@zapo-js/fake-server 0.3.0

package/dist/infra/WaFakeNoiseHandshake.js

@@ -0,0 +1,76 @@
+"use strict";
+/** Responder-side Noise handshake primitives for fake server pipelines. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WaFakeNoiseHandshake = void 0;
+const crypto_1 = require("../transport/crypto");
+const EMPTY = new Uint8Array(0);
+class WaFakeNoiseHandshake {
+    constructor() {
+        this.hash = EMPTY;
+        this.chainingKey = EMPTY;
+        this.cipherKey = null;
+        this.nonceCounter = 0;
+    }
+    async start(name, prologue) {
+        const initialHash = name.byteLength === 32 ? name : await (0, crypto_1.sha256)(name);
+        this.hash = initialHash;
+        this.chainingKey = initialHash;
+        this.cipherKey = await (0, crypto_1.importAesGcmKey)(initialHash, ['encrypt', 'decrypt']);
+        this.nonceCounter = 0;
+        await this.authenticate(prologue);
+    }
+    async authenticate(data) {
+        const concatenated = new Uint8Array(this.hash.byteLength + data.byteLength);
+        concatenated.set(this.hash, 0);
+        concatenated.set(data, this.hash.byteLength);
+        this.hash = await (0, crypto_1.sha256)(concatenated);
+    }
+    async mixIntoKey(input) {
+        const [nextChainingKey, nextCipherMaterial] = await (0, crypto_1.hkdfSplit)(input, this.chainingKey, '');
+        this.chainingKey = nextChainingKey;
+        this.cipherKey = await (0, crypto_1.importAesGcmKey)(nextCipherMaterial, ['encrypt', 'decrypt']);
+        this.nonceCounter = 0;
+    }
+    async encrypt(plaintext) {
+        if (!this.cipherKey) {
+            throw new Error('noise handshake encrypt called before key was derived');
+        }
+        const iv = this.buildNonceIv();
+        this.nonceCounter += 1;
+        const ciphertext = await (0, crypto_1.aesGcmEncrypt)(this.cipherKey, iv, plaintext, this.hash);
+        await this.authenticate(ciphertext);
+        return ciphertext;
+    }
+    async decrypt(ciphertext) {
+        if (!this.cipherKey) {
+            throw new Error('noise handshake decrypt called before key was derived');
+        }
+        const iv = this.buildNonceIv();
+        this.nonceCounter += 1;
+        const plaintext = await (0, crypto_1.aesGcmDecrypt)(this.cipherKey, iv, ciphertext, this.hash);
+        await this.authenticate(ciphertext);
+        return plaintext;
+    }
+    /** Derives transport keys (`first -> recv`, `second -> send` for responder role). */
+    async finish() {
+        const [first, second] = await (0, crypto_1.hkdfSplit)(EMPTY, this.chainingKey, '');
+        const [recvKey, sendKey] = await Promise.all([
+            (0, crypto_1.importAesGcmKey)(first, ['decrypt']),
+            (0, crypto_1.importAesGcmKey)(second, ['encrypt'])
+        ]);
+        return {
+            recvKey,
+            sendKey,
+            recvKeyBytes: first,
+            sendKeyBytes: second
+        };
+    }
+    buildNonceIv() {
+        const iv = new Uint8Array(12);
+        const view = new DataView(iv.buffer);
+        view.setUint32(8, this.nonceCounter, false);
+        return iv;
+    }
+}
+exports.WaFakeNoiseHandshake = WaFakeNoiseHandshake;
+//# sourceMappingURL=WaFakeNoiseHandshake.js.map

