fb-messenger-e2ee 0.1.1 → 0.1.2

package/tests/unit/e2ee/media-crypto.test.ts

@@ -1,55 +0,0 @@
-import { describe, it, expect } from "@jest/globals";
-import { decryptMedia, encryptMedia, expandMediaKey, MmsType, sha256 } from "../../../src/e2ee/media/media-crypto.ts";
-
-describe("media-crypto", () => {
-  it("encrypts and decrypts media with verifiable hashes", () => {
-    const plaintext = Buffer.from("hello encrypted media");
-    const encrypted = encryptMedia(plaintext, "image");
-
-    expect(encrypted.mediaKey.length).toBe(32);
-    expect(encrypted.fileLength).toBe(plaintext.length);
-    expect(encrypted.fileSHA256).toEqual(sha256(plaintext));
-    expect(encrypted.fileEncSHA256).toEqual(sha256(encrypted.dataToUpload));
-
-    const decrypted = decryptMedia({
-      data: encrypted.dataToUpload,
-      mediaKey: encrypted.mediaKey,
-      type: "image",
-      fileSHA256: encrypted.fileSHA256,
-      fileEncSHA256: encrypted.fileEncSHA256,
-    });
-    expect(decrypted).toEqual(plaintext);
-  });
-
-  it("rejects tampered encrypted hashes before decryption", () => {
-    const encrypted = encryptMedia(Buffer.from("payload"), "video");
-    const badHash = Buffer.alloc(32, 1);
-
-    expect(() => decryptMedia({
-      data: encrypted.dataToUpload,
-      mediaKey: encrypted.mediaKey,
-      type: "video",
-      fileEncSHA256: badHash,
-    })).toThrow("Invalid media enc SHA256");
-  });
-
-  it("rejects invalid HMAC and too-short media payloads", () => {
-    const encrypted = encryptMedia(Buffer.from("payload"), "audio");
-    const tampered = Buffer.from(encrypted.dataToUpload);
-    tampered[tampered.length - 1] = tampered[tampered.length - 1]! ^ 0xff;
-
-    expect(() => decryptMedia({ data: tampered, mediaKey: encrypted.mediaKey, type: "audio" })).toThrow("Invalid media HMAC");
-    expect(() => decryptMedia({ data: Buffer.alloc(10), mediaKey: encrypted.mediaKey, type: "audio" })).toThrow("Media data too short");
-  });
-
-  it("derives stable key sizes and maps MMS types", () => {
-    const keys = expandMediaKey(Buffer.alloc(32, 7), "document");
-
-    expect(keys.iv.length).toBe(16);
-    expect(keys.cipherKey.length).toBe(32);
-    expect(keys.macKey.length).toBe(32);
-    expect(keys.refKey.length).toBe(32);
-    expect(MmsType.audio).toBe("ptt");
-    expect(MmsType.sticker).toBe("image");
-  });
-});

package/tests/unit/e2ee/media-upload.test.ts

@@ -1,60 +0,0 @@
-import { jest, describe, it, expect, afterEach } from "@jest/globals";
-import { toMediaUploadToken, uploadMedia } from "../../../src/e2ee/media/media-upload.ts";
-
-describe("media-upload", () => {
-  afterEach(() => {
-    jest.restoreAllMocks();
-  });
-
-  it("builds padded URL-safe media upload tokens", () => {
-    expect(toMediaUploadToken(Buffer.from([0xfb]))).toBe("-w==");
-    expect(toMediaUploadToken(Buffer.from([0xfb, 0xff]))).toBe("-_8=");
-  });
-
-  it("rejects uploads without a media_conn auth token", async () => {
-    const fetchMock = jest.spyOn(globalThis, "fetch");
-
-    await expect(uploadMedia(
-      { host: "rupload.facebook.com", auth: "" },
-      Buffer.from("encrypted"),
-      Buffer.alloc(32),
-      "image",
-    )).rejects.toThrow("Missing media upload auth token");
-
-    expect(fetchMock).not.toHaveBeenCalled();
-  });
-
-  it("posts encrypted media using the server auth token and padded upload token", async () => {
-    const fetchMock = jest.spyOn(globalThis, "fetch").mockResolvedValue({
-      ok: true,
-      json: async () => ({
-        url: "https://cdn.example/image",
-        direct_path: "/direct/path",
-        handle: "handle-1",
-        object_id: "object-1",
