wowok 2.1.10 → 2.1.13

package/dist/cjs/w/messenger/crypto.js

@@ -1,448 +1,555 @@
 "use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var crypto_exports = {};
-__export(crypto_exports, {
-  arrayBufferToUint8Array: () => arrayBufferToUint8Array,
-  base64ToBytes: () => base64ToBytes,
-  bufferEqual: () => bufferEqual,
-  bytesToBase64: () => bytesToBase64,
-  bytesToHex: () => bytesToHex,
-  calculateMerkleLeafHash: () => calculateMerkleLeafHash,
-  computeNewRoot: () => computeNewRoot,
-  generateNonce: () => generateNonce,
-  hashMessage: () => hashMessage,
-  hashPlaintext: () => hashPlaintext,
-  hashSha256: () => hashSha256,
-  hexToBytes: () => hexToBytes,
-  merkleHash: () => merkleHash,
-  recoverXed25519FromX25519PrivateKey: () => recoverXed25519FromX25519PrivateKey,
-  uint8ArrayToArrayBuffer: () => uint8ArrayToArrayBuffer,
-  verifyEd25519Signature: () => verifyEd25519Signature,
-  verifyMerkleChain: () => verifyMerkleChain,
-  verifyMerkleProof: () => verifyMerkleProof,
-  verifyMessage: () => verifyMessage,
-  verifySingleMerkleRoot: () => verifySingleMerkleRoot,
-  verifyWtsMessages: () => verifyWtsMessages
-});
-module.exports = __toCommonJS(crypto_exports);
-var import_ed25519 = require("@noble/curves/ed25519");
-var import_sha256 = require("@noble/hashes/sha256");
-var import_utils = require("@noble/hashes/utils");
+// Copyright (c) Wowok.
+// SPDX-License-Identifier: Apache-2.0
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recoverXed25519FromX25519PrivateKey = recoverXed25519FromX25519PrivateKey;
+exports.hashSha256 = hashSha256;
+exports.hashMessage = hashMessage;
+exports.hashPlaintext = hashPlaintext;
+exports.generateNonce = generateNonce;
+exports.bytesToBase64 = bytesToBase64;
+exports.base64ToBytes = base64ToBytes;
+exports.bytesToHex = bytesToHex;
+exports.hexToBytes = hexToBytes;
+exports.arrayBufferToUint8Array = arrayBufferToUint8Array;
+exports.uint8ArrayToArrayBuffer = uint8ArrayToArrayBuffer;
+exports.bufferEqual = bufferEqual;
+exports.calculateMerkleLeafHash = calculateMerkleLeafHash;
+exports.merkleHash = merkleHash;
+exports.computeNewRoot = computeNewRoot;
+exports.verifyMerkleProof = verifyMerkleProof;
+exports.verifyMerkleChain = verifyMerkleChain;
+exports.verifySingleMerkleRoot = verifySingleMerkleRoot;
+exports.verifyMessage = verifyMessage;
+exports.verifyEd25519Signature = verifyEd25519Signature;
+exports.verifyWtsMessages = verifyWtsMessages;
+/**
+ * Messenger 加密工具模块
+ *
+ * 基于 Signal Protocol (双棘轮算法) 的端到端加密实现
+ * 使用 XEd25519 进行密钥转换，兼容 Ed25519 签名
+ */
+const ed25519_1 = require("@noble/curves/ed25519");
+const sha256_1 = require("@noble/hashes/sha256");
+const utils_1 = require("@noble/hashes/utils");
+// ========== 签名与验证（内部函数） ==========
+/**
+ * 使用 Ed25519 公钥验证签名（内部使用）
+ */
 function verifyEd25519(publicKey, message, signature) {
-  try {
-    return import_ed25519.ed25519.verify(signature, message, publicKey);
-  } catch {
-    return false;
-  }
+    try {
+        return ed25519_1.ed25519.verify(signature, message, publicKey);
+    }
+    catch {
+        return false;
+    }
 }
+// ========== 密钥生成 ==========
+/**
+ * 从 X25519 私钥恢复 XEd25519 密钥对
+ */
 function recoverXed25519FromX25519PrivateKey(x25519PrivateKey) {
-  const x25519PublicKey = import_ed25519.x25519.getPublicKey(x25519PrivateKey);
-  const ed25519PrivateKey = x25519PrivateKey;
-  const ed25519PublicKey = import_ed25519.ed25519.getPublicKey(ed25519PrivateKey);
-  return {
-    x25519PublicKey,
-    x25519PrivateKey,
-    ed25519PrivateKey,
-    ed25519PublicKey
-  };
+    const x25519PublicKey = ed25519_1.x25519.getPublicKey(x25519PrivateKey);
+    const ed25519PrivateKey = x25519PrivateKey;
+    const ed25519PublicKey = ed25519_1.ed25519.getPublicKey(ed25519PrivateKey);
+    return {
+        x25519PublicKey,
+        x25519PrivateKey,
+        ed25519PrivateKey,
+        ed25519PublicKey,
+    };
 }
+// ========== 哈希函数 ==========
+/**
+ * 计算 SHA-256 哈希
+ */
 function hashSha256(data) {
-  return (0, import_sha256.sha256)(data);
+    return (0, sha256_1.sha256)(data);
 }
+/**
