zapo-js 0.1.0

package/dist/auth/index.js

@@ -0,0 +1,27 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WaAuthSqliteStore = exports.createCompanionHello = exports.completeCompanionFinish = exports.WaAuthClient = exports.getLoginIdentity = void 0;
+__exportStar(require("./types"), exports);
+var jid_1 = require("../protocol/jid");
+Object.defineProperty(exports, "getLoginIdentity", { enumerable: true, get: function () { return jid_1.getLoginIdentity; } });
+var WaAuthClient_1 = require("./WaAuthClient");
+Object.defineProperty(exports, "WaAuthClient", { enumerable: true, get: function () { return WaAuthClient_1.WaAuthClient; } });
+var WaPairingCodeCrypto_1 = require("./pairing/WaPairingCodeCrypto");
+Object.defineProperty(exports, "completeCompanionFinish", { enumerable: true, get: function () { return WaPairingCodeCrypto_1.completeCompanionFinish; } });
+Object.defineProperty(exports, "createCompanionHello", { enumerable: true, get: function () { return WaPairingCodeCrypto_1.createCompanionHello; } });
+var auth_store_1 = require("../store/providers/sqlite/auth.store");
+Object.defineProperty(exports, "WaAuthSqliteStore", { enumerable: true, get: function () { return auth_store_1.WaAuthSqliteStore; } });

package/dist/auth/pairing/WaPairingCodeCrypto.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCompanionHello = createCompanionHello;
+exports.completeCompanionFinish = completeCompanionFinish;
+const constants_1 = require("../pairing/constants");
+const _crypto_1 = require("../../crypto/index.js");
+const X25519_1 = require("../../crypto/curves/X25519");
+const constants_2 = require("../../protocol/constants");
+const bytes_1 = require("../../util/bytes");
+function bytesToCrockford(bytes) {
+    let bitCount = 0;
+    let value = 0;
+    let out = '';
+    for (let i = 0; i < bytes.length; i += 1) {
+        value = (value << 8) | bytes[i];
+        bitCount += 8;
+        while (bitCount >= 5) {
+            out += constants_1.CROCKFORD_ALPHABET[(value >>> (bitCount - 5)) & 31];
+            bitCount -= 5;
+        }
+    }
+    if (bitCount > 0) {
+        out += constants_1.CROCKFORD_ALPHABET[(value << (5 - bitCount)) & 31];
+    }
+    return out;
+}
+async function createCompanionHello() {
+    const [codeBytes, companionEphemeralKeyPair, salt, counter] = await Promise.all([
+        (0, _crypto_1.randomBytesAsync)(5),
+        X25519_1.X25519.generateKeyPair(),
+        (0, _crypto_1.randomBytesAsync)(32),
+        (0, _crypto_1.randomBytesAsync)(16)
+    ]);
+    const pairingCode = bytesToCrockford(codeBytes);
+    const cipher = await (0, _crypto_1.pbkdf2DeriveAesCtrKey)(bytes_1.TEXT_ENCODER.encode(pairingCode), salt, constants_1.PBKDF2_ITERATIONS);
+    const encrypted = await (0, _crypto_1.aesCtrEncrypt)(cipher, counter, companionEphemeralKeyPair.pubKey);
+    return {
+        pairingCode,
+        companionEphemeralKeyPair,
+        wrappedCompanionEphemeralPub: (0, bytes_1.concatBytes)([salt, counter, encrypted])
+    };
+}
+async function completeCompanionFinish(args) {
+    if (args.wrappedPrimaryEphemeralPub.length <= 48) {
+        throw new Error('invalid wrapped primary payload');
+    }
+    const pairingCipher = await (0, _crypto_1.pbkdf2DeriveAesCtrKey)(bytes_1.TEXT_ENCODER.encode(args.pairingCode), args.wrappedPrimaryEphemeralPub.subarray(0, 32), constants_1.PBKDF2_ITERATIONS);
+    const primaryEphemeralPub = await (0, _crypto_1.aesCtrDecrypt)(pairingCipher, args.wrappedPrimaryEphemeralPub.subarray(32, 48), args.wrappedPrimaryEphemeralPub.subarray(48));
+    if (primaryEphemeralPub.length === 0) {
+        throw new Error('empty primary ephemeral public key');
+    }