package/dist/infra/WaFakeNoiseHandshake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WaFakeNoiseHandshake.js","sourceRoot":"","sources":["../../src/infra/WaFakeNoiseHandshake.ts"],"names":[],"mappings":";AAAA,2EAA2E;;;AAE3E,gDAO4B;AAE5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;AAS/B,MAAa,oBAAoB;IAAjC;QACY,SAAI,GAAe,KAAK,CAAA;QACxB,gBAAW,GAAe,KAAK,CAAA;QAC/B,cAAS,GAAqB,IAAI,CAAA;QAClC,iBAAY,GAAG,CAAC,CAAA;IAoE5B,CAAC;IAlEU,KAAK,CAAC,KAAK,CAAC,IAAgB,EAAE,QAAoB;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAA,eAAM,EAAC,IAAI,CAAC,CAAA;QACtE,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;QACvB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAC9B,IAAI,CAAC,SAAS,GAAG,MAAM,IAAA,wBAAe,EAAC,WAAW,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;QAC3E,IAAI,CAAC,YAAY,GAAG,CAAC,CAAA;QACrB,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;IACrC,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,IAAgB;QACtC,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAA;QAC3E,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9B,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,GAAG,MAAM,IAAA,eAAM,EAAC,YAAY,CAAC,CAAA;IAC1C,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,KAAiB;QACrC,MAAM,CAAC,eAAe,EAAE,kBAAkB,CAAC,GAAG,MAAM,IAAA,kBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,WAAW,GAAG,eAAe,CAAA;QAClC,IAAI,CAAC,SAAS,GAAG,MAAM,IAAA,wBAAe,EAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;QAClF,IAAI,CAAC,YAAY,GAAG,CAAC,CAAA;IACzB,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,SAAqB;QACtC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC5E,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QAC9B,IAAI,CAAC,YAAY,IAAI,CAAC,CAAA;QACtB,MAAM,UAAU,GAAG,MAAM,IAAA,sBAAa,EAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAChF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACnC,OAAO,UAAU,CAAA;IACrB,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,UAAsB;QACvC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QAC5E,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QAC9B,IAAI,CAAC,YAAY,IAAI,CAAC,CAAA;QACtB,MAAM,SAAS,GAAG,MAAM,IAAA,sBAAa,EAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAChF,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACnC,OAAO,SAAS,CAAA;IACpB,CAAC;IAED,qFAAqF;IAC9E,KAAK,CAAC,MAAM;QACf,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,IAAA,kBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACpE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzC,IAAA,wBAAe,EAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;YACnC,IAAA,wBAAe,EAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC;SACvC,CAAC,CAAA;QACF,OAAO;YACH,OAAO;YACP,OAAO;YACP,YAAY,EAAE,KAAK;YACnB,YAAY,EAAE,MAAM;SACvB,CAAA;IACL,CAAC;IAEO,YAAY;QAChB,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;QACpC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAC3C,OAAO,EAAE,CAAA;IACb,CAAC;CACJ;AAxED,oDAwEC"}

package/dist/infra/WaFakeTransport.d.ts

@@ -0,0 +1,15 @@
+/** Post-handshake Noise transport (AES-GCM with direction-specific counters). */
+import { type CryptoKey } from '../transport/crypto';
+export declare class WaFakeTransport {
+    private readonly recvKey;
+    private readonly sendKey;
+    private sendCounter;
+    private recvCounter;
+    constructor(keys: {
+        readonly recvKey: CryptoKey;
+        readonly sendKey: CryptoKey;
+    });
+    encryptFrame(plaintext: Uint8Array): Promise<Uint8Array>;
+    decryptFrame(ciphertext: Uint8Array): Promise<Uint8Array>;
+}
+//# sourceMappingURL=WaFakeTransport.d.ts.map

package/dist/infra/WaFakeTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WaFakeTransport.d.ts","sourceRoot":"","sources":["../../src/infra/WaFakeTransport.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,OAAO,EAAgC,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAElF,qBAAa,eAAe;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,WAAW,CAAI;IACvB,OAAO,CAAC,WAAW,CAAI;gBAEJ,IAAI,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;KAAE;IAKxE,YAAY,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAMxD,YAAY,CAAC,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAKzE"}

package/dist/infra/WaFakeTransport.js

@@ -0,0 +1,34 @@
+"use strict";
+/** Post-handshake Noise transport (AES-GCM with direction-specific counters). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WaFakeTransport = void 0;
+const crypto_1 = require("../transport/crypto");
+class WaFakeTransport {
+    constructor(keys) {
+        this.sendCounter = 0;
+        this.recvCounter = 0;
+        this.recvKey = keys.recvKey;
+        this.sendKey = keys.sendKey;
+    }
+    async encryptFrame(plaintext) {
+        const nonce = buildAesGcmNonce(this.sendCounter);
+        this.sendCounter += 1;
+        return (0, crypto_1.aesGcmEncrypt)(this.sendKey, nonce, plaintext);
+    }
+    async decryptFrame(ciphertext) {
+        const nonce = buildAesGcmNonce(this.recvCounter);
+        this.recvCounter += 1;
+        return (0, crypto_1.aesGcmDecrypt)(this.recvKey, nonce, ciphertext);
+    }
+}
+exports.WaFakeTransport = WaFakeTransport;
+function buildAesGcmNonce(counter) {
+    if (counter > 0xffffffff) {
+        throw new Error('noise transport nonce counter overflow');
+    }
+    const nonce = new Uint8Array(12);
+    const view = new DataView(nonce.buffer);
+    view.setUint32(8, counter, false);
+    return nonce;
+}
+//# sourceMappingURL=WaFakeTransport.js.map

package/dist/infra/WaFakeTransport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WaFakeTransport.js","sourceRoot":"","sources":["../../src/infra/WaFakeTransport.ts"],"names":[],"mappings":";AAAA,iFAAiF;;;AAEjF,gDAAkF;AAElF,MAAa,eAAe;IAMxB,YAAmB,IAAkE;QAH7E,gBAAW,GAAG,CAAC,CAAA;QACf,gBAAW,GAAG,CAAC,CAAA;QAGnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC/B,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,SAAqB;QAC3C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChD,IAAI,CAAC,WAAW,IAAI,CAAC,CAAA;QACrB,OAAO,IAAA,sBAAa,EAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IACxD,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,UAAsB;QAC5C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChD,IAAI,CAAC,WAAW,IAAI,CAAC,CAAA;QACrB,OAAO,IAAA,sBAAa,EAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAA;IACzD,CAAC;CACJ;AAtBD,0CAsBC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACrC,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACvC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IACjC,OAAO,KAAK,CAAA;AAChB,CAAC"}