+ * 计算消息哈希（用于 Merkle Tree 叶子节点）
+ */
 function hashMessage(data) {
-  const hash = (0, import_sha256.sha256)(new TextEncoder().encode(data));
-  return bytesToHex(hash);
+    const hash = (0, sha256_1.sha256)(new TextEncoder().encode(data));
+    return bytesToHex(hash);
 }
+/**
+ * 计算明文哈希（用于 Merkle Tree 证明）
+ * plaintext_hash = SHA256(plaintext + client_timestamp + guardAddress + passportAddress)
+ */
 function hashPlaintext(plaintext, clientTimestamp, guardAddress, passportAddress, lastReceivedLeafIndex) {
-  let data = plaintext + clientTimestamp.toString();
-  if (lastReceivedLeafIndex !== void 0 && lastReceivedLeafIndex >= 0) {
-    data += lastReceivedLeafIndex.toString();
-  }
-  if (guardAddress) {
-    data += guardAddress;
-  }
-  if (passportAddress) {
-    data += passportAddress;
-  }
-  const hash = (0, import_sha256.sha256)(new TextEncoder().encode(data));
-  return "0x" + bytesToHex(hash);
+    let data = plaintext + clientTimestamp.toString();
+    // 【新增】包含 lastReceivedLeafIndex 在哈希计算中
+    if (lastReceivedLeafIndex !== undefined && lastReceivedLeafIndex >= 0) {
+        data += lastReceivedLeafIndex.toString();
+    }
+    if (guardAddress) {
+        data += guardAddress;
+    }
+    if (passportAddress) {
+        data += passportAddress;
+    }
+    const hash = (0, sha256_1.sha256)(new TextEncoder().encode(data));
+    return "0x" + bytesToHex(hash);
 }
+// ========== 工具函数 ==========
+/**
+ * 生成随机 nonce
+ */
 function generateNonce() {
-  return bytesToHex((0, import_utils.randomBytes)(16));
+    return bytesToHex((0, utils_1.randomBytes)(16));
 }
+/**
+ * Uint8Array 转 Base64
+ */
 function bytesToBase64(bytes) {
-  return Buffer.from(bytes).toString("base64");
+    return Buffer.from(bytes).toString("base64");
 }
+/**
+ * Base64 转 Uint8Array
+ */
 function base64ToBytes(base64) {
-  return new Uint8Array(Buffer.from(base64, "base64"));
+    return new Uint8Array(Buffer.from(base64, "base64"));
 }
+/**
+ * Uint8Array 转 Hex
+ */
 function bytesToHex(bytes) {
-  return Buffer.from(bytes).toString("hex");
+    return Buffer.from(bytes).toString("hex");
 }
+/**
+ * Hex 转 Uint8Array
+ */
 function hexToBytes(hex) {
-  return new Uint8Array(Buffer.from(hex, "hex"));
+    return new Uint8Array(Buffer.from(hex, "hex"));
 }
+/**
+ * ArrayBuffer 转 Uint8Array
+ */
 function arrayBufferToUint8Array(buf) {
-  return new Uint8Array(buf);
+    return new Uint8Array(buf);
 }
+/**
+ * Uint8Array 转 ArrayBuffer
+ */
 function uint8ArrayToArrayBuffer(arr) {
-  const result = arr.buffer.slice(
-    arr.byteOffset,
-    arr.byteOffset + arr.byteLength
-  );
-  return result;
+    const result = arr.buffer.slice(arr.byteOffset, arr.byteOffset + arr.byteLength);
+    return result;
 }
+/**
+ * 比较两个 ArrayBuffer 是否相等
+ */
 function bufferEqual(a, b) {
-  if (a.byteLength !== b.byteLength) return false;
-  const va = new Uint8Array(a);
-  const vb = new Uint8Array(b);
-  for (let i = 0; i < va.length; i++) {
-    if (va[i] !== vb[i]) return false;
-  }
-  return true;
+    if (a.byteLength !== b.byteLength)
+        return false;
+    const va = new Uint8Array(a);
+    const vb = new Uint8Array(b);
+    for (let i = 0; i < va.length; i++) {
+        if (va[i] !== vb[i])
+            return false;
+    }
+    return true;
 }
+/**
+ * 计算 Merkle 叶子哈希（与服务器端 calculate_message_hash 一致）
+ * leaf_hash = SHA256(plaintext_hash.as_bytes() + server_timestamp.to_le_bytes())
+ */
 function calculateMerkleLeafHash(plaintextHash, serverTimestamp) {
-  const plaintextHashBytes = new TextEncoder().encode(plaintextHash);
-  const timestampBuffer = new ArrayBuffer(8);
-  const timestampView = new DataView(timestampBuffer);
-  timestampView.setBigUint64(0, BigInt(serverTimestamp), true);
-  const timestampBytes = new Uint8Array(timestampBuffer);
-  const combined = new Uint8Array(
-    plaintextHashBytes.length + timestampBytes.length
-  );
-  combined.set(plaintextHashBytes);
-  combined.set(timestampBytes, plaintextHashBytes.length);
-  const hash = (0, import_sha256.sha256)(combined);
-  return "0x" + bytesToHex(hash);