+    const sharedEphemeral = await X25519_1.X25519.scalarMult(args.companionEphemeralPrivKey, primaryEphemeralPub);
+    const [bundleSalt, bundleSecret, bundleIv] = await Promise.all([
+        (0, _crypto_1.randomBytesAsync)(32),
+        (0, _crypto_1.randomBytesAsync)(32),
+        (0, _crypto_1.randomBytesAsync)(12)
+    ]);
+    const bundleEncryptionKeyRaw = await (0, _crypto_1.hkdf)(sharedEphemeral, bundleSalt, constants_2.WA_PAIRING_KDF_INFO.LINK_CODE_BUNDLE, 32);
+    const bundleEncryptionKey = await (0, _crypto_1.importAesGcmKey)(bundleEncryptionKeyRaw, ['encrypt']);
+    const plaintextBundle = (0, bytes_1.concatBytes)([
+        args.registrationIdentityKeyPair.pubKey,
+        args.primaryIdentityPub,
+        bundleSecret
+    ]);
+    const encryptedBundle = await (0, _crypto_1.aesGcmEncrypt)(bundleEncryptionKey, bundleIv, plaintextBundle);
+    const wrappedKeyBundle = (0, bytes_1.concatBytes)([bundleSalt, bundleIv, encryptedBundle]);
+    const sharedIdentity = await X25519_1.X25519.scalarMult(args.registrationIdentityKeyPair.privKey, args.primaryIdentityPub);
+    const advMaterial = (0, bytes_1.concatBytes)([sharedEphemeral, sharedIdentity, bundleSecret]);
+    const advSecret = await (0, _crypto_1.hkdf)(advMaterial, null, constants_2.WA_PAIRING_KDF_INFO.ADV_SECRET, 32);
+    return {
+        wrappedKeyBundle,
+        companionIdentityPublic: args.registrationIdentityKeyPair.pubKey,
+        advSecret
+    };
+}

package/dist/auth/pairing/WaPairingFlow.js

@@ -0,0 +1,328 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WaPairingFlow = void 0;
+const WaPairingCodeCrypto_1 = require("../pairing/WaPairingCodeCrypto");
+const _crypto_1 = require("../../crypto/index.js");
+const _proto_1 = require("../../proto.js");
+const constants_1 = require("../../protocol/constants");
+const jid_1 = require("../../protocol/jid");
+const WaAdvSignature_1 = require("../../signal/crypto/WaAdvSignature");
+const pairing_1 = require("../../transport/node/builders/pairing");
+const helpers_1 = require("../../transport/node/helpers");
+const base64_1 = require("../../util/base64");
+const bytes_1 = require("../../util/bytes");
+class WaPairingFlow {
+    constructor(options) {
+        this.opts = options;
+        this.pairingSession = null;
+    }
+    hasPairingSession() {
+        return this.pairingSession !== null;
+    }
+    clearSession() {
+        this.opts.logger.trace('pairing flow session cleared');
+        this.pairingSession = null;
+    }
+    async requestPairingCode(phoneNumber, shouldShowPushNotification = false) {
+        this.opts.logger.info('requesting pairing code', {
+            shouldShowPushNotification
+        });
+        const credentials = this.requireCredentials();
+        const phoneJid = (0, jid_1.parsePhoneJid)(phoneNumber);
+        const [companionHello, refreshedCredentials] = await Promise.all([
+            (0, WaPairingCodeCrypto_1.createCompanionHello)(),
+            this.rotateAdvSecret(credentials)
+        ]);
+        const browser = this.opts.device.browser;
+        const browserDisplayName = {
+            chrome: 'Chrome',
+            firefox: 'Firefox',
+            ie: 'IE',
+            opera: 'Opera',
+            safari: 'Safari',
+            edge: 'Edge',
+            chromium: 'Chromium'
+        }[browser.trim().toLowerCase()] ?? browser;
+        const response = await this.opts.socket.query((0, pairing_1.buildCompanionHelloRequestNode)({
+            phoneJid,
+            shouldShowPushNotification,
+            wrappedCompanionEphemeralPub: companionHello.wrappedCompanionEphemeralPub,
+            companionServerAuthKeyPub: refreshedCredentials.noiseKeyPair.pubKey,
+            companionPlatformId: this.opts.device.platform,
