fb-messenger-e2ee 0.1.0 → 0.1.2

package/src/e2ee/application/retry-manager.ts

@@ -1,156 +0,0 @@
-import type { E2EEClient } from "./e2ee-client.ts";
-import type { OutboundMessageCache, RecentE2EEOutgoing } from "./outbound-message-cache.ts";
-import { parseMessengerJid, sameMessengerUser } from "./fanout-planner.ts";
-import type { FacebookE2EESocket } from "../transport/noise/noise-socket.ts";
-import { encodeNode, marshal, type Node } from "../transport/binary/wa-binary.ts";
-import type { RawPreKeyBundle } from "../../models/e2ee.ts";
-import { now, str } from "../../utils/fca-utils.ts";
-import { logger } from "../../utils/logger.ts";
-
-export interface E2EERetryManagerOptions {
-  cache: OutboundMessageCache;
-  getClient: () => E2EEClient;
-  getSocket: () => FacebookE2EESocket | null;
-  getSelfJid: () => string;
-  getPreKeyBundle: (jid: string) => Promise<RawPreKeyBundle>;
-}
-
-/** Handles Messenger E2EE retry receipts using recent outbound encrypted payloads. */
-export class E2EERetryManager {
-  constructor(private readonly opts: E2EERetryManagerOptions) {}
-
-  async handleReceipt(node: Node): Promise<void> {
-    const retryNode = this.findChild(node, "retry");
-    const messageId = str(retryNode?.attrs?.id || node.attrs.id);
-    if (!messageId) return;
-
-    const cached = this.opts.cache.get(messageId);
-    if (!cached) {
-      logger.warn("E2EERetryManager", `Received retry receipt for unknown/out-of-cache E2EE message ${messageId}`);
-      return;
-    }
-
-    const requesterJid = this.resolveRetryRequesterJid(node, cached);
-    if (!requesterJid) {
-      logger.warn("E2EERetryManager", `Cannot resolve retry requester for E2EE message ${messageId}`);
-      return;
-    }
-
-    const retryCount = Number(retryNode?.attrs?.count ?? "1") || 1;
-    if (retryCount >= 10) {
-      logger.warn("E2EERetryManager", `Ignoring retry receipt #${retryCount} for ${messageId}`);
-      return;
-    }
-
-    const e2eeClient = this.opts.getClient();
-    const selfJid = this.opts.getSelfJid();
-
-    const retryBundle = this.preKeyBundleFromRetryReceipt(node, requesterJid);
-    if (retryBundle) {
-      await e2eeClient.establishSession(requesterJid, retryBundle);
-    } else if (!(await e2eeClient.hasSession(requesterJid))) {
-      const bundle = await this.opts.getPreKeyBundle(requesterJid);
-      await e2eeClient.establishSession(requesterJid, bundle);
-    }
-
-    const t = String(retryNode?.attrs?.t || node.attrs.t || Math.floor(now() / 1000));
-    let encrypted: { type: "msg" | "pkmsg"; ciphertext: Buffer };
-    const attrs: Record<string, string> = {
-      to: cached.chatJid,
-      type: cached.messageType,
-      id: messageId,
-      t,
-    };
-
-    if (cached.kind === "group") {
-      attrs.participant = requesterJid;
-      const skdm = await e2eeClient.createSenderKeyDistributionPayload(cached.chatJid, selfJid);
-      encrypted = await e2eeClient.encryptMessageAppForDevice(requesterJid, selfJid, cached.messageApp, {
-        skdm,
-        backupDirective: { messageId, actionType: "UPSERT" },
-      });
-    } else {
-      attrs.device_fanout = "false";
-      if (node.attrs.participant) attrs.participant = node.attrs.participant;
