@wacando/agent 2.0.1 → 2.1.0

package/packages/wacando/omemo.mjs

@@ -0,0 +1,2488 @@
+// Embedded from lbframe/wacando@9f82881d4ee6cfd655727a08883877230917c955 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+import {
+  authenticatedMessageOrigin,
+  pepFetchItems,
+  pepPublish
+} from "./chunks/chunk-GASYW3SG.mjs";
+import {
+  BODY_MARKER,
+  GCM_IV_BYTES,
+  GCM_TAG_BYTES,
+  MESSAGE_KEY_BYTES,
+  NS_DEVICELIST,
+  NS_EME,
+  NS_HINTS,
+  NS_OMEMO,
+  NS_RECOVERY,
+  NS_SCE,
+  NS_WACANDO_OMEMO,
+  OmemoError,
+  OmemoReceiveError,
+  PEP_ITEM_ID,
+  RECOVERY_DOMAIN,
+  UnsupportedSignalFormatError,
+  b64decode,
+  b64encode,
+  buildEncryptedMessageEl,
+  buildRecoveryEl,
+  buildSceEnvelope,
+  bundleNode,
+  encodeRecord,
+  parseEncrypted,
+  parseRecord,
+  parseRecoveryEl,
+  parseSceEnvelope,
+  parseXmlDocument,
+  randomBytes,
+  signerJid,
+  signerRole,
+  utf8Encode
+} from "./chunks/chunk-OI3RF7TS.mjs";
+import "./chunks/chunk-EIGFLZ2Y.mjs";
+
+// packages/omemo/src/libsignal.ts
+import { jid as parseJid2 } from "@xmpp/jid";
+
+// packages/omemo/src/libsignal-backend.ts
+import {
+  CiphertextMessageType,
+  PreKeySignalMessage,
+  ProtocolAddress,
+  processPreKeyBundle,
+  SignalMessage,
+  signalDecrypt,
+  signalDecryptPreKey,
+  signalEncrypt
+} from "@signalapp/libsignal-client";
+
+// packages/omemo/src/bundle.ts
+import { KEMPublicKey, PreKeyBundle, PublicKey } from "@signalapp/libsignal-client";
+import xml2 from "@xmpp/xml";
+
+// packages/omemo/src/devicelist.ts
+import xml from "@xmpp/xml";
+function deviceListEl(deviceIds) {
+  return xml(
+    "list",
+    { xmlns: NS_OMEMO },
+    ...deviceIds.map((id) => xml("device", { id: String(id) }))
+  );
+}
+function parseDeviceList(el) {
+  if (!el || el.getName() !== "list") return [];
+  return el.getChildren("device").map((d) => Number(d.getAttr("id"))).filter((n) => Number.isInteger(n) && n > 0);
+}
+function pickSlot(prekeys, pickerKey) {
+  if (prekeys.length === 0) return void 0;
+  let h = 2166136261;
+  for (let i = 0; i < pickerKey.length; i++) {
+    h ^= pickerKey.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return prekeys[(h >>> 0) % prekeys.length];
+}
+
+// packages/omemo/src/bundle.ts
+function b64(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+function unb64(s) {
+  return new Uint8Array(Buffer.from(s, "base64"));
+}
+function bundleEl(state) {
+  const spk = state.signedPreKey;
+  const kpk = state.kyberPreKey;
+  return xml2(
+    "bundle",
+    { xmlns: NS_OMEMO },
+    xml2(
+      "signedPreKeyPublic",
+      { signedPreKeyId: String(spk.id()) },
+      b64(spk.publicKey().serialize())
+    ),
+    xml2("signedPreKeySignature", {}, b64(spk.signature())),
+    xml2("identityKey", {}, b64(state.identityKeyPair.publicKey.serialize())),
+    xml2(
+      "prekeys",
+      {},
+      ...[...state.preKeys].map(
+        ([id, rec]) => xml2("preKeyPublic", { preKeyId: String(id) }, b64(rec.publicKey().serialize()))
+      )
+    ),
+    xml2(
+      "kyberPreKeys",
+      { xmlns: NS_WACANDO_OMEMO },
+      xml2(
+        "kyberPreKeyPublic",
+        { kyberPreKeyId: String(kpk.id()) },
+        b64(kpk.publicKey().serialize())
+      ),
+      xml2("kyberPreKeySignature", {}, b64(kpk.signature()))
+    )
+  );
+}
+function requiredText(el, name) {
+  const text = el?.getChildText(name);
+  if (!text) throw new OmemoError(`bundle missing <${name}>`);
+  return text;
+}
+function parseBundle(bundleElement, expectedDeviceId, pickerKey = "", explicitPreKeyId) {
+  if (bundleElement.getName() !== "bundle") {
+    throw new OmemoError("PEP item is not an OMEMO bundle");
+  }
+  try {
+    const spkPubEl = bundleElement.getChild("signedPreKeyPublic");
+    const spkId = Number(spkPubEl?.getAttr("signedPreKeyId"));
+    const spkPub = PublicKey.deserialize(unb64(requiredText(bundleElement, "signedPreKeyPublic")));
+    const spkSig = unb64(requiredText(bundleElement, "signedPreKeySignature"));
+    const identityKey = PublicKey.deserialize(unb64(requiredText(bundleElement, "identityKey")));
+    const prekeys = bundleElement.getChild("prekeys")?.getChildren("preKeyPublic") ?? [];
+    const picked = explicitPreKeyId === void 0 ? pickSlot(prekeys, pickerKey) ?? prekeys[0] : prekeys.find((k) => k.getAttr("preKeyId") === String(explicitPreKeyId));
+    if (explicitPreKeyId !== void 0 && !picked) {
+      throw new OmemoError("bundle lacks the selected one-time prekey");
+    }
+    const preKeyId = picked ? Number(picked.getAttr("preKeyId")) : null;
+    const preKeyPub = picked ? PublicKey.deserialize(unb64(picked.text())) : null;
+    const kyber = bundleElement.getChild("kyberPreKeys", NS_WACANDO_OMEMO);
+    const kpkPubEl = kyber?.getChild("kyberPreKeyPublic");
+    const kyberPreKeyId = Number(kpkPubEl?.getAttr("kyberPreKeyId"));
+    const kpkPubText = kpkPubEl?.text();
+    const kpkSigText = kyber?.getChild("kyberPreKeySignature")?.text();
+    if (!Number.isInteger(kyberPreKeyId) || !kpkPubText || !kpkSigText) {
+      throw new OmemoError("bundle missing kyber prekey material");
+    }
+    const kyberPub = KEMPublicKey.deserialize(unb64(kpkPubText));
+    const bundle = PreKeyBundle.new(
+      expectedDeviceId,
+      // registrationId === deviceId (documented convention)
+      expectedDeviceId,
+      typeof preKeyId === "number" && Number.isInteger(preKeyId) && preKeyId > 0 ? preKeyId : null,
+      preKeyPub,
+      spkId,
+      spkPub,
+      spkSig,
+      identityKey,
+      kyberPreKeyId,
+      kyberPub,
+      unb64(kpkSigText)
+    );
+    return { bundle, registrationId: expectedDeviceId, deviceId: expectedDeviceId };
+  } catch (err) {
+    if (err instanceof OmemoError) throw err;
+    throw new OmemoError(`bundle parse failed: ${err.message}`);
+  }
+}
+
+// packages/omemo/src/prekey-header.ts
+var MAX_MESSAGE_BYTES = 8192;
+function readVarint(buf, at) {
+  let value = 0;
+  let shift = 0;
+  let i = at;
+  while (i < buf.length && shift <= 28) {
+    const byte = buf[i];
+    value += (byte & 127) * 2 ** shift;
+    i++;
+    if ((byte & 128) === 0) return [value, i];
+    shift += 7;
+  }
+  return null;
+}
+function preKeyHeaderIdentity(raw) {
+  if (raw.length < 2 || raw.length > MAX_MESSAGE_BYTES) return void 0;
+  let at = 1;
+  let identity;
+  while (at < raw.length) {
+    const tag = readVarint(raw, at);
+    if (!tag) return void 0;
+    const [key2, next] = tag;
+    at = next;
+    const field = Math.floor(key2 / 8);
+    const wire = key2 % 8;
+    if (wire === 0) {
+      const v = readVarint(raw, at);
+      if (!v) return void 0;
+      at = v[1];
+    } else if (wire === 2) {
+      const len = readVarint(raw, at);
+      if (!len) return void 0;
+      const [size, start] = len;
+      if (start + size > raw.length) return void 0;
+      if (field === 3) {
+        if (identity !== void 0) return void 0;
+        identity = raw.slice(start, start + size);
+      }
+      at = start + size;
+    } else {
+      return void 0;
+    }
+  }
+  return identity !== void 0 && identity.length === 33 && identity[0] === 5 ? identity : void 0;
+}
+
+// packages/omemo/src/stores.ts
+import {
+  IdentityChange,
+  IdentityKeyStore,
+  KyberPreKeyStore,
+  PreKeyStore,
+  SessionStore,
+  SignedPreKeyStore
+} from "@signalapp/libsignal-client";
+function key(addr) {
+  return `${addr.name()}.${addr.deviceId()}`;
+}
+var FileSessionStore = class extends SessionStore {
+  constructor(state) {
+    super();
+    this.state = state;
+  }
+  state;
+  async saveSession(name, record) {
+    this.state.sessions.set(key(name), record);
+    this.state.persist();
+  }
+  async getSession(name) {
+    return this.state.sessions.get(key(name)) ?? null;
+  }
+  async getExistingSessions(addresses) {
+    const out = [];
+    for (const addr of addresses) {
+      const rec = this.state.sessions.get(key(addr));
+      if (rec) out.push(rec);
+    }
+    return out;
+  }
+};
+var ReceiveSessionStore = class extends FileSessionStore {
+  async saveSession(name, record) {
+    this.state.sessions.set(key(name), record);
+    this.state.bumpSessionGeneration(key(name));
+    this.state.persist();
+  }
+};
+var FileIdentityStore = class extends IdentityKeyStore {
+  constructor(state) {
+    super();
+    this.state = state;
+  }
+  state;
+  async getIdentityKey() {
+    return this.state.identityKeyPair.privateKey;
+  }
+  async getLocalRegistrationId() {
+    return this.state.deviceId;
+  }
+  async saveIdentity(name, pub) {
+    const k = key(name);
+    const existing = this.state.identities.get(k);
+    if (existing && !existing.equals(pub)) {
+      throw new OmemoError("untrusted identity: existing pin differs");
+    }
+    if (!existing) {
+      this.state.identities.set(k, pub);
+      this.state.persist();
+    }
+    return IdentityChange.NewOrUnchanged;
+  }
+  async isTrustedIdentity(name, pub, _direction) {
+    const existing = this.state.identities.get(key(name));
+    return existing === void 0 || existing.equals(pub);
+  }
+  async getIdentity(name) {
+    return this.state.identities.get(key(name)) ?? null;
+  }
+};
+var FilePreKeyStore = class extends PreKeyStore {
+  constructor(state) {
+    super();
+    this.state = state;
+  }
+  state;
+  /**
+   * #50 typed classification signal (never parsed from an error string): the
+   * one-time prekey ID a library call asked for and did not find. Use one
+   * instance per decrypt call (concurrent peers never share it).
