@oxidezap/baileyrs 0.0.8 → 0.0.9

package/lib/Utils/__tests__/wrap-legacy-store-session.test.d.ts

@@ -1,32 +1,14 @@
 /**
- * Pin down the `session` cross-impl gap. Sister of the sender_key test.
- *
- * Bridge (Rust libsignal) writes:
- *   • store: `session`
- *   • key:   `{user}[:jidDev]@{server}.{signalDev}`  e.g. "100000037037034@lid.0"
- *   • value: raw protobuf bytes of `waproto.RecordStructure`
- *           (current_session + previous_sessions, both `SessionStructure`)
- *
- * Upstream baileys (JS libsignal) writes:
- *   • store: `session`           (same name, so no rename)
- *   • key:   `{signalUser}.{deviceId}`           e.g. "100000037037034_1.0"
- *           where signalUser = `${user}` for s.whatsapp.net (domainType 0),
- *                            `${user}_${domainType}` otherwise
- *   • value: a plain JS object (NOT bytes!) with shape
- *           `{ _sessions: { [base64BaseKey]: SessionEntry }, version: 'v1' }`
- *           The keys store is responsible for JSON-stringifying it on disk.
- *
- * Two diffs at the boundary:
- *   1. KEY format: bridge `addr@server.dev` ↔ upstream `signalUser.deviceId`
- *   2. VALUE format: proto bytes ↔ JS object (with base64-encoded byte fields)
- *
- * If wrap-legacy-store doesn't translate, upstream's `loadSession` either
- *   (a) doesn't find the key at all, OR
- *   (b) finds it (Buffer of proto bytes) and throws inside SessionRecord.deserialize
- * → returns null → falls back to fresh PreKey signal handshake. The e2e
- * 1:1 phases still pass via that fallback, but every cross-impl swap then
- * costs an extra ~3 wire roundtrips per peer pair. These tests pin down
- * the contract for direct, no-re-handshake compatibility.
+ * Cross-impl gap for `session`:
+ *   • Bridge: store `session`, key `{user}[:dev]@{server}.{sig}`,
+ *     value = protobuf `RecordStructure` (current + previous_sessions).
+ *   • Upstream: store `session`, key `{signalUser}.{deviceId}`,
+ *     value = JS object `{ _sessions: { [base64BaseKey]: SessionEntry }, version: 'v1' }`.
+ *
+ * Without conversion, upstream's `loadSession` either misses the key or
+ * throws inside `SessionRecord.deserialize`, falling back to a fresh
+ * PreKey signal handshake on every cross-impl swap. These tests pin
+ * direct, no-re-handshake compatibility.
  */
 export {};
 //# sourceMappingURL=wrap-legacy-store-session.test.d.ts.map

package/lib/Utils/__tests__/wrap-legacy-store-session.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrap-legacy-store-session.test.d.ts","sourceRoot":"","sources":["../../../src/Utils/__tests__/wrap-legacy-store-session.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG"}
+{"version":3,"file":"wrap-legacy-store-session.test.d.ts","sourceRoot":"","sources":["../../../src/Utils/__tests__/wrap-legacy-store-session.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/lib/Utils/__tests__/wrap-legacy-store-session.test.js

@@ -1,150 +1,50 @@
 /**
- * Pin down the `session` cross-impl gap. Sister of the sender_key test.
+ * Cross-impl gap for `session`:
+ *   • Bridge: store `session`, key `{user}[:dev]@{server}.{sig}`,
+ *     value = protobuf `RecordStructure` (current + previous_sessions).
+ *   • Upstream: store `session`, key `{signalUser}.{deviceId}`,
+ *     value = JS object `{ _sessions: { [base64BaseKey]: SessionEntry }, version: 'v1' }`.
  *
- * Bridge (Rust libsignal) writes:
- *   • store: `session`
- *   • key:   `{user}[:jidDev]@{server}.{signalDev}`  e.g. "100000037037034@lid.0"
- *   • value: raw protobuf bytes of `waproto.RecordStructure`
- *           (current_session + previous_sessions, both `SessionStructure`)
- *
- * Upstream baileys (JS libsignal) writes:
- *   • store: `session`           (same name, so no rename)
- *   • key:   `{signalUser}.{deviceId}`           e.g. "100000037037034_1.0"
- *           where signalUser = `${user}` for s.whatsapp.net (domainType 0),
- *                            `${user}_${domainType}` otherwise
- *   • value: a plain JS object (NOT bytes!) with shape
- *           `{ _sessions: { [base64BaseKey]: SessionEntry }, version: 'v1' }`
- *           The keys store is responsible for JSON-stringifying it on disk.