-      encrypted = await e2eeClient.encryptMessageAppForDevice(requesterJid, selfJid, cached.messageApp, {
-        dsm: sameMessengerUser(requesterJid, selfJid) ? { destinationJid: cached.chatJid, phash: "" } : undefined,
-      });
-    }
-
-    const msgNode = encodeNode("message", attrs, [
-      encodeNode("enc", { v: "3", type: encrypted.type, count: String(retryCount) }, encrypted.ciphertext),
-      encodeNode("franking", {}, [
-        encodeNode("franking_tag", {}, cached.frankingTag),
-      ]),
-    ]);
-
-    await this.opts.getSocket()?.sendFrame(marshal(msgNode));
-    logger.info("E2EERetryManager", `Resent E2EE message ${messageId} for retry #${retryCount} to ${requesterJid}`);
-  }
-
-  private resolveRetryRequesterJid(node: Node, cached: RecentE2EEOutgoing): string {
-    if (cached.kind === "group") {
-      return str(node.attrs.participant || node.attrs.recipient);
-    }
-    return str(node.attrs.participant || node.attrs.from || node.attrs.recipient || cached.chatJid);
-  }
-
-  private preKeyBundleFromRetryReceipt(node: Node, jid: string): RawPreKeyBundle | null {
-    const keysNode = this.findChild(node, "keys");
-    if (!keysNode) return null;
-
-    const registration = this.findChild(node, "registration")?.content;
-    const identity = this.findChild(keysNode, "identity")?.content;
-    const keyNode = this.findChild(keysNode, "key");
-    const skeyNode = this.findChild(keysNode, "skey");
-    const signedPreKeyId = this.findChild(skeyNode, "id")?.content;
-    const signedPreKeyValue = this.findChild(skeyNode, "value")?.content;
-    const signedPreKeySignature = this.findChild(skeyNode, "signature")?.content;
-    const preKeyId = this.findChild(keyNode, "id")?.content;
-    const preKeyValue = this.findChild(keyNode, "value")?.content;
-
-    if (!Buffer.isBuffer(registration) || !Buffer.isBuffer(identity) || !Buffer.isBuffer(signedPreKeyValue) || !Buffer.isBuffer(signedPreKeySignature)) {
-      return null;
-    }
-
-    const bundle: RawPreKeyBundle = {
-      registrationId: registration.length === 4 ? registration.readUInt32BE(0) : 0,
-      deviceId: parseMessengerJid(jid).device,
-      identityKey: this.keyWithSignalPrefix(identity),
-      signedPreKey: {
-        keyId: this.readSignalKeyId(signedPreKeyId),
-        publicKey: this.keyWithSignalPrefix(signedPreKeyValue),
-        signature: signedPreKeySignature,
-      },
-    };
-
-    if (Buffer.isBuffer(preKeyValue)) {
-      bundle.preKey = {
-        keyId: this.readSignalKeyId(preKeyId),
-        publicKey: this.keyWithSignalPrefix(preKeyValue),
-      };
-    }
-
-    return bundle;
-  }
-
-  private findChild(node: any, tag: string): any | null {
-    if (!node) return null;
-    if (node.tag === tag) return node;
-    const children = Array.isArray(node.content) ? node.content : [];
-    for (const child of children) {
-      const found = this.findChild(child, tag);
-      if (found) return found;
-    }
-    return null;
-  }
-
-  private keyWithSignalPrefix(value: Buffer): Buffer {
-    return value.length === 32 ? Buffer.concat([Buffer.from([5]), value]) : value;
-  }
-
-  private readSignalKeyId(value: unknown): number {
-    if (!Buffer.isBuffer(value) || value.length === 0) return 0;
-    return value.readUIntBE(0, Math.min(value.length, 3));
-  }
-}