+   */
+  missingLookup;
+  async savePreKey(id, record) {
+    this.state.preKeys.set(id, record);
+    this.state.persist();
+  }
+  async getPreKey(id) {
+    const rec = this.state.preKeys.get(id);
+    if (!rec) {
+      this.missingLookup = id;
+      throw new Error("one-time prekey not found");
+    }
+    return rec;
+  }
+  async removePreKey(id) {
+    this.state.consumePreKey(id);
+    this.state.persist();
+  }
+};
+var FileSignedPreKeyStore = class extends SignedPreKeyStore {
+  constructor(state) {
+    super();
+    this.state = state;
+  }
+  state;
+  async saveSignedPreKey(_id, record) {
+    void record;
+    this.state.persist();
+  }
+  async getSignedPreKey(id) {
+    if (id !== this.state.signedPreKey.id()) {
+      throw new Error(`signed prekey ${id} not found`);
+    }
+    return this.state.signedPreKey;
+  }
+};
+var FileKyberPreKeyStore = class extends KyberPreKeyStore {
+  constructor(state) {
+    super();
+    this.state = state;
+  }
+  state;
+  used = /* @__PURE__ */ new Set();
+  async saveKyberPreKey(_id, _record) {
+    this.state.persist();
+  }
+  async getKyberPreKey(id) {
+    if (id !== this.state.kyberPreKey.id()) {
+      throw new Error(`kyber prekey ${id} not found`);
+    }
+    return this.state.kyberPreKey;
+  }
+  async markKyberPreKeyUsed(kyberPreKeyId) {
+    this.used.add(kyberPreKeyId);
+    this.state.persist();
+  }
+};
+function makeStores(state) {
+  return {
+    session: new FileSessionStore(state),
+    identity: new FileIdentityStore(state),
+    preKey: new FilePreKeyStore(state),
+    signedPreKey: new FileSignedPreKeyStore(state),
+    kyberPreKey: new FileKyberPreKeyStore(state)
+  };
+}
+
+// packages/omemo/src/libsignal-backend.ts
+function address(peer) {
+  return ProtocolAddress.new(peer.bareJid, peer.deviceId);
+}
+var LibsignalNodeBackend = class {
+  state;
+  stores;
+  localAddress;
+  constructor(state) {
+    this.state = state;
+    this.stores = makeStores(state);
+    this.localAddress = ProtocolAddress.new(state.jid, state.deviceId);
+  }
+  get deviceId() {
+    return this.state.deviceId;
+  }
+  /** The live libsignal stores (#50 recovery builds staged copies over them). */
+  get signalStores() {
+    return this.stores;
+  }
+  bundleElement() {
+    return bundleEl(this.state);
+  }
+  topUpPreKeys() {
+    this.state.topUpPreKeys();
+  }
+  supportsBundle(bundleElement) {
+    return bundleElement.getChild("kyberPreKeys", NS_WACANDO_OMEMO) !== void 0;
+  }
+  async hasSession(peer) {
+    return await this.stores.session.getSession(address(peer)) !== null;
+  }
+  async ensureSession(peer, bundleElement) {
+    const addr = address(peer);
+    if (await this.stores.session.getSession(addr) !== null) return;
+    const { bundle } = parseBundle(bundleElement, peer.deviceId, this.state.jid);
+    try {
+      await processPreKeyBundle(
+        bundle,
+        addr,
+        this.localAddress,
+        this.stores.session,
+        this.stores.identity
+      );
+    } catch (err) {
+      throw new OmemoError(
+        `session establishment failed for ${peer.bareJid}.${peer.deviceId}: ${err.message}`
+      );
+    }
+  }
+  async encrypt(peer, plaintext) {
+    try {
+      const encrypted = await signalEncrypt(
+        plaintext,
+        address(peer),
+        this.localAddress,
+        this.stores.session,
+        this.stores.identity
+      );
+      return {
+        ciphertextB64: b64encode(encrypted.serialize()),
+        isPreKey: encrypted.type() === CiphertextMessageType.PreKey
+      };
+    } catch (err) {
+      throw new OmemoError(
+        `encrypt failed for ${peer.bareJid}.${peer.deviceId}: ${err.message}`
+      );
+    }
+  }
+  async decrypt(peer, ciphertextB64, isPreKey) {
+    const raw = b64decode(ciphertextB64);
+    const addr = address(peer);
+    if (isPreKey && raw[0] === 51 && !await this.hasSession(peer)) {
+      throw new UnsupportedSignalFormatError("classic v3 first-contact format");
+    }
+    const preKeys = new FilePreKeyStore(this.state);
+    const sessions = new ReceiveSessionStore(this.state);
+    try {
+      return isPreKey ? await signalDecryptPreKey(
+        PreKeySignalMessage.deserialize(raw),
+        addr,
+        this.localAddress,
+        sessions,
+        this.stores.identity,
+        preKeys,
+        this.stores.signedPreKey,
+        this.stores.kyberPreKey
+      ) : await signalDecrypt(
+        SignalMessage.deserialize(raw),
+        addr,
+        this.localAddress,
+        sessions,
+        this.stores.identity
+      );
+    } catch (err) {
+      const failure = this.classifyFailure(peer, raw, isPreKey, preKeys.missingLookup);
+      throw new OmemoReceiveError(
+        `decrypt failed for ${peer.bareJid}.${peer.deviceId}: ${err.message}`,
+        failure
+      );
+    }
+  }
+  /**
+   * #50 §3 classification, from typed store signals only (never error text).
+   * `consumed_prekey_candidate` requires: a structurally valid PreKey message,
+   * a library lookup of exactly its one-time prekey that found nothing, a
+   * committed consumption tombstone for that ID, our current signed prekey,
+   * and no conflicting exact-device pin. The message itself stays
+   * unauthenticated — the candidate only allows the signed negotiation.
+   */
+  classifyFailure(peer, raw, isPreKey, missingLookup) {
+    if (!isPreKey) return { kind: "authentication_failed" };
+    let preKeyId;
+    let signedPreKeyId;
+    let claimed;
+    try {
+      const msg = PreKeySignalMessage.deserialize(raw);
+      preKeyId = msg.preKeyId();
+      signedPreKeyId = msg.signedPreKeyId();
+      claimed = preKeyHeaderIdentity(raw);
+    } catch {
+      return { kind: "authentication_failed" };
+    }
+    if (preKeyId === null || !claimed) return { kind: "authentication_failed" };
+    const pin = this.state.identities.get(`${peer.bareJid}.${peer.deviceId}`);
+    if (pin && !bytesEqual(pin.serialize(), claimed)) {
+      return { kind: "untrusted_identity", preKeyId };
+    }
+    if (missingLookup !== preKeyId) {
+      return { kind: "authentication_failed", preKeyId };
+    }
+    if (!this.state.isConsumedPreKey(preKeyId) || signedPreKeyId !== this.state.signedPreKey.id()) {
+      return { kind: "missing_prekey_unknown", preKeyId };
+    }
+    return { kind: "consumed_prekey_candidate", preKeyId, claimedIdentity: claimed };
+  }
+};
+function bytesEqual(a, b) {
+  return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+
+// packages/omemo/src/provider.ts
+import { jid as parseJid } from "@xmpp/jid";
+var OmemoProvider = class {
+  bareJid;
+  backend;
+  /** Serialize ratchet ops per peer session (encrypt/decrypt mutate state). */
+  locks = /* @__PURE__ */ new Map();
+  /** #50 consumed-prekey recovery, when attached (recovery.ts). */
+  recovery;
+  constructor(jid, backend) {
+    this.bareJid = parseJid(jid).bare().toString();
+    this.backend = backend;
+  }
+  get deviceId() {
+    return this.backend.deviceId;
+  }
+  /** This device's public bundle element (what publishBundle sends to PEP). */
+  bundleElement() {
+    return this.backend.bundleElement();
+  }
+  /**
+   * Publish our devicelist (merged + pruned) and this device's bundle via PEP.
+   * Merge keeps other devices of this principal listed (multi-device);
+   * prune drops ids whose bundle node is gone (self-heals stale entries —
+   * a stale id would otherwise block every send fail-closed forever).
+   */
+  async publishBundle(entity, timeoutMs = 1e4) {
+    const existing = await this.deviceIds(entity, this.bareJid, timeoutMs).catch(
+      () => []
+    );
+    const live = [];
+    for (const id of existing) {
+      if (id === this.deviceId) continue;
+      const items = await pepFetchItems(entity, this.bareJid, bundleNode(id), timeoutMs);
+      if (items.length > 0) live.push(id);
+    }
+    const ids = [.../* @__PURE__ */ new Set([...live, this.deviceId])].sort((a, b) => a - b);
+    await this.backend.topUpPreKeys();
+    await pepPublish(
+      entity,
+      this.bareJid,
+      NS_DEVICELIST,
+      PEP_ITEM_ID,
+      deviceListEl(ids),
+      timeoutMs
+    );
+    const published = this.bundleElement();
+    await pepPublish(
+      entity,
+      this.bareJid,
+      bundleNode(this.deviceId),
+      PEP_ITEM_ID,
+      published,
+      timeoutMs
+    );
+    return published;
+  }
+  /** Device ids advertised by `bareJid` (empty when no devicelist node). */
+  async deviceIds(entity, bareJid, timeoutMs) {
+    const payloads = await pepFetchItems(entity, bareJid, NS_DEVICELIST, timeoutMs);
+    for (const el of payloads) {
+      const ids = parseDeviceList(el);
+      if (ids.length > 0) return ids;
+    }
+    return [];
+  }
+  /**
+   * Resolve OMEMO device targets for a member set via PEP — fail closed:
+   * missing devicelist or missing bundle throws OmemoError before any
+   * plaintext is touched. Bundle elements are kept raw: each session
+   * backend parses the flavor it accepts (kyber → PQXDH, else classic).
+   */
+  async resolveDeviceTargets(entity, memberBareJids, timeoutMs = 1e4) {
+    const recipients = [.../* @__PURE__ */ new Set([...memberBareJids, this.bareJid])];
+    const targets = [];
+    for (const member of recipients) {
+      const ids = await this.deviceIds(entity, member, timeoutMs);
+      if (ids.length === 0) {
+        throw new OmemoError(`missing OMEMO devicelist for ${member}`);
+      }
+      for (const deviceId of ids) {
+        if (member === this.bareJid && deviceId === this.deviceId) continue;
+        const items = await pepFetchItems(entity, member, bundleNode(deviceId), timeoutMs);
+        const bundleElement = items[0];
+        if (!bundleElement) {
+          throw new OmemoError(`missing OMEMO bundle for ${member} device ${deviceId}`);
+        }
+        targets.push({ bareJid: member, deviceId, bundleElement });
+      }
+    }
+    return targets;
+  }
+  /**
+   * Encrypt `plaintext` for already-resolved device targets and return the
+   * ready-to-send groupchat stanza Element.
+   */
+  async encryptForTargets(targets, roomJid, plaintext) {
+    const effective = targets.filter(
+      (t) => !(t.bareJid === this.bareJid && t.deviceId === this.deviceId)
+    );
+    if (effective.length === 0) {
+      throw new OmemoError("empty recipient device set");
+    }
+    for (const t of effective) {
+      const peer = { bareJid: t.bareJid, deviceId: t.deviceId };
+      await this.withLock(
+        `${t.bareJid}.${t.deviceId}`,
+        () => this.backend.ensureSession(peer, t.bundleElement, this.bareJid)
+      );
+    }
+    const messageKey = randomBytes(MESSAGE_KEY_BYTES);
+    const iv = randomBytes(GCM_IV_BYTES);
+    const envelope = buildSceEnvelope(plaintext);
+    const key2 = await globalThis.crypto.subtle.importKey(
+      "raw",
+      messageKey,
+      { name: "AES-GCM" },
+      false,
+      ["encrypt"]
+    );
+    const payload = new Uint8Array(
+      await globalThis.crypto.subtle.encrypt(
+        { name: "AES-GCM", iv },
+        key2,
+        new TextEncoder().encode(envelope)
+      )
+    );
+    const keys = [];
+    for (const t of effective) {
+      const peer = { bareJid: t.bareJid, deviceId: t.deviceId };
+      const wrapped = await this.withLock(
+        `${t.bareJid}.${t.deviceId}`,
+        () => this.backend.encrypt(peer, messageKey)
+      );
+      keys.push({
+        rid: t.deviceId,
+        jid: t.bareJid,
+        ciphertextB64: wrapped.ciphertextB64,
+        isPreKey: wrapped.isPreKey
+      });
+    }
+    const el = buildEncryptedMessageEl({
+      roomJid,
+      senderBareJid: this.bareJid,
+      senderDeviceId: this.deviceId,
+      keys,
+      ivB64: b64encode(iv),
+      payloadB64: b64encode(payload)
+    });
+    const stanzaId = el.getAttr("id");
+    if (this.recovery && typeof stanzaId === "string") {
+      for (const k of keys) {
+        if (k.isPreKey)
+          this.recovery.onPreKeySent(
+            { bareJid: k.jid, deviceId: k.rid },
+            stanzaId,
+            k.ciphertextB64,
+            roomJid
+          );
+      }
+    }
+    return el;
+  }
+  /**
+   * Encrypt `plaintext` for every device of every member bare JID
+   * (our other devices included so multi-device senders read sent copies;
+   * the SENDING device itself is excluded — X3DH self-send is undefined).
+   * Returns the ready-to-send groupchat stanza Element.
+   * Throws OmemoError on ANY missing device material — nothing is sent.
+   */
+  async encryptForRoom(entity, roomJid, memberBareJids, plaintext, timeoutMs = 1e4) {
+    const targets = await this.resolveDeviceTargets(entity, memberBareJids, timeoutMs);
+    return this.encryptForTargets(targets, roomJid, plaintext);
+  }
+  /**
+   * Decrypt one stanza (Element or raw XML — raw message or MAM-forwarded).
+   * Returns the SCE-protected body text. Requires transport provenance on
+   * the Element, or a trusted caller-supplied origin. Serialized XML alone
+   * cannot authenticate a sender. Never derive origin from sender claims.
+   * Returns null only when the stanza is not OMEMO-encrypted at all;
+   * every real decryption failure throws OmemoError (fail closed).