- *
- * Two diffs at the boundary:
- *   1. KEY format: bridge `addr@server.dev` ↔ upstream `signalUser.deviceId`
- *   2. VALUE format: proto bytes ↔ JS object (with base64-encoded byte fields)
- *
- * If wrap-legacy-store doesn't translate, upstream's `loadSession` either
- *   (a) doesn't find the key at all, OR
- *   (b) finds it (Buffer of proto bytes) and throws inside SessionRecord.deserialize
- * → returns null → falls back to fresh PreKey signal handshake. The e2e
- * 1:1 phases still pass via that fallback, but every cross-impl swap then
- * costs an extra ~3 wire roundtrips per peer pair. These tests pin down
- * the contract for direct, no-re-handshake compatibility.
+ * Without conversion, upstream's `loadSession` either misses the key or
+ * throws inside `SessionRecord.deserialize`, falling back to a fresh
+ * PreKey signal handshake on every cross-impl swap. These tests pin
+ * direct, no-re-handshake compatibility.
  */
 import { Buffer } from 'node:buffer';
 import { describe, test } from 'node:test';
-// libsignal has no .d.ts; importing the JS module directly is fine for a
-// node-test runtime, we just have to widen the type at the boundary.
 // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-// @ts-expect-error -- no types
+// @ts-expect-error -- libsignal lacks .d.ts
 import SessionRecord from 'libsignal/src/session_record.js';
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- bridge proto-types ambient
 import { proto as bridgeProto } from 'whatsapp-rust-bridge/proto-types';
-import { wrapLegacyStore } from "../wrap-legacy-store.js";
-import { initAuthCreds } from "../generics.js";
 import { expect } from "../../__tests__/expect.js";
-// ── Helpers ──────────────────────────────────────────────────────────────
-function makeMemKeys() {
-    const data = {};
-    return {
-        raw: data,
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        async get(type, ids) {
-            const bucket = data[type] ?? {};
-            const out = {};
-            for (const id of ids)
-                out[id] = bucket[id] ?? null;
-            return out;
-        },
-        async set(updates) {
-            for (const [type, bucket] of Object.entries(updates)) {
-                data[type] ?? (data[type] = {});
-                for (const [id, val] of Object.entries(bucket)) {
-                    if (val === null || val === undefined)
-                        delete data[type][id];
-                    else
-                        data[type][id] = val;
-                }
-            }
-        }
-    };
-}
-async function makeWrapped() {
-    const creds = initAuthCreds();
-    const keys = makeMemKeys();
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const state = { creds, keys: keys };
-    const wrapped = await wrapLegacyStore(state, async () => { });
-    return { wrapped, keys, creds };
-}
-const fill = (n, base) => new Uint8Array(n).map((_, i) => (i * base + base) & 0xff);
-/** Build a realistic, fully-populated `RecordStructure` proto byte blob —
- * matching what Rust libsignal would produce for an established Signal
- * session that has both a sender chain and a receiver chain. */
-function buildBridgeSessionBytes(opts) {
-    const { rootKey = fill(32, 1), previousCounter = 0, senderRatchetPub = fill(33, 2), senderRatchetPriv = fill(32, 3), senderChainKey = fill(32, 4), senderChainIndex = 0, receiverRatchetPub = fill(33, 5), receiverChainKey = fill(32, 6), receiverChainIndex = 1, aliceBaseKey = fill(33, 7), remoteIdentity = fill(33, 8), remoteRegistrationId = 1234, localRegistrationId = 5678 } = opts;
-    const session = bridgeProto.SessionStructure.create({
-        sessionVersion: 3,
-        localIdentityPublic: fill(33, 9),
-        remoteIdentityPublic: remoteIdentity,
-        rootKey,
-        previousCounter,
-        senderChain: {
-            senderRatchetKey: senderRatchetPub,
-            senderRatchetKeyPrivate: senderRatchetPriv,
-            chainKey: { index: senderChainIndex, key: senderChainKey },
-            messageKeys: []
-        },
-        receiverChains: [
-            {
-                senderRatchetKey: receiverRatchetPub,
-                chainKey: { index: receiverChainIndex, key: receiverChainKey },
-                messageKeys: []
-            }
-        ],
-        remoteRegistrationId,
-        localRegistrationId,
-        aliceBaseKey
-    });
-    const record = bridgeProto.RecordStructure.create({
-        currentSession: session,
-        previousSessions: []
-    });
-    return bridgeProto.RecordStructure.encode(record).finish();
-}
-const SAMPLE_BRIDGE_KEY_LID = '100000037037034@lid.0';
-const EXPECTED_UPSTREAM_KEY_LID = '100000037037034_1.0';
-const SAMPLE_BRIDGE_KEY_PN = '559980000003@s.whatsapp.net.0';
-const EXPECTED_UPSTREAM_KEY_PN = '559980000003.0';
-const SAMPLE_BRIDGE_KEY_PN_DEV = '559980000003:5@s.whatsapp.net.0';
-const EXPECTED_UPSTREAM_KEY_PN_DEV = '559980000003.5';
-// ── Tests ────────────────────────────────────────────────────────────────
-describe('wrap-legacy-store: session key-name translation (cross-impl)', () => {
-    test('bridge SET writes under the upstream-formatted key (LID)', async () => {
+import { BRIDGE_SESSION_KEY_LID, BRIDGE_SESSION_KEY_PN, BRIDGE_SESSION_KEY_PN_DEV, UPSTREAM_SESSION_KEY_LID, UPSTREAM_SESSION_KEY_PN, UPSTREAM_SESSION_KEY_PN_DEV, buildBridgeSessionBytes, fill, makeWrapped } from "./_legacy-store-fixtures.js";
+describe('wrap-legacy-store: session key-name translation', () => {
+    test('LID → upstream `_1.deviceId`', async () => {
         const { wrapped, keys } = await makeWrapped();
-        await wrapped.set('session', SAMPLE_BRIDGE_KEY_LID, buildBridgeSessionBytes({}));
-        expect(keys.raw['session']?.[EXPECTED_UPSTREAM_KEY_LID]).toBeDefined();
-        // The bridge-shaped key MUST NOT be written; otherwise upstream's
-        // `loadSession(<upstreamKey>)` won't find anything.