package/dist/infra/WaFakeWsServer.d.ts

@@ -0,0 +1,29 @@
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+import { WaFakeConnection } from './WaFakeConnection';
+export type WaFakeHttpRequestHandler = (req: IncomingMessage, res: ServerResponse) => void | Promise<void>;
+export interface WaFakeWsServerOptions {
+    readonly host?: string;
+    readonly port?: number;
+    readonly path?: string;
+}
+export interface WaFakeWsServerListenInfo {
+    readonly host: string;
+    readonly port: number;
+    readonly path: string;
+    readonly url: string;
+}
+export type WaFakeWsServerConnectionListener = (connection: WaFakeConnection) => void;
+export declare class WaFakeWsServer {
+    private readonly options;
+    private httpServer;
+    private wsServer;
+    private connectionListener;
+    private httpRequestHandler;
+    private nextConnectionId;
+    constructor(options?: WaFakeWsServerOptions);
+    onConnection(listener: WaFakeWsServerConnectionListener): void;
+    setHttpRequestHandler(handler: WaFakeHttpRequestHandler | null): void;
+    listen(): Promise<WaFakeWsServerListenInfo>;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=WaFakeWsServer.d.ts.map

package/dist/infra/WaFakeWsServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WaFakeWsServer.d.ts","sourceRoot":"","sources":["../../src/infra/WaFakeWsServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAe,KAAK,cAAc,EAAE,MAAM,WAAW,CAAA;AAKhG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,MAAM,MAAM,wBAAwB,GAAG,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,KAClB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;AAEzB,MAAM,WAAW,qBAAqB;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,wBAAwB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,MAAM,gCAAgC,GAAG,CAAC,UAAU,EAAE,gBAAgB,KAAK,IAAI,CAAA;AAErF,qBAAa,cAAc;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IACzD,OAAO,CAAC,UAAU,CAAsB;IACxC,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,kBAAkB,CAAgD;IAC1E,OAAO,CAAC,kBAAkB,CAAwC;IAClE,OAAO,CAAC,gBAAgB,CAAI;gBAET,OAAO,GAAE,qBAA0B;IAQ/C,YAAY,CAAC,QAAQ,EAAE,gCAAgC,GAAG,IAAI;IAI9D,qBAAqB,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,GAAG,IAAI;IAI/D,MAAM,IAAI,OAAO,CAAC,wBAAwB,CAAC;IA4D3C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAkBtC"}

package/dist/infra/WaFakeWsServer.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WaFakeWsServer = void 0;
+const node_http_1 = require("node:http");
+const ws_1 = require("ws");
+const WaFakeConnection_1 = require("./WaFakeConnection");
+class WaFakeWsServer {
+    constructor(options = {}) {
+        this.httpServer = null;
+        this.wsServer = null;
+        this.connectionListener = null;
+        this.httpRequestHandler = null;
+        this.nextConnectionId = 0;
+        this.options = {
+            host: options.host ?? '127.0.0.1',
+            port: options.port ?? 0,
+            path: options.path ?? '/ws/chat'
+        };
+    }
+    onConnection(listener) {
+        this.connectionListener = listener;
+    }
+    setHttpRequestHandler(handler) {
+        this.httpRequestHandler = handler;
+    }
+    async listen() {
+        if (this.httpServer) {
+            throw new Error('fake ws server is already listening');
+        }
+        const httpServer = (0, node_http_1.createServer)(async (req, res) => {
+            const handler = this.httpRequestHandler;
+            if (!handler) {
+                res.statusCode = 404;
+                res.end();
+                return;
+            }
+            try {
+                await Promise.resolve(handler(req, res)).catch((error) => {
+                    if (!res.headersSent) {
+                        res.statusCode = 500;
+                    }
+                    res.end(error instanceof Error ? error.message : String(error));
+                });
+            }
+            catch (error) {
+                if (!res.headersSent) {
+                    res.statusCode = 500;
+                }
+                res.end(error instanceof Error ? error.message : String(error));
+            }
+        });
+        const wsServer = new ws_1.WebSocketServer({ server: httpServer, path: this.options.path });
+        wsServer.on('connection', (socket) => {
+            const id = `c${this.nextConnectionId++}`;
+            const connection = new WaFakeConnection_1.WaFakeConnection(id, socket);
+            this.connectionListener?.(connection);
+        });
+        await new Promise((resolve, reject) => {
+            const onError = (error) => {
+                httpServer.off('listening', onListening);
+                reject(error);
+            };
+            const onListening = () => {
+                httpServer.off('error', onError);
+                resolve();
+            };
+            httpServer.once('error', onError);
+            httpServer.once('listening', onListening);
+            httpServer.listen(this.options.port, this.options.host);
+        });
+        this.httpServer = httpServer;
+        this.wsServer = wsServer;
+        const address = httpServer.address();
+        return {
+            host: address.address,
+            port: address.port,
+            path: this.options.path,
+            url: `ws://${address.address}:${address.port}${this.options.path}`
+        };
+    }
+    async close() {
+        const wsServer = this.wsServer;
+        const httpServer = this.httpServer;
+        if (!wsServer || !httpServer) {
+            return;
+        }
+        for (const client of wsServer.clients) {
+            client.terminate();
+        }
+        await new Promise((resolve, reject) => {
+            wsServer.close((error) => (error ? reject(error) : resolve()));
+        });
+        await new Promise((resolve, reject) => {
+            httpServer.close((error) => (error ? reject(error) : resolve()));
+        });
+        this.wsServer = null;
+        this.httpServer = null;
+    }
+}
+exports.WaFakeWsServer = WaFakeWsServer;
+//# sourceMappingURL=WaFakeWsServer.js.map