+   */
+  async decryptStanza(stanza, origin) {
+    const el = typeof stanza === "string" ? parseXmlDocument(stanza) : stanza;
+    const parsed = parseEncrypted(el);
+    if (!parsed) return null;
+    const source = origin ?? authenticatedMessageOrigin(el);
+    if (!source || source.senderBareJid !== parsed.senderBareJid) {
+      throw new OmemoError("missing or mismatched authenticated sender origin");
+    }
+    const from = el.getAttr("from");
+    if (from !== void 0 && !from.startsWith(`${source.roomJid}/`)) {
+      throw new OmemoError("authenticated room origin mismatch");
+    }
+    const candidates = parsed.keys.filter(
+      (k) => k.rid === this.deviceId && (k.jid === void 0 || k.jid === this.bareJid)
+    );
+    if (candidates.length === 0) {
+      throw new OmemoError(`no key element for device ${this.deviceId}`);
+    }
+    const peer = {
+      bareJid: parsed.senderBareJid,
+      deviceId: parsed.senderDeviceId
+    };
+    const lockKey = `${parsed.senderBareJid}.${parsed.senderDeviceId}`;
+    let lastErr;
+    let messageKey;
+    let commitCandidate;
+    let failed;
+    for (const ours of candidates) {
+      try {
+        messageKey = await this.withLock(lockKey, async () => {
+          try {
+            return await this.backend.decrypt(peer, ours.ciphertextB64, ours.isPreKey);
+          } catch (err) {
+            const viaCandidate = await this.recovery?.decryptCandidate(
+              peer,
+              ours.ciphertextB64,
+              ours.isPreKey
+            );
+            if (viaCandidate) {
+              commitCandidate = viaCandidate.commit;
+              return viaCandidate.key;
+            }
+            throw err;
+          }
+        });
+        break;
+      } catch (err) {
+        lastErr = err;
+        if (err instanceof OmemoReceiveError && !failed)
+          failed = { ciphertextB64: ours.ciphertextB64, failure: err.failure };
+      }
+    }
+    if (!messageKey && failed && this.recovery && authenticatedMessageOrigin(el) === source) {
+      const stanzaId = el.getAttr("id");
+      this.recovery.onReceiveFailure({
+        roomJid: source.roomJid,
+        peer,
+        stanzaId: typeof stanzaId === "string" ? stanzaId : void 0,
+        ciphertextB64: failed.ciphertextB64,
+        failure: failed.failure
+      });
+    }
+    if (!messageKey) {
+      throw lastErr instanceof OmemoError ? lastErr : new OmemoError(
+        `key decryption failed for device ${this.deviceId}: ${lastErr?.message}`
+      );
+    }
+    const ciphertext = b64decode(parsed.payloadB64);
+    if (ciphertext.length < GCM_TAG_BYTES + 1) {
+      throw new OmemoError("payload too short for GCM tag");
+    }
+    const key2 = await globalThis.crypto.subtle.importKey(
+      "raw",
+      messageKey,
+      { name: "AES-GCM" },
+      false,
+      ["decrypt"]
+    );
+    let envelope;
+    try {
+      envelope = new Uint8Array(
+        await globalThis.crypto.subtle.decrypt(
+          { name: "AES-GCM", iv: b64decode(parsed.ivB64) },
+          key2,
+          ciphertext
+        )
+      );
+    } catch {
+      throw new OmemoError("payload authentication failed");
+    }
+    const body = parseSceEnvelope(new TextDecoder().decode(envelope));
+    commitCandidate?.();
+    this.recovery?.onDecrypted(peer);
+    return body;
+  }
+  /** Run `fn` exclusively with every other ratchet operation on this peer device. */
+  exclusive(peer, fn) {
+    return this.withLock(`${peer.bareJid}.${peer.deviceId}`, fn);
+  }
+  /** Serialize async ops per key so concurrent calls never interleave on one ratchet. */
+  async withLock(key2, fn) {
+    const prev = this.locks.get(key2) ?? Promise.resolve();
+    const next = prev.then(fn, fn);
+    this.locks.set(
+      key2,
+      next.catch(() => {
+      })
+    );
+    return next;
+  }
+};
+
+// packages/omemo/src/state.ts
+import { randomInt } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  IdentityKeyPair,
+  KEMKeyPair,
+  KyberPreKeyRecord,
+  PreKeyRecord,
+  PrivateKey,
+  PublicKey as PublicKey2,
+  SessionRecord,
+  SignedPreKeyRecord
+} from "@signalapp/libsignal-client";
+var STATE_VERSION = 1;
+var PREKEY_COUNT = 100;
+var SIGNED_PREKEY_ID = 1;
+var KYBER_PREKEY_ID = 1;
+var DEVICE_ID_MAX = 127;
+function toRanges(ids) {
+  const sorted = [...ids].sort((a, b) => a - b);
+  const out = [];
+  for (const id of sorted) {
+    const last = out[out.length - 1];
+    if (last && id === last[1] + 1) last[1] = id;
+    else out.push([id, id]);
+  }
+  return out;
+}
+function fromRanges(ranges) {
+  const out = /* @__PURE__ */ new Set();
+  if (!Array.isArray(ranges)) throw new Error("corrupt prekey consumption ledger");
+  for (const r of ranges) {
+    if (!Array.isArray(r) || r.length !== 2 || !Number.isSafeInteger(r[0]) || !Number.isSafeInteger(r[1]) || r[0] < 1 || r[1] < r[0] || r[1] > 16777215)
+      throw new Error("corrupt prekey consumption ledger");
+    for (let id = r[0]; id <= r[1]; id++) out.add(id);
+  }
+  return out;
+}
+function b642(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+function unb642(s) {
+  return new Uint8Array(Buffer.from(s, "base64"));
+}
+function defaultStateBaseDir() {
+  return join(homedir(), ".wacando");
+}
+function jidStateDirName(jid) {
+  return jid.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+var DeviceState = class _DeviceState {
+  jid;
+  deviceId;
+  identityKeyPair;
+  signedPreKey;
+  kyberPreKey;
+  preKeys = /* @__PURE__ */ new Map();
+  sessions = /* @__PURE__ */ new Map();
+  identities = /* @__PURE__ */ new Map();
+  /** #50: consumed one-time prekey IDs (tombstones; never key material). */
+  consumedPreKeys = /* @__PURE__ */ new Set();
+  /** #50: IDs below this were allocated before the ledger existed. */
+  ledgerFloor = 1;
+  /**
+   * #50: per-peer generation of AUTHENTICATED receive state. It moves on every
+   * successful decrypt and on every recovery promotion, so a candidate built
+   * on an older view never overwrites a session that has since become healthy.
+   */
+  sessionGenerations = /* @__PURE__ */ new Map();
+  /** #50: bundle publication generation. */
+  publicationGeneration = 0;
+  /** #50: opaque recovery ledger, persisted atomically with everything else. */
+  recoveryLedger;
+  nextPreKeyId = PREKEY_COUNT + 1;
+  stateFile;
+  codec;
+  ephemeral = false;
+  constructor(jid, stateFile, init) {
+    this.jid = jid;
+    this.stateFile = stateFile;
+    this.deviceId = init.deviceId;
+    this.identityKeyPair = init.identityKeyPair;
+    this.signedPreKey = init.signedPreKey;
+    this.kyberPreKey = init.kyberPreKey;
+  }
+  /** Load existing device state or generate a fresh device. */
+  static load(jid, options = {}) {
+    if (options.ephemeral) {
+      const state2 = _DeviceState.generate(jid, "");
+      state2.ephemeral = true;
+      return state2;
+    }
+    const base = options.baseDir ?? process.env.WACANDO_STATE_DIR ?? defaultStateBaseDir();
+    const dir = join(base, jidStateDirName(jid));
+    const codec = options.codec;
+    const plainFile = join(dir, "state.json");
+    const file = codec ? join(dir, "state.enc") : plainFile;
+    mkdirSync(dir, { recursive: true, mode: 448 });
+    chmodSync(dir, 448);
+    if (codec && existsSync(plainFile)) {
+      throw new Error("plaintext device state present where encrypted state is required");
+    }
+    if (existsSync(file)) {
+      const raw = codec ? codec.decode(new Uint8Array(readFileSync(file))) : readFileSync(file, "utf8");
+      const state2 = _DeviceState.deserialize(jid, file, raw);
+      state2.codec = codec;
+      return state2;
+    }
+    const state = _DeviceState.generate(jid, file);
+    state.codec = codec;
+    state.persist();
+    return state;
+  }
+  static generate(jid, file) {
+    const identityKeyPair = IdentityKeyPair.generate();
+    const deviceId = randomInt(1, DEVICE_ID_MAX + 1);
+    const signedPreKeyPair = PrivateKey.generate();
+    const signedPreKey = SignedPreKeyRecord.new(
+      SIGNED_PREKEY_ID,
+      Date.now(),
+      signedPreKeyPair.getPublicKey(),
+      signedPreKeyPair,
+      identityKeyPair.privateKey.sign(signedPreKeyPair.getPublicKey().serialize())
+    );
+    const kyberPair = KEMKeyPair.generate();
+    const kyberPreKey = KyberPreKeyRecord.new(
+      KYBER_PREKEY_ID,
+      Date.now(),
+      kyberPair,
+      identityKeyPair.privateKey.sign(kyberPair.getPublicKey().serialize())
+    );
+    const state = new _DeviceState(jid, file, {
+      deviceId,
+      identityKeyPair,
+      signedPreKey,
+      kyberPreKey
+    });
+    for (let id = 1; id <= PREKEY_COUNT; id++) {
+      const pk = PrivateKey.generate();
+      state.preKeys.set(id, PreKeyRecord.new(id, pk.getPublicKey(), pk));
+    }
+    return state;
+  }
+  static deserialize(jid, file, raw) {
+    const s = JSON.parse(raw);
+    if (s.version !== STATE_VERSION) {
+      throw new Error(`unsupported device-state version ${s.version} at ${file}`);
+    }
+    const state = new _DeviceState(jid, file, {
+      deviceId: s.deviceId,
+      identityKeyPair: IdentityKeyPair.deserialize(unb642(s.identityKeyPair)),
+      signedPreKey: SignedPreKeyRecord.deserialize(unb642(s.signedPreKey)),
+      kyberPreKey: KyberPreKeyRecord.deserialize(unb642(s.kyberPreKey))
+    });
+    for (const [id, rec] of Object.entries(s.preKeys)) {
+      state.preKeys.set(Number(id), PreKeyRecord.deserialize(unb642(rec)));
+    }
+    state.nextPreKeyId = Math.max(
+      PREKEY_COUNT + 1,
+      ...[...state.preKeys.keys()].map((id) => id + 1),
+      s.nextPreKeyId ?? 1
+    );
+    for (const [addr, rec] of Object.entries(s.sessions)) {
+      state.sessions.set(addr, SessionRecord.deserialize(unb642(rec)));
+    }
+    for (const [addr, key2] of Object.entries(s.identities)) {
+      state.identities.set(addr, PublicKey2.deserialize(unb642(key2)));
+    }
+    if (s.consumedPreKeys === void 0) {
+      state.ledgerFloor = state.nextPreKeyId;
+    } else {
+      for (const id of fromRanges(s.consumedPreKeys)) state.consumedPreKeys.add(id);
+      const floor = s.ledgerFloor ?? 1;
+      if (!Number.isSafeInteger(floor) || floor < 1) throw new Error("corrupt prekey ledger floor");
+      state.ledgerFloor = floor;
+    }
+    for (const [addr, gen] of Object.entries(s.sessionGenerations ?? {})) {
+      if (!Number.isSafeInteger(gen) || gen < 0) throw new Error("corrupt session generation");
+      state.sessionGenerations.set(addr, gen);
+    }
+    const pub = s.publicationGeneration ?? 0;
+    if (!Number.isSafeInteger(pub) || pub < 0) throw new Error("corrupt publication generation");
+    state.publicationGeneration = pub;
+    state.recoveryLedger = typeof s.recovery === "string" ? s.recovery : void 0;
+    return state;
+  }
+  /** Has this one-time prekey ID been allocated by this device (ever)? */
+  wasAllocated(id) {
+    return Number.isSafeInteger(id) && id >= 1 && id < this.nextPreKeyId;
+  }
+  /**
+   * #50 classification: was `id` consumed by an authenticated session on
+   * this device, with a committed tombstone? IDs below the ledger floor have
+   * unknown history and never qualify.