-        expect(keys.raw['session']?.[SAMPLE_BRIDGE_KEY_LID]).toBeUndefined();
+        await wrapped.set('session', BRIDGE_SESSION_KEY_LID, buildBridgeSessionBytes());
+        expect(keys.raw['session']?.[UPSTREAM_SESSION_KEY_LID]).toBeDefined();
+        expect(keys.raw['session']?.[BRIDGE_SESSION_KEY_LID]).toBeUndefined();
     });
-    test('bridge SET writes under the upstream-formatted key (PN, no device)', async () => {
+    test('PN no-device → bare `{user}.{signalDev}`', async () => {
         const { wrapped, keys } = await makeWrapped();
-        await wrapped.set('session', SAMPLE_BRIDGE_KEY_PN, buildBridgeSessionBytes({}));
-        expect(keys.raw['session']?.[EXPECTED_UPSTREAM_KEY_PN]).toBeDefined();
+        await wrapped.set('session', BRIDGE_SESSION_KEY_PN, buildBridgeSessionBytes());
+        expect(keys.raw['session']?.[UPSTREAM_SESSION_KEY_PN]).toBeDefined();
     });
-    test('bridge SET writes under the upstream-formatted key (PN with device)', async () => {
+    test('PN with JID device → device suffix preserved', async () => {
         const { wrapped, keys } = await makeWrapped();
-        await wrapped.set('session', SAMPLE_BRIDGE_KEY_PN_DEV, buildBridgeSessionBytes({}));
-        expect(keys.raw['session']?.[EXPECTED_UPSTREAM_KEY_PN_DEV]).toBeDefined();
+        await wrapped.set('session', BRIDGE_SESSION_KEY_PN_DEV, buildBridgeSessionBytes());
+        expect(keys.raw['session']?.[UPSTREAM_SESSION_KEY_PN_DEV]).toBeDefined();
     });
 });
-describe('wrap-legacy-store: session value-byte translation (cross-impl)', () => {
-    test('bridge-written proto bytes are loadable by upstream SessionRecord.deserialize', async () => {
+describe('wrap-legacy-store: session value-byte translation', () => {
+    test('bridge proto bytes load via upstream `SessionRecord.deserialize` as OPEN', async () => {
         const { wrapped, keys } = await makeWrapped();
-        const aliceBaseKey = Buffer.from(new Uint8Array(33).map((_, i) => (i + 100) & 0xff));
-        const rootKey = Buffer.from(new Uint8Array(32).map((_, i) => (i * 3 + 1) & 0xff));
-        const remoteIdentity = Buffer.from(new Uint8Array(33).map((_, i) => (i * 5 + 7) & 0xff));
-        const senderRatchetPub = Buffer.from(new Uint8Array(33).map((_, i) => (i * 11 + 13) & 0xff));
-        const senderRatchetPriv = Buffer.from(new Uint8Array(32).map((_, i) => (i * 13 + 17) & 0xff));
-        await wrapped.set('session', SAMPLE_BRIDGE_KEY_LID, buildBridgeSessionBytes({
+        const aliceBaseKey = Buffer.from(fill(33, 100));
+        const rootKey = Buffer.from(fill(32, 11));
+        const remoteIdentity = Buffer.from(fill(33, 17));
+        const senderRatchetPub = Buffer.from(fill(33, 23));
+        const senderRatchetPriv = Buffer.from(fill(32, 29));
+        await wrapped.set('session', BRIDGE_SESSION_KEY_LID, buildBridgeSessionBytes({
             rootKey: new Uint8Array(rootKey),
             aliceBaseKey: new Uint8Array(aliceBaseKey),
             remoteIdentity: new Uint8Array(remoteIdentity),
@@ -153,15 +53,11 @@ describe('wrap-legacy-store: session value-byte translation (cross-impl)', () =>
             remoteRegistrationId: 99,
             previousCounter: 4
         }));
-        const stored = keys.raw['session']?.[EXPECTED_UPSTREAM_KEY_LID];
-        expect(stored).toBeDefined();
-        // THE call upstream's loadSession makes. If it throws or produces a
-        // session with no open entries, the regression isn't fixed.