package/dist/infra/WaFakeWsServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WaFakeWsServer.js","sourceRoot":"","sources":["../../src/infra/WaFakeWsServer.ts"],"names":[],"mappings":";;;AAAA,yCAAgG;AAGhG,2BAAoC;AAEpC,yDAAqD;AAsBrD,MAAa,cAAc;IAQvB,YAAmB,UAAiC,EAAE;QAN9C,eAAU,GAAkB,IAAI,CAAA;QAChC,aAAQ,GAA2B,IAAI,CAAA;QACvC,uBAAkB,GAA4C,IAAI,CAAA;QAClE,uBAAkB,GAAoC,IAAI,CAAA;QAC1D,qBAAgB,GAAG,CAAC,CAAA;QAGxB,IAAI,CAAC,OAAO,GAAG;YACX,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,WAAW;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC;YACvB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,UAAU;SACnC,CAAA;IACL,CAAC;IAEM,YAAY,CAAC,QAA0C;QAC1D,IAAI,CAAC,kBAAkB,GAAG,QAAQ,CAAA;IACtC,CAAC;IAEM,qBAAqB,CAAC,OAAwC;QACjE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAA;IACrC,CAAC;IAEM,KAAK,CAAC,MAAM;QACf,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,wBAAY,EAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAA;YACvC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACX,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACV,CAAC;YACD,IAAI,CAAC;gBACD,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;wBACnB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;oBACxB,CAAC;oBACD,GAAG,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;gBACnE,CAAC,CAAC,CAAA;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACnB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACxB,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YACnE,CAAC;QACL,CAAC,CAAC,CAAA;QACF,MAAM,QAAQ,GAAG,IAAI,oBAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QAErF,QAAQ,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YACjC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAA;YACxC,MAAM,UAAU,GAAG,IAAI,mCAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACnD,IAAI,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,CAAA;QACzC,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,CAAC,KAAY,EAAQ,EAAE;gBACnC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;gBACxC,MAAM,CAAC,KAAK,CAAC,CAAA;YACjB,CAAC,CAAA;YACD,MAAM,WAAW,GAAG,GAAS,EAAE;gBAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;gBAChC,OAAO,EAAE,CAAA;YACb,CAAC,CAAA;YACD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACjC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;YACzC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC3D,CAAC,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QAExB,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAiB,CAAA;QACnD,OAAO;YACH,IAAI,EAAE,OAAO,CAAC,OAAO;YACrB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YACvB,GAAG,EAAE,QAAQ,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;SACrE,CAAA;IACL,CAAC;IAEM,KAAK,CAAC,KAAK;QACd,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QAClC,IAAI,CAAC,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;YAC3B,OAAM;QACV,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,CAAC,SAAS,EAAE,CAAA;QACtB,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAClE,CAAC,CAAC,CAAA;QACF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QACpE,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;IAC1B,CAAC;CACJ;AAtGD,wCAsGC"}

package/dist/protocol/auth/cert-chain.d.ts

@@ -0,0 +1,18 @@
+/** Fake noise certificate chain generator for handshake tests. */
+export interface FakeNoiseRootCa {
+    readonly publicKey: Uint8Array;
+    readonly serial: number;
+    readonly privateKey: Uint8Array;
+}
+export interface FakeCertChainResult {
+    readonly encoded: Uint8Array;
+}
+export interface BuildFakeCertChainInput {
+    readonly root: FakeNoiseRootCa;
+    readonly leafKey: Uint8Array;
+    readonly intermediateSerial?: number;
+    readonly leafSerial?: number;
+}
+export declare function generateFakeNoiseRootCa(): Promise<FakeNoiseRootCa>;
+export declare function buildFakeCertChain(input: BuildFakeCertChainInput): Promise<FakeCertChainResult>;
+//# sourceMappingURL=cert-chain.d.ts.map

package/dist/protocol/auth/cert-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-chain.d.ts","sourceRoot":"","sources":["../../../src/protocol/auth/cert-chain.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAKlE,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;CAClC;AAED,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACpC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IACpC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC/B;AAED,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,eAAe,CAAC,CAOxE;AAED,wBAAsB,kBAAkB,CACpC,KAAK,EAAE,uBAAuB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAgC9B"}