-      }),
-    } as Response);
-
-    const result = await uploadMedia(
-      { host: "rupload.facebook.com", auth: "server-auth" },
-      Buffer.from("encrypted"),
-      Buffer.from([0xfb]),
-      "image",
-    );
-
-    expect(result).toEqual({
-      url: "https://cdn.example/image",
-      directPath: "/direct/path",
-      handle: "handle-1",
-      objectId: "object-1",
-    });
-    expect(fetchMock).toHaveBeenCalledTimes(1);
-
-    const call = fetchMock.mock.calls[0];
-    expect(call).toBeDefined();
-    const [url, init] = call!;
-    expect(String(url)).toBe("https://rupload.facebook.com/wa-msgr/mms/image/-w==?auth=server-auth&token=-w%3D%3D");
-    expect(init?.method).toBe("POST");
-    expect((init?.headers as Record<string, string>)["Content-Length"]).toBe("9");
-  });
-});

package/tests/unit/e2ee/message-builder.test.ts

@@ -1,42 +0,0 @@
-import { ProtoWriter } from "../../../src/e2ee/message/message-builder.ts";
-
-describe("message-builder", () => {
-  describe("ProtoWriter", () => {
-    it("should encode varints correctly", () => {
-      const writer = new ProtoWriter();
-      writer.varint(1, 150); // Field 1, value 150
-      // 1 << 3 | 0 = 8 (header)
-      // 150 -> [0x96, 0x01] (varint)
-      expect(writer.build()).toEqual(Buffer.from([0x08, 0x96, 0x01]));
-    });
-
-    it("should encode bigint varints correctly", () => {
-      const writer = new ProtoWriter();
-      writer.uint64_varint(2, 1234567890123456789n);
-      const buf = writer.build();
-      expect(buf[0]).toBe((2 << 3) | 0);
-      expect(buf.length).toBeGreaterThan(5);
-    });
-
-    it("should encode strings/bytes correctly", () => {
-      const writer = new ProtoWriter();
-      writer.string(3, "test");
-      // Header: (3 << 3) | 2 = 26 (0x1a)
-      // Len: 4
-      // Data: "test"
-      expect(writer.build()).toEqual(Buffer.from([0x1a, 0x04, 116, 101, 115, 116]));
-    });
-
-    it("should encode booleans correctly", () => {
-      const writer = new ProtoWriter();
-      writer.bool(4, true);
-      expect(writer.build()).toEqual(Buffer.from([(4 << 3) | 0, 0x01]));
-    });
-
-    it("should encode fixed64 correctly", () => {
-      const writer = new ProtoWriter();
-      writer.uint64(5, 0x0102030405060708n);
-      expect(writer.build()).toEqual(Buffer.from([(5 << 3) | 1, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01]));
-    });
-  });
-});

package/tests/unit/e2ee/message-builders.test.ts

@@ -1,230 +0,0 @@
-import { describe, it, expect } from "@jest/globals";
-import {
-  decodeConsumerApplication,
-  decodeImageTransport,
-  decodeVideoTransport,
-  decodeAudioTransport,
-  decodeDocumentTransport,
-  decodeStickerTransport,
-  decodeMessageApplication,
-  decodeMessageTransport,
-  encodeClientPayload,
-  encodeMessageApplication,
-  encodeMessageTransport,
-  encodeEditMessage,
-  encodeReactionMessage,
-  encodeTextMessage,
-  encodeImageMessage,
-  encodeVideoMessage,
-  encodeAudioMessage,
-  encodeDocumentMessage,
-  encodeStickerMessage,
-  encodeRevokeMessage,
-  FB_CONSUMER_MESSAGE_VERSION,
-  FB_MESSAGE_APPLICATION_VERSION,
-} from "../../../src/e2ee/message/message-builder.ts";
-
-describe("message builders", () => {
-  it("encodes text consumer applications", () => {
-    const decoded = decodeConsumerApplication(encodeTextMessage("hello"));
-
-    expect(decoded.payload.content.messageText.text).toBe("hello");
-  });
-
-  it("encodes reaction consumer applications", () => {
-    const decoded = decodeConsumerApplication(encodeReactionMessage("mid.1", "👍"));
-
-    expect(decoded.payload.content.reactionMessage.text).toBe("👍");