package/src/e2ee/facebook/facebook-protocol-utils.ts

@@ -1,230 +0,0 @@
-import { createHash } from 'crypto';
-import { PrivateKey, PublicKey } from '@signalapp/libsignal-client';
-
-/**
- * Facebook-specific Protocol Utilities
- * 
- * This module contains helpers for handling Facebook's variant of the Signal protocol,
- * including varint encoding/decoding, UUID manipulation, and signature spoofing.
- */
-
-export interface FBProtobufSKMSG {
-  id: number;
-  iteration: number;
-  ciphertext: Buffer;
-}
-
-export interface FBProtobufSKDM {
-  chainId: number;
-  iteration: number;
-  chainKey: Buffer;
-  signingPublicKey?: Buffer;
-}
-
-/**
- * Encodes a number into a varint (variable-length integer).
- * Uses arithmetic operations to safely handle large 32-bit unsigned integers.
- */
-export function encodeVarint(v: number): Buffer {
-  const res: number[] = [];
-  while (v >= 0x80) {
-    res.push((v % 128) | 0x80);
-    v = Math.floor(v / 128);
-  }
-  res.push(v);
-  return Buffer.from(res);
-}
-
-/**
- * Decodes a varint from a buffer at a given position.
- */
-export function decodeVarint(buf: Buffer | Uint8Array, pos: number): { value: number; length: number } {
-  let value = 0;
-  let shift = 1;
-  let length = 0;
-  while (true) {
-    const byte = buf[pos + length];
-    if (byte === undefined) throw new Error("Unexpected EOF in varint");
-    value += (byte & 0x7f) * shift;
-    length++;
-    if (!(byte & 0x80)) break;
-    shift *= 128;
-    if (length > 10) throw new Error("Varint too long");
-  }
-  return { value, length };
-}
-
-/**
- * Converts a 16-byte UUID buffer to a string.
- */
-export function uuidStringify(buf: Buffer | Uint8Array): string {
-  const hex = Buffer.from(buf).toString('hex');
-  return [
-    hex.slice(0, 8),
-    hex.slice(8, 12),
-    hex.slice(12, 16),
-    hex.slice(16, 20),
-    hex.slice(20, 32)
-  ].join('-');
-}
-
-/**
- * Parses a UUID string into a 16-byte buffer.
- */
-export function uuidParse(uuid: string): Buffer {
-  return Buffer.from(uuid.replace(/-/g, ''), 'hex');
-}
-
-/**
- * Generates a deterministic Mock Private Key based on the sender's JID.
- * This is used to satisfy libsignal-client's signature requirements for FB messages.
- */
-export function getMockPrivateKey(jid: string): PrivateKey {
-  const hash = createHash('sha256').update(`MOCK_SIG_KEY:${jid}`).digest();
-  return PrivateKey.deserialize(hash);
-}
-
-/**
- * Derives a stable distributionId (UUID) from a group and sender JID.
- * Facebook often lacks the distributionId in SKDM packets.
- */
-export function stableDistributionId(groupJid: string, senderJid: string): string {
-  const raw = `${groupJid}:${senderJid}`;
-  const bytes = Buffer.alloc(16);
-  for (let i = 0; i < raw.length && i < 16; i++) {
-    bytes[i] = raw.charCodeAt(i) & 0xff;
-  }
-  // Set UUID version 4 markers (though it's not a real v4 UUID)
-  bytes[6] = (bytes[6]! & 0x0f) | 0x40;
-  bytes[8] = (bytes[8]! & 0x3f) | 0x80;
-  return uuidStringify(bytes);
-}
-
-/**
- * Parses a Facebook-style Protobuf SKMSG.
- */
-export function parseFBProtobufSKMSG(buf: Buffer): FBProtobufSKMSG | null {
-  let pos = 0;
-  let id = 0;
-  let iteration = 0;
-  let ciphertext = Buffer.alloc(0);
-
-  try {
-    while (pos < buf.length) {
-      const { value: tagValue, length: tagLen } = decodeVarint(buf, pos);
-      pos += tagLen;
-      const field = tagValue >> 3;
-
-      if (field === 1) { // id
-        const { value, length } = decodeVarint(buf, pos);
-        id = value;
