zapo-js 0.1.0

package/dist/esm/signal/api/codec.js

@@ -0,0 +1,23 @@
+import { decodeNodeContentBase64OrBytes } from '../../transport/node/helpers.js';
+export function decodeExactLength(value, field, expectedLength) {
+    const bytes = decodeNodeContentBase64OrBytes(value, field);
+    if (bytes.byteLength !== expectedLength) {
+        throw new Error(`${field} must be ${expectedLength} bytes`);
+    }
+    return bytes;
+}
+export function parseUint(bytes, field) {
+    if (bytes.byteLength === 1) {
+        return bytes[0];
+    }
+    if (bytes.byteLength === 2) {
+        return (bytes[0] << 8) | bytes[1];
+    }
+    if (bytes.byteLength === 3) {
+        return (bytes[0] << 16) | (bytes[1] << 8) | bytes[2];
+    }
+    if (bytes.byteLength === 4) {
+        return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0, false);
+    }
+    throw new Error(`${field} has invalid byte length`);
+}

package/dist/esm/signal/api/constants.js

@@ -0,0 +1,9 @@
+export const SIGNAL_UPLOAD_PREKEYS_COUNT = 812;
+export const SIGNAL_SIGNED_PREKEY_ROTATION_INTERVAL_MS = 27 * 24 * 60 * 60 * 1000;
+export const SIGNAL_SIGNED_PREKEY_SERVER_ERROR_BACKOFF_MS = 24 * 60 * 60 * 1000;
+export const SIGNAL_KEY_BUNDLE_TYPE_BYTES = new Uint8Array([5]);
+export const SIGNAL_KEY_BUNDLE_TYPE_LENGTH = 1;
+export const SIGNAL_REGISTRATION_ID_LENGTH = 4;
+export const SIGNAL_KEY_ID_LENGTH = 3;
+export const SIGNAL_KEY_DATA_LENGTH = 32;
+export const SIGNAL_SIGNATURE_LENGTH = 64;

package/dist/esm/signal/api/prekeys.js

@@ -0,0 +1,9 @@
+import { parseIqError } from '../../transport/node/query.js';
+export { buildMissingPreKeysFetchIq, buildPreKeyUploadIq, buildSignedPreKeyRotateIq } from '../../transport/node/builders/prekeys.js';
+export function parsePreKeyUploadFailure(node) {
+    const error = parseIqError(node);
+    return {
+        ...(error.numericCode !== undefined ? { errorCode: error.numericCode } : {}),
+        errorText: error.text
+    };
+}

package/dist/esm/signal/constants.js

@@ -0,0 +1,16 @@
+import { SERIALIZED_PUB_KEY_PREFIX as CORE_SERIALIZED_PUB_KEY_PREFIX } from '../crypto/core/constants.js';
+import { TEXT_ENCODER } from '../util/bytes.js';
+export const SIGNAL_VERSION = 3;
+export const SIGNAL_GROUP_VERSION = 3;
+export const SERIALIZED_PUB_KEY_PREFIX = CORE_SERIALIZED_PUB_KEY_PREFIX;
+export const KEY_TYPE_CURVE25519 = 5;
+export const SIGNAL_MAC_SIZE = 8;
+export const SIGNATURE_SIZE = 64;
+export const MAX_PREV_SESSIONS = 40;
+export const MAX_UNUSED_KEYS = 2000;
+export const FUTURE_MESSAGES_MAX = 2000;
+export const SENDER_KEY_FUTURE_MESSAGES_MAX = 20000;
+export const MESSAGE_KEY_LABEL = new Uint8Array([1]);
+export const CHAIN_KEY_LABEL = new Uint8Array([2]);
+export const WHISPER_GROUP_INFO = TEXT_ENCODER.encode('WhisperGroup');
+export const SIGNAL_PREFIX = new Uint8Array(32).fill(0xff);