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any -- libsignal lacks .d.ts
+        const stored = keys.raw['session']?.[UPSTREAM_SESSION_KEY_LID];
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const rec = SessionRecord.deserialize(stored);
         expect(rec.haveOpenSession()).toBe(true);
         const open = rec.getOpenSession();
-        expect(open).toBeDefined();
         expect(open.registrationId).toBe(99);
         expect(open.currentRatchet.previousCounter).toBe(4);
         expect(Buffer.from(open.currentRatchet.rootKey).equals(rootKey)).toBe(true);
@@ -169,54 +65,44 @@ describe('wrap-legacy-store: session value-byte translation (cross-impl)', () =>
         expect(Buffer.from(open.currentRatchet.ephemeralKeyPair.privKey).equals(senderRatchetPriv)).toBe(true);
         expect(Buffer.from(open.indexInfo.baseKey).equals(aliceBaseKey)).toBe(true);
         expect(Buffer.from(open.indexInfo.remoteIdentityKey).equals(remoteIdentity)).toBe(true);
-        // indexInfo.closed === -1 means the session is OPEN; cross-impl
-        // swap of an open session is the whole point.
         expect(open.indexInfo.closed).toBe(-1);
-        // We expect at least one chain populated (sender + receiver).
         expect(Object.keys(open._chains).length).toBeGreaterThanOrEqual(1);
     });
-    test('upstream-written JS-shaped object round-trips through bridge GET to valid proto bytes', async () => {
+    test('upstream JS object → bridge GET produces valid proto with same fields', async () => {
         const { wrapped, keys } = await makeWrapped();
-        // Build a SessionRecord the upstream way (start from a synthetic
-        // session shape, since libsignal exposes no public constructor that
-        // fully populates the entry).
         const baseKey = Buffer.alloc(33, 0xa0);
         const rootKey = Buffer.alloc(32, 0xb0);
         const remoteIdent = Buffer.alloc(33, 0xc0);
         const ephPub = Buffer.alloc(33, 0xd0);
         const ephPriv = Buffer.alloc(32, 0xe0);
         const lastRemoteEph = Buffer.alloc(33, 0xf0);
-        const upstreamRecord = {
-            _sessions: {
-                [baseKey.toString('base64')]: {
-                    registrationId: 4242,
-                    currentRatchet: {
-                        ephemeralKeyPair: {
-                            pubKey: ephPub.toString('base64'),
-                            privKey: ephPriv.toString('base64')
+        keys.raw['session'] = {
+            [UPSTREAM_SESSION_KEY_LID]: {
+                _sessions: {
+                    [baseKey.toString('base64')]: {
+                        registrationId: 4242,
+                        currentRatchet: {
+                            ephemeralKeyPair: { pubKey: ephPub.toString('base64'), privKey: ephPriv.toString('base64') },
+                            lastRemoteEphemeralKey: lastRemoteEph.toString('base64'),
+                            previousCounter: 7,
+                            rootKey: rootKey.toString('base64')
                         },
-                        lastRemoteEphemeralKey: lastRemoteEph.toString('base64'),
-                        previousCounter: 7,
-                        rootKey: rootKey.toString('base64')
-                    },
-                    indexInfo: {
-                        baseKey: baseKey.toString('base64'),
-                        baseKeyType: 1, // OURS — we initiated
-                        closed: -1,
-                        used: Date.now(),
-                        created: Date.now(),
-                        remoteIdentityKey: remoteIdent.toString('base64')
-                    },
-                    _chains: {}
-                }
-            },
-            version: 'v1'
+                        indexInfo: {
+                            baseKey: baseKey.toString('base64'),
+                            baseKeyType: 1,
+                            closed: -1,
+                            used: Date.now(),
+                            created: Date.now(),
+                            remoteIdentityKey: remoteIdent.toString('base64')
+                        },
+                        _chains: {}
+                    }
+                },
+                version: 'v1'
+            }
         };
-        keys.raw['session'] = { [EXPECTED_UPSTREAM_KEY_LID]: upstreamRecord };
-        const protoOut = (await wrapped.get('session', SAMPLE_BRIDGE_KEY_LID));
-        expect(protoOut).not.toBe(null);
+        const protoOut = (await wrapped.get('session', BRIDGE_SESSION_KEY_LID));