+            companionPlatformDisplay: `${browserDisplayName} (${this.opts.device.osDisplayName})`
+        }), constants_1.WA_DEFAULTS.IQ_TIMEOUT_MS);
+        this.opts.logger.debug('pairing code request response received', {
+            responseTag: response.tag,
+            responseType: response.attrs.type
+        });
+        const linkCodeNode = (0, helpers_1.findNodeChild)(response, constants_1.WA_NODE_TAGS.LINK_CODE_COMPANION_REG);
+        if (!linkCodeNode) {
+            throw new Error('companion hello response missing link_code_companion_reg');
+        }
+        const refNode = (0, helpers_1.findNodeChild)(linkCodeNode, constants_1.WA_NODE_TAGS.LINK_CODE_PAIRING_REF);
+        if (!refNode) {
+            throw new Error('companion hello response missing link_code_pairing_ref');
+        }
+        const ref = (0, helpers_1.decodeNodeContentUtf8OrBytes)(refNode.content, 'link_code_pairing_ref');
+        this.pairingSession = {
+            pairingCode: companionHello.pairingCode,
+            phoneJid,
+            ref,
+            createdAtSeconds: Math.floor(Date.now() / 1000),
+            companionEphemeralKeyPair: companionHello.companionEphemeralKeyPair,
+            attempts: 0,
+            finished: false
+        };
+        this.opts.callbacks.emitPairingCode(companionHello.pairingCode);
+        this.opts.logger.info('pairing code emitted', {
+            phoneJid,
+            createdAtSeconds: this.pairingSession.createdAtSeconds
+        });
+        return companionHello.pairingCode;
+    }
+    async fetchPairingCountryCodeIso() {
+        this.opts.logger.trace('fetching pairing country code ISO');
+        const response = await this.opts.socket.query((0, pairing_1.buildGetCountryCodeRequestNode)(), constants_1.WA_DEFAULTS.IQ_TIMEOUT_MS);
+        const countryCodeNode = (0, helpers_1.findNodeChild)(response, constants_1.WA_NODE_TAGS.COUNTRY_CODE);
+        const iso = countryCodeNode?.attrs.iso;
+        if (!iso) {
+            throw new Error('country_code response is missing iso');
+        }
+        this.opts.logger.debug('pairing country code received', { iso });
+        return iso;
+    }
+    async handleIncomingIqSet(node) {
+        this.opts.logger.trace('pairing flow received iq:set', {
+            id: node.attrs.id,
+            from: node.attrs.from
+        });
+        const firstChild = (0, helpers_1.getFirstNodeChild)(node);
+        if (!firstChild) {
+            return false;
+        }
+        if (firstChild.tag === constants_1.WA_NODE_TAGS.PAIR_DEVICE) {
+            this.opts.logger.debug('handling pair-device stanza', { id: node.attrs.id });
+            await this.handlePairDevice(node, firstChild);
+            return true;
+        }
+        if (firstChild.tag === constants_1.WA_NODE_TAGS.PAIR_SUCCESS) {
+            this.opts.logger.debug('handling pair-success stanza', { id: node.attrs.id });
+            await this.handlePairSuccess(node, firstChild);
+            return true;
+        }
+        return false;
+    }
+    async handleLinkCodeNotification(node) {
+        const linkCodeNode = (0, helpers_1.findNodeChild)(node, constants_1.WA_NODE_TAGS.LINK_CODE_COMPANION_REG);
+        if (!linkCodeNode) {
+            return false;
+        }
+        this.opts.logger.trace('handling link_code_companion_reg notification', {
+            id: node.attrs.id,
+            stage: linkCodeNode.attrs.stage
+        });
+        await this.opts.socket.sendNode((0, pairing_1.buildNotificationAckNode)(node));
+        const stage = linkCodeNode.attrs.stage;
+        if (stage === constants_1.WA_SIGNALING.LINK_CODE_STAGE_REFRESH_CODE) {
+            const refNode = (0, helpers_1.findNodeChild)(linkCodeNode, constants_1.WA_NODE_TAGS.LINK_CODE_PAIRING_REF);