package/dist/protocol/auth/cert-chain.js

@@ -0,0 +1,44 @@
+"use strict";
+/** Fake noise certificate chain generator for handshake tests. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateFakeNoiseRootCa = generateFakeNoiseRootCa;
+exports.buildFakeCertChain = buildFakeCertChain;
+const crypto_1 = require("../../transport/crypto");
+const protos_1 = require("../../transport/protos");
+async function generateFakeNoiseRootCa() {
+    const keyPair = await crypto_1.X25519.generateKeyPair();
+    return {
+        publicKey: keyPair.pubKey,
+        privateKey: keyPair.privKey,
+        serial: 0
+    };
+}
+async function buildFakeCertChain(input) {
+    const intermediateSerial = input.intermediateSerial ?? 1;
+    const leafSerial = input.leafSerial ?? 2;
+    const intermediateKeyPair = await crypto_1.X25519.generateKeyPair();
+    const intermediateDetails = protos_1.proto.CertChain.NoiseCertificate.Details.encode({
+        serial: intermediateSerial,
+        issuerSerial: input.root.serial,
+        key: intermediateKeyPair.pubKey
+    }).finish();
+    const intermediateSignature = await (0, crypto_1.xeddsaSign)(input.root.privateKey, intermediateDetails);
+    const leafDetails = protos_1.proto.CertChain.NoiseCertificate.Details.encode({
+        serial: leafSerial,
+        issuerSerial: intermediateSerial,
+        key: input.leafKey
+    }).finish();
+    const leafSignature = await (0, crypto_1.xeddsaSign)(intermediateKeyPair.privKey, leafDetails);
+    const encoded = protos_1.proto.CertChain.encode({
+        intermediate: {
+            details: intermediateDetails,
+            signature: intermediateSignature
+        },
+        leaf: {
+            details: leafDetails,
+            signature: leafSignature
+        }
+    }).finish();
+    return { encoded };
+}
+//# sourceMappingURL=cert-chain.js.map

package/dist/protocol/auth/cert-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-chain.js","sourceRoot":"","sources":["../../../src/protocol/auth/cert-chain.ts"],"names":[],"mappings":";AAAA,kEAAkE;;AAsBlE,0DAOC;AAED,gDAkCC;AA/DD,mDAA2D;AAC3D,mDAA8C;AAmBvC,KAAK,UAAU,uBAAuB;IACzC,MAAM,OAAO,GAAG,MAAM,eAAM,CAAC,eAAe,EAAE,CAAA;IAC9C,OAAO;QACH,SAAS,EAAE,OAAO,CAAC,MAAM;QACzB,UAAU,EAAE,OAAO,CAAC,OAAO;QAC3B,MAAM,EAAE,CAAC;KACZ,CAAA;AACL,CAAC;AAEM,KAAK,UAAU,kBAAkB,CACpC,KAA8B;IAE9B,MAAM,kBAAkB,GAAG,KAAK,CAAC,kBAAkB,IAAI,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,CAAA;IAExC,MAAM,mBAAmB,GAAG,MAAM,eAAM,CAAC,eAAe,EAAE,CAAA;IAE1D,MAAM,mBAAmB,GAAG,cAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC;QACxE,MAAM,EAAE,kBAAkB;QAC1B,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;QAC/B,GAAG,EAAE,mBAAmB,CAAC,MAAM;KAClC,CAAC,CAAC,MAAM,EAAE,CAAA;IACX,MAAM,qBAAqB,GAAG,MAAM,IAAA,mBAAU,EAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAA;IAE1F,MAAM,WAAW,GAAG,cAAK,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC;QAChE,MAAM,EAAE,UAAU;QAClB,YAAY,EAAE,kBAAkB;QAChC,GAAG,EAAE,KAAK,CAAC,OAAO;KACrB,CAAC,CAAC,MAAM,EAAE,CAAA;IACX,MAAM,aAAa,GAAG,MAAM,IAAA,mBAAU,EAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IAEhF,MAAM,OAAO,GAAG,cAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QACnC,YAAY,EAAE;YACV,OAAO,EAAE,mBAAmB;YAC5B,SAAS,EAAE,qBAAqB;SACnC;QACD,IAAI,EAAE;YACF,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,aAAa;SAC3B;KACJ,CAAC,CAAC,MAAM,EAAE,CAAA;IAEX,OAAO,EAAE,OAAO,EAAE,CAAA;AACtB,CAAC"}