+   */
+  isConsumedPreKey(id) {
+    return id >= this.ledgerFloor && this.consumedPreKeys.has(id) && !this.preKeys.has(id);
+  }
+  /** Delete a one-time prekey and commit its tombstone (call persist()). */
+  consumePreKey(id) {
+    this.preKeys.delete(id);
+    if (this.wasAllocated(id)) this.consumedPreKeys.add(id);
+  }
+  /** Bump the authenticated-receive generation of a peer session (promotion fence). */
+  bumpSessionGeneration(address2) {
+    const next = (this.sessionGenerations.get(address2) ?? 0) + 1;
+    this.sessionGenerations.set(address2, next);
+    return next;
+  }
+  sessionGeneration(address2) {
+    return this.sessionGenerations.get(address2) ?? 0;
+  }
+  /** Regenerate consumed one-time prekeys back to PREKEY_COUNT. */
+  topUpPreKeys() {
+    while (this.preKeys.size < PREKEY_COUNT) {
+      const id = this.nextPreKeyId++;
+      if (!Number.isSafeInteger(id) || id > 16777215) {
+        throw new Error("native prekey ID space exhausted");
+      }
+      const pk = PrivateKey.generate();
+      this.preKeys.set(id, PreKeyRecord.new(id, pk.getPublicKey(), pk));
+    }
+    this.persist();
+  }
+  /** Flush all in-memory state to state.json (0600). */
+  persist() {
+    if (this.ephemeral) return;
+    const s = {
+      version: STATE_VERSION,
+      deviceId: this.deviceId,
+      identityKeyPair: b642(this.identityKeyPair.serialize()),
+      signedPreKey: b642(this.signedPreKey.serialize()),
+      kyberPreKey: b642(this.kyberPreKey.serialize()),
+      preKeys: Object.fromEntries(
+        [...this.preKeys].map(([id, r]) => [String(id), b642(r.serialize())])
+      ),
+      nextPreKeyId: this.nextPreKeyId,
+      sessions: Object.fromEntries([...this.sessions].map(([a, r]) => [a, b642(r.serialize())])),
+      identities: Object.fromEntries([...this.identities].map(([a, k]) => [a, b642(k.serialize())])),
+      consumedPreKeys: toRanges(this.consumedPreKeys),
+      ledgerFloor: this.ledgerFloor,
+      sessionGenerations: Object.fromEntries(this.sessionGenerations),
+      publicationGeneration: this.publicationGeneration,
+      ...this.recoveryLedger !== void 0 ? { recovery: this.recoveryLedger } : {}
+    };
+    const tmp = `${this.stateFile}.${process.pid}.tmp`;
+    const text = `${JSON.stringify(s)}
+`;
+    writeFileSync(tmp, this.codec ? this.codec.encode(text) : text, { mode: 384 });
+    renameSync(tmp, this.stateFile);
+    chmodSync(this.stateFile, 384);
+  }
+};
+
+// packages/omemo/src/decryptor.ts
+var OmemoTranscriptDecryptor = class {
+  constructor(provider) {
+    this.provider = provider;
+  }
+  provider;
+  async decrypt(stanzaXml) {
+    try {
+      return await this.provider.decryptStanza(stanzaXml);
+    } catch {
+      return null;
+    }
+  }
+};
+
+// packages/omemo/src/recovery.ts
+import {
+  CiphertextMessageType as CiphertextMessageType2,
+  PreKeySignalMessage as PreKeySignalMessage2,
+  ProtocolAddress as ProtocolAddress2,
+  PublicKey as PublicKey4,
+  processPreKeyBundle as processPreKeyBundle2,
+  SessionRecord as SessionRecord3,
+  SignalMessage as SignalMessage2,
+  signalDecrypt as signalDecrypt2,
+  signalDecryptPreKey as signalDecryptPreKey2,
+  signalEncrypt as signalEncrypt2
+} from "@signalapp/libsignal-client";
+import xml3 from "@xmpp/xml";
+
+// packages/omemo/src/recovery-crypto.ts
+import { createHash } from "node:crypto";
+import {
+  IdentityChange as IdentityChange2,
+  IdentityKeyStore as IdentityKeyStore2,
+  KyberPreKeyStore as KyberPreKeyStore2,
+  PreKeyStore as PreKeyStore2,
+  PublicKey as PublicKey3,
+  SessionRecord as SessionRecord2,
+  SessionStore as SessionStore2,
+  SignedPreKeyStore as SignedPreKeyStore2
+} from "@signalapp/libsignal-client";
+function sha256Hex(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+function fingerprintOf(identity) {
+  return sha256Hex(identity instanceof PublicKey3 ? identity.serialize() : identity);
+}
+function canon(text) {
+  if (text === void 0 || text === "") throw new OmemoError("bundle field missing");
+  return b64encode(b64decode(text));
+}
+function bundleDigest(bundle) {
+  if (bundle.getName() !== "bundle") throw new OmemoError("not an OMEMO bundle");
+  const spk = bundle.getChild("signedPreKeyPublic");
+  const kyber = bundle.getChild("kyberPreKeys", NS_WACANDO_OMEMO);
+  const kpk = kyber?.getChild("kyberPreKeyPublic");
+  const pairs = (bundle.getChild("prekeys")?.getChildren("preKeyPublic") ?? []).map((k) => {
+    const id = Number(k.getAttr("preKeyId"));
+    if (!Number.isSafeInteger(id) || id < 1) throw new OmemoError("bundle prekey id invalid");
+    return [id, canon(k.text())];
+  });
+  pairs.sort((a, b) => a[0] - b[0]);
+  const fields = [
+    "wacando-omemo-bundle-digest-v1",
+    canon(bundle.getChildText("identityKey") ?? void 0),
+    String(Number(spk?.getAttr("signedPreKeyId"))),
+    canon(spk?.text()),
+    canon(bundle.getChildText("signedPreKeySignature") ?? void 0),
+    ...pairs.flatMap(([id, pub]) => [String(id), pub]),
+    "kyber",
+    kyber ? String(Number(kpk?.getAttr("kyberPreKeyId"))) : "",
+    kyber ? canon(kpk?.text()) : "",
+    kyber ? canon(kyber.getChild("kyberPreKeySignature")?.text()) : ""
+  ];
+  return sha256Hex(utf8Encode(JSON.stringify(fields)));
+}
+function bundleIdentity(bundle) {
+  const text = bundle.getChildText("identityKey");
+  if (!text) throw new OmemoError("bundle missing identity");
+  return b64decode(text);
+}
+function bundlePreKeyIds(bundle) {
+  return (bundle.getChild("prekeys")?.getChildren("preKeyPublic") ?? []).map((k) => Number(k.getAttr("preKeyId"))).filter((id) => Number.isSafeInteger(id) && id > 0);
+}
+function controlPlaintext(phase, nonce, prevDigest) {
+  return utf8Encode(JSON.stringify([RECOVERY_DOMAIN, "control", phase, nonce, prevDigest]));
+}
+function bytesEqual2(a, b) {
+  return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+function addressKey(addr) {
+  return `${addr.name()}.${addr.deviceId()}`;
+}
+var StagedStores = class {
+  constructor(state, target, base, expectedIdentity) {
+    this.state = state;
+    this.target = target;
+    this.expectedIdentity = expectedIdentity;
+    this.record = base === null ? null : SessionRecord2.deserialize(
+      typeof base === "string" ? b64decode(base) : base.serialize()
+    );
+    const self = this;
+    const guard = (addr) => {
+      if (addressKey(addr) !== self.target) throw new OmemoError("staged store: foreign address");
+    };
+    this.session = new class extends SessionStore2 {
+      async saveSession(addr, record) {
+        guard(addr);
+        self.record = record;
+      }
+      async getSession(addr) {
+        guard(addr);
+        return self.record;
+      }
+      async getExistingSessions(addrs) {
+        for (const a of addrs) guard(a);
+        return self.record ? [self.record] : [];
+      }
+    }();
+    this.identity = new class extends IdentityKeyStore2 {
+      async getIdentityKey() {
+        return self.state.identityKeyPair.privateKey;
+      }
+      async getLocalRegistrationId() {
+        return self.state.deviceId;
+      }
+      async saveIdentity(addr, pub) {
+        guard(addr);
+        const pin = self.state.identities.get(self.target);
+        if (pin) {
+          if (!pin.equals(pub)) throw new OmemoError("untrusted identity: existing pin differs");
+          return IdentityChange2.NewOrUnchanged;
+        }
+        if (!self.expectedIdentity?.equals(pub)) {
+          throw new OmemoError("untrusted identity: not the expected first-contact identity");
+        }
+        self.stagedPin = pub;
+        return IdentityChange2.NewOrUnchanged;
+      }
+      async isTrustedIdentity(addr, pub, _d) {
+        if (addressKey(addr) !== self.target) return false;
+        const pin = self.state.identities.get(self.target);
+        return pin ? pin.equals(pub) : self.expectedIdentity?.equals(pub) === true;
+      }
+      async getIdentity(addr) {
+        guard(addr);
+        return self.state.identities.get(self.target) ?? self.stagedPin ?? null;
+      }
+    }();
+    this.preKey = new class extends PreKeyStore2 {
+      async savePreKey() {
+        throw new OmemoError("staged store: prekey generation refused");
+      }
+      async getPreKey(id) {
+        const rec = self.removedPreKeys.has(id) ? void 0 : self.state.preKeys.get(id);
+        if (!rec) throw new OmemoError("one-time prekey not found");
+        return rec;
+      }
+      async removePreKey(id) {
+        self.removedPreKeys.add(id);
+      }
+    }();
+    this.signedPreKey = new class extends SignedPreKeyStore2 {
+      async saveSignedPreKey() {
+        throw new OmemoError("staged store: signed prekey write refused");
+      }
+      async getSignedPreKey(id) {
+        if (id !== self.state.signedPreKey.id()) throw new OmemoError("signed prekey not found");
+        return self.state.signedPreKey;
+      }
+    }();
+    this.kyberPreKey = new class extends KyberPreKeyStore2 {
+      async saveKyberPreKey() {
+        throw new OmemoError("staged store: kyber prekey write refused");
+      }
+      async getKyberPreKey(id) {
+        if (id !== self.state.kyberPreKey.id()) throw new OmemoError("kyber prekey not found");
+        return self.state.kyberPreKey;
+      }
+      async markKyberPreKeyUsed() {
+      }
+    }();
+  }
+  state;
+  target;
+  expectedIdentity;
+  record;
+  stagedPin;
+  removedPreKeys = /* @__PURE__ */ new Set();
+  session;
+  identity;
+  preKey;
+  signedPreKey;
+  kyberPreKey;
+  /** The staged record, serialized (endpoint-private, same protection as sessions). */
+  serialized() {
+    if (!this.record) throw new OmemoError("staged store holds no session");
+    return b64encode(this.record.serialize());
+  }
+};
+
+// packages/omemo/src/recovery-first-contact.ts
+var DIRECTORY_FIRST_CONTACT = /* @__PURE__ */ Symbol(
+  "wacando.recovery.directoryFirstContact"
+);
+
+// packages/omemo/src/recovery-machine.ts
+var RECOVERY_LIMITS = {
+  /** Authenticated automatic attempts per local/peer device pair, rolling hour. */
+  attemptsPerPairPerHour: 3,
+  /** Delay before the 1st, 2nd and 3rd attempt of a window (seconds). */
+  attemptDelaysS: [0, 5, 30],
+  jitterMaxMs: 1e3,
+  attemptTtlS: 120,
+  skewS: 30,
+  /** Exact cached packet retransmissions inside the attempt expiry. */
+  retransmitDelaysMs: [2e3, 8e3],
+  offersPerPeerPerHour: 4,
+  offersPerLocalPerMinute: 16,
+  maxUnconfirmedOffers: 16,
+  maxAcceptedAttempts: 16,
+  maxPendingSendsPerPeer: 8,
+  maxPendingSends: 64,
+  /** Failed-packet digests already resolved (recovered or refused as stale). */
+  maxResolvedKeys: 256,
+  /** Cancellation fences kept (oldest dropped; lifecycle + STOP still deny). */
+  maxCancelled: 1024,
+  /** Periodic expiry check, independent of inbound controls. */
+  tickIntervalMs: 15e3
+};
+var HOUR = 3600;
+var MINUTE = 60;
+function emptyLedger() {
+  return {
+    v: 1,
+    attempts: [],
+    spends: [],
+    offers: [],
+    pendingSends: [],
+    backoff: {},
+    cancelled: [],
+    highWater: 0,
+    resolvedKeys: []
+  };
+}
+function parseLedger(raw) {
+  if (raw === void 0) return emptyLedger();
+  const v = JSON.parse(raw);
+  if (v.v !== 1 || !Array.isArray(v.attempts) || !Array.isArray(v.spends) || !Array.isArray(v.offers) || !Array.isArray(v.pendingSends) || typeof v.backoff !== "object" || v.backoff === null || !Array.isArray(v.cancelled) || typeof v.highWater !== "number")
+    throw new Error("corrupt recovery ledger");
+  if (v.resolvedKeys !== void 0 && !Array.isArray(v.resolvedKeys))
+    throw new Error("corrupt recovery ledger");
+  return { ...v, resolvedKeys: v.resolvedKeys ?? [] };
+}
+function markResolved(ledger, keyDigest) {
+  if (ledger.resolvedKeys.includes(keyDigest)) return;
+  ledger.resolvedKeys.push(keyDigest);