+    const plaintextHashBytes = new TextEncoder().encode(plaintextHash);
+    const timestampBuffer = new ArrayBuffer(8);
+    const timestampView = new DataView(timestampBuffer);
+    timestampView.setBigUint64(0, BigInt(serverTimestamp), true);
+    const timestampBytes = new Uint8Array(timestampBuffer);
+    const combined = new Uint8Array(plaintextHashBytes.length + timestampBytes.length);
+    combined.set(plaintextHashBytes);
+    combined.set(timestampBytes, plaintextHashBytes.length);
+    const hash = (0, sha256_1.sha256)(combined);
+    return "0x" + bytesToHex(hash);
 }
+// ========== Merkle Tree 工具 ==========
+/**
+ * 计算两个哈希的父节点哈希
+ */
 function merkleHash(left, right) {
-  const leftBytes = hexToBytes(left.replace(/^0x/, ""));
-  const rightBytes = hexToBytes(right.replace(/^0x/, ""));
-  const combined = new Uint8Array(leftBytes.length + rightBytes.length);
-  combined.set(leftBytes);
-  combined.set(rightBytes, leftBytes.length);
-  return "0x" + bytesToHex((0, import_sha256.sha256)(combined));
+    const leftBytes = hexToBytes(left.replace(/^0x/, ""));
+    const rightBytes = hexToBytes(right.replace(/^0x/, ""));
+    const combined = new Uint8Array(leftBytes.length + rightBytes.length);
+    combined.set(leftBytes);
+    combined.set(rightBytes, leftBytes.length);
+    return "0x" + bytesToHex((0, sha256_1.sha256)(combined));
 }
+/**
+ * 计算新的 Merkle Root（与服务器保持一致）
+ *
+ * 服务器算法：
+ * new_root = SHA256(prev_root + leaf_hash + leaf_index_le_bytes)
+ *
+ * @param prevRoot 前一个 Root（hex 格式，带或不带 0x 前缀）
+ * @param leafHash 叶子节点哈希（hex 格式，带或不带 0x 前缀）
+ * @param leafIndex 叶子节点索引
+ * @returns 新的 Root（带 0x 前缀的 hex）
+ */
 function computeNewRoot(prevRoot, leafHash, leafIndex) {
-  const prevRootBytes = new TextEncoder().encode(prevRoot);
-  const leafHashBytes = new TextEncoder().encode(leafHash);
-  const leafIndexBuffer = new ArrayBuffer(4);
-  const leafIndexView = new DataView(leafIndexBuffer);
-  leafIndexView.setUint32(0, leafIndex, true);
-  const leafIndexBytes = new Uint8Array(leafIndexBuffer);
-  const combined = new Uint8Array(
-    prevRootBytes.length + leafHashBytes.length + leafIndexBytes.length
-  );
-  combined.set(prevRootBytes);
-  combined.set(leafHashBytes, prevRootBytes.length);
-  combined.set(leafIndexBytes, prevRootBytes.length + leafHashBytes.length);
-  return "0x" + bytesToHex((0, import_sha256.sha256)(combined));
+    // 与服务器端一致：直接对 hex 字符串编码（而不是解码 hex）
+    const prevRootBytes = new TextEncoder().encode(prevRoot);
+    const leafHashBytes = new TextEncoder().encode(leafHash);
+    // leaf_index 使用小端字节序 (u32)
+    const leafIndexBuffer = new ArrayBuffer(4);
+    const leafIndexView = new DataView(leafIndexBuffer);
+    leafIndexView.setUint32(0, leafIndex, true); // true = little endian
+    const leafIndexBytes = new Uint8Array(leafIndexBuffer);
+    // 组合：prev_root + leaf_hash + leaf_index
+    const combined = new Uint8Array(prevRootBytes.length + leafHashBytes.length + leafIndexBytes.length);
+    combined.set(prevRootBytes);
+    combined.set(leafHashBytes, prevRootBytes.length);
+    combined.set(leafIndexBytes, prevRootBytes.length + leafHashBytes.length);
+    return "0x" + bytesToHex((0, sha256_1.sha256)(combined));
 }
+/**
+ * 验证 Merkle Proof
+ */
 function verifyMerkleProof(leafHash, proof) {
-  let current = leafHash;
-  for (let i = 0; i < proof.siblings.length; i++) {
-    if (proof.indices[i] === 0) {
-      current = merkleHash(current, proof.siblings[i]);
-    } else {
-      current = merkleHash(proof.siblings[i], current);
+    let current = leafHash;
+    for (let i = 0; i < proof.siblings.length; i++) {
+        if (proof.indices[i] === 0) {
+            // 当前是左子节点
+            current = merkleHash(current, proof.siblings[i]);
+        }
+        else {
+            // 当前是右子节点
+            current = merkleHash(proof.siblings[i], current);
+        }
     }
-  }
-  return current === proof.root;
+    return current === proof.root;
 }
+/**
+ * 验证 Merkle Root 链的完整性和时序性
+ *
+ * 客户端使用此函数独立校验消息链的完整性，通过相同的算法核对 Merkle Tree root 的前后关系
+ *
+ * @param messages 按顺序排列的消息列表（按 leafIndex 排序）