package/dist/protocol/auth/client-payload-validate.d.ts

@@ -0,0 +1,21 @@
+/** ClientPayload parser/validator (registration vs login flavors). */
+import { type Proto } from '../../transport/protos';
+export interface RegistrationPayload {
+    readonly kind: 'registration';
+    readonly raw: Proto.IClientPayload;
+    readonly devicePairingData: NonNullable<Proto.IClientPayload['devicePairingData']>;
+}
+export interface LoginPayload {
+    readonly kind: 'login';
+    readonly raw: Proto.IClientPayload;
+    readonly username: string;
+    readonly device: number;
+    readonly loginCounter: number;
+}
+export type ParsedClientPayload = RegistrationPayload | LoginPayload;
+export declare class ClientPayloadValidationError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare function parseClientPayload(bytes: Uint8Array): ParsedClientPayload;
+//# sourceMappingURL=client-payload-validate.d.ts.map

package/dist/protocol/auth/client-payload-validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-payload-validate.d.ts","sourceRoot":"","sources":["../../../src/protocol/auth/client-payload-validate.ts"],"names":[],"mappings":"AAAA,sEAAsE;AAEtE,OAAO,EAAS,KAAK,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAE1D,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,cAAc,CAAA;IAClC,QAAQ,CAAC,iBAAiB,EAAE,WAAW,CAAC,KAAK,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAAA;CACrF;AAED,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,cAAc,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAChC;AAED,MAAM,MAAM,mBAAmB,GAAG,mBAAmB,GAAG,YAAY,CAAA;AAEpE,qBAAa,4BAA6B,SAAQ,KAAK;IACnD,SAAgB,IAAI,EAAE,MAAM,CAAA;gBACT,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAKnD;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,mBAAmB,CAmCzE"}

package/dist/protocol/auth/client-payload-validate.js

@@ -0,0 +1,61 @@
+"use strict";
+/** ClientPayload parser/validator (registration vs login flavors). */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientPayloadValidationError = void 0;
+exports.parseClientPayload = parseClientPayload;
+const protos_1 = require("../../transport/protos");
+class ClientPayloadValidationError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = 'ClientPayloadValidationError';
+        this.code = code;
+    }
+}
+exports.ClientPayloadValidationError = ClientPayloadValidationError;
+function parseClientPayload(bytes) {
+    let raw;
+    try {
+        raw = protos_1.proto.ClientPayload.decode(bytes);
+    }
+    catch (error) {
+        throw new ClientPayloadValidationError('invalid_proto', `failed to decode ClientPayload: ${error.message}`);
+    }
+    const devicePairingData = raw.devicePairingData;
+    if (devicePairingData) {
+        validateRegistrationFields(devicePairingData);
+        return {
+            kind: 'registration',
+            raw,
+            devicePairingData
+        };
+    }
+    if (raw.username === undefined || raw.username === null) {
+        throw new ClientPayloadValidationError('missing_username', 'login ClientPayload is missing the username field');
+    }
+    return {
+        kind: 'login',
+        raw,
+        username: String(raw.username),
+        device: typeof raw.device === 'number' ? raw.device : 0,
+        loginCounter: typeof raw.lc === 'number' ? raw.lc : 0
+    };
+}
+function validateRegistrationFields(devicePairingData) {
+    const required = [
+        ['eIdent', 'identity public key'],
+        ['eRegid', 'registration id'],
+        ['eKeytype', 'key type marker'],
+        ['eSkeyId', 'signed pre-key id'],
+        ['eSkeyVal', 'signed pre-key public'],
+        ['eSkeySig', 'signed pre-key signature'],
+        ['buildHash', 'client build hash'],
+        ['deviceProps', 'device properties']
+    ];
+    for (const [field, label] of required) {
+        const value = devicePairingData[field];
+        if (value === undefined || value === null) {
+            throw new ClientPayloadValidationError('missing_field', `registration ClientPayload missing ${label} (devicePairingData.${String(field)})`);
+        }
+    }
+}
+//# sourceMappingURL=client-payload-validate.js.map

package/dist/protocol/auth/client-payload-validate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-payload-validate.js","sourceRoot":"","sources":["../../../src/protocol/auth/client-payload-validate.ts"],"names":[],"mappings":";AAAA,sEAAsE;;;AA6BtE,gDAmCC;AA9DD,mDAA0D;AAkB1D,MAAa,4BAA6B,SAAQ,KAAK;IAEnD,YAAmB,IAAY,EAAE,OAAe;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAA;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;IACpB,CAAC;CACJ;AAPD,oEAOC;AAED,SAAgB,kBAAkB,CAAC,KAAiB;IAChD,IAAI,GAAyB,CAAA;IAC7B,IAAI,CAAC;QACD,GAAG,GAAG,cAAK,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,4BAA4B,CAClC,eAAe,EACf,mCAAoC,KAAe,CAAC,OAAO,EAAE,CAChE,CAAA;IACL,CAAC;IAED,MAAM,iBAAiB,GAAG,GAAG,CAAC,iBAAiB,CAAA;IAC/C,IAAI,iBAAiB,EAAE,CAAC;QACpB,0BAA0B,CAAC,iBAAiB,CAAC,CAAA;QAC7C,OAAO;YACH,IAAI,EAAE,cAAc;YACpB,GAAG;YACH,iBAAiB;SACpB,CAAA;IACL,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,4BAA4B,CAClC,kBAAkB,EAClB,mDAAmD,CACtD,CAAA;IACL,CAAC;IAED,OAAO;QACH,IAAI,EAAE,OAAO;QACb,GAAG;QACH,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,YAAY,EAAE,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;KACxD,CAAA;AACL,CAAC;AAED,SAAS,0BAA0B,CAC/B,iBAAyE;IAEzE,MAAM,QAAQ,GAAqE;QAC/E,CAAC,QAAQ,EAAE,qBAAqB,CAAC;QACjC,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QAC7B,CAAC,UAAU,EAAE,iBAAiB,CAAC;QAC/B,CAAC,SAAS,EAAE,mBAAmB,CAAC;QAChC,CAAC,UAAU,EAAE,uBAAuB,CAAC;QACrC,CAAC,UAAU,EAAE,0BAA0B,CAAC;QACxC,CAAC,WAAW,EAAE,mBAAmB,CAAC;QAClC,CAAC,aAAa,EAAE,mBAAmB,CAAC;KACvC,CAAA;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,4BAA4B,CAClC,eAAe,EACf,sCAAsC,KAAK,uBAAuB,MAAM,CAAC,KAAK,CAAC,GAAG,CACrF,CAAA;QACL,CAAC;IACL,CAAC;AACL,CAAC"}