+  if (ledger.resolvedKeys.length > RECOVERY_LIMITS.maxResolvedKeys) ledger.resolvedKeys.shift();
+}
+function isResolved(ledger, keyDigest) {
+  return ledger.resolvedKeys.includes(keyDigest);
+}
+function serializeLedger(ledger) {
+  return JSON.stringify(ledger);
+}
+function pairKey(peerJid, peerDevice) {
+  return `${peerJid}#${peerDevice}`;
+}
+var TERMINAL = /* @__PURE__ */ new Set(["recovered", "failed", "cancelled"]);
+function isUnconfirmed(a) {
+  return a.state === "offered";
+}
+function isAccepted(a) {
+  return !TERMINAL.has(a.state) && !isUnconfirmed(a);
+}
+function activeAttempt(ledger, pair) {
+  return ledger.attempts.find(
+    (a) => pairKey(a.peerJid, a.peerDevice) === pair && !TERMINAL.has(a.state)
+  );
+}
+function findAttempt(ledger, nonce) {
+  return ledger.attempts.find((a) => a.nonce === nonce);
+}
+function observeClock(ledger, nowS) {
+  if (nowS + RECOVERY_LIMITS.skewS < ledger.highWater) return false;
+  if (nowS > ledger.highWater) ledger.highWater = nowS;
+  return true;
+}
+function isCancelled(ledger, conversationId) {
+  return ledger.cancelled.includes(conversationId);
+}
+function cancelConversation(ledger, conversationId) {
+  if (!ledger.cancelled.includes(conversationId)) {
+    ledger.cancelled.push(conversationId);
+    if (ledger.cancelled.length > RECOVERY_LIMITS.maxCancelled) ledger.cancelled.shift();
+  }
+  const hit = [];
+  for (const a of ledger.attempts) {
+    if (a.conversationId !== conversationId || a.state === "cancelled") continue;
+    a.state = "cancelled";
+    delete a.cached;
+    a.reason = "not_authorized";
+    hit.push(a);
+  }
+  return hit;
+}
+function prune(ledger, nowS) {
+  ledger.spends = ledger.spends.filter((s) => nowS - s.at < HOUR);
+  ledger.offers = ledger.offers.filter((s) => nowS - s.at < HOUR);
+  ledger.pendingSends = ledger.pendingSends.filter((p) => nowS - p.at < HOUR);
+  ledger.attempts = ledger.attempts.filter(
+    (a) => !TERMINAL.has(a.state) || nowS <= a.expiresAt + RECOVERY_LIMITS.skewS
+  );
+}
+function canOffer(ledger, pair, conversationId, nowS) {
+  if (!observeClock(ledger, nowS)) return { ok: false, reason: "clock" };
+  prune(ledger, nowS);
+  if (isCancelled(ledger, conversationId)) return { ok: false, reason: "cancelled" };
+  if (activeAttempt(ledger, pair)) return { ok: false, reason: "busy" };
+  if ((ledger.backoff[pair] ?? 0) > nowS) return { ok: false, reason: "backoff" };
+  const perPeer = ledger.offers.filter((o) => o.pair === pair).length;
+  const perMinute = ledger.offers.filter((o) => nowS - o.at < MINUTE).length;
+  const unconfirmed = ledger.attempts.filter(isUnconfirmed).length;
+  if (perPeer >= RECOVERY_LIMITS.offersPerPeerPerHour || perMinute >= RECOVERY_LIMITS.offersPerLocalPerMinute || unconfirmed >= RECOVERY_LIMITS.maxUnconfirmedOffers)
+    return { ok: false, reason: "quota" };
+  const spent = ledger.spends.filter((s) => s.pair === pair).length;
+  if (spent >= RECOVERY_LIMITS.attemptsPerPairPerHour) return { ok: false, reason: "quota" };
+  return { ok: true };
+}
+function recordOffer(ledger, attempt, nowS) {
+  ledger.offers.push({ pair: pairKey(attempt.peerJid, attempt.peerDevice), at: nowS });
+  ledger.attempts.push(attempt);
+}
+function canSpend(ledger, pair, conversationId, nowS, except) {
+  if (!observeClock(ledger, nowS)) return { ok: false, reason: "clock" };
+  prune(ledger, nowS);
+  if (isCancelled(ledger, conversationId)) return { ok: false, reason: "cancelled" };
+  const live = ledger.attempts.filter(
+    (a) => pairKey(a.peerJid, a.peerDevice) === pair && !TERMINAL.has(a.state) && a.nonce !== except
+  );
+  if (live.some(
+    (a) => a.state === "awaiting_commit_resolution" || a.state === "recovered_unacknowledged"
+  ))
+    return { ok: false, reason: "fenced" };
+  if (live.length > 0) return { ok: false, reason: "fenced" };
+  const spent = ledger.spends.filter((s) => s.pair === pair).length;
+  const accepted = ledger.attempts.filter((a) => isAccepted(a) && a.nonce !== except).length;
+  if (spent >= RECOVERY_LIMITS.attemptsPerPairPerHour) return { ok: false, reason: "limit" };
+  if (accepted >= RECOVERY_LIMITS.maxAcceptedAttempts) return { ok: false, reason: "limit" };
+  return { ok: true };
+}
+function spend(ledger, pair, nowS) {
+  ledger.spends.push({ pair, at: nowS });
+}
+function scheduleBackoff(ledger, pair, nowS, jitterMs) {
+  const spent = ledger.spends.filter((s) => s.pair === pair && nowS - s.at < HOUR).length;
+  const delays = RECOVERY_LIMITS.attemptDelaysS;
+  const delay = delays[Math.min(spent, delays.length - 1)] ?? 0;
+  const jitter = Math.max(0, Math.min(RECOVERY_LIMITS.jitterMaxMs, jitterMs)) / 1e3;
+  ledger.backoff[pair] = nowS + delay + jitter;
+}
+function classifyInbound(attempt, phase, recordDigest, prevDigest) {
+  if (attempt.state === "cancelled") return "reject";
+  if (attempt.inboundDigest !== "" && recordDigest === attempt.inboundDigest) {
+    return attempt.cached ? "duplicate" : "reject";
+  }
+  const expected = attempt.role === "A" ? { handshaking: "CONFIRM", awaiting_commit_resolution: "COMMITTED" } : { offered: "INIT", confirming: "COMMIT" };
+  if (expected[attempt.state] !== phase) return "reject";
+  if (prevDigest !== attempt.sentDigest) return "reject";
+  return "process";
+}
+function withinValidity(createdAt, expiresAt, nowS) {
+  return expiresAt - createdAt <= RECOVERY_LIMITS.attemptTtlS && createdAt <= nowS + RECOVERY_LIMITS.skewS && nowS <= expiresAt + RECOVERY_LIMITS.skewS;
+}
+function expireAttempts(ledger, nowS, jitterMs) {
+  const out = [];
+  for (const a of ledger.attempts) {
+    if (TERMINAL.has(a.state) || nowS <= a.expiresAt + RECOVERY_LIMITS.skewS) continue;
+    const pair = pairKey(a.peerJid, a.peerDevice);
+    if (a.state === "offered") {
+      a.state = "failed";
+      a.reason = "expired";
+      delete a.cached;
+      scheduleBackoff(ledger, pair, nowS, jitterMs);
+      out.push({ attempt: a, status: "backoff" });
+    } else if (a.state === "handshaking" || a.state === "confirming") {
+      a.state = "failed";
+      a.reason = "expired";
+      delete a.cached;
+      delete a.candidate;
+      scheduleBackoff(ledger, pair, nowS, jitterMs);
+      out.push({ attempt: a, status: "backoff" });
+    } else if (a.state === "awaiting_commit_resolution" && a.reason !== "expired") {
+      a.reason = "expired";
+      delete a.cached;
+      out.push({ attempt: a, status: "needs_attention" });
+    } else if (a.state === "recovered_unacknowledged" && a.reason !== "expired") {
+      a.reason = "expired";
+      delete a.cached;
+    }
+  }
+  return out;
+}
+function compareInitiators(x, y) {
+  const a = utf8Encode(x.jid);
+  const b = utf8Encode(y.jid);
+  const n = Math.min(a.length, b.length);
+  for (let i = 0; i < n; i++) {
+    const d = a[i] - b[i];
+    if (d !== 0) return d < 0 ? -1 : 1;
+  }
+  if (a.length !== b.length) return a.length < b.length ? -1 : 1;
+  if (x.device === y.device) return 0;
+  return x.device < y.device ? -1 : 1;
+}
+function recordPendingSend(ledger, send) {
+  if (ledger.pendingSends.some((p) => p.pair === send.pair && p.keyDigest === send.keyDigest))
+    return;
+  ledger.pendingSends.push(send);
+  const mine = ledger.pendingSends.filter((p) => p.pair === send.pair);
+  if (mine.length > RECOVERY_LIMITS.maxPendingSendsPerPeer) {
+    const drop = mine[0];
+    ledger.pendingSends = ledger.pendingSends.filter((p) => p !== drop);
+  }
+  if (ledger.pendingSends.length > RECOVERY_LIMITS.maxPendingSends) ledger.pendingSends.shift();
+}
+function clearPendingSends(ledger, pair) {
+  ledger.pendingSends = ledger.pendingSends.filter((p) => p.pair !== pair);
+}
+function findPendingSend(ledger, pair, roomJid, stanzaId, keyDigest, preKeyId) {
+  return ledger.pendingSends.find(
+    (p) => p.pair === pair && p.roomJid === roomJid && p.stanzaId === stanzaId && p.keyDigest === keyDigest && p.preKeyId === preKeyId
+  );
+}
+function statusOf(a) {
+  switch (a.state) {
+    case "recovered":
+      return "recovered";
+    case "recovered_unacknowledged":
+      return "recovered";
+    case "cancelled":
+      return "cancelled";
+    case "failed":
+      return a.reason === "expired" || a.reason === "stale" || a.reason === "transport_unavailable" ? "backoff" : "needs_attention";
+    case "awaiting_commit_resolution":
+      return a.reason === "expired" ? "needs_attention" : "recovering";
+    default:
+      return "recovering";
+  }
+}
+
+// packages/omemo/src/recovery.ts
+var NS_STANZA = "urn:ietf:params:xml:ns:xmpp-stanzas";
+var Refused = class extends Error {
+  constructor(condition, reason) {
+    super(reason);
+    this.condition = condition;
+    this.reason = reason;
+  }
+  condition;
+  reason;
+};
+function errorEl(condition) {
+  const type = condition === "resource-constraint" ? "wait" : condition === "not-acceptable" ? "modify" : "cancel";
+  return xml3("error", { type }, xml3(condition, NS_STANZA));
+}
+function conversationOfRoom(roomJid) {
+  const local = roomJid.split("@")[0] ?? "";
+  return /^c_[a-z0-9][a-z0-9_-]{0,63}$/.test(local) ? local.slice(2) : void 0;
+}
+var TRANSIENT = /* @__PURE__ */ new Set([
+  "recipient-unavailable",
+  "remote-server-timeout",
+  "resource-constraint",
+  "internal-server-error"
+]);
+var REFUSAL_REASON = {
+  forbidden: "not_authorized",
+  "not-authorized": "authentication_failed",
+  "not-acceptable": "stale",
+  "service-unavailable": "transport_unavailable",
+  "item-not-found": "transport_unavailable"
+};
+function sameTuple(a, b) {
+  return a.conversationId === b.conversationId && a.roomJid === b.roomJid && a.aJid === b.aJid && a.aDevice === b.aDevice && a.aFingerprint === b.aFingerprint && a.bJid === b.bJid && a.bDevice === b.bDevice && a.bFingerprint === b.bFingerprint && a.nonce === b.nonce && a.createdAt === b.createdAt && a.expiresAt === b.expiresAt && a.consumedPreKeyId === b.consumedPreKeyId && a.stanzaId === b.stanzaId && a.keyDigest === b.keyDigest && a.generation === b.generation && a.bundleDigest === b.bundleDigest;
+}
+var SessionRecovery = class _SessionRecovery {
+  constructor(o) {
+    this.o = o;
+    this.now = o.now ?? (() => Date.now());
+    this.jitter = o.jitter ?? (() => Math.random());
+    this.timeoutMs = o.timeoutMs ?? 1e4;
+    this.setTimer = o.setTimer ?? ((fn, ms) => {
+      const t = setTimeout(fn, ms);
+      t.unref?.();
+      return () => clearTimeout(t);
+    });
+    try {
+      this.ledger = parseLedger(o.backend.state.recoveryLedger);
+    } catch {
+      this.corrupt = true;
+      this.ledger = parseLedger(void 0);
+    }
+  }
+  o;
+  ledger;
+  corrupt = false;
+  detached = false;
+  chain = Promise.resolve();
+  /** Pairs with network work in flight (offer preparation / offer acceptance). */
+  inflight = /* @__PURE__ */ new Set();
+  timers = /* @__PURE__ */ new Set();
+  persistQueued = false;
+  /** Background work in flight (offer preparation, acceptance, sends). */
+  pending = /* @__PURE__ */ new Set();
+  now;
+  setTimer;
+  jitter;
+  timeoutMs;
+  /** Attach to a provider + XMPP entity. One instance per device state at a time. */
+  static attach(options) {
+    const recovery = new _SessionRecovery(options);
+    options.entity.iqCallee.set(NS_RECOVERY, "recovery", (ctx) => recovery.onIq(ctx));
+    options.provider.recovery = recovery;
+    recovery.tick();
+    recovery.armTick();
+    return recovery;
+  }
+  armTick() {
+    if (this.detached) return;
+    const cancel = this.setTimer(() => {
+      this.timers.delete(cancel);
+      this.tick();
+      this.armTick();
+    }, RECOVERY_LIMITS.tickIntervalMs);
+    this.timers.add(cancel);
+  }
+  /**
+   * Resolves once no recovery work is in flight (event-driven barrier for
+   * callers and tests; retransmission timers are not awaited).