+            if (!refNode || !this.pairingSession?.ref) {
+                return true;
+            }
+            const ref = (0, helpers_1.decodeNodeContentUtf8OrBytes)(refNode.content, 'refresh_code.link_code_pairing_ref');
+            if ((0, bytes_1.uint8Equal)(ref, this.pairingSession.ref)) {
+                this.opts.logger.info('received pairing refresh notification', {
+                    forceManualRefresh: linkCodeNode.attrs.force_manual_refresh === 'true'
+                });
+                this.opts.callbacks.emitPairingRefresh(linkCodeNode.attrs.force_manual_refresh === 'true');
+            }
+            return true;
+        }
+        if (stage !== constants_1.WA_SIGNALING.LINK_CODE_STAGE_PRIMARY_HELLO) {
+            return true;
+        }
+        await this.handlePrimaryHello(linkCodeNode);
+        return true;
+    }
+    async handleCompanionRegRefreshNotification(node) {
+        const hasExpectedChild = (0, helpers_1.hasNodeChild)(node, constants_1.WA_SIGNALING.COMPANION_REG_REFRESH_NOTIFICATION) ||
+            (0, helpers_1.hasNodeChild)(node, 'pair-device-rotate-qr');
+        if (!hasExpectedChild) {
+            return false;
+        }
+        await this.opts.socket.sendNode((0, pairing_1.buildNotificationAckNode)(node, constants_1.WA_SIGNALING.COMPANION_REG_REFRESH_NOTIFICATION));
+        await this.rotateAdvSecret(this.requireCredentials());
+        this.opts.logger.info('handled companion_reg_refresh notification');
+        this.opts.qrFlow.refreshCurrentQr();
+        return true;
+    }
+    async handlePairDevice(iqNode, pairDeviceNode) {
+        const refs = (0, helpers_1.getNodeChildrenByTag)(pairDeviceNode, constants_1.WA_NODE_TAGS.REF)
+            .map((child) => bytes_1.TEXT_DECODER.decode((0, helpers_1.decodeNodeContentUtf8OrBytes)(child.content, 'pair-device.ref')))
+            .filter((ref) => ref.length > 0);
+        await this.rotateAdvSecret(this.requireCredentials());
+        this.opts.qrFlow.setRefs(refs);
+        this.opts.logger.info('pair-device refs updated', { refsCount: refs.length });
+        await this.opts.socket.sendNode((0, pairing_1.buildIqResultNode)(iqNode));
+    }
+    async handlePairSuccess(iqNode, pairSuccessNode) {
+        this.opts.logger.info('processing pair-success node');
+        const credentials = this.requireCredentials();
+        const deviceIdentityNode = (0, helpers_1.findNodeChild)(pairSuccessNode, constants_1.WA_NODE_TAGS.DEVICE_IDENTITY);
+        const deviceNode = (0, helpers_1.findNodeChild)(pairSuccessNode, 'device');
+        const platformNode = (0, helpers_1.findNodeChild)(pairSuccessNode, constants_1.WA_NODE_TAGS.PLATFORM);
+        if (!deviceIdentityNode || !deviceNode || !platformNode) {
+            this.opts.logger.error('pair-success missing required nodes', {
+                hasDeviceIdentity: !!deviceIdentityNode,
+                hasDevice: !!deviceNode,
+                hasPlatform: !!platformNode
+            });
+            throw new Error('pair-success stanza is missing required nodes');
+        }
+        const wrappedIdentity = _proto_1.proto.ADVSignedDeviceIdentityHMAC.decode((0, helpers_1.decodeNodeContentUtf8OrBytes)(deviceIdentityNode.content, 'pair-success.device-identity'));
+        const wrappedDetails = (0, base64_1.decodeProtoBytes)(wrappedIdentity.details, 'ADVSignedDeviceIdentityHMAC.details');
+        const wrappedHmac = (0, base64_1.decodeProtoBytes)(wrappedIdentity.hmac, 'ADVSignedDeviceIdentityHMAC.hmac');
+        const accountType = wrappedIdentity.accountType ?? _proto_1.proto.ADVEncryptionType.E2EE;
+        const isHosted = accountType === _proto_1.proto.ADVEncryptionType.HOSTED;