package/dist/protocol/auth/fake-primary-device.d.ts

@@ -0,0 +1,19 @@
+/** Fake primary-device identity/signature helpers for pairing. */
+import { type SignalKeyPair } from '../../transport/crypto';
+export interface FakePrimaryDevice {
+    readonly identityKeyPair: SignalKeyPair;
+}
+export declare function generateFakePrimaryDevice(): Promise<FakePrimaryDevice>;
+export interface BuildAdvIdentityInput {
+    readonly primary: FakePrimaryDevice;
+    readonly advSecretKey: Uint8Array;
+    readonly companionIdentityPublicKey: Uint8Array;
+    readonly companionDeviceId: number;
+    readonly timestampSeconds?: number;
+    readonly keyIndex?: number;
+}
+export interface BuildAdvIdentityResult {
+    readonly deviceIdentityBytes: Uint8Array;
+}
+export declare function buildAdvSignedDeviceIdentity(input: BuildAdvIdentityInput): Promise<BuildAdvIdentityResult>;
+//# sourceMappingURL=fake-primary-device.d.ts.map

package/dist/protocol/auth/fake-primary-device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-primary-device.d.ts","sourceRoot":"","sources":["../../../src/protocol/auth/fake-primary-device.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAElE,OAAO,EAGH,KAAK,aAAa,EAGrB,MAAM,wBAAwB,CAAA;AAK/B,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAA;CAC1C;AAED,wBAAsB,yBAAyB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAI5E;AAED,MAAM,WAAW,qBAAqB;IAClC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;IACnC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAA;IACjC,QAAQ,CAAC,0BAA0B,EAAE,UAAU,CAAA;IAC/C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACnC,QAAQ,CAAC,mBAAmB,EAAE,UAAU,CAAA;CAC3C;AAED,wBAAsB,4BAA4B,CAC9C,KAAK,EAAE,qBAAqB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CA+BjC"}

package/dist/protocol/auth/fake-primary-device.js

@@ -0,0 +1,53 @@
+"use strict";
+/** Fake primary-device identity/signature helpers for pairing. */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateFakePrimaryDevice = generateFakePrimaryDevice;
+exports.buildAdvSignedDeviceIdentity = buildAdvSignedDeviceIdentity;
+const crypto_1 = require("../../transport/crypto");
+const protos_1 = require("../../transport/protos");
+const ADV_PREFIX_ACCOUNT_SIGNATURE = new Uint8Array([0x06, 0x00]);
+async function generateFakePrimaryDevice() {
+    return {
+        identityKeyPair: await crypto_1.X25519.generateKeyPair()
+    };
+}
+async function buildAdvSignedDeviceIdentity(input) {
+    const advDeviceIdentity = protos_1.proto.ADVDeviceIdentity.encode({
+        rawId: input.companionDeviceId,
+        timestamp: input.timestampSeconds ?? Math.floor(Date.now() / 1000),
+        keyIndex: input.keyIndex ?? 0
+    }).finish();
+    // Sign exactly: prefix || details || companionIdentityPublicKey.
+    const accountSignatureKey = input.primary.identityKeyPair.pubKey;
+    const messageToSign = concatBytes([
+        ADV_PREFIX_ACCOUNT_SIGNATURE,
+        advDeviceIdentity,
+        input.companionIdentityPublicKey
+    ]);
+    const accountSignature = await (0, crypto_1.xeddsaSign)(input.primary.identityKeyPair.privKey, messageToSign);
+    const signedIdentity = protos_1.proto.ADVSignedDeviceIdentity.encode({
+        details: advDeviceIdentity,
+        accountSignatureKey,
+        accountSignature
+    }).finish();
+    const hmacKey = await (0, crypto_1.importHmacKey)(input.advSecretKey);
+    const hmac = await (0, crypto_1.hmacSign)(hmacKey, signedIdentity);
+    const wrapped = protos_1.proto.ADVSignedDeviceIdentityHMAC.encode({
+        details: signedIdentity,
+        hmac
+    }).finish();
+    return { deviceIdentityBytes: wrapped };
+}
+function concatBytes(parts) {
+    let total = 0;
+    for (const p of parts)
+        total += p.byteLength;
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const p of parts) {
+        out.set(p, offset);
+        offset += p.byteLength;
+    }
+    return out;
+}
+//# sourceMappingURL=fake-primary-device.js.map