+   */
+  async idle() {
+    while (this.pending.size > 0) await Promise.allSettled([...this.pending]);
+  }
+  track(work) {
+    const tracked = work.catch(() => {
+    }).finally(() => this.pending.delete(tracked));
+    this.pending.add(tracked);
+  }
+  /** Stop handling controls (connection replaced). Persisted state is kept. */
+  detach() {
+    this.detached = true;
+    for (const cancel of this.timers) cancel();
+    this.timers.clear();
+    if (this.o.provider.recovery === this) this.o.provider.recovery = void 0;
+  }
+  /** Current attempts (identifiers and states only) — diagnostics/tests. */
+  attempts() {
+    return this.ledger.attempts.map((a) => ({
+      nonce: a.nonce,
+      role: a.role,
+      conversationId: a.conversationId,
+      peerJid: a.peerJid,
+      peerDevice: a.peerDevice,
+      state: a.state,
+      reason: a.reason
+    }));
+  }
+  /** Authoritative attempts spent for a peer device in the rolling hour. */
+  spentFor(peer) {
+    const pair = pairKey(peer.bareJid, peer.deviceId);
+    return this.ledger.spends.filter((s) => s.pair === pair).length;
+  }
+  /**
+   * STOP / revocation / closed: persist the terminal fence NOW (synchronous),
+   * before any further callback, and cancel every attempt of the conversation.
+   */
+  cancelConversation(conversationId) {
+    const hit = cancelConversation(this.ledger, conversationId);
+    this.persist();
+    for (const a of hit) this.emit(a, "cancelled", "not_authorized");
+  }
+  /** Apply expiry (and its statuses) at the current clock. */
+  tick() {
+    if (this.corrupt || this.detached) return;
+    const nowS = this.nowS();
+    if (!observeClock(this.ledger, nowS)) return;
+    const out = expireAttempts(this.ledger, nowS, this.jitterMs());
+    if (out.length > 0) this.persist();
+    for (const { attempt, status } of out) this.emit(attempt, status, attempt.reason);
+  }
+  // ---------------------------------------------------------------- hook
+  onPreKeySent(peer, stanzaId, ciphertextB64, roomJid) {
+    if (this.corrupt || this.detached) return;
+    let preKeyId;
+    let raw;
+    try {
+      raw = b64decode(ciphertextB64);
+      preKeyId = PreKeySignalMessage2.deserialize(raw).preKeyId();
+    } catch {
+      return;
+    }
+    if (preKeyId === null) return;
+    recordPendingSend(this.ledger, {
+      pair: pairKey(peer.bareJid, peer.deviceId),
+      roomJid,
+      stanzaId,
+      keyDigest: sha256Hex(raw),
+      preKeyId,
+      at: this.nowS()
+    });
+    if (!this.persistQueued) {
+      this.persistQueued = true;
+      queueMicrotask(() => {
+        this.persistQueued = false;
+        this.persist();
+      });
+    }
+  }
+  onDecrypted(peer) {
+    if (this.corrupt || this.detached) return;
+    const pair = pairKey(peer.bareJid, peer.deviceId);
+    let changed = this.ledger.pendingSends.some((p) => p.pair === pair);
+    clearPendingSends(this.ledger, pair);
+    for (const a of this.ledger.attempts) {
+      if (pairKey(a.peerJid, a.peerDevice) !== pair || TERMINAL.has(a.state)) continue;
+      if (a.role === "B" && a.state === "recovered_unacknowledged") {
+        a.state = "recovered";
+        changed = true;
+        this.emit(a, "recovered");
+      } else if (a.state === "offered" || a.state === "handshaking" || a.state === "confirming") {
+        a.state = "failed";
+        a.reason = "stale";
+        delete a.cached;
+        delete a.candidate;
+        changed = true;
+        this.emit(a, "recovered", "stale");
+      }
+    }
+    if (changed) this.persist();
+  }
+  onReceiveFailure(info) {
+    this.track(
+      this.startOffer(info).catch(() => {
+        this.log("recovery.offer.error", { peerDevice: info.peer.deviceId });
+      })
+    );
+  }
+  async decryptCandidate(peer, ciphertextB64, isPreKey) {
+    if (this.corrupt || this.detached || isPreKey) return void 0;
+    const pair = pairKey(peer.bareJid, peer.deviceId);
+    const a = this.ledger.attempts.find(
+      (x) => pairKey(x.peerJid, x.peerDevice) === pair && x.role === "A" && x.state === "awaiting_commit_resolution" && x.candidate !== void 0
+    );
+    if (!a?.candidate) return void 0;
+    if (isCancelled(this.ledger, a.conversationId) || this.o.lifecycle(a.conversationId) !== "active")
+      return void 0;
+    const key2 = `${peer.bareJid}.${peer.deviceId}`;
+    const staged = new StagedStores(this.state, key2, a.candidate);
+    let plaintext;
+    try {
+      plaintext = await signalDecrypt2(
+        SignalMessage2.deserialize(b64decode(ciphertextB64)),
+        ProtocolAddress2.new(peer.bareJid, peer.deviceId),
+        this.localAddress(),
+        staged.session,
+        staged.identity
+      );
+    } catch {
+      return void 0;
+    }
+    if (this.state.sessionGeneration(key2) !== a.candidateBaseGeneration || !staged.record) {
+      a.reason = "state";
+      this.persist();
+      this.emit(a, "needs_attention", "state");
+      return void 0;
+    }
+    const record = staged.record;
+    const commit = () => {
+      if (a.state !== "awaiting_commit_resolution" || this.state.sessionGeneration(key2) !== a.candidateBaseGeneration || !this.allowed(a.conversationId))
+        return;
+      this.promote(key2, record);
+      this.finishInitiator(a, pair);
+    };
+    return { key: plaintext, commit };
+  }
+  // ------------------------------------------------------------- B: OFFER
+  async startOffer(info) {
+    if (this.corrupt || this.detached) return;
+    const conversationId = conversationOfRoom(info.roomJid);
+    if (!conversationId) return;
+    const { peer, failure } = info;
+    const pair = pairKey(peer.bareJid, peer.deviceId);
+    if (failure.kind === "untrusted_identity" || failure.kind === "missing_prekey_unknown") {
+      this.emitRaw(conversationId, peer, "receiver", "needs_attention", failure.kind);
+      return;
+    }
+    if (failure.kind !== "consumed_prekey_candidate" || failure.preKeyId === void 0) return;
+    const claimed = failure.claimedIdentity;
+    if (!claimed || !info.stanzaId || !/^[A-Za-z0-9_.:-]{1,64}$/.test(info.stanzaId)) return;
+    if (this.inflight.has(pair) || !this.allowed(conversationId)) return;
+    this.tick();
+    if (isResolved(this.ledger, sha256Hex(b64decode(info.ciphertextB64)))) return;
+    const gate = canOffer(this.ledger, pair, conversationId, this.nowS());
+    if (!gate.ok) {
+      if (gate.reason === "quota" || gate.reason === "clock")
+        this.emitRaw(
+          conversationId,
+          peer,
+          "receiver",
+          "needs_attention",
+          gate.reason === "clock" ? "clock" : "limit"
+        );
+      else if (gate.reason === "backoff") this.emitRaw(conversationId, peer, "receiver", "backoff");
+      return;
+    }
+    this.inflight.add(pair);
+    try {
+      const key2 = `${peer.bareJid}.${peer.deviceId}`;
+      const pin = this.state.identities.get(key2);
+      let peerIdentity;
+      if (pin) {
+        if (!bytesEqual2(pin.serialize(), claimed)) {
+          this.emitRaw(conversationId, peer, "receiver", "needs_attention", "untrusted_identity");
+          return;
+        }
+      } else if (this.o[DIRECTORY_FIRST_CONTACT] !== true) {
+        this.emitRaw(conversationId, peer, "receiver", "needs_attention", "first_contact");
+        return;
+      } else {
+        const items = await pepFetchItems(
+          this.o.entity,
+          peer.bareJid,
+          bundleNode(peer.deviceId),
+          this.timeoutMs
+        );
+        const advertised = items[0];
+        if (!advertised || advertised.getChild("kyberPreKeys", NS_WACANDO_OMEMO) === void 0 || !bytesEqual2(bundleIdentity(advertised), claimed)) {
+          this.emitRaw(conversationId, peer, "receiver", "needs_attention", "untrusted_identity");
+          return;
+        }
+        peerIdentity = b64encode(claimed);
+      }
+      const published = await this.o.provider.publishBundle(this.o.entity, this.timeoutMs);
+      if (this.detached || !this.allowed(conversationId)) return;
+      const again = canOffer(this.ledger, pair, conversationId, this.nowS());
+      if (!again.ok) return;
+      this.state.publicationGeneration += 1;
+      const nowS = this.nowS();
+      const record = {
+        phase: "OFFER",
+        conversationId,
+        roomJid: info.roomJid,
+        aJid: peer.bareJid,
+        aDevice: peer.deviceId,
+        aFingerprint: fingerprintOf(claimed),
+        bJid: this.o.provider.bareJid,
+        bDevice: this.state.deviceId,
+        bFingerprint: this.ownFingerprint(),
+        nonce: Buffer.from(randomBytes(32)).toString("hex"),
+        createdAt: nowS,
+        expiresAt: nowS + RECOVERY_LIMITS.attemptTtlS,
+        consumedPreKeyId: failure.preKeyId,
+        stanzaId: info.stanzaId,
+        keyDigest: sha256Hex(b64decode(info.ciphertextB64)),
+        generation: this.state.publicationGeneration,
+        bundleDigest: bundleDigest(published),
+        prevDigest: "",
+        ctlDigest: "",
+        selectedPreKeyId: null
+      };
+      const { packet, digest } = this.sign(record);
+      const attempt = {
+        nonce: record.nonce,
+        role: "B",
+        conversationId,
+        roomJid: info.roomJid,
+        peerJid: peer.bareJid,
+        peerDevice: peer.deviceId,
+        state: "offered",
+        createdAt: record.createdAt,
+        expiresAt: record.expiresAt,
+        consumedPreKeyId: record.consumedPreKeyId,
+        stanzaId: record.stanzaId,
+        keyDigest: record.keyDigest,
+        sentDigest: digest,
+        inboundDigest: "",
+        cached: packet,
+        offerRecordB64: packet.recordB64,
+        bundleDigest: record.bundleDigest,
+        generation: record.generation,
+        retransmits: 0,
+        ...peerIdentity ? { peerIdentity } : {}
+      };
+      recordOffer(this.ledger, attempt, nowS);
+      this.persist();
+      this.log("recovery.offer", { conversation: conversationId, peerDevice: peer.deviceId });
+      this.emit(attempt, "recovering");
+      this.track(this.transmit(attempt));
+    } finally {
+      this.inflight.delete(pair);
+    }
+  }
+  // --------------------------------------------------------------- inbound
+  async onIq(ctx) {
+    if (this.detached) return errorEl("service-unavailable");
+    if (ctx.stanza.attrs.from !== this.o.policyJid) {
+      this.log("recovery.refused", { reason: "source" });
+      return errorEl("not-authorized");
+    }
+    const element = ctx.stanza.getChild("recovery", NS_RECOVERY);
+    if (!element) return errorEl("not-acceptable");
+    const parsed = parseRecoveryEl(element, true);
+    if (!parsed.ok) {
+      this.log("recovery.refused", { reason: parsed.reason });
+      return errorEl("not-acceptable");
+    }
+    const after = [];
+    try {
+      await this.serial(() => this.handle(parsed.control, after));
+    } catch (err) {
+      const refusal = err instanceof Refused ? err : new Refused("not-acceptable", "error");
+      this.log("recovery.refused", {
+        phase: parsed.control.record.phase,
+        reason: refusal.reason
+      });
+      return errorEl(refusal.condition);
+    }
+    for (const fn of after) queueMicrotask(fn);
+    return xml3("recovered", { xmlns: NS_RECOVERY });
+  }
+  async handle(c, after) {
+    if (this.corrupt) throw new Refused("service-unavailable", "state");
+    const r = c.record;
+    const origin = c.originJid?.split("/")[0];
+    if (origin !== signerJid(r)) throw new Refused("not-authorized", "origin");