-        pos += length;
-      } else if (field === 2) { // iteration
-        const { value, length } = decodeVarint(buf, pos);
-        iteration = value;
-        pos += length;
-      } else if (field === 3) { // ciphertext
-        const { value, length } = decodeVarint(buf, pos);
-        pos += length;
-        ciphertext = buf.slice(pos, pos + value);
-        pos += value;
-      } else {
-        // Skip unknown
-        const tag = tagValue & 0x07;
-        if (tag === 0) {
-          const { length } = decodeVarint(buf, pos);
-          pos += length;
-        } else if (tag === 2) {
-          const { value, length } = decodeVarint(buf, pos);
-          pos += length + value;
-        } else break;
-      }
-    }
-    return { id, iteration, ciphertext };
-  } catch (e) {
-    return null;
-  }
-}
-
-/**
- * Parses a Facebook-style Protobuf SKDM.
- */
-export function parseFBProtobufSKDM(buf: Buffer): FBProtobufSKDM | null {
-  let pos = 0;
-  let chainId = 0;
-  let iteration = 0;
-  let chainKey = Buffer.alloc(0);
-  let signingPublicKey: Buffer | undefined;
-
-  try {
-    while (pos < buf.length) {
-      const { value: tagValue, length: tagLen } = decodeVarint(buf, pos);
-      pos += tagLen;
-      const field = tagValue >> 3;
-
-      if (field === 1) {
-        const { value, length } = decodeVarint(buf, pos);
-        chainId = value;
-        pos += length;
-      } else if (field === 2) {
-        const { value, length } = decodeVarint(buf, pos);
-        iteration = value;
-        pos += length;
-      } else if (field === 3) {
-        const { value, length } = decodeVarint(buf, pos);
-        pos += length;
-        chainKey = buf.slice(pos, pos + value);
-        pos += value;
-      } else if (field === 4) {
-        const { value, length } = decodeVarint(buf, pos);
-        pos += length;
-        signingPublicKey = buf.slice(pos, pos + value);
-        pos += value;
-      } else {
-        const tag = tagValue & 0x07;
-        if (tag === 0) {
-          const { length } = decodeVarint(buf, pos);
-          pos += length;
-        } else if (tag === 2) {
-          const { value, length } = decodeVarint(buf, pos);
-          pos += length + value;
-        } else break;
-      }
-    }
-    return { chainId, iteration, chainKey, signingPublicKey };
-  } catch (e) {
-    return null;
-  }
-}
-
-/**
- * Re-encodes a Facebook-style SenderKeyMessage into a standard Signal Protobuf.
- * FB messages often lack a signature and use a different tag structure.
- */
-export function wrapAsSignalSKMSG(params: {
-  distributionId: string;
-  id: number;
-  iteration: number;
-  ciphertext: Buffer;
-  senderJid: string;
-}): Buffer {
-  const { distributionId, id, iteration, ciphertext, senderJid } = params;
-  
-  const uuidBuf = uuidParse(distributionId);
-  const protoChunks = [
-    Buffer.from([0x0a, 0x10]), uuidBuf,            // Tag 1 (distributionId)
-    Buffer.from([0x10]), encodeVarint(id),        // Tag 2 (id)
-    Buffer.from([0x18]), encodeVarint(iteration), // Tag 3 (iteration)
-    Buffer.from([0x22]), encodeVarint(ciphertext.length), ciphertext, // Tag 4 (ct)
-  ];
-  
-  const protobuf = Buffer.concat(protoChunks);
-  const header = Buffer.from([0x33]); // Protocol version
-  const toSign = Buffer.concat([header, protobuf]);
-  
-  // Sign using our deterministic Mock Key
-  const privKey = getMockPrivateKey(senderJid);
-  const signature = privKey.sign(toSign);
-  
-  return Buffer.concat([toSign, signature]);
-}