+        const hmacInput = isHosted
+            ? (0, bytes_1.concatBytes)([WaAdvSignature_1.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, wrappedDetails])
+            : wrappedDetails;
+        const expectedHmac = await (0, WaAdvSignature_1.computeAdvIdentityHmac)(credentials.advSecretKey, hmacInput);
+        if (!(0, bytes_1.uint8Equal)(expectedHmac, wrappedHmac)) {
+            this.opts.logger.error('pair-success hmac mismatch');
+            throw new Error('pair-success HMAC validation failed');
+        }
+        const { signedIdentity, keyIndex, responseIdentityBytes } = await this.buildPairSuccessResponseIdentity(credentials, wrappedDetails, isHosted);
+        const nextCredentials = {
+            ...credentials,
+            signedIdentity,
+            meJid: deviceNode.attrs.jid,
+            meLid: deviceNode.attrs.lid,
+            platform: platformNode.attrs.name
+        };
+        await this.opts.auth.updateCredentials(nextCredentials);
+        this.opts.logger.info('pair-success credentials updated', {
+            meJid: nextCredentials.meJid,
+            meLid: nextCredentials.meLid,
+            platform: nextCredentials.platform
+        });
+        this.opts.qrFlow.clear();
+        await this.opts.socket.sendNode({
+            tag: constants_1.WA_NODE_TAGS.IQ,
+            attrs: {
+                ...(iqNode.attrs.id ? { id: iqNode.attrs.id } : {}),
+                to: iqNode.attrs.from ?? constants_1.WA_DEFAULTS.HOST_DOMAIN,
+                type: constants_1.WA_IQ_TYPES.RESULT
+            },
+            content: [
+                {
+                    tag: 'pair-device-sign',
+                    attrs: {},
+                    content: [
+                        {
+                            tag: constants_1.WA_NODE_TAGS.DEVICE_IDENTITY,
+                            attrs: {
+                                'key-index': String(keyIndex)
+                            },
+                            content: responseIdentityBytes
+                        }
+                    ]
+                }
+            ]
+        });
+        this.opts.callbacks.emitPaired(nextCredentials);
+        this.opts.logger.debug('pair-success completed and paired event emitted');
+    }
+    async buildPairSuccessResponseIdentity(credentials, wrappedDetails, isHosted) {
+        const signedIdentity = _proto_1.proto.ADVSignedDeviceIdentity.decode(wrappedDetails);
+        const details = (0, base64_1.decodeProtoBytes)(signedIdentity.details, 'ADVSignedDeviceIdentity.details');
+        const accountSignature = (0, base64_1.decodeProtoBytes)(signedIdentity.accountSignature, 'ADVSignedDeviceIdentity.accountSignature');
+        const accountSignatureKey = (0, base64_1.decodeProtoBytes)(signedIdentity.accountSignatureKey, 'ADVSignedDeviceIdentity.accountSignatureKey');
+        const localIdentity = credentials.registrationInfo.identityKeyPair;
+        const validAccountSignature = await (0, WaAdvSignature_1.verifyDeviceIdentityAccountSignature)(details, accountSignature, localIdentity.pubKey, accountSignatureKey, isHosted);
+        if (!validAccountSignature) {
+            this.opts.logger.error('pair-success account signature invalid');
+            throw new Error('pair-success account signature validation failed');
+        }
+        signedIdentity.deviceSignature = await (0, WaAdvSignature_1.generateDeviceSignature)(details, localIdentity, accountSignatureKey, isHosted);
+        const advDeviceIdentity = _proto_1.proto.ADVDeviceIdentity.decode(details);
+        const responseIdentityBytes = _proto_1.proto.ADVSignedDeviceIdentity.encode({
+            details: signedIdentity.details,