package/dist/esm/signal/crypto/WaAdvSignature.js

@@ -0,0 +1,60 @@
+import { ed25519VerifyRaw, importHmacKey, hmacSign, randomBytesAsync, sha512, toRawPubKey } from '../../crypto/index.js';
+import { clampCurvePrivateKeyInPlace, montgomeryToEdwardsPublic } from '../../crypto/curves/X25519.js';
+import { encodeExtendedPoint, scalarMultBase } from '../../crypto/math/edwards.js';
+import { bytesToBigIntLE, bigIntToBytesLE } from '../../crypto/math/le.js';
+import { modGroup } from '../../crypto/math/mod.js';
+import { ADV_PREFIX_ACCOUNT_SIGNATURE, ADV_PREFIX_DEVICE_SIGNATURE, ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, ADV_PREFIX_HOSTED_DEVICE_SIGNATURE, SIGNAL_PREFIX_SIGNATURE_RANDOM } from '../crypto/constants.js';
+import { concatBytes } from '../../util/bytes.js';
+export { ADV_PREFIX_ACCOUNT_SIGNATURE, ADV_PREFIX_DEVICE_SIGNATURE, ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, ADV_PREFIX_HOSTED_DEVICE_SIGNATURE } from '../crypto/constants.js';
+export async function verifySignalSignature(publicKey, message, signature) {
+    if (signature.length !== 64) {
+        return false;
+    }
+    if ((signature[63] & 0x60) !== 0) {
+        return false;
+    }
+    const signalSignature = new Uint8Array(signature);
+    const signBit = signalSignature[63] & 0x80;
+    signalSignature[63] &= 0x7f;
+    const curvePublic = toRawPubKey(publicKey);
+    const edPublic = montgomeryToEdwardsPublic(curvePublic, signBit);
+    return ed25519VerifyRaw(edPublic, signalSignature, message);
+}
+export async function signSignalMessage(privateKey, message) {
+    if (privateKey.length !== 32) {
+        throw new Error(`invalid curve25519 private key length ${privateKey.length}`);
+    }
+    const clampedPrivateKey = clampCurvePrivateKeyInPlace(privateKey);
+    const privateScalar = bytesToBigIntLE(clampedPrivateKey);
+    const encodedPublic = encodeExtendedPoint(scalarMultBase(privateScalar));
+    const pubKeySignBit = encodedPublic[31] & 0x80;
+    const randomSuffix = await randomBytesAsync(64);
+    const hashInput = concatBytes([
+        SIGNAL_PREFIX_SIGNATURE_RANDOM,
+        clampedPrivateKey,
+        message,
+        randomSuffix
+    ]);
+    const r = modGroup(bytesToBigIntLE(await sha512(hashInput)));
+    const encodedR = encodeExtendedPoint(scalarMultBase(r));
+    const hInput = concatBytes([encodedR, encodedPublic, message]);
+    const h = modGroup(bytesToBigIntLE(await sha512(hInput)));
+    const s = modGroup(r + h * privateScalar);
+    const encodedS = bigIntToBytesLE(s, 32);
+    encodedS[31] = (encodedS[31] & 0x7f) | pubKeySignBit;
+    return concatBytes([encodedR, encodedS]);
+}
+export async function verifyDeviceIdentityAccountSignature(details, accountSignature, identityPublicKey, accountSignatureKey, isHosted = false) {
+    const prefix = isHosted ? ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE : ADV_PREFIX_ACCOUNT_SIGNATURE;
+    const message = concatBytes([prefix, details, identityPublicKey]);
+    return verifySignalSignature(accountSignatureKey, message, accountSignature);
+}
+export async function generateDeviceSignature(details, identityKeyPair, accountSignatureKey, isHosted = false) {
+    const prefix = isHosted ? ADV_PREFIX_HOSTED_DEVICE_SIGNATURE : ADV_PREFIX_DEVICE_SIGNATURE;
+    const message = concatBytes([prefix, details, identityKeyPair.pubKey, accountSignatureKey]);
+    return signSignalMessage(identityKeyPair.privKey, message);
+}
+export async function computeAdvIdentityHmac(secretKey, details) {
+    const key = await importHmacKey(secretKey);
+    return hmacSign(key, details);
+}

package/dist/esm/signal/crypto/constants.js

@@ -0,0 +1,8 @@
+export const SIGNAL_PREFIX_SIGNATURE_RANDOM = new Uint8Array([
+    0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+]);
+export const ADV_PREFIX_ACCOUNT_SIGNATURE = new Uint8Array([6, 0]);
+export const ADV_PREFIX_DEVICE_SIGNATURE = new Uint8Array([6, 1]);
+export const ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE = new Uint8Array([6, 5]);
+export const ADV_PREFIX_HOSTED_DEVICE_SIGNATURE = new Uint8Array([6, 6]);

package/dist/esm/signal/group/SenderKeyChain.js

@@ -0,0 +1,97 @@
+import { hkdf, importHmacKey, hmacSign } from '../../crypto/index.js';
+import { CHAIN_KEY_LABEL, MAX_UNUSED_KEYS, MESSAGE_KEY_LABEL, SENDER_KEY_FUTURE_MESSAGES_MAX, WHISPER_GROUP_INFO } from '../constants.js';
+import { removeAt } from '../../util/bytes.js';
+export async function selectMessageKey(senderKey, targetIteration) {
+    const delta = targetIteration - senderKey.iteration;
+    if (delta > SENDER_KEY_FUTURE_MESSAGES_MAX) {
+        throw new Error('sender key message is too far in future');
+    }
+    const currentUnused = senderKey.unusedMessageKeys ?? [];
+    if (delta < 0) {
+        const foundIndex = currentUnused.findIndex((entry) => entry.iteration === targetIteration);
+        if (foundIndex === -1) {
+            throw new Error('sender key message iteration is stale');
+        }
+        const messageKey = currentUnused[foundIndex];
+        const nextUnused = removeAt(currentUnused, foundIndex);
+        return {
+            messageKey,
+            updatedRecord: {
+                ...senderKey,
+                unusedMessageKeys: nextUnused
+            }
+        };
+    }
+    let chainState = await createSenderChainState(senderKey.chainKey);
+    const firstDerived = await deriveSenderKeyMsgKeyFromState(senderKey.iteration, chainState);
+    chainState = firstDerived.nextState;
+    let messageKey = firstDerived.messageKey;
+    let nextUnused = currentUnused.slice();
+    if (delta > 0) {
+        let overflow = delta + currentUnused.length - MAX_UNUSED_KEYS;
+        if (overflow > 0) {
+            nextUnused = nextUnused.slice(overflow);
+            overflow -= currentUnused.length;
+        }
+        for (let iteration = senderKey.iteration + 1; iteration <= targetIteration; iteration += 1) {
+            if (overflow > 0) {
+                overflow -= 1;
+            }
+            else {
+                nextUnused.push(messageKey);
+            }
+            const derived = await deriveSenderKeyMsgKeyFromState(iteration, chainState);
+            chainState = derived.nextState;
+            messageKey = derived.messageKey;
+        }
+    }
+    return {
+        messageKey,
+        updatedRecord: {
+            ...senderKey,
+            iteration: targetIteration + 1,
+            chainKey: chainState.chainKey,
+            unusedMessageKeys: nextUnused
+        }
+    };
+}
+export async function deriveSenderKeyMsgKey(iteration, chainKey) {
+    const state = await createSenderChainState(chainKey);
+    const derived = await deriveSenderKeyMsgKeyFromState(iteration, state);
+    return {
+        nextChainKey: derived.nextState.chainKey,
+        messageKey: derived.messageKey
+    };
+}
+async function createSenderChainState(chainKey) {
+    if (chainKey.length !== 32) {
+        throw new Error('sender key chainKey must be 32 bytes');
+    }
+    return {
+        chainKey,
+        hmacKey: await importHmacKey(chainKey)
+    };
+}
+async function deriveSenderKeyMsgKeyFromState(iteration, state) {
+    const nextChainRawPromise = hmacSign(state.hmacKey, CHAIN_KEY_LABEL);
+    const messageInputKeyPromise = hmacSign(state.hmacKey, MESSAGE_KEY_LABEL);
+    const [nextChainRaw, messageInputKey] = await Promise.all([
+        nextChainRawPromise,
+        messageInputKeyPromise
+    ]);
+    const nextChainKey = nextChainRaw.subarray(0, 32);
+    const [nextHmacKey, messageSeed] = await Promise.all([
+        importHmacKey(nextChainKey),
+        hkdf(messageInputKey, null, WHISPER_GROUP_INFO, 50)
+    ]);
+    return {
+        nextState: {
+            chainKey: nextChainKey,
+            hmacKey: nextHmacKey
+        },
+        messageKey: {
+            iteration,
+            seed: messageSeed
+        }
+    };
+}

package/dist/esm/signal/group/SenderKeyCodec.js

@@ -0,0 +1,46 @@
+import { readVersionedContent, toSerializedPubKey } from '../../crypto/index.js';
+import { proto } from '../../proto.js';
+import { SIGNATURE_SIZE, SIGNAL_GROUP_VERSION } from '../constants.js';
+import { toBytesView } from '../../util/bytes.js';
+export function parseDistributionPayload(payload) {
+    const body = readVersionedContent(payload, SIGNAL_GROUP_VERSION, 0);
+    const decoded = proto.SenderKeyDistributionMessage.decode(body);
+    if (decoded.id === null ||
+        decoded.id === undefined ||
+        decoded.iteration === null ||
+        decoded.iteration === undefined ||
+        decoded.chainKey === null ||
+        decoded.chainKey === undefined ||
+        decoded.signingKey === null ||
+        decoded.signingKey === undefined) {
+        throw new Error('invalid sender key distribution message');
+    }
+    const chainKey = toBytesView(decoded.chainKey);
+    if (chainKey.length !== 32) {
+        throw new Error('sender key distribution chainKey must be 32 bytes');
+    }
+    return {
+        keyId: decoded.id,
+        iteration: decoded.iteration,
+        chainKey,
+        signingPublicKey: toSerializedPubKey(toBytesView(decoded.signingKey))
+    };
+}
+export function parseSenderKeyMessage(versionContentMac) {
+    const body = readVersionedContent(versionContentMac, SIGNAL_GROUP_VERSION, SIGNATURE_SIZE);
+    const decoded = proto.SenderKeyMessage.decode(body);
+    if (decoded.id === null ||
+        decoded.id === undefined ||
+        decoded.iteration === null ||
+        decoded.iteration === undefined ||
+        decoded.ciphertext === null ||
+        decoded.ciphertext === undefined) {
+        throw new Error('invalid sender key message');
+    }
+    return {
+        keyId: decoded.id,
+        iteration: decoded.iteration,
+        ciphertext: toBytesView(decoded.ciphertext),
+        versionContentMac
+    };
+}

package/dist/esm/signal/group/SenderKeyManager.js

@@ -0,0 +1,176 @@
+import { aesCbcDecrypt, aesCbcEncrypt, importAesCbcKey, toSerializedPubKey, prependVersion, randomBytesAsync, randomIntAsync, X25519 } from '../../crypto/index.js';
+import { proto } from '../../proto.js';
+import { SIGNAL_GROUP_VERSION, SIGNATURE_SIZE } from '../constants.js';
+import { signSignalMessage, verifySignalSignature } from '../crypto/WaAdvSignature.js';
+import { deriveSenderKeyMsgKey, selectMessageKey } from '../group/SenderKeyChain.js';
+import { parseDistributionPayload, parseSenderKeyMessage } from '../group/SenderKeyCodec.js';
+import { concatBytes } from '../../util/bytes.js';
+function extractAesCbcParams(seed) {
+    if (seed.length < 48) {
+        throw new Error('sender key message seed must be at least 48 bytes');
+    }
+    return {
+        iv: seed.subarray(0, 16),
+        keyBytes: seed.subarray(16, 48)
+    };
+}
+async function aesCbcEncryptFromSeed(seed, plaintext) {
+    const { keyBytes, iv } = extractAesCbcParams(seed);
+    return aesCbcEncrypt(await importAesCbcKey(keyBytes), iv, plaintext);
+}
+async function aesCbcDecryptFromSeed(seed, ciphertext) {
+    const { keyBytes, iv } = extractAesCbcParams(seed);
+    return aesCbcDecrypt(await importAesCbcKey(keyBytes), iv, ciphertext);
+}
+export class SenderKeyManager {
+    constructor(store) {
+        this.store = store;
+    }
+    async createSenderKeyDistributionMessage(groupId, sender) {
+        const senderKey = await this.ensureSenderKey(groupId, sender);
+        const distributionProto = proto.SenderKeyDistributionMessage.encode({
+            id: senderKey.keyId,
+            iteration: senderKey.iteration,
+            chainKey: senderKey.chainKey,
+            signingKey: senderKey.signingPublicKey
+        }).finish();
+        const payload = prependVersion(distributionProto, SIGNAL_GROUP_VERSION);
+        await this.store.upsertSenderKeyDistribution({
+            groupId,
+            sender,
+            keyId: senderKey.keyId,
+            timestampMs: Date.now()
+        });
+        return {
+            groupId,
+            axolotlSenderKeyDistributionMessage: payload
+        };
+    }
+    async filterParticipantsNeedingDistribution(groupId, sender, participants) {
+        if (participants.length === 0) {
+            return [];
+        }
+        const senderKey = await this.ensureSenderKey(groupId, sender);
+        const distributed = await this.store.getDeviceSenderKeyDistributions(groupId, participants);
+        return participants.filter((_, index) => {
+            const record = distributed[index];
+            return !record || record.keyId !== senderKey.keyId;
+        });
+    }
+    async markSenderKeyDistributed(groupId, sender, participants) {
+        if (participants.length === 0) {
+            return;
+        }
+        const senderKey = await this.ensureSenderKey(groupId, sender);
+        const timestampMs = Date.now();
+        await this.store.upsertSenderKeyDistributions(participants.map((participant) => ({
+            groupId,
+            sender: participant,
+            keyId: senderKey.keyId,
+            timestampMs
+        })));
+    }
+    async processSenderKeyDistributionPayload(groupId, sender, payload) {
+        if (groupId.length === 0) {
+            throw new Error('sender key distribution missing groupId');
+        }
+        const parsed = parseDistributionPayload(payload);
+        const record = {
+            groupId,
+            sender,
+            keyId: parsed.keyId,
+            iteration: parsed.iteration,
+            chainKey: parsed.chainKey,
+            signingPublicKey: parsed.signingPublicKey,
+            unusedMessageKeys: []
+        };
+        await this.store.upsertSenderKey(record);
+        await this.store.upsertSenderKeyDistribution({
+            groupId,
+            sender,
+            keyId: parsed.keyId,
+            timestampMs: Date.now()
+        });
+        return record;
+    }
+    async encryptGroupMessage(groupId, sender, plaintext) {
+        const senderKey = await this.ensureSenderKey(groupId, sender);
+        if (!senderKey.signingPrivateKey) {
+            throw new Error('sender private signing key is missing');
+        }
+        const derived = await deriveSenderKeyMsgKey(senderKey.iteration, senderKey.chainKey);
+        const messagePayload = await aesCbcEncryptFromSeed(derived.messageKey.seed, plaintext);
+        const senderKeyMessage = proto.SenderKeyMessage.encode({
+            id: senderKey.keyId,
+            iteration: derived.messageKey.iteration,
+            ciphertext: messagePayload
+        }).finish();
+        const versionedContent = prependVersion(senderKeyMessage, SIGNAL_GROUP_VERSION);
+        const signature = await signSignalMessage(senderKey.signingPrivateKey, versionedContent);
+        if (signature.length !== SIGNATURE_SIZE) {
+            throw new Error(`invalid sender key signature length ${signature.length}`);
+        }
+        const ciphertext = concatBytes([versionedContent, signature]);
+        await this.store.upsertSenderKey({
+            ...senderKey,
+            chainKey: derived.nextChainKey,
+            iteration: derived.messageKey.iteration + 1
+        });
+        return {
+            groupId,
+            sender,
+            keyId: senderKey.keyId,
+            iteration: derived.messageKey.iteration,
+            ciphertext
+        };
+    }
+    async decryptGroupMessage(payload) {
+        const parsed = parseSenderKeyMessage(payload.ciphertext);
+        const senderKey = await this.store.getDeviceSenderKey(payload.groupId, payload.sender);
+        if (!senderKey) {
+            throw new Error('missing sender key');
+        }
+        if (senderKey.keyId !== parsed.keyId) {
+            throw new Error('sender key id mismatch');
+        }
+        if (payload.keyId !== undefined &&
+            payload.keyId !== null &&
+            parsed.keyId !== payload.keyId) {
+            throw new Error('sender key id mismatch');
+        }
+        if (payload.iteration !== undefined &&
+            payload.iteration !== null &&
+            parsed.iteration !== payload.iteration) {
+            throw new Error('sender key iteration mismatch');
+        }
+        const signedContent = parsed.versionContentMac.subarray(0, parsed.versionContentMac.length - SIGNATURE_SIZE);
+        const signature = parsed.versionContentMac.subarray(parsed.versionContentMac.length - SIGNATURE_SIZE);
+        const validSignature = await verifySignalSignature(senderKey.signingPublicKey, signedContent, signature);
+        if (!validSignature) {
+            throw new Error('invalid sender key signature');
+        }
+        const selected = await selectMessageKey(senderKey, parsed.iteration);
+        const plaintext = await aesCbcDecryptFromSeed(selected.messageKey.seed, parsed.ciphertext);
+        await this.store.upsertSenderKey(selected.updatedRecord);
+        return plaintext;
+    }
+    async ensureSenderKey(groupId, sender) {
+        const existing = await this.store.getDeviceSenderKey(groupId, sender);
+        if (existing) {
+            return existing;
+        }
+        const signingKeyPair = await X25519.generateKeyPair();
+        const created = {
+            groupId,
+            sender,
+            keyId: await randomIntAsync(1, 2147483647),
+            iteration: 0,
+            chainKey: await randomBytesAsync(32),
+            signingPublicKey: toSerializedPubKey(signingKeyPair.pubKey),
+            signingPrivateKey: signingKeyPair.privKey,
+            unusedMessageKeys: []
+        };
+        await this.store.upsertSenderKey(created);
+        return created;
+    }
+}

package/dist/esm/signal/index.js

@@ -0,0 +1,11 @@
+export { generatePreKeyPair, generateRegistrationId, generateRegistrationInfo, generateSignedPreKey } from './registration/keygen.js';
+export { buildPreKeyUploadIq, parsePreKeyUploadFailure } from './api/prekeys.js';
+export { SignalDigestSyncApi } from './api/SignalDigestSyncApi.js';
+export { SignalDeviceSyncApi } from './api/SignalDeviceSyncApi.js';
+export { SignalIdentitySyncApi } from './api/SignalIdentitySyncApi.js';
+export { SignalMissingPreKeysSyncApi } from './api/SignalMissingPreKeysSyncApi.js';
+export { SignalRotateKeyApi } from './api/SignalRotateKeyApi.js';
+export { SignalSessionSyncApi } from './api/SignalSessionSyncApi.js';
+export { SenderKeyManager } from './group/SenderKeyManager.js';
+export { createAndStoreInitialKeys } from './registration/utils.js';
+export { SignalProtocol } from './session/SignalProtocol.js';

package/dist/esm/signal/registration/keygen.js

@@ -0,0 +1,31 @@
+import { randomIntAsync } from '../../crypto/index.js';
+import { toSerializedPubKey } from '../../crypto/core/keys.js';
+import { X25519 } from '../../crypto/curves/X25519.js';
+import { signSignalMessage } from '../crypto/WaAdvSignature.js';
+export async function generateRegistrationInfo() {
+    return {
+        registrationId: await generateRegistrationId(),
+        identityKeyPair: await X25519.generateKeyPair()
+    };
+}
+export async function generatePreKeyPair(keyId) {
+    return {
+        keyId,
+        keyPair: await X25519.generateKeyPair(),
+        uploaded: false
+    };
+}
+export async function generateSignedPreKey(keyId, signingPrivateKey) {
+    const keyPair = await X25519.generateKeyPair();
+    const serializedPubKey = toSerializedPubKey(keyPair.pubKey);
+    const signature = await signSignalMessage(signingPrivateKey, serializedPubKey);
+    return {
+        keyId,
+        keyPair,
+        signature,
+        uploaded: false
+    };
+}
+export async function generateRegistrationId() {
+    return await randomIntAsync(1, 16381);
+}

package/dist/esm/signal/registration/utils.js

@@ -0,0 +1,16 @@
+import { generatePreKeyPair, generateRegistrationInfo, generateSignedPreKey } from '../registration/keygen.js';
+export async function createAndStoreInitialKeys(store) {
+    const [registrationInfo, firstPreKey] = await Promise.all([
+        generateRegistrationInfo(),
+        generatePreKeyPair(1)
+    ]);
+    const signedPreKey = await generateSignedPreKey(1, registrationInfo.identityKeyPair.privKey);
+    await store.setRegistrationInfo(registrationInfo);
+    await store.setSignedPreKey(signedPreKey);
+    await store.getOrGenSinglePreKey(async () => firstPreKey);
+    return {
+        registrationInfo,
+        signedPreKey,
+        firstPreKey
+    };
+}

package/dist/esm/signal/session/SignalProtocol.js

@@ -0,0 +1,122 @@
+import { toSerializedPubKey } from '../../crypto/index.js';
+import { ConsoleLogger } from '../../infra/log/ConsoleLogger.js';
+import { MAX_PREV_SESSIONS } from '../constants.js';
+import { decryptMsg, decryptMsgFromSession, encryptMsg } from '../session/SignalRatchet.js';
+import { deserializeMsg, deserializePkMsg, requirePreKey, requireSignedPreKey } from '../session/SignalSerializer.js';
+import { detachSession, findMatchingSession, generateSerializedKeyPair, initiateSessionIncoming, initiateSessionOutgoing, requireLocalIdentity, toSerializedKeyPair } from '../session/SignalSession.js';
+import { uint8Equal } from '../../util/bytes.js';
+export class SignalProtocol {
+    constructor(store, logger = new ConsoleLogger('info')) {
+        this.store = store;
+        this.logger = logger;
+    }
+    async hasSession(address) {
+        return this.store.hasSession(address);
+    }
+    async hasSessions(addresses) {
+        return this.store.hasSessions(addresses);
+    }
+    async establishOutgoingSession(address, remoteBundle) {
+        const [local, localOneTimeBase] = await Promise.all([
+            requireLocalIdentity(this.store),
+            generateSerializedKeyPair()
+        ]);
+        const session = await initiateSessionOutgoing(local, remoteBundle, localOneTimeBase);
+        await this.store.setRemoteIdentity(address, session.remote.pubKey);
+        await this.store.setSession(address, session);
+        return session;
+    }
+    async encryptMessage(address, plaintext, expectedIdentity) {
+        const session = await this.store.getSession(address);
+        if (!session) {
+            throw new Error('signal session not found');
+        }
+        if (expectedIdentity &&
+            !uint8Equal(toSerializedPubKey(expectedIdentity), session.remote.pubKey)) {
+            throw new Error('identity mismatch');
+        }
+        const [updatedSession, encrypted] = await encryptMsg(session, plaintext);
+        await this.store.setSession(address, updatedSession);
+        if (!uint8Equal(updatedSession.remote.pubKey, session.remote.pubKey)) {
+            await this.store.setRemoteIdentity(address, updatedSession.remote.pubKey);
+        }
+        return {
+            ...encrypted,
+            baseKey: updatedSession.aliceBaseKey
+        };
+    }
+    async decryptMessage(address, envelope) {
+        const currentSession = await this.store.getSession(address);
+        let outcome;
+        if (envelope.type === 'pkmsg') {
+            const parsedPk = deserializePkMsg(envelope.ciphertext);
+            outcome = await this.decryptPkMsg(currentSession, parsedPk);
+        }
+        else {
+            const parsed = deserializeMsg(envelope.ciphertext);
+            outcome = await this.decryptMsgInternal(currentSession, parsed);
+        }
+        const nextRemoteIdentity = outcome.newSessionInfo?.newIdentity ?? outcome.updatedSession.remote.pubKey;
+        if (!currentSession || !uint8Equal(currentSession.remote.pubKey, nextRemoteIdentity)) {
+            await this.store.setRemoteIdentity(address, nextRemoteIdentity);
+        }
+        await this.store.setSession(address, outcome.updatedSession);
+        return outcome.plaintext;
+    }
+    async decryptMsgInternal(session, parsed) {
+        return decryptMsg(session, parsed, (error, previousSessionIndex) => {
+            this.logger.debug('signal decrypt fallback session failed', {
+                previousSessionIndex,
+                message: error.message
+            });
+        });
+    }
+    async decryptPkMsg(currentSession, parsed) {
+        const matchingSession = findMatchingSession(currentSession, parsed.sessionBaseKey);
+        if (matchingSession) {
+            const [updatedSession, plaintext] = await decryptMsgFromSession(matchingSession, parsed);
+            return {
+                updatedSession,
+                plaintext,
+                newSessionInfo: null
+            };
+        }
+        const [local, signedPreKey, oneTimePreKey] = await Promise.all([
+            requireLocalIdentity(this.store),
+            requireSignedPreKey(this.store, parsed.localSignedPreKeyId),
+            parsed.localOneTimeKeyId === null || parsed.localOneTimeKeyId === undefined
+                ? Promise.resolve(null)
+                : requirePreKey(this.store, parsed.localOneTimeKeyId)
+        ]);
+        const incoming = await initiateSessionIncoming(local, parsed.remote, parsed.sessionBaseKey, {
+            signed: toSerializedKeyPair(signedPreKey.keyPair),
+            oneTime: oneTimePreKey ? toSerializedKeyPair(oneTimePreKey.keyPair) : undefined,
+            ratchet: toSerializedKeyPair(signedPreKey.keyPair)
+        });
+        const newIdentity = !currentSession || !uint8Equal(incoming.remote.pubKey, currentSession.remote.pubKey)
+            ? incoming.remote.pubKey
+            : null;
+        const baseSession = currentSession
+            ? {
+                ...incoming,
+                prevSessions: [
+                    detachSession(currentSession),
+                    ...currentSession.prevSessions.slice(0, MAX_PREV_SESSIONS - 1)
+                ]
+            }
+            : incoming;
+        const [updatedSession, plaintext] = await decryptMsgFromSession(baseSession, parsed);
+        if (parsed.localOneTimeKeyId !== null && parsed.localOneTimeKeyId !== undefined) {
+            await this.store.consumePreKeyById(parsed.localOneTimeKeyId);
+        }
+        return {
+            updatedSession,
+            plaintext,
+            newSessionInfo: {
+                newIdentity,
+                baseSession,
+                usedPreKey: parsed.localOneTimeKeyId
+            }
+        };
+    }
+}