+ * @param initialRoot 初始 Root（可选，默认为全0）
+ * @returns 验证结果
+ *
+ * @example
+ * ```typescript
+ * const messages = [
+ *   { leafIndex: 0, prevRoot: "0x00...", newRoot: "0xabc...", plaintextHash: "0x123..." },
+ *   { leafIndex: 1, prevRoot: "0xabc...", newRoot: "0xdef...", plaintextHash: "0x456..." },
+ * ];
+ * const result = verifyMerkleChain(messages);
+ * if (result.valid) {
+ *   console.log("Merkle 链验证通过");
+ * } else {
+ *   console.error("验证失败:", result.error);
+ * }
+ * ```
+ */
 function verifyMerkleChain(messages, initialRoot) {
-  if (messages.length === 0) {
-    return { valid: true };
-  }
-  const sortedMessages = [...messages].sort(
-    (a, b) => a.leafIndex - b.leafIndex
-  );
-  const zeroRoot = initialRoot || "0x" + "0".repeat(64);
-  let expectedPrevRoot = zeroRoot;
-  for (const msg of sortedMessages) {
-    if (msg.prevRoot.toLowerCase() !== expectedPrevRoot.toLowerCase()) {
-      return {
-        valid: false,
-        error: `Root chain broken at leafIndex ${msg.leafIndex}: expected prevRoot ${expectedPrevRoot}, got ${msg.prevRoot}`,
-        expectedRoot: expectedPrevRoot,
-        actualRoot: msg.prevRoot
-      };
+    if (messages.length === 0) {
+        return { valid: true };
     }
-    const result = verifySingleMerkleRoot(
-      msg.prevRoot,
-      msg.newRoot,
-      msg.plaintextHash,
-      msg.serverTimestamp,
-      msg.leafIndex
-    );
-    if (!result.valid) {
-      return {
-        valid: false,
-        error: `${result.error} at leafIndex ${msg.leafIndex}`,
-        expectedRoot: result.expectedRoot,
-        actualRoot: result.actualRoot
-      };
+    // 按 leafIndex 排序
+    const sortedMessages = [...messages].sort((a, b) => a.leafIndex - b.leafIndex);
+    // 初始 Root
+    const zeroRoot = initialRoot || "0x" + "0".repeat(64);
+    let expectedPrevRoot = zeroRoot;
+    for (const msg of sortedMessages) {
+        // 1. 验证 prevRoot 是否匹配预期（链式连续性检查）
+        if (msg.prevRoot.toLowerCase() !== expectedPrevRoot.toLowerCase()) {
+            return {
+                valid: false,
+                error: `Root chain broken at leafIndex ${msg.leafIndex}: expected prevRoot ${expectedPrevRoot}, got ${msg.prevRoot}`,
+                expectedRoot: expectedPrevRoot,
+                actualRoot: msg.prevRoot,
+            };
+        }
+        // 2. 复用 verifySingleMerkleRoot 验证单个消息的 Root 计算
+        const result = verifySingleMerkleRoot(msg.prevRoot, msg.newRoot, msg.plaintextHash, msg.serverTimestamp, msg.leafIndex);
+        if (!result.valid) {
+            // 添加 leafIndex 上下文到错误信息
+            return {
+                valid: false,
+                error: `${result.error} at leafIndex ${msg.leafIndex}`,
+                expectedRoot: result.expectedRoot,
+                actualRoot: result.actualRoot,
+            };
+        }
+        // 3. 更新预期的 prevRoot 为当前的 newRoot
+        expectedPrevRoot = msg.newRoot;
     }
-    expectedPrevRoot = msg.newRoot;
-  }
-  return { valid: true };
+    return { valid: true };
 }
+/**
+ * 验证单个消息的 Merkle Root 计算
+ *
+ * 用于验证服务器返回的 Merkle 数据是否正确
+ *
+ * @param prevRoot 前一个 Root
+ * @param newRoot 新的 Root（服务器返回）
+ * @param plaintextHash 明文哈希
+ * @param serverTimestamp 服务器时间戳
+ * @param leafIndex 叶子索引
+ * @returns 验证结果
+ */
 function verifySingleMerkleRoot(prevRoot, newRoot, plaintextHash, serverTimestamp, leafIndex) {
-  const leafHash = calculateMerkleLeafHash(plaintextHash, serverTimestamp);
-  const computedRoot = computeNewRoot(prevRoot, leafHash, leafIndex);
-  if (computedRoot.toLowerCase() !== newRoot.toLowerCase()) {
-    return {
-      valid: false,
-      error: `Root computation mismatch: expected ${computedRoot}, got ${newRoot}`,
-      expectedRoot: computedRoot,
-      actualRoot: newRoot
-    };
-  }
-  return { valid: true };
+    // 计算正确的 leafHash
+    const leafHash = calculateMerkleLeafHash(plaintextHash, serverTimestamp);
+    const computedRoot = computeNewRoot(prevRoot, leafHash, leafIndex);
+    if (computedRoot.toLowerCase() !== newRoot.toLowerCase()) {
+        return {
+            valid: false,