         const decoded = bridgeProto.RecordStructure.decode(protoOut);
-        expect(decoded.currentSession).toBeDefined();
         const cs = decoded.currentSession;
         expect(cs.remoteRegistrationId).toBe(4242);
         expect(cs.previousCounter).toBe(7);
@@ -226,32 +112,24 @@ describe('wrap-legacy-store: session value-byte translation (cross-impl)', () =>
         expect(Buffer.from(cs.senderChain.senderRatchetKey).equals(ephPub)).toBe(true);
         expect(Buffer.from(cs.senderChain.senderRatchetKeyPrivate).equals(ephPriv)).toBe(true);
     });
-    test('round-trip: bridge SET → upstream loadSession+haveOpenSession → still open + correct identity', async () => {
+    test('round-trip: bridge SET → upstream loadSession → still open + same identity', async () => {
         const { wrapped, keys } = await makeWrapped();
         const remoteIdentity = Buffer.alloc(33, 0x11);
-        await wrapped.set('session', SAMPLE_BRIDGE_KEY_PN, buildBridgeSessionBytes({ remoteIdentity: new Uint8Array(remoteIdentity), remoteRegistrationId: 7 }));
-        const stored = keys.raw['session']?.[EXPECTED_UPSTREAM_KEY_PN];
-        expect(stored).toBeDefined();
+        await wrapped.set('session', BRIDGE_SESSION_KEY_PN, buildBridgeSessionBytes({ remoteIdentity: new Uint8Array(remoteIdentity), remoteRegistrationId: 7 }));
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        const rec = SessionRecord.deserialize(stored);
-        expect(rec.haveOpenSession()).toBe(true);
+        const rec = SessionRecord.deserialize(keys.raw['session']?.[UPSTREAM_SESSION_KEY_PN]);
         const open = rec.getOpenSession();
         expect(open.registrationId).toBe(7);
         expect(Buffer.from(open.indexInfo.remoteIdentityKey).equals(remoteIdentity)).toBe(true);
     });
 });
-describe('wrap-legacy-store: session edge cases (multi-session, pendingPreKey, lastRemoteEph)', () => {
-    test('lastRemoteEphemeralKey does NOT collide with senderRatchetKey when receiverChains is empty (no-collide bug fix)', async () => {
-        // Regression for the bug discovered in audit: previously the
-        // converter used senderRatchetKey as a placeholder for
-        // lastRemoteEphemeralKey when receiverChains was empty, which
-        // caused upstream's `maybeStepRatchet` → `getChain(lastRemoteEph)`
-        // to return the SENDER chain and `delete chainKey.key` corrupted
-        // the outbound encryption channel.
+describe('wrap-legacy-store: session edge cases', () => {
+    test('lastRemoteEphemeralKey does NOT collide with senderRatchetKey when receiverChains empty', async () => {
+        // Regression: the converter previously used senderRatchetKey as a
+        // placeholder, which made upstream's `maybeStepRatchet` close the
+        // SENDER chain on the next peer ratchet (corrupting outbound
+        // encryption). Now uses aliceBaseKey (when bob) or empty buffer.
         const { wrapped, keys } = await makeWrapped();
-        // Build a freshly-initiated alice-side session: sender chain
-        // populated, no receiverChain yet, pendingPreKey set (alice waits
-        // for bob's first reply).
         const senderRatchetPub = fill(33, 2);
         const aliceBaseKey = fill(33, 7);
         const protoBytes = bridgeProto.RecordStructure.encode(bridgeProto.RecordStructure.create({
@@ -274,56 +152,18 @@ describe('wrap-legacy-store: session edge cases (multi-session, pendingPreKey, l
             }),
             previousSessions: []
         })).finish();
-        await wrapped.set('session', SAMPLE_BRIDGE_KEY_LID, protoBytes);
-        const stored = keys.raw['session']?.[EXPECTED_UPSTREAM_KEY_LID];
-        expect(stored).toBeDefined();
+        await wrapped.set('session', BRIDGE_SESSION_KEY_LID, protoBytes);
+        const stored = keys.raw['session']?.[UPSTREAM_SESSION_KEY_LID];
         const entry = Object.values(stored._sessions)[0];
-        // The last-remote-eph MUST NOT equal the sender's ratchet pubkey,
-        // otherwise upstream's maybeStepRatchet will close the SENDER chain
-        // when the peer ratchets next.
         expect(entry.currentRatchet.lastRemoteEphemeralKey).not.toBe(Buffer.from(senderRatchetPub).toString('base64'));
     });
-    test('baseKeyType derives from pendingPreKey: present → OURS (alice), absent → THEIRS (bob)', async () => {
-        // Regression for the bug where I always set OURS when aliceBaseKey
-        // was set (which is ALWAYS in established sessions), causing
-        // upstream's `getSession(byBaseKey)` to throw on every lookup.