package/src/e2ee/facebook/icdc-payload.ts

@@ -1,31 +0,0 @@
-import { ProtoWriter } from "../message/message-builder.ts";
-
-export interface ICDCIdentityListOptions {
-  seq: number;
-  timestamp: number;
-  devices: Uint8Array[];
-  signingDeviceIndex: number;
-}
-
-export function encodeICDCIdentityList(opts: ICDCIdentityListOptions): Buffer {
-  const w = new ProtoWriter();
-  w.varint(1, opts.seq);
-  w.uint64_varint(2, BigInt(opts.timestamp));
-  for (const device of opts.devices) {
-    w.bytes(3, Buffer.from(device));
-  }
-  w.varint(4, opts.signingDeviceIndex);
-  return w.build();
-}
-
-export interface SignedICDCIdentityListOptions {
-  details: Buffer;
-  signature: Buffer;
-}
-
-export function encodeSignedICDCIdentityList(opts: SignedICDCIdentityListOptions): Buffer {
-  const w = new ProtoWriter();
-  w.bytes(1, opts.details);
-  w.bytes(2, opts.signature);
-  return w.build();
-}

package/src/e2ee/index.ts

@@ -1,76 +0,0 @@
-/**
- * Public API for the E2EE module.
- * Import from here - don't import internal files directly.
- */
-
-// Client orchestrator
-export { E2EEClient } from "./application/e2ee-client.ts";
-export type {
-  E2EESendTextOptions,
-  E2EESendTextResult,
-  E2EEEncryptMediaOptions,
-  E2EEEncryptMediaResult,
-  E2EEDecryptMediaOptions,
-} from "./application/e2ee-client.ts";
-
-// Device store
-export { DeviceStore } from "./store/device-store.ts";
-export type { DeviceJSON, NoiseKeyPair } from "./store/device-store.ts";
-
-// Media crypto (can be used standalone)
-export { encryptMedia, decryptMedia, expandMediaKey, sha256, MediaType, MmsType } from "./media/media-crypto.ts";
-export type { MediaTypeKey, MediaKeys, EncryptMediaResult, DecryptMediaOptions } from "./media/media-crypto.ts";
-
-// Media upload
-export { uploadMedia } from "./media/media-upload.ts";
-export type { MediaUploadConfig, MediaUploadResult, MmsTypeStr } from "./media/media-upload.ts";
-
-// Signal manager (lower level)
-export {
-  jidToAddress,
-  addressToJidKey,
-  establishSession,
-  encryptDM,
-  decryptDM,
-  decryptDMPreKey,
-  encryptGroup,
-  decryptGroup,
-  createSenderKeyDistributionMessage,
-  processSKDM,
-  hasSession,
-} from "./signal/signal-manager.ts";
-
-// PreKey manager
-export {
-  generatePreKeys,
-  generateSignedPreKey,
-  buildPreKeyUploadPayload,
-  buildPreKeyBundle,
-  INITIAL_PREKEY_COUNT,
-  WANTED_PREKEY_COUNT,
-  MIN_PREKEY_COUNT,
-} from "./signal/prekey-manager.ts";
-export type { GeneratedPreKey, PreKeyUploadPayload, RawPreKeyBundle } from "./signal/prekey-manager.ts";
-
-// Message builder
-export {
-  encodeTextMessage,
-  encodeImageMessage,
-  encodeVideoMessage,
-  encodeAudioMessage,
-  encodeDocumentMessage,
-  encodeStickerMessage,
-  encodeReactionMessage,
-  encodeEditMessage,
-  encodeRevokeMessage,
-  encodeMessageApplication,
-  encodeMessageTransport,
-  FB_MESSAGE_VERSION,
-  FB_MESSAGE_APPLICATION_VERSION,
-  FB_CONSUMER_MESSAGE_VERSION,
-} from "./message/message-builder.ts";
-export type { MediaFields, MessageTransportOptions } from "./message/message-builder.ts";
-
-// Noise handshake
-export { doHandshake, WA_CERT_PUB_KEY, WA_HEADER } from "./transport/noise/noise-handshake.ts";
-export type { NoiseSocket, RawWebSocket, HandshakeResult } from "./transport/noise/noise-handshake.ts";

package/src/e2ee/internal.ts

@@ -1,27 +0,0 @@
-/**
- * Internal/dev barrel for E2EE implementation details.
- *
- * Public consumers should prefer `src/e2ee/index.ts` or the package root.
- * This file intentionally exposes lower-level protocol modules for tests,
- * debugging, and advanced integrations.
- */
-
-export * from "./application/e2ee-client.ts";
-export * from "./application/fanout-planner.ts";
-export * from "./application/outbound-message-cache.ts";
-export * from "./application/prekey-maintenance.ts";
-export * from "./application/retry-manager.ts";
-export * from "./store/device-json.ts";
-export * from "./store/device-repository.ts";
-export * from "./store/device-store.ts";
-export * from "./transport/binary/wa-binary.ts";
-export * from "./transport/dgw/dgw-socket.ts";
-export * from "./transport/noise/noise-handshake.ts";
-export * from "./transport/noise/noise-socket.ts";
-export * from "./signal/prekey-manager.ts";
-export * from "./signal/signal-manager.ts";
-export * from "./message/message-builder.ts";
-export * from "./media/media-crypto.ts";
-export * from "./media/media-upload.ts";
-export * from "./facebook/facebook-protocol-utils.ts";
-export { encodeICDCIdentityList as encodeFacebookICDCIdentityList, encodeSignedICDCIdentityList as encodeFacebookSignedICDCIdentityList } from "./facebook/icdc-payload.ts";