package/dist/protocol/auth/fake-primary-device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-primary-device.js","sourceRoot":"","sources":["../../../src/protocol/auth/fake-primary-device.ts"],"names":[],"mappings":";AAAA,kEAAkE;;AAiBlE,8DAIC;AAeD,oEAiCC;AAnED,mDAM+B;AAC/B,mDAA8C;AAE9C,MAAM,4BAA4B,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;AAM1D,KAAK,UAAU,yBAAyB;IAC3C,OAAO;QACH,eAAe,EAAE,MAAM,eAAM,CAAC,eAAe,EAAE;KAClD,CAAA;AACL,CAAC;AAeM,KAAK,UAAU,4BAA4B,CAC9C,KAA4B;IAE5B,MAAM,iBAAiB,GAAG,cAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACrD,KAAK,EAAE,KAAK,CAAC,iBAAiB;QAC9B,SAAS,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAK,CAAC;QACnE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC;KAChC,CAAC,CAAC,MAAM,EAAE,CAAA;IAEX,iEAAiE;IACjE,MAAM,mBAAmB,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAA;IAChE,MAAM,aAAa,GAAG,WAAW,CAAC;QAC9B,4BAA4B;QAC5B,iBAAiB;QACjB,KAAK,CAAC,0BAA0B;KACnC,CAAC,CAAA;IACF,MAAM,gBAAgB,GAAG,MAAM,IAAA,mBAAU,EAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAE/F,MAAM,cAAc,GAAG,cAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC;QACxD,OAAO,EAAE,iBAAiB;QAC1B,mBAAmB;QACnB,gBAAgB;KACnB,CAAC,CAAC,MAAM,EAAE,CAAA;IAEX,MAAM,OAAO,GAAG,MAAM,IAAA,sBAAa,EAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACvD,MAAM,IAAI,GAAG,MAAM,IAAA,iBAAQ,EAAC,OAAO,EAAE,cAAc,CAAC,CAAA;IAEpD,MAAM,OAAO,GAAG,cAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC;QACrD,OAAO,EAAE,cAAc;QACvB,IAAI;KACP,CAAC,CAAC,MAAM,EAAE,CAAA;IAEX,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAA;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,KAA4B;IAC7C,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,KAAK,IAAI,CAAC,CAAC,UAAU,CAAA;IAC5C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;QAClB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAA;IAC1B,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC"}

package/dist/protocol/auth/pair-device.d.ts

@@ -0,0 +1,26 @@
+/** Pairing IQ builders/parsers (source: `WAWebHandlePairDevice*`, `/wa-web`). */
+import type { BinaryNode } from '../../transport/codec';
+export interface BuildPairDeviceIqInput {
+    readonly id?: string;
+    readonly refs: readonly Uint8Array[];
+}
+export declare function buildPairDeviceIq(input: BuildPairDeviceIqInput): BinaryNode;
+export interface BuildPairSuccessIqInput {
+    readonly id?: string;
+    readonly deviceJid: string;
+    readonly deviceLid?: string;
+    readonly platform: string;
+    readonly deviceIdentityBytes: Uint8Array;
+    readonly bizName?: string;
+}
+export declare function buildPairSuccessIq(input: BuildPairSuccessIqInput): BinaryNode;
+/** Parses `auth_qr`: `ref,noisePub,identityPub,advSecret,platform`. */
+export interface ParsedPairingQr {
+    readonly ref: string;
+    readonly noisePublicKey: Uint8Array;
+    readonly identityPublicKey: Uint8Array;
+    readonly advSecretKey: Uint8Array;
+    readonly platform: string;
+}
+export declare function parsePairingQrString(qr: string): ParsedPairingQr;
+//# sourceMappingURL=pair-device.d.ts.map

package/dist/protocol/auth/pair-device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pair-device.d.ts","sourceRoot":"","sources":["../../../src/protocol/auth/pair-device.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAEvD,MAAM,WAAW,sBAAsB;IACnC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,CAAA;CACvC;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,UAAU,CAwB3E;AAED,MAAM,WAAW,uBAAuB;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,mBAAmB,EAAE,UAAU,CAAA;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,UAAU,CAyC7E;AAED,uEAAuE;AACvE,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,cAAc,EAAE,UAAU,CAAA;IACnC,QAAQ,CAAC,iBAAiB,EAAE,UAAU,CAAA;IACtC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC5B;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,eAAe,CAiBhE"}