+            error: `Root computation mismatch: expected ${computedRoot}, got ${newRoot}`,
+            expectedRoot: computedRoot,
+            actualRoot: newRoot,
+        };
+    }
+    return { valid: true };
 }
+/**
+ * 通用消息验证函数
+ *
+ * 基于 Message 结构中保存的数据验证消息的完整性和 Merkle 证明
+ *
+ * @param params 验证参数
+ * @returns 验证结果
+ *
+ * @example
+ * ```typescript
+ * const result = verifyMessage({
+ *   messageId: "msg-123",
+ *   plaintext: "Hello",
+ *   plaintextHash: "0xabc...",
+ *   createdAt: 1234567890,
+ *   guardAddress: "0x...",
+ *   passportAddress: "0x...",
+ *   merkleMetadata: { ... }
+ * });
+ *
+ * if (!result.valid) {
+ *   throw new Error(result.error);
+ * }
+ * ```
+ */
 function verifyMessage(params) {
-  const {
-    messageId,
-    plaintext,
-    plaintextHash,
-    createdAt,
-    guardAddress,
-    passportAddress,
-    lastReceivedLeafIndex,
-    serverSignature,
-    serverPublicKey,
-    merkleMetadata
-  } = params;
-  const computedPlaintextHash = hashPlaintext(
-    plaintext,
-    createdAt,
-    guardAddress,
-    passportAddress,
-    lastReceivedLeafIndex
-  );
-  const normalizeHash = (hash) => {
-    return hash.toLowerCase().replace(/^0x/, "");
-  };
-  if (normalizeHash(computedPlaintextHash) !== normalizeHash(plaintextHash)) {
-    return {
-      valid: false,
-      error: `Plaintext hash mismatch for message ${messageId}: expected ${plaintextHash}, got ${computedPlaintextHash}`,
-      failedCheck: "plaintext"
+    const { messageId, plaintext, plaintextHash, createdAt, guardAddress, passportAddress, lastReceivedLeafIndex, serverSignature, serverPublicKey, merkleMetadata, } = params;
+    // 1. 验证 plaintextHash（本地验证）
+    // 【更新】包含 lastReceivedLeafIndex 在哈希计算中
+    const computedPlaintextHash = hashPlaintext(plaintext, createdAt, guardAddress, passportAddress, lastReceivedLeafIndex);
+    // 标准化哈希值（移除 0x 前缀，转小写）
+    const normalizeHash = (hash) => {
+        return hash.toLowerCase().replace(/^0x/, "");
     };
-  }
-  if (merkleMetadata) {
-    if (merkleMetadata.proofSiblings && merkleMetadata.proofIndices) {
-      const bodyB64 = bytesToBase64(new TextEncoder().encode(plaintext));
-      const leafHash = hashMessage(bodyB64);
-      const proofValid = verifyMerkleProof(leafHash, {
-        root: merkleMetadata.newRoot,
-        siblings: merkleMetadata.proofSiblings,
-        indices: merkleMetadata.proofIndices
-      });
-      if (!proofValid) {
+    if (normalizeHash(computedPlaintextHash) !== normalizeHash(plaintextHash)) {
         return {
-          valid: false,
-          error: `Merkle proof verification failed for message ${messageId}`,
-          failedCheck: "merkle"
+            valid: false,
+            error: `Plaintext hash mismatch for message ${messageId}: expected ${plaintextHash}, got ${computedPlaintextHash}`,
+            failedCheck: "plaintext",
         };
-      }
-    }
-    const serverTimestamp = merkleMetadata.serverTimestamp;
-    if (!serverTimestamp) {
-      return {
-        valid: false,
-        error: `Missing server timestamp for Merkle root verification in message ${messageId}`,
-        failedCheck: "merkle"
-      };
-    }
-    if (!merkleMetadata.prevRoot) {
-      return {
-        valid: false,
-        error: `Missing prevRoot for Merkle root verification in message ${messageId}`,
-        failedCheck: "merkle"
-      };
-    }
-    const rootValid = verifySingleMerkleRoot(
-      merkleMetadata.prevRoot,
-      merkleMetadata.newRoot,
-      plaintextHash,
-      serverTimestamp,
-      merkleMetadata.leafIndex
-    );
-    if (!rootValid.valid) {
-      return {
-        valid: false,
-        error: `Merkle root verification failed for message ${messageId}: ${rootValid.error}`,
-        failedCheck: "merkle"
-      };
     }
-  }
-  if (serverSignature && serverPublicKey) {
-    const timestamp = merkleMetadata?.serverTimestamp;
-    if (!timestamp) {
-      return {
-        valid: false,
-        error: `Missing server timestamp for signature verification in message ${messageId}`,
-        failedCheck: "merkle"