package/src/e2ee/media/media-crypto.ts

@@ -1,147 +0,0 @@
-/**
- * E2EE Media Crypto - Layer 4
- *
- * Implements the AES-256-CBC + HMAC-SHA256 + HKDF media scheme.
- *
- * No Signal Protocol needed here - this is pure symmetric crypto.
- */
-
-import { createCipheriv, createDecipheriv, createHmac, hkdfSync, randomBytes, createHash } from "node:crypto";
-import type { DecryptMediaOptions, EncryptMediaResult, MediaKeys } from "../../models/media.ts";
-export type { DecryptMediaOptions, EncryptMediaResult, MediaKeys };
-
-// Media type -> HKDF info string
-
-export const MediaType = {
-  image: "WhatsApp Image Keys",
-  video: "WhatsApp Video Keys",
-  audio: "WhatsApp Audio Keys",
-  document: "WhatsApp Document Keys",
-  sticker: "WhatsApp Image Keys",       // same as image
-  history: "WhatsApp History Keys",
-  appstate: "WhatsApp App State Keys",
-} as const;
-
-export type MediaTypeKey = keyof typeof MediaType;
-
-// MMS type strings used in upload/download URLs
-export const MmsType: Record<MediaTypeKey, string> = {
-  image: "image",
-  video: "video",
-  audio: "ptt",      // Messenger only allows PTT (push-to-talk), not generic audio
-  document: "document",
-  sticker: "image",
-  history: "md-msg-hist",
-  appstate: "md-app-state",
-};
-
-// Key derivation
-
-
-/**
- * HKDF-SHA256 expand of mediaKey into iv + cipherKey + macKey + refKey (112 bytes total).
- */
-export function expandMediaKey(mediaKey: Buffer, type: MediaTypeKey): MediaKeys {
-  const info = MediaType[type];
-  const expanded = Buffer.from(
-    hkdfSync("sha256", mediaKey, Buffer.alloc(0), info, 112),
-  );
-  return {
-    iv: expanded.subarray(0, 16),
-    cipherKey: expanded.subarray(16, 48),
-    macKey: expanded.subarray(48, 80),
-    refKey: expanded.subarray(80, 112),
-  };
-}
-
-// Encrypt
-
-
-/**
- * Encrypt media for upload.
- */
-export function encryptMedia(plaintext: Buffer, type: MediaTypeKey): EncryptMediaResult {
-  const mediaKey = randomBytes(32);
-  const { iv, cipherKey, macKey } = expandMediaKey(mediaKey, type);
-
-  // AES-256-CBC
-  const cipher = createCipheriv("aes-256-cbc", cipherKey, iv);
-  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-
-  // HMAC-SHA256(macKey, iv ‖ ciphertext), take first 10 bytes
-  const mac = createHmac("sha256", macKey)
-    .update(iv)
-    .update(ciphertext)
-    .digest()
-    .subarray(0, 10);
-
-  const dataToUpload = Buffer.concat([ciphertext, mac]);
-
-  return {
-    mediaKey,
-    fileSHA256: Buffer.from(createHash("sha256").update(plaintext).digest()),
-    fileEncSHA256: Buffer.from(createHash("sha256").update(dataToUpload).digest()),
-    fileLength: plaintext.length,
-    dataToUpload,
-  };
-}
-
-// Decrypt
-
-const MEDIA_MAC_LENGTH = 10;
-
-/**
- * Decrypt downloaded E2EE media.
- */
-export function decryptMedia(opts: DecryptMediaOptions): Buffer {
-  const { data, mediaKey, type, fileSHA256: expectedFileSHA256, fileEncSHA256: expectedFileEncSHA256 } = opts;
-
-  if (data.length <= MEDIA_MAC_LENGTH) {
-    throw new Error(`Media data too short (${data.length} bytes)`);
-  }
-
-  // Optional: verify encrypted SHA256 (checksum of entire downloaded blob)
-  if (expectedFileEncSHA256) {
-    const actual = createHash("sha256").update(data).digest();
-    if (!actual.equals(expectedFileEncSHA256)) {
-      throw new Error("Invalid media enc SHA256 - data corrupted or tampered");
-    }
-  }
-
-  const ciphertext = data.subarray(0, -MEDIA_MAC_LENGTH);
-  const mac = data.subarray(-MEDIA_MAC_LENGTH);
-
-  const { iv, cipherKey, macKey } = expandMediaKey(mediaKey, type);
-
-  // Verify HMAC
-  const expectedMac = createHmac("sha256", macKey)
-    .update(iv)
-    .update(ciphertext)
-    .digest()
-    .subarray(0, MEDIA_MAC_LENGTH);
-
-  if (!expectedMac.equals(mac)) {
-    throw new Error("Invalid media HMAC - data corrupted or wrong key");
-  }
-
-  // AES-256-CBC decrypt
-  const decipher = createDecipheriv("aes-256-cbc", cipherKey, iv);
-  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-
-  // Optional: verify plaintext SHA256
-  if (expectedFileSHA256) {
-    const actual = createHash("sha256").update(plaintext).digest();
-    if (!actual.equals(expectedFileSHA256)) {
-      throw new Error("Invalid media SHA256 - file corrupted after decryption");
-    }
-  }
-
-  return plaintext;
-}
-
-// Helpers
-
-/** SHA256 helper */
-export function sha256(data: Buffer): Buffer {
-  return Buffer.from(createHash("sha256").update(data).digest());
-}