-        const { wrapped, keys } = await makeWrapped();
-        // Bob-side session: established, no pendingPreKey, aliceBaseKey set
-        // (it's the peer's ephemeral). MUST land as THEIRS so upstream can
-        // look it up by baseKey.
-        const bobSideBytes = bridgeProto.RecordStructure.encode(bridgeProto.RecordStructure.create({
-            currentSession: bridgeProto.SessionStructure.create({
-                sessionVersion: 3,
-                rootKey: fill(32, 1),
-                previousCounter: 0,
-                senderChain: {
-                    senderRatchetKey: fill(33, 2),
-                    senderRatchetKeyPrivate: fill(32, 3),
-                    chainKey: { index: 0, key: fill(32, 4) },
-                    messageKeys: []
-                },
-                receiverChains: [
-                    {
-                        senderRatchetKey: fill(33, 5),
-                        chainKey: { index: 1, key: fill(32, 6) },
-                        messageKeys: []
-                    }
-                ],
-                remoteIdentityPublic: fill(33, 8),
-                remoteRegistrationId: 1,
-                aliceBaseKey: fill(33, 7) // present but we're bob (no pendingPreKey)
-            }),
-            previousSessions: []
-        })).finish();
-        await wrapped.set('session', SAMPLE_BRIDGE_KEY_PN, bobSideBytes);
-        const stored = keys.raw['session']?.[EXPECTED_UPSTREAM_KEY_PN];
-        const bobEntry = Object.values(stored._sessions)[0];
-        expect(bobEntry.indexInfo.baseKeyType).toBe(2); // THEIRS
-        // Now alice-side: same session shape but with pendingPreKey → OURS.
-        const { wrapped: w2, keys: k2 } = await makeWrapped();
-        const aliceBaseKey = fill(33, 7);
-        const aliceBytes = bridgeProto.RecordStructure.encode(bridgeProto.RecordStructure.create({
-            currentSession: bridgeProto.SessionStructure.create({
+    test('baseKeyType: pendingPreKey present → OURS (alice), absent → THEIRS (bob)', async () => {
+        // Regression: previously set OURS whenever aliceBaseKey existed
+        // (always), making upstream `getSession(byBaseKey)` throw.
+        const baseKeyTypeFor = async (withPendingPreKey) => {
+            const { wrapped, keys } = await makeWrapped();
+            const aliceBaseKey = fill(33, 7);
+            const session = bridgeProto.SessionStructure.create({
                 sessionVersion: 3,
                 rootKey: fill(32, 1),
                 previousCounter: 0,
@@ -333,24 +173,28 @@ describe('wrap-legacy-store: session edge cases (multi-session, pendingPreKey, l
                     chainKey: { index: 0, key: fill(32, 4) },
                     messageKeys: []
                 },
-                receiverChains: [],
+                receiverChains: withPendingPreKey
+                    ? []
+                    : [
+                        {
+                            senderRatchetKey: fill(33, 5),
+                            chainKey: { index: 1, key: fill(32, 6) },
+                            messageKeys: []
+                        }
+                    ],
                 remoteIdentityPublic: fill(33, 8),
                 remoteRegistrationId: 1,
                 aliceBaseKey,
-                pendingPreKey: { preKeyId: 1, signedPreKeyId: 2, baseKey: aliceBaseKey }
-            }),
-            previousSessions: []
-        })).finish();
-        await w2.set('session', SAMPLE_BRIDGE_KEY_PN, aliceBytes);
-        const aliceStored = k2.raw['session']?.[EXPECTED_UPSTREAM_KEY_PN];
-        const aliceEntry = Object.values(aliceStored._sessions)[0];
-        expect(aliceEntry.indexInfo.baseKeyType).toBe(1); // OURS
+                ...(withPendingPreKey ? { pendingPreKey: { preKeyId: 1, signedPreKeyId: 2, baseKey: aliceBaseKey } } : {})
+            });
+            await wrapped.set('session', BRIDGE_SESSION_KEY_PN, bridgeProto.RecordStructure.encode(bridgeProto.RecordStructure.create({ currentSession: session, previousSessions: [] })).finish());
+            const stored = keys.raw['session']?.[UPSTREAM_SESSION_KEY_PN];
+            return Object.values(stored._sessions)[0].indexInfo.baseKeyType;
+        };
+        expect(await baseKeyTypeFor(true)).toBe(1); // OURS
+        expect(await baseKeyTypeFor(false)).toBe(2); // THEIRS
     });
-    test('multi-session: currentSession + previousSessions[] all round-trip into upstream _sessions', async () => {
-        // Cover the path where Rust archives sessions into previous_sessions
-        // (e.g. after identity change). Upstream should see one OPEN entry
-        // (closed=-1) plus one or more closed entries that share the same
-        // peer key.