+    const self = this.o.provider.bareJid;
+    const mine = signerRole(r.phase) === "B" ? r.aJid === self && r.aDevice === this.state.deviceId : r.bJid === self && r.bDevice === this.state.deviceId;
+    if (!mine) throw new Refused("not-acceptable", "target");
+    if (!this.allowed(r.conversationId)) throw new Refused("forbidden", "lifecycle");
+    const nowS = this.nowS();
+    if (!observeClock(this.ledger, nowS)) throw new Refused("resource-constraint", "clock");
+    this.tick();
+    if (!withinValidity(r.createdAt, r.expiresAt, nowS))
+      throw new Refused("not-acceptable", "expired");
+    if (c.ctl && sha256Hex(c.ctl) !== r.ctlDigest)
+      throw new Refused("not-acceptable", "ctl-digest");
+    const digest = sha256Hex(c.recordBytes);
+    switch (r.phase) {
+      case "OFFER":
+        return this.onOffer(c, digest, after);
+      case "INIT":
+        return this.onInit(c, digest, after);
+      case "CONFIRM":
+        return this.onConfirm(c, digest, after);
+      case "COMMIT":
+        return this.onCommit(c, digest, after);
+      case "COMMITTED":
+        return this.onCommitted(c, digest);
+    }
+  }
+  /** Signature by the exact pinned (or B's TOFU-expected) identity of the signer. */
+  verify(c, identity, fingerprint) {
+    if (!identity || fingerprintOf(identity) !== fingerprint)
+      throw new Refused("not-authorized", "signer");
+    let ok = false;
+    try {
+      ok = identity.verify(c.recordBytes, c.signature);
+    } catch {
+      ok = false;
+    }
+    if (!ok) throw new Refused("not-authorized", "signature");
+    const ownFp = this.ownFingerprint();
+    const r = c.record;
+    if ((signerRole(r.phase) === "B" ? r.aFingerprint : r.bFingerprint) !== ownFp)
+      throw new Refused("not-acceptable", "own-identity");
+  }
+  offerOf(a) {
+    const parsed = a.offerRecordB64 ? parseRecord(b64decode(a.offerRecordB64)) : void 0;
+    if (!parsed?.ok) throw new Refused("not-acceptable", "state");
+    return parsed.record;
+  }
+  /** Inbound phase against our attempt: duplicates only re-send the cached answer. */
+  expect(c, digest, role) {
+    const a = findAttempt(this.ledger, c.record.nonce);
+    if (!a || a.role !== role) throw new Refused("not-acceptable", "unknown-attempt");
+    const cls = classifyInbound(a, c.record.phase, digest, c.record.prevDigest);
+    if (cls === "duplicate") return null;
+    if (cls === "reject") {
+      if (a.state === "recovered" && a.inboundDigest === digest) return null;
+      throw new Refused("not-acceptable", "unexpected-phase");
+    }
+    if (!sameTuple(this.offerOf(a), c.record)) throw new Refused("not-acceptable", "tuple");
+    if (c.record.phase !== "OFFER" && c.record.selectedPreKeyId !== (a.selectedPreKeyId ?? c.record.selectedPreKeyId))
+      throw new Refused("not-acceptable", "selected");
+    return a;
+  }
+  duplicate(c, after) {
+    const a = findAttempt(this.ledger, c.record.nonce);
+    if (a?.cached && a.retransmits < RECOVERY_LIMITS.retransmitDelaysMs.length) {
+      a.retransmits += 1;
+      this.persist();
+      after.push(() => this.track(this.transmit(a, false)));
+    }
+  }
+  // A side ---------------------------------------------------------------
+  async onOffer(c, digest, after) {
+    const r = c.record;
+    const peer = { bareJid: r.bJid, deviceId: r.bDevice };
+    const key2 = `${r.bJid}.${r.bDevice}`;
+    const pair = pairKey(r.bJid, r.bDevice);
+    this.verify(c, this.state.identities.get(key2), r.bFingerprint);
+    const existing = findAttempt(this.ledger, r.nonce);
+    if (existing) {
+      if (existing.role === "A" && existing.inboundDigest === digest)
+        return this.duplicate(c, after);
+      throw new Refused("not-acceptable", "nonce-reuse");
+    }
+    if (this.inflight.has(pair)) throw new Refused("resource-constraint", "busy");
+    if (!findPendingSend(this.ledger, pair, r.roomJid, r.stanzaId, r.keyDigest, r.consumedPreKeyId))
+      throw new Refused("not-acceptable", "stale");
+    const own = activeAttempt(this.ledger, pair);
+    if (own) {
+      const weInitiate = { jid: this.o.provider.bareJid, device: this.state.deviceId };
+      const theyInitiate = { jid: r.bJid, device: r.bDevice };
+      if (own.role === "B" && own.state === "offered" && compareInitiators(weInitiate, theyInitiate) < 0) {
+        own.state = "failed";
+        own.reason = "stale";
+        delete own.cached;
+        this.persist();
+      } else throw new Refused("not-acceptable", "fenced");
+    }
+    const gate = canSpend(this.ledger, pair, r.conversationId, this.nowS());
+    if (!gate.ok)
+      throw new Refused(
+        gate.reason === "limit" ? "resource-constraint" : "not-acceptable",
+        gate.reason
+      );
+    this.inflight.add(pair);
+    after.push(() => {
+      this.track(this.acceptOffer(c, digest, peer).finally(() => this.inflight.delete(pair)));
+    });
+  }
+  async acceptOffer(c, digest, peer) {
+    const r = c.record;
+    const key2 = `${peer.bareJid}.${peer.deviceId}`;
+    const pair = pairKey(peer.bareJid, peer.deviceId);
+    let bundle;
+    try {
+      bundle = (await pepFetchItems(this.o.entity, r.bJid, bundleNode(r.bDevice), this.timeoutMs))[0];
+    } catch {
+      bundle = void 0;
+    }
+    const pin = this.state.identities.get(key2);
+    if (!bundle || !pin || bundle.getChild("kyberPreKeys", NS_WACANDO_OMEMO) === void 0 || bundleDigest(bundle) !== r.bundleDigest || !bytesEqual2(bundleIdentity(bundle), pin.serialize())) {
+      this.log("recovery.offer.rejected", { reason: "bundle", peerDevice: peer.deviceId });
+      return;
+    }
+    const ids = bundlePreKeyIds(bundle).filter((id) => id !== r.consumedPreKeyId);
+    if (ids.length === 0) return;
+    const selected = ids[Number.parseInt(r.nonce.slice(0, 8), 16) % ids.length];
+    await this.serial(async () => {
+      if (this.detached || !this.allowed(r.conversationId) || findAttempt(this.ledger, r.nonce))
+        return;
+      if (!findPendingSend(this.ledger, pair, r.roomJid, r.stanzaId, r.keyDigest, r.consumedPreKeyId))
+        return;
+      this.tick();
+      const gate = canSpend(this.ledger, pair, r.conversationId, this.nowS());
+      if (!gate.ok) return;
+      spend(this.ledger, pair, this.nowS());
+      const a = {
+        nonce: r.nonce,
+        role: "A",
+        conversationId: r.conversationId,
+        roomJid: r.roomJid,
+        peerJid: r.bJid,
+        peerDevice: r.bDevice,
+        state: "handshaking",
+        createdAt: r.createdAt,
+        expiresAt: r.expiresAt,
+        consumedPreKeyId: r.consumedPreKeyId,
+        stanzaId: r.stanzaId,
+        keyDigest: r.keyDigest,
+        sentDigest: "",
+        inboundDigest: digest,
+        offerRecordB64: c.packet.recordB64,
+        selectedPreKeyId: selected,
+        retransmits: 0
+      };
+      this.ledger.attempts.push(a);
+      this.persist();
+      this.emit(a, "recovering");
+      try {
+        await this.o.provider.exclusive(peer, async () => {
+          const staged = new StagedStores(this.state, key2, this.state.sessions.get(key2) ?? null);
+          const addr = ProtocolAddress2.new(peer.bareJid, peer.deviceId);
+          const parsed = parseBundle(bundle, peer.deviceId, "", selected);
+          await processPreKeyBundle2(
+            parsed.bundle,
+            addr,
+            this.localAddress(),
+            staged.session,
+            staged.identity
+          );
+          const probe = await signalEncrypt2(
+            controlPlaintext("INIT", r.nonce, digest),
+            addr,
+            this.localAddress(),
+            staged.session,
+            staged.identity
+          );
+          if (probe.type() !== CiphertextMessageType2.PreKey)
+            throw new Error("probe is not a PreKey message");
+          const ctl = probe.serialize();
+          a.candidate = staged.serialized();
+          a.candidateBaseGeneration = this.state.sessionGeneration(key2);
+          const signed = this.sign(
+            {
+              ...r,
+              phase: "INIT",
+              prevDigest: digest,
+              ctlDigest: sha256Hex(ctl),
+              selectedPreKeyId: selected
+            },
+            ctl
+          );
+          a.sentDigest = signed.digest;
+          a.cached = signed.packet;
+        });
+      } catch {
+        this.fail(a, "authentication_failed");
+        return;
+      }
+      if (isCancelled(this.ledger, a.conversationId)) return;
+      this.persist();
+      this.log("recovery.init", { conversation: a.conversationId, peerDevice: a.peerDevice });
+      this.track(this.transmit(a));
+    });
+  }
+  async onConfirm(c, digest, after) {
+    const r = c.record;
+    const a = this.expect(c, digest, "A");
+    if (!a) return this.duplicate(c, after);
+    const key2 = `${r.bJid}.${r.bDevice}`;
+    this.verify(c, this.state.identities.get(key2), r.bFingerprint);
+    const peer = { bareJid: r.bJid, deviceId: r.bDevice };
+    await this.o.provider.exclusive(peer, async () => {
+      const staged = new StagedStores(this.state, key2, a.candidate ?? null);
+      const addr = ProtocolAddress2.new(peer.bareJid, peer.deviceId);
+      let plain;
+      try {
+        plain = await signalDecrypt2(
+          SignalMessage2.deserialize(c.ctl),
+          addr,
+          this.localAddress(),
+          staged.session,
+          staged.identity
+        );
+      } catch {
+        throw new Refused("not-acceptable", "ctl-auth");
+      }
+      if (!bytesEqual2(plain, controlPlaintext("CONFIRM", r.nonce, r.prevDigest)))
+        throw new Refused("not-acceptable", "ctl-context");
+      const commit = await signalEncrypt2(
+        controlPlaintext("COMMIT", r.nonce, digest),
+        addr,
+        this.localAddress(),
+        staged.session,
+        staged.identity
+      );
+      const ctl = commit.serialize();
+      if (!this.allowed(a.conversationId)) throw new Refused("forbidden", "lifecycle");
+      const signed = this.sign(
+        { ...r, phase: "COMMIT", prevDigest: digest, ctlDigest: sha256Hex(ctl) },
+        ctl
+      );
+      a.candidate = staged.serialized();
+      a.state = "awaiting_commit_resolution";
+      a.inboundDigest = digest;
+      a.sentDigest = signed.digest;
+      a.cached = signed.packet;
+      a.retransmits = 0;
+      this.persist();
+    });
+    after.push(() => this.track(this.transmit(a)));
+  }
+  async onCommitted(c, digest) {
+    const r = c.record;
+    const a = this.expect(c, digest, "A");
+    if (!a) return;
+    const key2 = `${r.bJid}.${r.bDevice}`;
+    this.verify(c, this.state.identities.get(key2), r.bFingerprint);
+    const peer = { bareJid: r.bJid, deviceId: r.bDevice };
+    await this.o.provider.exclusive(peer, async () => {
+      if (a.state !== "awaiting_commit_resolution") return;
+      const staged = new StagedStores(this.state, key2, a.candidate ?? null);
+      let plain;
+      try {
+        plain = await signalDecrypt2(
+          SignalMessage2.deserialize(c.ctl),
+          ProtocolAddress2.new(peer.bareJid, peer.deviceId),
+          this.localAddress(),
+          staged.session,
+          staged.identity
+        );
+      } catch {
+        throw new Refused("not-acceptable", "ctl-auth");
+      }
+      if (!bytesEqual2(plain, controlPlaintext("COMMITTED", r.nonce, r.prevDigest)))
+        throw new Refused("not-acceptable", "ctl-context");