-    expect(decoded.payload.content.reactionMessage.key.ID).toBe("mid.1");
-  });
-
-  it("encodes E2EE group reaction message keys with remote JID and participant", () => {
-    const decoded = decodeConsumerApplication(encodeReactionMessage("7456658723671758234", "👍", {
-      remoteJid: "1805602490133470@g.us",
-      fromMe: false,
-      participant: "100042415119261.0@msgr",
-      senderTimestampMs: 1777805979855,
-    }));
-
-    const reaction = decoded.payload.content.reactionMessage;
-    expect(reaction.text).toBe("👍");
-    expect(reaction.senderTimestampMS).toBe("1777805979855");
-    expect(reaction.key).toMatchObject({
-      remoteJID: "1805602490133470@g.us",
-      fromMe: false,
-      ID: "7456658723671758234",
-      participant: "100042415119261.0@msgr",
-    });
-  });
-
-  it("encodes edit consumer applications", () => {
-    const decoded = decodeConsumerApplication(encodeEditMessage("mid.1", "new text"));
-
-    expect(decoded.payload.content.editMessage.key.ID).toBe("mid.1");
-    expect(decoded.payload.content.editMessage.message.text).toBe("new text");
-  });
-
-
-
-  const media = {
-    mimeType: "image/png",
-    fileSHA256: Buffer.alloc(32, 1),
-    fileLength: 12345,
-    mediaKey: Buffer.alloc(32, 2),
-    fileEncSHA256: Buffer.alloc(32, 3),
-    directPath: "/mms/direct-path",
-    caption: "hello media",
-    width: 640,
-    height: 480,
-    seconds: 9,
-    ptt: true,
-    fileName: "file.pdf",
-    objectId: "object-123",
-    mediaKeyTimestamp: 1710000000,
-  };
-
-  it("encodes image messages using the image oneof and nested WAMediaTransport", () => {
-    const decoded = decodeConsumerApplication(encodeImageMessage(media));
-    const image = decoded.payload.content.imageMessage;
-    const transport = decodeImageTransport(image.image.payload);
-    const common = transport.integral.transport;
-
-    expect(image.caption.text).toBe("hello media");
-    expect(image.image.version).toBe(1);
-    expect(common.integral.fileSHA256).toEqual(media.fileSHA256);
-    expect(common.integral.mediaKey).toEqual(media.mediaKey);
-    expect(common.integral.fileEncSHA256).toEqual(media.fileEncSHA256);
-    expect(common.integral.directPath).toBe(media.directPath);
-    expect(common.integral.mediaKeyTimestamp).toBe(media.mediaKeyTimestamp);
-    expect(common.ancillary.mimetype).toBe("image/png");
-    expect(common.ancillary.fileLength).toBe(media.fileLength);
-    expect(common.ancillary.objectID).toBe("object-123");
-    expect(common.ancillary.thumbnail).toMatchObject({ thumbnailWidth: 640, thumbnailHeight: 480 });
-    expect(transport.ancillary).toMatchObject({ width: 640, height: 480 });
-    expect(decoded.payload.content.contactMessage).toBeUndefined();
-  });
-
-  it("encodes video messages using the video oneof, not contactMessage", () => {
-    const decoded = decodeConsumerApplication(encodeVideoMessage({ ...media, mimeType: "video/mp4" }));
-    const video = decoded.payload.content.videoMessage;
-    const transport = decodeVideoTransport(video.video.payload);
-    const common = transport.integral.transport;
-
-    expect(video.caption.text).toBe("hello media");
-    expect(video.video.version).toBe(1);
-    expect(common.ancillary.mimetype).toBe("video/mp4");
-    expect(transport.ancillary).toMatchObject({ width: 640, height: 480, seconds: 9, gifPlayback: false });
-    expect(decoded.payload.content.contactMessage).toBeUndefined();
-  });
-
-  it("encodes audio messages using the audio oneof with PTT metadata", () => {
-    const decoded = decodeConsumerApplication(encodeAudioMessage({ ...media, mimeType: "audio/ogg" }));
-    const audio = decoded.payload.content.audioMessage;
-    const transport = decodeAudioTransport(audio.audio.payload);
-    const common = transport.integral.transport;
-
-    expect(audio.PTT).toBe(true);
-    expect(audio.audio.version).toBe(1);
-    expect(common.ancillary.mimetype).toBe("audio/ogg");
-    expect(transport.ancillary.seconds).toBe(9);
-    expect(decoded.payload.content.locationMessage).toBeUndefined();
-  });
-
-  it("encodes document messages using the document oneof with filename", () => {
-    const decoded = decodeConsumerApplication(encodeDocumentMessage({ ...media, mimeType: "application/pdf" }));
-    const document = decoded.payload.content.documentMessage;
-    const transport = decodeDocumentTransport(document.document.payload);
-    const common = transport.integral.transport;
-
-    expect(document.fileName).toBe("file.pdf");
-    expect(document.document.version).toBe(1);
-    expect(common.ancillary.mimetype).toBe("application/pdf");
-    expect(common.ancillary.objectID).toBe("object-123");
-    expect(decoded.payload.content.extendedTextMessage).toBeUndefined();
-  });
-
-  it("encodes sticker messages using the sticker oneof", () => {
-    const decoded = decodeConsumerApplication(encodeStickerMessage({ ...media, mimeType: "image/webp", caption: undefined }));
-    const sticker = decoded.payload.content.stickerMessage;
-    const transport = decodeStickerTransport(sticker.sticker.payload);
-    const common = transport.integral.transport;
-
-    expect(sticker.sticker.version).toBe(1);
-    expect(common.ancillary.mimetype).toBe("image/webp");
-    expect(transport.ancillary).toMatchObject({ width: 640, height: 480 });
-    expect(decoded.payload.content.statusTextMessage).toBeUndefined();
-  });
-
-  it("encodes revoke messages as application data with a valid message key", () => {
-    const decoded = decodeConsumerApplication(encodeRevokeMessage("mid.remove", {
-      remoteJid: "180@g.us",
-      fromMe: true,
-    }));
-
-    expect(decoded.payload.applicationData.revoke.key.remoteJID).toBe("180@g.us");
-    expect(decoded.payload.applicationData.revoke.key.ID).toBe("mid.remove");
-    expect(decoded.payload.applicationData.revoke.key.fromMe).toBe(true);
-  });
-
-  it("wraps consumer bytes in MessageApplication with franking metadata and quote", () => {
-    const consumer = encodeTextMessage("quoted");
-    const { messageApp, frankingKey, frankingTag } = encodeMessageApplication(consumer, {
-      id: "mid.quote",
-      senderJid: "100.1@msgr",
-    });
-    const decoded = decodeMessageApplication(messageApp);
-
-    expect(decoded.payload.subProtocol.consumerMessage.version).toBe(FB_CONSUMER_MESSAGE_VERSION);
-    expect(decoded.payload.subProtocol.consumerMessage.payload).toEqual(consumer);
-    expect(decoded.metadata.frankingKey).toEqual(frankingKey);
-    expect(frankingKey.length).toBe(32);
-    expect(frankingTag.length).toBe(32);
-    expect(decoded.metadata.quotedMessage.stanzaID).toBe("mid.quote");
-    expect(decoded.metadata.quotedMessage.remoteJID).toBe("100.1@msgr");
-  });
-
-  it("encodes MessageTransport with app payload, DSM, SKDM, and backup directive", () => {
-    const messageApp = Buffer.from("message-app");
-    const skdmBytes = Buffer.from("skdm");
-    const decoded = decodeMessageTransport(encodeMessageTransport({
-      messageApp,
-      padding: Buffer.from([1]),
-      dsm: { destinationJid: "200.0@msgr", phash: "hash" },
-      skdm: { groupId: "180@g.us", skdmBytes },
-      backupDirective: { messageId: "mid.1", actionType: "REMOVE" },
-    }));
-
-    expect(decoded.payload.applicationPayload.payload).toEqual(messageApp);
-    expect(decoded.payload.applicationPayload.version).toBe(FB_MESSAGE_APPLICATION_VERSION);
-    expect(decoded.protocol.integral.padding).toEqual(Buffer.from([1]));
-    expect(decoded.protocol.integral.DSM).toMatchObject({ destinationJID: "200.0@msgr", phash: "hash" });
-    expect(decoded.protocol.ancillary.skdm.groupID).toBe("180@g.us");
-    expect(decoded.protocol.ancillary.skdm.axolotlSenderKeyDistributionMessage).toEqual(skdmBytes);
-    expect(decoded.protocol.ancillary.backupDirective).toMatchObject({ messageID: "mid.1", actionType: "DELETE" });
-  });
-
-  it("encodes SKDM-only transports without application payload", () => {
-    const decoded = decodeMessageTransport(encodeMessageTransport({
-      padding: Buffer.from([2]),
-      skdm: { groupId: "180@g.us", skdmBytes: Buffer.from("skdm") },
-    }));
-
-    expect(decoded.payload).toBeUndefined();
-    expect(decoded.protocol.integral.padding).toEqual(Buffer.from([2]));
-    expect(decoded.protocol.ancillary.skdm.groupID).toBe("180@g.us");
-  });
-
-  it("encodes client payload with username, device ID, CAT, user agent, and pull flag", () => {
-    const payload = encodeClientPayload({
-      username: 123456789n,
-      deviceId: 42,
-      fbCatBase64: "cat-token",
-      fbUserAgent: Buffer.from("ua"),
-    });
-
-    expect(payload).toContain(42);
-    expect(payload.includes(Buffer.from("cat-token"))).toBe(true);
-    expect(payload.includes(Buffer.from("ua"))).toBe(true);
-    expect([...payload.slice(-3)]).toEqual([0x88, 0x02, 0x01]); // field 33 bool header + true
-  });
-});

package/tests/unit/e2ee/noise-handshake.test.ts

@@ -1,260 +0,0 @@
-import { createCipheriv, createDecipheriv, createHash, hkdfSync } from "node:crypto";
-import { doHandshake, generateX25519, getX25519PublicKey, x25519DH, WA_HEADER } from "../../../src/e2ee/transport/noise/noise-handshake.ts";
-
-describe("noise-handshake", () => {
-  describe("X25519 helpers", () => {
-    it("should generate valid X25519 keys", () => {
-      const { priv, pub } = generateX25519();
-      expect(priv.length).toBe(32);
-      expect(pub.length).toBe(32);
-    });
-
-    it("should derive public key from private key", () => {
-      const { priv, pub } = generateX25519();
-      const derivedPub = getX25519PublicKey(priv);
-      expect(derivedPub.toString("hex")).toBe(pub.toString("hex"));
-    });
-
-    it("should perform Diffie-Hellman exchange", () => {
-      const alice = generateX25519();
-      const bob = generateX25519();
-
-      const secret1 = x25519DH(alice.priv, bob.pub);
-      const secret2 = x25519DH(bob.priv, alice.pub);
-
-      expect(secret1.length).toBe(32);
-      expect(secret1.toString("hex")).toBe(secret2.toString("hex"));
-    });
-  });
-
-  describe("Constants", () => {
-    it("should have the correct WA_HEADER", () => {
-      expect(WA_HEADER).toEqual(Buffer.from([87, 65, 6, 3]));
-    });
-  });
-});
-
-
-const NOISE_START_PATTERN = Buffer.from("Noise_XX_25519_AESGCM_SHA256\0\0\0\0");
-
-function sha256(data: Buffer): Buffer {
-  return Buffer.from(createHash("sha256").update(data).digest());
-}
-
-class TestNoiseState {
-  private h: Buffer;
-  private ck: Buffer;
-  private k: Buffer | null = null;
-  private n = 0;
-
-  constructor() {
-    this.h = NOISE_START_PATTERN.length === 32 ? Buffer.from(NOISE_START_PATTERN) : sha256(NOISE_START_PATTERN);
-    this.ck = this.h;
-    this.mixHash(WA_HEADER);
-  }
-
-  mixHash(data: Buffer): void {
-    this.h = sha256(Buffer.concat([this.h, data]));
-  }
-
-  mixKey(input: Buffer): void {
-    const expanded = Buffer.from(hkdfSync("sha256", input, this.ck, "", 64));
-    this.ck = expanded.subarray(0, 32);
-    this.k = expanded.subarray(32, 64);
-    this.n = 0;
-  }
-
-  mixSharedSecretIntoKey(priv: Buffer, pub: Buffer): void {
-    this.mixKey(x25519DH(priv, pub));
-  }
-
-  encrypt(plaintext: Buffer): Buffer {
-    if (!this.k) throw new Error("missing key");
-    const nonce = Buffer.alloc(12);
-    nonce.writeUInt32BE(this.n++, 8);
-    const cipher = createCipheriv("aes-256-gcm", this.k, nonce);
-    cipher.setAAD(this.h);
-    const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
-    this.mixHash(encrypted);
-    return encrypted;
-  }
-
-  decrypt(ciphertext: Buffer): Buffer {
-    if (!this.k) throw new Error("missing key");
-    const nonce = Buffer.alloc(12);
-    nonce.writeUInt32BE(this.n++, 8);
-    const body = ciphertext.subarray(0, -16);
-    const tag = ciphertext.subarray(-16);
-    const decipher = createDecipheriv("aes-256-gcm", this.k, nonce);
-    decipher.setAAD(this.h);
-    decipher.setAuthTag(tag);
-    const plaintext = Buffer.concat([decipher.update(body), decipher.final()]);
-    this.mixHash(ciphertext);
-    return plaintext;
-  }
-
-  finish(): { clientSendKey: Buffer; clientRecvKey: Buffer } {
-    const expanded = Buffer.from(hkdfSync("sha256", Buffer.alloc(0), this.ck, Buffer.alloc(0), 64));
-    return { clientSendKey: expanded.subarray(0, 32), clientRecvKey: expanded.subarray(32, 64) };
-  }
-}
-
-function encVarint(n: number): Buffer {
-  const bytes: number[] = [];
-  let v = n >>> 0;
-  while (v > 127) {
-    bytes.push((v & 0x7f) | 0x80);
-    v >>>= 7;
-  }
-  bytes.push(v);
-  return Buffer.from(bytes);
-}
-
-function encLenDelim(field: number, data: Buffer): Buffer {
-  return Buffer.concat([encVarint((field << 3) | 2), encVarint(data.length), data]);
-}
-
-function decodeLenDelim(data: Buffer, targetField: number): Buffer {
-  let pos = 0;
-  while (pos < data.length) {
-    const tag = data[pos++]!;
-    const field = tag >> 3;
-    const wire = tag & 0x07;
-    if (wire !== 2) throw new Error(`unexpected wire ${wire}`);
-    let len = 0;
-    let shift = 0;
-    while (true) {
-      const b = data[pos++]!;
-      len |= (b & 0x7f) << shift;
-      if (!(b & 0x80)) break;
-      shift += 7;
-    }
-    const value = data.subarray(pos, pos + len);
-    pos += len;
-    if (field === targetField) return Buffer.from(value);
-  }
-  throw new Error(`field ${targetField} not found`);
-}
-
-function prependLength(data: Buffer): Buffer {
-  const header = Buffer.alloc(3);
-  header.writeUIntBE(data.length, 0, 3);
-  return Buffer.concat([header, data]);
-}
-
-function decryptAppFrame(frame: Buffer, key: Buffer, counter: number): Buffer {
-  const len = frame.readUIntBE(0, 3);
-  const payload = frame.subarray(3, 3 + len);
-  const body = payload.subarray(0, -16);
-  const tag = payload.subarray(-16);
-  const nonce = Buffer.alloc(12);
-  nonce.writeBigUInt64BE(BigInt(counter), 4);
-  const decipher = createDecipheriv("aes-256-gcm", key, nonce);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(body), decipher.final()]);
-}
-
-function encryptAppPayload(plaintext: Buffer, key: Buffer, counter: number): Buffer {
-  const nonce = Buffer.alloc(12);
-  nonce.writeBigUInt64BE(BigInt(counter), 4);
-  const cipher = createCipheriv("aes-256-gcm", key, nonce);
-  return Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
-}
-
-class FakeNoiseWebSocket {
-  public sent: Buffer[] = [];
-  public clientPayload: Buffer | null = null;
-  public keys: { clientSendKey: Buffer; clientRecvKey: Buffer } | null = null;
-  public closed = false;
-  private inbound: Buffer[] = [];