+    test('multi-session: currentSession + previousSessions[] all land in upstream `_sessions`', async () => {
         const { wrapped, keys } = await makeWrapped();
         const mkSession = (rootSeed, baseKeySeed) => bridgeProto.SessionStructure.create({
             sessionVersion: 3,
@@ -373,38 +217,28 @@ describe('wrap-legacy-store: session edge cases (multi-session, pendingPreKey, l
             remoteRegistrationId: 1,
             aliceBaseKey: fill(33, baseKeySeed)
         });
-        const protoBytes = bridgeProto.RecordStructure.encode(bridgeProto.RecordStructure.create({
+        await wrapped.set('session', BRIDGE_SESSION_KEY_LID, bridgeProto.RecordStructure.encode(bridgeProto.RecordStructure.create({
             currentSession: mkSession(1, 100),
             previousSessions: [mkSession(2, 200), mkSession(3, 250)]
-        })).finish();
-        await wrapped.set('session', SAMPLE_BRIDGE_KEY_LID, protoBytes);
-        const stored = keys.raw['session']?.[EXPECTED_UPSTREAM_KEY_LID];
+        })).finish());
+        const stored = keys.raw['session']?.[UPSTREAM_SESSION_KEY_LID];
         expect(stored.version).toBe('v1');
-        // 1 current + 2 previous, distinct baseKeys → 3 entries.
         expect(Object.keys(stored._sessions).length).toBe(3);
-        // Exactly one OPEN session (closed=-1).
         const open = Object.values(stored._sessions).filter(e => e.indexInfo.closed === -1);
         expect(open.length).toBe(1);
         expect(open[0].indexInfo.baseKey).toBe(Buffer.from(fill(33, 100)).toString('base64'));
-        // The other two are CLOSED with positive timestamps. Most recent
-        // archived (previous[0]) must have a LARGER timestamp than
-        // previous[1] so removeOldSessions evicts the oldest first
-        // (matching Rust's archive ordering: front = newest).
+        // Front of Rust's previous_sessions = newest archived → must get
+        // the LARGER `closed` timestamp so upstream's removeOldSessions
+        // evicts the oldest first.
         const closedEntries = Object.values(stored._sessions).filter(e => e.indexInfo.closed > 0);
-        expect(closedEntries.length).toBe(2);
         const newer = closedEntries.find(e => e.indexInfo.baseKey === Buffer.from(fill(33, 200)).toString('base64'));
         const older = closedEntries.find(e => e.indexInfo.baseKey === Buffer.from(fill(33, 250)).toString('base64'));
-        expect(newer).toBeDefined();
-        expect(older).toBeDefined();
         expect(newer.indexInfo.closed).toBeGreaterThan(older.indexInfo.closed);
     });
-    test('pendingPreKey: round-trips through bridge→upstream→bridge with field rename preserved', async () => {
-        // Bridge proto: pendingPreKey { preKeyId, signedPreKeyId, baseKey }
-        // Upstream JS: session.pendingPreKey { preKeyId, signedKeyId, baseKey }
-        // (yes, the field name differs — `signedPreKeyId` vs `signedKeyId`)
+    test('pendingPreKey round-trips with field rename `signedPreKeyId↔signedKeyId`', async () => {
         const { wrapped, keys } = await makeWrapped();
         const aliceBaseKey = fill(33, 7);
-        const protoBytes = bridgeProto.RecordStructure.encode(bridgeProto.RecordStructure.create({
+        await wrapped.set('session', BRIDGE_SESSION_KEY_LID, bridgeProto.RecordStructure.encode(bridgeProto.RecordStructure.create({
             currentSession: bridgeProto.SessionStructure.create({
                 sessionVersion: 3,
                 rootKey: fill(32, 1),
@@ -422,46 +256,36 @@ describe('wrap-legacy-store: session edge cases (multi-session, pendingPreKey, l
                 pendingPreKey: { preKeyId: 314, signedPreKeyId: 271, baseKey: aliceBaseKey }
             }),
             previousSessions: []
-        })).finish();
-        await wrapped.set('session', SAMPLE_BRIDGE_KEY_LID, protoBytes);
-        const stored = keys.raw['session']?.[EXPECTED_UPSTREAM_KEY_LID];
+        })).finish());
+        const stored = keys.raw['session']?.[UPSTREAM_SESSION_KEY_LID];
         const entry = Object.values(stored._sessions)[0];
-        expect(entry.pendingPreKey).toBeDefined();
         expect(entry.pendingPreKey.preKeyId).toBe(314);
-        // Field rename: bridge's `signedPreKeyId` → upstream's `signedKeyId`.