-      };
+    // 2. 如果提供了 Merkle 元数据，验证 Merkle
+    if (merkleMetadata) {
+        // 2.1 验证 Merkle Proof（消息是否在树中）
+        // 注意：服务器拉取消息时不返回 proofSiblings 和 proofIndices
+        // 只有在发送消息时返回的 merkleMetadata 才包含这些字段
+        if (merkleMetadata.proofSiblings && merkleMetadata.proofIndices) {
+            const bodyB64 = bytesToBase64(new TextEncoder().encode(plaintext));
+            const leafHash = hashMessage(bodyB64);
+            const proofValid = verifyMerkleProof(leafHash, {
+                root: merkleMetadata.newRoot,
+                siblings: merkleMetadata.proofSiblings,
+                indices: merkleMetadata.proofIndices,
+            });
+            if (!proofValid) {
+                return {
+                    valid: false,
+                    error: `Merkle proof verification failed for message ${messageId}`,
+                    failedCheck: "merkle",
+                };
+            }
+        }
+        // 2.2 验证 Root 计算是否正确
+        // 必须使用服务器时间戳进行验证
+        const serverTimestamp = merkleMetadata.serverTimestamp;
+        if (!serverTimestamp) {
+            return {
+                valid: false,
+                error: `Missing server timestamp for Merkle root verification in message ${messageId}`,
+                failedCheck: "merkle",
+            };
+        }
+        if (!merkleMetadata.prevRoot) {
+            return {
+                valid: false,
+                error: `Missing prevRoot for Merkle root verification in message ${messageId}`,
+                failedCheck: "merkle",
+            };
+        }
+        const rootValid = verifySingleMerkleRoot(merkleMetadata.prevRoot, merkleMetadata.newRoot, plaintextHash, serverTimestamp, merkleMetadata.leafIndex);
+        if (!rootValid.valid) {
+            return {
+                valid: false,
+                error: `Merkle root verification failed for message ${messageId}: ${rootValid.error}`,
+                failedCheck: "merkle",
+            };
+        }
     }
-    if (!merkleMetadata?.newRoot) {
-      return {
-        valid: false,
-        error: `Missing newRoot for signature verification in message ${messageId}`,
-        failedCheck: "merkle"
-      };
+    // 3. 验证服务器签名（如果提供了签名和公钥）
+    if (serverSignature && serverPublicKey) {
+        // 必须使用服务器时间戳进行验证，不能使用客户端时间
+        const timestamp = merkleMetadata?.serverTimestamp;
+        if (!timestamp) {
+            return {
+                valid: false,
+                error: `Missing server timestamp for signature verification in message ${messageId}`,
+                failedCheck: "merkle",
+            };
+        }
+        // 验证必需的字段
+        if (!merkleMetadata?.newRoot) {
+            return {
+                valid: false,
+                error: `Missing newRoot for signature verification in message ${messageId}`,
+                failedCheck: "merkle",
+            };
+        }
+        if (!merkleMetadata?.prevRoot) {
+            return {
+                valid: false,
+                error: `Missing prevRoot for signature verification in message ${messageId}`,
+                failedCheck: "merkle",
+            };
+        }
+        const signData = `${merkleMetadata.prevRoot}:${merkleMetadata.newRoot}:${timestamp}:${serverPublicKey}`;
+        const signatureValid = verifyEd25519Signature(serverPublicKey, signData, serverSignature);
+        if (!signatureValid) {
+            return {
+                valid: false,
+                error: `Server signature verification failed for message ${messageId}`,
+                failedCheck: "merkle",
+            };
+        }
     }
-    if (!merkleMetadata?.prevRoot) {
-      return {
-        valid: false,
-        error: `Missing prevRoot for signature verification in message ${messageId}`,
-        failedCheck: "merkle"
-      };
-    }
-    const signData = `${merkleMetadata.prevRoot}:${merkleMetadata.newRoot}:${timestamp}:${serverPublicKey}`;
-    const signatureValid = verifyEd25519Signature(
-      serverPublicKey,
-      signData,
-      serverSignature
-    );