+            accountSignature: signedIdentity.accountSignature,
+            deviceSignature: signedIdentity.deviceSignature
+        }).finish();
+        return {
+            signedIdentity,
+            keyIndex: advDeviceIdentity.keyIndex ?? 0,
+            responseIdentityBytes
+        };
+    }
+    async handlePrimaryHello(linkCodeNode) {
+        const credentials = this.requireCredentials();
+        const pairingSession = this.pairingSession;
+        if (!pairingSession || pairingSession.finished) {
+            this.opts.logger.trace('primary_hello ignored: no active session');
+            return;
+        }
+        pairingSession.attempts += 1;
+        this.opts.logger.debug('processing primary_hello', {
+            attempts: pairingSession.attempts
+        });
+        if (pairingSession.attempts > 3) {
+            throw new Error('pairing code exceeded maximum primary hello attempts');
+        }
+        const refNode = (0, helpers_1.findNodeChild)(linkCodeNode, constants_1.WA_NODE_TAGS.LINK_CODE_PAIRING_REF);
+        const wrappedPrimaryNode = (0, helpers_1.findNodeChild)(linkCodeNode, 'link_code_pairing_wrapped_primary_ephemeral_pub');
+        const primaryIdentityNode = (0, helpers_1.findNodeChild)(linkCodeNode, 'primary_identity_pub');
+        if (!refNode || !wrappedPrimaryNode || !primaryIdentityNode) {
+            throw new Error('primary_hello notification is missing fields');
+        }
+        const ref = (0, helpers_1.decodeNodeContentUtf8OrBytes)(refNode.content, 'primary_hello.link_code_pairing_ref');
+        if (!pairingSession.ref || !(0, bytes_1.uint8Equal)(ref, pairingSession.ref)) {
+            this.opts.logger.warn('primary_hello ref mismatch ignored');
+            return;
+        }
+        const nowSeconds = Math.floor(Date.now() / 1000);
+        if (nowSeconds - pairingSession.createdAtSeconds >
+            constants_1.WA_DEFAULTS.PAIRING_CODE_MAX_AGE_SECONDS) {
+            throw new Error('primary_hello received for an expired pairing code');
+        }
+        const finish = await (0, WaPairingCodeCrypto_1.completeCompanionFinish)({
+            pairingCode: pairingSession.pairingCode,
+            wrappedPrimaryEphemeralPub: (0, helpers_1.decodeNodeContentUtf8OrBytes)(wrappedPrimaryNode.content, 'primary_hello.link_code_pairing_wrapped_primary_ephemeral_pub'),
+            primaryIdentityPub: (0, helpers_1.decodeNodeContentUtf8OrBytes)(primaryIdentityNode.content, 'primary_hello.primary_identity_pub'),
+            companionEphemeralPrivKey: pairingSession.companionEphemeralKeyPair.privKey,
+            registrationIdentityKeyPair: credentials.registrationInfo.identityKeyPair
+        });
+        await this.opts.auth.updateCredentials({
+            ...credentials,
+            advSecretKey: finish.advSecret
+        });
+        const result = await this.opts.socket.query((0, pairing_1.buildCompanionFinishRequestNode)({
+            phoneJid: pairingSession.phoneJid,
+            wrappedKeyBundle: finish.wrappedKeyBundle,
+            companionIdentityPublic: finish.companionIdentityPublic,
+            ref
+        }), constants_1.WA_DEFAULTS.IQ_TIMEOUT_MS);
+        if (result.attrs.type === constants_1.WA_IQ_TYPES.ERROR) {
+            throw new Error('companion_finish returned error');
+        }
+        pairingSession.finished = true;
+        this.opts.logger.info('primary_hello completed with companion_finish success');
+    }
+    async rotateAdvSecret(credentials) {
+        const nextCredentials = {
+            ...credentials,
+            advSecretKey: await (0, _crypto_1.randomBytesAsync)(32)
+        };
+        await this.opts.auth.updateCredentials(nextCredentials);