-  private readonly serverEphemeral = generateX25519();
-  private readonly serverStatic = generateX25519();
-  private readonly state = new TestNoiseState();
-
-  send(data: Buffer): void {
-    this.sent.push(Buffer.from(data));
-    if (this.sent.length === 2) this.processClientFinish(data);
-  }
-
-  async readRaw(len?: number): Promise<Buffer> {
-    if (this.inbound.length === 0) this.enqueueServerHello();
-    const chunk = this.inbound.shift();
-    if (!chunk) throw new Error("no inbound data");
-    if (len !== undefined) expect(chunk).toHaveLength(len);
-    return chunk;
-  }
-
-  close(): void {
-    this.closed = true;
-  }
-
-  enqueueServerAppFrame(plaintext: Buffer): void {
-    if (!this.keys) throw new Error("handshake keys not ready");
-    const encrypted = encryptAppPayload(plaintext, this.keys.clientRecvKey, 0);
-    const header = Buffer.alloc(3);
-    header.writeUIntBE(encrypted.length, 0, 3);
-    this.inbound.push(header, encrypted);
-  }
-
-  private enqueueServerHello(): void {
-    const first = this.sent[0];
-    if (!first) throw new Error("client hello not sent");
-    expect(first.subarray(0, 4)).toEqual(WA_HEADER);
-    const clientHelloLen = first.readUIntBE(4, 3);
-    const clientHello = first.subarray(7, 7 + clientHelloLen);
-    const hello = decodeLenDelim(clientHello, 2);
-    const clientEphemeral = decodeLenDelim(hello, 1);
-
-    this.state.mixHash(clientEphemeral);
-    this.state.mixHash(this.serverEphemeral.pub);
-    this.state.mixSharedSecretIntoKey(this.serverEphemeral.priv, clientEphemeral);
-    const encryptedStatic = this.state.encrypt(this.serverStatic.pub);
-    this.state.mixSharedSecretIntoKey(this.serverStatic.priv, clientEphemeral);
-    const encryptedCert = this.state.encrypt(Buffer.from("test-cert"));
-
-    const serverHello = Buffer.concat([
-      encLenDelim(1, this.serverEphemeral.pub),
-      encLenDelim(2, encryptedStatic),
-      encLenDelim(3, encryptedCert),
-    ]);
-    const frame = prependLength(encLenDelim(3, serverHello));
-    this.inbound.push(frame.subarray(0, 3), frame.subarray(3));
-  }
-
-  private processClientFinish(frame: Buffer): void {
-    const finishPayload = frame.subarray(3);
-    const finish = decodeLenDelim(finishPayload, 4);
-    const encryptedStatic = decodeLenDelim(finish, 1);
-    const encryptedPayload = decodeLenDelim(finish, 2);
-    const clientStatic = this.state.decrypt(encryptedStatic);
-    this.state.mixSharedSecretIntoKey(this.serverEphemeral.priv, clientStatic);
-    this.clientPayload = this.state.decrypt(encryptedPayload);
-    this.keys = this.state.finish();
-  }
-}
-
-describe("noise-handshake integration", () => {
-  it("performs a full Noise XX handshake and returns an encrypted frame socket", async () => {
-    const ws = new FakeNoiseWebSocket();
-    const noiseKey = generateX25519();
-    const clientPayload = Buffer.from("client-payload");
-
-    const result = await doHandshake(ws as any, noiseKey.priv, clientPayload);
-
-    expect(ws.sent).toHaveLength(2);
-    expect(ws.sent[0]!.subarray(0, 4)).toEqual(WA_HEADER);
-    expect(ws.sent[1]!.subarray(0, 4)).not.toEqual(WA_HEADER);
-    expect(ws.clientPayload).toEqual(clientPayload);
-    expect(ws.keys).not.toBeNull();
-
-    await result.socket.sendFrame(Buffer.from("ping"));
-    expect(ws.sent).toHaveLength(3);
-    expect(decryptAppFrame(ws.sent[2]!, ws.keys!.clientSendKey, 0)).toEqual(Buffer.from("ping"));
-
-    ws.enqueueServerAppFrame(Buffer.from("pong"));
-    await expect(result.socket.readFrame()).resolves.toEqual(Buffer.from("pong"));
-
-    result.socket.close();
-    expect(ws.closed).toBe(true);
-  });
-});