-    if (!signatureValid) {
-      return {
-        valid: false,
-        error: `Server signature verification failed for message ${messageId}`,
-        failedCheck: "merkle"
-      };
-    }
-  }
-  return { valid: true };
+    return { valid: true };
 }
+/**
+ * 验证 Ed25519 签名（十六进制格式）
+ *
+ * @param publicKeyHex 公钥（十六进制字符串）
+ * @param message 消息内容
+ * @param signatureHex 签名（十六进制字符串）
+ * @returns 验证结果
+ */
 function verifyEd25519Signature(publicKeyHex, message, signatureHex) {
-  try {
-    const publicKey = hexToBytes(publicKeyHex.replace("0x", ""));
-    const signature = hexToBytes(signatureHex.replace("0x", ""));
-    const messageBytes = new TextEncoder().encode(message);
-    return verifyEd25519(publicKey, messageBytes, signature);
-  } catch {
-    return false;
-  }
+    try {
+        const publicKey = hexToBytes(publicKeyHex.replace("0x", ""));
+        const signature = hexToBytes(signatureHex.replace("0x", ""));
+        const messageBytes = new TextEncoder().encode(message);
+        return verifyEd25519(publicKey, messageBytes, signature);
+    }
+    catch {
+        return false;
+    }
 }
+/**
+ * 验证 WTS 文件中的消息
+ *
+ * @param messages WTS 消息列表（按 leafIndex 排序）
+ * @returns 验证结果
+ */
 function verifyWtsMessages(messages) {
-  if (messages.length === 0) {
-    return { valid: true };
-  }
-  const sortedMessages = [...messages].sort(
-    (a, b) => a.leafIndex - b.leafIndex
-  );
-  for (let i = 0; i < sortedMessages.length; i++) {
-    const msg = sortedMessages[i];
-    if (msg.plaintext != null) {
-      const computedHash = hashPlaintext(
-        msg.plaintext || "",
-        msg.clientTimestamp,
-        msg.guardAddress,
-        msg.passportAddress,
-        msg.lastReceivedLeafIndex
-      );
-      if (computedHash.toLowerCase() !== msg.plaintextHash.toLowerCase()) {
-        return {
-          valid: false,
-          error: `Plaintext hash mismatch for message ${msg.id} at index ${i}`,
-          failedMessageIndex: i,
-          failedCheck: "plaintext"
-        };
-      }
+    if (messages.length === 0) {
+        return { valid: true };
     }
-    if (msg.merkleProof) {
-      const bodyB64 = bytesToBase64(
-        new TextEncoder().encode(msg.plaintext || "")
-      );
-      const leafHash = hashMessage(bodyB64);
-      const proofValid = verifyMerkleProof(leafHash, {
-        root: msg.merkleRoot,
-        siblings: msg.merkleProof.siblings,
-        indices: msg.merkleProof.indices
-      });
-      if (!proofValid) {
-        return {
-          valid: false,
-          error: `Merkle proof verification failed for message ${msg.id} at index ${i}`,
-          failedMessageIndex: i,
-          failedCheck: "merkle"
-        };
-      }
+    // 按 leafIndex 排序
+    const sortedMessages = [...messages].sort((a, b) => a.leafIndex - b.leafIndex);
+    // 验证每条消息
+    for (let i = 0; i < sortedMessages.length; i++) {
+        const msg = sortedMessages[i];
+        // 1. 如果提供了明文，验证 plaintextHash
+        if (msg.plaintext != null) {
+            const computedHash = hashPlaintext(msg.plaintext || "", msg.clientTimestamp, msg.guardAddress, msg.passportAddress, msg.lastReceivedLeafIndex);
+            if (computedHash.toLowerCase() !== msg.plaintextHash.toLowerCase()) {
+                return {
+                    valid: false,
+                    error: `Plaintext hash mismatch for message ${msg.id} at index ${i}`,
+                    failedMessageIndex: i,
+                    failedCheck: "plaintext",
+                };
+            }
+        }
+        // 2. 如果提供了 Merkle Proof，验证 Merkle
+        if (msg.merkleProof) {
+            const bodyB64 = bytesToBase64(new TextEncoder().encode(msg.plaintext || ""));
+            const leafHash = hashMessage(bodyB64);
+            const proofValid = verifyMerkleProof(leafHash, {
+                root: msg.merkleRoot,
+                siblings: msg.merkleProof.siblings,
+                indices: msg.merkleProof.indices,
+            });
+            if (!proofValid) {
+                return {
+                    valid: false,