+        return nextCredentials;
+    }
+    requireCredentials() {
+        const credentials = this.opts.auth.getCredentials();
+        if (!credentials) {
+            throw new Error('credentials are not initialized');
+        }
+        return credentials;
+    }
+}
+exports.WaPairingFlow = WaPairingFlow;

package/dist/auth/pairing/WaQrFlow.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WaQrFlow = void 0;
+const constants_1 = require("../../protocol/constants");
+const base64_1 = require("../../util/base64");
+class WaQrFlow {
+    constructor(args) {
+        this.logger = args.logger;
+        this.getCredentials = args.getCredentials;
+        this.getDevicePlatform = args.getDevicePlatform;
+        this.emitQr = args.emitQr;
+        this.qrRefs = [];
+        this.currentRef = null;
+        this.currentQrTimer = null;
+    }
+    hasQr() {
+        return this.qrRefs.length > 0 || this.currentQrTimer !== null;
+    }
+    clear() {
+        this.logger.trace('qr flow clear');
+        if (this.currentQrTimer) {
+            clearTimeout(this.currentQrTimer);
+            this.currentQrTimer = null;
+        }
+        this.qrRefs = [];
+        this.currentRef = null;
+    }
+    refreshCurrentQr() {
+        if (!this.currentRef) {
+            this.logger.trace('qr flow refresh skipped: no active ref');
+            return false;
+        }
+        const credentials = this.getCredentials();
+        if (!credentials) {
+            this.logger.warn('qr flow refresh skipped: missing credentials');
+            return false;
+        }
+        const ttlMs = this.qrRefs.length === 5
+            ? constants_1.WA_DEFAULTS.QR_INITIAL_TTL_MS
+            : constants_1.WA_DEFAULTS.QR_ROTATION_TTL_MS;
+        this.logger.debug('qr flow refresh emit', { ttlMs, remainingRefs: this.qrRefs.length });
+        this.emitQr(this.buildQr(this.currentRef, credentials), ttlMs);
+        return true;
+    }
+    setRefs(refs) {
+        this.clear();
+        this.qrRefs = [...refs];
+        this.logger.info('qr refs updated', { count: this.qrRefs.length });
+        if (this.qrRefs.length === 0) {
+            return;
+        }
+        this.rotateRef();
+    }
+    rotateRef() {
+        const credentials = this.getCredentials();
+        if (!credentials) {
+            this.clear();
+            return;
+        }
+        const ref = this.qrRefs.shift();
+        if (!ref) {
+            this.clear();
+            return;
+        }
+        this.currentRef = ref;
+        const ttlMs = this.qrRefs.length === 5
+            ? constants_1.WA_DEFAULTS.QR_INITIAL_TTL_MS
+            : constants_1.WA_DEFAULTS.QR_ROTATION_TTL_MS;
+        this.logger.trace('qr flow emit new code', { ttlMs, remainingRefs: this.qrRefs.length });
+        this.emitQr(this.buildQr(ref, credentials), ttlMs);
+        this.currentQrTimer = setTimeout(() => {
+            this.currentQrTimer = null;
+            this.rotateRef();
+        }, ttlMs);
+    }
+    buildQr(ref, credentials) {
+        return [
+            ref,
+            (0, base64_1.bytesToBase64)(credentials.noiseKeyPair.pubKey),
+            (0, base64_1.bytesToBase64)(credentials.registrationInfo.identityKeyPair.pubKey),
+            (0, base64_1.bytesToBase64)(credentials.advSecretKey),
+            this.getDevicePlatform()
+        ].join(',');
+    }
+}
+exports.WaQrFlow = WaQrFlow;

package/dist/auth/pairing/constants.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PBKDF2_ITERATIONS = exports.CROCKFORD_ALPHABET = void 0;
+exports.CROCKFORD_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTVWXYZ';
+exports.PBKDF2_ITERATIONS = 2 << 16;

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });