storeName === 'device')
             return 'device';
-        if (BINARY_STORES.has(store))
+        if (BINARY_STORES.has(storeName))
             return 'signal';
-        if (BRIDGE_ONLY_STORES.has(store))
+        if (BRIDGE_ONLY_STORES.has(storeName))
             return 'bridge-only';
-        if (STORE_MAP[store])
+        if (STORE_MAP[storeName])
             return 'converter';
         return 'unknown';
     };
     /** Translate bridge key format to upstream Baileys key format */
-    const translateKey = (store, key) => {
+    const translateKey = (storeName, key) => {
         // Bridge encodes sync_key IDs as hex; upstream stores use base64
-        if (store === 'sync_key')
+        if (storeName === 'sync_key')
             return hexToBase64(key);
+        // Bridge sender_key cache_key uses single-colon separator + signal-
+        // device suffix; upstream's `SenderKeyName.serialize()` uses double
+        // colons and drops the signal device — see bridgeSenderKeyToUpstream.
+        if (storeName === 'sender_key') {
+            const translated = bridgeSenderKeyToUpstream(key);
+            if (translated == null) {
+                // eslint-disable-line eqeqeq -- intentional null+undefined check
+                warn(`sender_key key translation failed for "${key}", falling back to passthrough`);
+                return key;
+            }
+            return translated;
+        }
+        // Bridge session key is the protocol address (`user[:dev]@server.sig`);
+        // upstream's libsignal looks under `signalUser.deviceId`. Reuses
+        // `bridgeAddrToBaileysAddr` which already does the LID/PN→signalUser
+        // rewrite + JID-device extraction.
+        if (storeName === 'session') {
+            const translated = bridgeAddrToBaileysAddr(key);
+            if (translated == null) {
+                // eslint-disable-line eqeqeq -- intentional null+undefined check
+                warn(`session key translation failed for "${key}", falling back to passthrough`);
+                return key;
+            }
+            return translated;
+        }
+        // Bridge lid_mapping uses prefixed keys (`lid:{X}`, `pn:{X}`) that
+        // upstream's `Signal/lid-mapping.js` doesn't recognize. Map them to
+        // upstream's bare-userpart shape: `pn:{X}` → `{X}`, `lid:{X}` →
+        // `{X}_reverse`.
+        if (storeName === 'lid_mapping') {
+            if (key.startsWith('pn:'))
+                return key.slice(3);
+            if (key.startsWith('lid:'))
+                return `${key.slice(4)}_reverse`;
+            return key;
+        }
         return key;
     };
     /** Read a binary value from the keys store */
@@ -496,8 +1093,19 @@ export async function wrapLegacyStore(state, saveCreds, logger) {
             const route = resolve(bridgeStore);
             const type = STORE_MAP[bridgeStore];
             if (route === 'device') {
-                if (key === 'device')
+                if (key === 'device') {
+                    // Fresh/stub creds (baileyrs' `initAuthCreds()` shim, or an
+                    // upstream flow that hadn't finished its first pair) carry
+                    // neither a noise key nor a paired `me.id`. Returning a
+                    // zeroed `credsToDeviceJson` in that state poisons the
+                    // bridge's noise handshake (server responds 428 Precondition
+                    // Required). Signaling `null` instead lets the bridge
+                    // bootstrap its own device identity and write it back
+                    // through `set('device', 'device', …)` on pair-success.
+                    if (!creds.noiseKey && !creds.me?.id)
+                        return null;
                     return credsToDeviceJson(creds);
+                }
                 if (key === 'account') {
                     if (!creds.account)
                         return null;