-        expect(entry.pendingPreKey.signedKeyId).toBe(271);
+        expect(entry.pendingPreKey.signedKeyId).toBe(271); // rename: signedPreKeyId → signedKeyId
         expect(entry.pendingPreKey.baseKey).toBe(Buffer.from(aliceBaseKey).toString('base64'));
-        // Now read it back through the bridge GET path — pendingPreKey
-        // should round-trip with the original field names.
-        const protoOut = (await wrapped.get('session', SAMPLE_BRIDGE_KEY_LID));
+        const protoOut = (await wrapped.get('session', BRIDGE_SESSION_KEY_LID));
         const decoded = bridgeProto.RecordStructure.decode(protoOut);
         expect(decoded.currentSession?.pendingPreKey?.preKeyId).toBe(314);
         expect(decoded.currentSession?.pendingPreKey?.signedPreKeyId).toBe(271);
     });
-    test('aliceBaseKey is preserved on JS→bridge round-trip regardless of baseKeyType', async () => {
-        // Regression for the matching-second bug discovered in audit: the
-        // reverse converter only set aliceBaseKey when baseKeyType=OURS, so
-        // bob-side sessions lost aliceBaseKey, breaking Rust's
-        // `find_matching_previous_session_index` lookups on subsequent
-        // PreKeySignal arrivals.
+    test('aliceBaseKey preserved on JS→bridge regardless of baseKeyType (bob-side restoration)', async () => {
+        // Regression: previously dropped aliceBaseKey when baseKeyType=THEIRS,
+        // breaking Rust's `find_matching_previous_session_index` lookup on
+        // subsequent PreKeySignal arrivals.
         const { wrapped, keys } = await makeWrapped();
         const baseKey = Buffer.alloc(33, 0xa0);
-        const remoteIdent = Buffer.alloc(33, 0xc0);
-        const ephPub = Buffer.alloc(33, 0xd0);
-        const ephPriv = Buffer.alloc(32, 0xe0);
-        const lastRemoteEph = Buffer.alloc(33, 0xf0);
-        const rootKey = Buffer.alloc(32, 0xb0);
-        // Bob-side stored object (baseKeyType=THEIRS, no pendingPreKey).
         keys.raw['session'] = {
-            [EXPECTED_UPSTREAM_KEY_LID]: {
+            [UPSTREAM_SESSION_KEY_LID]: {
                 _sessions: {
                     [baseKey.toString('base64')]: {
                         registrationId: 4242,
                         currentRatchet: {
-                            ephemeralKeyPair: { pubKey: ephPub.toString('base64'), privKey: ephPriv.toString('base64') },
-                            lastRemoteEphemeralKey: lastRemoteEph.toString('base64'),
+                            ephemeralKeyPair: {
+                                pubKey: Buffer.alloc(33, 0xd0).toString('base64'),
+                                privKey: Buffer.alloc(32, 0xe0).toString('base64')
+                            },
+                            lastRemoteEphemeralKey: Buffer.alloc(33, 0xf0).toString('base64'),
                             previousCounter: 0,
-                            rootKey: rootKey.toString('base64')
+                            rootKey: Buffer.alloc(32, 0xb0).toString('base64')
                         },
                         indexInfo: {
                             baseKey: baseKey.toString('base64'),
@@ -469,7 +293,7 @@ describe('wrap-legacy-store: session edge cases (multi-session, pendingPreKey, l
                             closed: -1,
                             used: Date.now(),
                             created: Date.now(),
-                            remoteIdentityKey: remoteIdent.toString('base64')
+                            remoteIdentityKey: Buffer.alloc(33, 0xc0).toString('base64')
                         },
                         _chains: {}
                     }
@@ -477,11 +301,8 @@ describe('wrap-legacy-store: session edge cases (multi-session, pendingPreKey, l
                 version: 'v1'
             }
         };
-        const protoOut = (await wrapped.get('session', SAMPLE_BRIDGE_KEY_LID));
+        const protoOut = (await wrapped.get('session', BRIDGE_SESSION_KEY_LID));
         const decoded = bridgeProto.RecordStructure.decode(protoOut);
-        // aliceBaseKey MUST be set even when we're bob (baseKeyType=THEIRS),
-        // otherwise Rust's session-matching path breaks.
-        expect(decoded.currentSession?.aliceBaseKey).toBeDefined();
         expect(Buffer.from(decoded.currentSession.aliceBaseKey).equals(baseKey)).toBe(true);
     });
 });