+                    error: `Merkle proof verification failed for message ${msg.id} at index ${i}`,
+                    failedMessageIndex: i,
+                    failedCheck: "merkle",
+                };
+            }
+        }
+        // 3. 验证服务器签名（如果提供了签名和公钥）
+        if (msg.serverSignature && msg.serverPublicKey) {
+            // 验证必需的字段
+            if (!msg.merkleRoot) {
+                return {
+                    valid: false,
+                    error: `Missing merkleRoot for message ${msg.id} at index ${i}`,
+                    failedMessageIndex: i,
+                    failedCheck: "merkle",
+                };
+            }
+            if (!msg.timestamp) {
+                return {
+                    valid: false,
+                    error: `Missing timestamp for message ${msg.id} at index ${i}`,
+                    failedMessageIndex: i,
+                    failedCheck: "merkle",
+                };
+            }
+            if (!msg.prevRoot) {
+                return {
+                    valid: false,
+                    error: `Missing prevRoot for message ${msg.id} at index ${i}`,
+                    failedMessageIndex: i,
+                    failedCheck: "merkle",
+                };
+            }
+            const signData = `${msg.prevRoot}:${msg.merkleRoot}:${msg.timestamp}:${msg.serverPublicKey}`;
+            const signatureValid = verifyEd25519Signature(msg.serverPublicKey, signData, msg.serverSignature);
+            if (!signatureValid) {
+                return {
+                    valid: false,
+                    error: `Server signature verification failed for message ${msg.id} at index ${i}`,
+                    failedMessageIndex: i,
+                    failedCheck: "merkle",
+                };
+            }
+        }
     }
-    if (msg.serverSignature && msg.serverPublicKey) {
-      if (!msg.merkleRoot) {
+    // 4. 验证 Merkle 链的连续性
+    const chainResult = verifyMerkleChain(sortedMessages.map((msg) => ({
+        leafIndex: msg.leafIndex,
+        prevRoot: msg.merkleRoot, // WTS 中只保存了最终的 merkleRoot
+        newRoot: msg.merkleRoot,
+        plaintextHash: msg.plaintextHash,
+        serverTimestamp: msg.timestamp,
+    })));
+    if (!chainResult.valid) {
         return {
-          valid: false,
-          error: `Missing merkleRoot for message ${msg.id} at index ${i}`,
-          failedMessageIndex: i,
-          failedCheck: "merkle"
+            valid: false,
+            error: chainResult.error,
+            failedCheck: "chain",
         };
-      }
-      if (!msg.timestamp) {
-        return {
-          valid: false,
-          error: `Missing timestamp for message ${msg.id} at index ${i}`,
-          failedMessageIndex: i,
-          failedCheck: "merkle"
-        };
-      }
-      if (!msg.prevRoot) {
-        return {
-          valid: false,
-          error: `Missing prevRoot for message ${msg.id} at index ${i}`,
-          failedMessageIndex: i,
-          failedCheck: "merkle"
-        };
-      }
-      const signData = `${msg.prevRoot}:${msg.merkleRoot}:${msg.timestamp}:${msg.serverPublicKey}`;
-      const signatureValid = verifyEd25519Signature(
-        msg.serverPublicKey,
-        signData,
-        msg.serverSignature
-      );
-      if (!signatureValid) {
-        return {
-          valid: false,
-          error: `Server signature verification failed for message ${msg.id} at index ${i}`,
-          failedMessageIndex: i,
-          failedCheck: "merkle"
-        };
-      }
     }
-  }
-  const chainResult = verifyMerkleChain(
-    sortedMessages.map((msg) => ({
-      leafIndex: msg.leafIndex,
-      prevRoot: msg.merkleRoot,
-      // WTS 中只保存了最终的 merkleRoot
-      newRoot: msg.merkleRoot,
-      plaintextHash: msg.plaintextHash,
-      serverTimestamp: msg.timestamp
-    }))
-  );
-  if (!chainResult.valid) {
-    return {
-      valid: false,
-      error: chainResult.error,
-      failedCheck: "chain"
-    };
-  }
-  return { valid: true };
+    return { valid: true };
 }
+//# sourceMappingURL=crypto.js.map