+      if (this.state.sessionGeneration(key2) !== a.candidateBaseGeneration || !staged.record) {
+        a.reason = "state";
+        this.persist();
+        this.emit(a, "needs_attention", "state");
+        throw new Refused("not-acceptable", "generation");
+      }
+      if (!this.allowed(a.conversationId)) throw new Refused("forbidden", "lifecycle");
+      a.inboundDigest = digest;
+      this.promote(key2, staged.record);
+      this.finishInitiator(a, pairKey(r.bJid, r.bDevice));
+    });
+  }
+  // B side ---------------------------------------------------------------
+  async onInit(c, digest, after) {
+    const r = c.record;
+    const a = this.expect(c, digest, "B");
+    if (!a) return this.duplicate(c, after);
+    const key2 = `${r.aJid}.${r.aDevice}`;
+    const pin = this.state.identities.get(key2);
+    const expected = pin ?? (a.peerIdentity ? PublicKey4.deserialize(b64decode(a.peerIdentity)) : void 0);
+    this.verify(c, expected, r.aFingerprint);
+    const selected = r.selectedPreKeyId;
+    const pair = pairKey(r.aJid, r.aDevice);
+    const gate = canSpend(this.ledger, pair, r.conversationId, this.nowS(), a.nonce);
+    if (!gate.ok) throw new Refused("resource-constraint", gate.reason);
+    spend(this.ledger, pair, this.nowS());
+    a.inboundDigest = digest;
+    a.selectedPreKeyId = selected;
+    a.state = "confirming";
+    delete a.cached;
+    this.persist();
+    const reserved = this.ledger.attempts.some(
+      (x) => x !== a && x.role === "B" && !TERMINAL.has(x.state) && x.selectedPreKeyId === selected
+    );
+    if (!this.state.preKeys.has(selected) || reserved) {
+      this.fail(a, "stale");
+      throw new Refused("not-acceptable", "selected-gone");
+    }
+    const peer = { bareJid: r.aJid, deviceId: r.aDevice };
+    try {
+      await this.o.provider.exclusive(peer, async () => {
+        const ctl = c.ctl;
+        const msg = PreKeySignalMessage2.deserialize(ctl);
+        const header = preKeyHeaderIdentity(ctl);
+        if (msg.preKeyId() !== selected) throw new Refused("not-acceptable", "probe-key");
+        if (!header || !expected || !bytesEqual2(header, expected.serialize()))
+          throw new Refused("not-acceptable", "probe-header");
+        const staged = new StagedStores(
+          this.state,
+          key2,
+          this.state.sessions.get(key2) ?? null,
+          pin ? void 0 : expected
+        );
+        const addr = ProtocolAddress2.new(peer.bareJid, peer.deviceId);
+        const plain = await signalDecryptPreKey2(
+          msg,
+          addr,
+          this.localAddress(),
+          staged.session,
+          staged.identity,
+          staged.preKey,
+          staged.signedPreKey,
+          staged.kyberPreKey
+        );
+        if (!bytesEqual2(plain, controlPlaintext("INIT", r.nonce, r.prevDigest)))
+          throw new Refused("not-acceptable", "probe-context");
+        if (staged.removedPreKeys.size !== 1 || !staged.removedPreKeys.has(selected))
+          throw new Refused("not-acceptable", "probe-consumed");
+        const confirm = await signalEncrypt2(
+          controlPlaintext("CONFIRM", r.nonce, digest),
+          addr,
+          this.localAddress(),
+          staged.session,
+          staged.identity
+        );
+        const out = confirm.serialize();
+        if (isCancelled(this.ledger, a.conversationId)) throw new Error("cancelled");
+        const signed = this.sign(
+          { ...r, phase: "CONFIRM", prevDigest: digest, ctlDigest: sha256Hex(out) },
+          out
+        );
+        this.state.consumePreKey(selected);
+        if (staged.stagedPin) this.state.identities.set(key2, staged.stagedPin);
+        a.candidate = staged.serialized();
+        a.candidateBaseGeneration = this.state.sessionGeneration(key2);
+        a.sentDigest = signed.digest;
+        a.cached = signed.packet;
+        a.retransmits = 0;
+        this.persist();
+      });
+    } catch (err) {
+      this.fail(a, "authentication_failed");
+      throw err instanceof Refused ? err : new Refused("not-acceptable", "probe");
+    }
+    this.log("recovery.confirm", { conversation: a.conversationId, peerDevice: a.peerDevice });
+    after.push(() => this.track(this.transmit(a)));
+  }
+  async onCommit(c, digest, after) {
+    const r = c.record;
+    const a = this.expect(c, digest, "B");
+    if (!a) return this.duplicate(c, after);
+    const key2 = `${r.aJid}.${r.aDevice}`;
+    this.verify(c, this.state.identities.get(key2), r.aFingerprint);
+    const peer = { bareJid: r.aJid, deviceId: r.aDevice };
+    await this.o.provider.exclusive(peer, async () => {
+      const staged = new StagedStores(this.state, key2, a.candidate ?? null);
+      const addr = ProtocolAddress2.new(peer.bareJid, peer.deviceId);
+      let plain;
+      try {
+        plain = await signalDecrypt2(
+          SignalMessage2.deserialize(c.ctl),
+          addr,
+          this.localAddress(),
+          staged.session,
+          staged.identity
+        );
+      } catch {
+        throw new Refused("not-acceptable", "ctl-auth");
+      }
+      if (!bytesEqual2(plain, controlPlaintext("COMMIT", r.nonce, r.prevDigest)))
+        throw new Refused("not-acceptable", "ctl-context");
+      if (this.state.sessionGeneration(key2) !== a.candidateBaseGeneration || !staged.record) {
+        this.fail(a, "state");
+        throw new Refused("not-acceptable", "generation");
+      }
+      if (isCancelled(this.ledger, a.conversationId) || !this.allowed(a.conversationId))
+        throw new Refused("forbidden", "lifecycle");
+      this.promote(key2, staged.record);
+      const stores = this.o.backend.signalStores;
+      const committed = await signalEncrypt2(
+        controlPlaintext("COMMITTED", r.nonce, digest),
+        addr,
+        this.localAddress(),
+        stores.session,
+        stores.identity
+      );
+      const out = committed.serialize();
+      const signed = this.sign(
+        { ...r, phase: "COMMITTED", prevDigest: digest, ctlDigest: sha256Hex(out) },
+        out
+      );
+      delete a.candidate;
+      markResolved(this.ledger, a.keyDigest);
+      a.state = "recovered_unacknowledged";
+      a.inboundDigest = digest;
+      a.sentDigest = signed.digest;
+      a.cached = signed.packet;
+      a.retransmits = 0;
+      this.persist();
+      this.emit(a, "recovered");
+    });
+    after.push(() => this.track(this.transmit(a)));
+  }
+  // --------------------------------------------------------------- helpers
+  get state() {
+    return this.o.backend.state;
+  }
+  localAddress() {
+    return ProtocolAddress2.new(this.o.provider.bareJid, this.state.deviceId);
+  }
+  ownFingerprint() {
+    return fingerprintOf(this.state.identityKeyPair.publicKey);
+  }
+  nowS() {
+    return Math.floor(this.now() / 1e3);
+  }
+  jitterMs() {
+    return Math.floor(Math.min(0.999, Math.max(0, this.jitter())) * RECOVERY_LIMITS.jitterMaxMs);
+  }
+  allowed(conversationId) {
+    return !isCancelled(this.ledger, conversationId) && this.o.lifecycle(conversationId) === "active";
+  }
+  sign(record, ctl) {
+    const bytes = encodeRecord(record);
+    const sig = this.state.identityKeyPair.privateKey.sign(bytes);
+    return {
+      packet: {
+        recordB64: b64encode(bytes),
+        sigB64: b64encode(sig),
+        ...ctl ? { ctlB64: b64encode(ctl) } : {}
+      },
+      digest: sha256Hex(bytes)
+    };
+  }
+  /** Promote a candidate into the live store (generation moves; old states stay archived). */
+  promote(key2, record) {
+    this.state.sessions.set(
+      key2,
+      SessionRecord3.deserialize(record.serialize())
+    );
+    this.state.bumpSessionGeneration(key2);
+  }
+  finishInitiator(a, pair) {
+    const uncertain = [
+      .../* @__PURE__ */ new Set([
+        a.stanzaId,
+        ...this.ledger.pendingSends.filter((p) => p.pair === pair).map((p) => p.stanzaId)
+      ])
+    ];
+    a.state = "recovered";
+    delete a.candidate;
+    delete a.cached;
+    clearPendingSends(this.ledger, pair);
+    this.persist();
+    this.log("recovery.recovered", { conversation: a.conversationId, peerDevice: a.peerDevice });
+    this.emit(a, "recovered", void 0, uncertain);
+  }
+  fail(a, reason) {
+    if (a.role === "B" && reason === "stale") markResolved(this.ledger, a.keyDigest);
+    a.state = "failed";
+    a.reason = reason;
+    delete a.cached;
+    delete a.candidate;
+    scheduleBackoff(this.ledger, pairKey(a.peerJid, a.peerDevice), this.nowS(), this.jitterMs());
+    this.persist();
+    this.emit(a, statusOf(a), reason);
+  }
+  persist() {
+    if (this.detached) return;
+    this.state.recoveryLedger = serializeLedger(this.ledger);
+    this.state.persist();
+  }
+  serial(fn) {
+    const next = this.chain.then(fn, fn);
+    this.chain = next.catch(() => {
+    });
+    return next;
+  }
+  /** Send our cached packet through the component; bounded retransmission on transport errors only. */
+  async transmit(a, schedule = true) {
+    const packet = a.cached;
+    if (!packet || this.detached || isCancelled(this.ledger, a.conversationId)) return;
+    try {
+      await this.o.entity.iqCaller.set(buildRecoveryEl(packet), this.o.policyJid, this.timeoutMs);
+    } catch (err) {
+      const condition = err?.condition;
+      const transient = condition === void 0 || TRANSIENT.has(condition);
+      if (a.cached !== packet || this.detached) return;
+      if (!transient) {
+        if (a.state === "offered" || a.state === "handshaking" || a.state === "confirming") {
+          this.fail(a, REFUSAL_REASON[condition] ?? "authentication_failed");
+        }
+        return;
+      }
+      if (!schedule || a.retransmits >= RECOVERY_LIMITS.retransmitDelaysMs.length) return;
+      if (this.nowS() > a.expiresAt) return;
+      const delay = RECOVERY_LIMITS.retransmitDelaysMs[a.retransmits];
+      a.retransmits += 1;
+      this.persist();
+      const cancel = this.setTimer(() => {
+        this.timers.delete(cancel);
+        this.track(this.transmit(a));
+      }, delay);
+      this.timers.add(cancel);
+    }
+  }
+  emit(a, status, reason, deliveryUncertain) {
+    this.o.onStatus?.({
+      conversationId: a.conversationId,
+      peerJid: a.peerJid,
+      peerDeviceId: a.peerDevice,
+      role: a.role === "A" ? "initiator" : "receiver",
+      status,
+      ...reason ? { reason } : {},
+      ...deliveryUncertain && deliveryUncertain.length > 0 ? { deliveryUncertain } : {}
+    });
+  }
+  emitRaw(conversationId, peer, role, status, reason) {
+    this.o.onStatus?.({
+      conversationId,
+      peerJid: peer.bareJid,
+      peerDeviceId: peer.deviceId,
+      role,
+      status,
+      ...reason ? { reason } : {}
+    });
+  }
+  log(event, fields) {
+    this.o.log?.(event, fields);
+  }
+};
+
+// packages/omemo/src/libsignal.ts
+function loadNativeOmemoProvider(jid, options = {}) {
+  const bare = parseJid2(jid).bare().toString();
+  return new OmemoProvider(bare, new LibsignalNodeBackend(DeviceState.load(bare, options)));
+}
+export {
+  BODY_MARKER,
+  DeviceState,
+  LibsignalNodeBackend,
+  NS_DEVICELIST,
+  NS_EME,
+  NS_HINTS,
+  NS_OMEMO,
+  NS_RECOVERY,
+  NS_SCE,
+  NS_WACANDO_OMEMO,
+  OmemoError,
+  OmemoProvider,
+  OmemoReceiveError,
+  OmemoTranscriptDecryptor,
+  PEP_ITEM_ID,
+  RECOVERY_LIMITS,
+  SessionRecovery,
+  UnsupportedSignalFormatError,
+  bundleNode,
+  defaultStateBaseDir,
+  deviceListEl,
+  jidStateDirName,
+  loadNativeOmemoProvider,
+  parseDeviceList,
+  parseEncrypted
+};