zapo-js 0.1.0

package/dist/signal/group/SenderKeyManager.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SenderKeyManager = void 0;
+const _crypto_1 = require("../../crypto/index.js");
+const _proto_1 = require("../../proto.js");
+const constants_1 = require("../constants");
+const WaAdvSignature_1 = require("../crypto/WaAdvSignature");
+const SenderKeyChain_1 = require("../group/SenderKeyChain");
+const SenderKeyCodec_1 = require("../group/SenderKeyCodec");
+const bytes_1 = require("../../util/bytes");
+function extractAesCbcParams(seed) {
+    if (seed.length < 48) {
+        throw new Error('sender key message seed must be at least 48 bytes');
+    }
+    return {
+        iv: seed.subarray(0, 16),
+        keyBytes: seed.subarray(16, 48)
+    };
+}
+async function aesCbcEncryptFromSeed(seed, plaintext) {
+    const { keyBytes, iv } = extractAesCbcParams(seed);
+    return (0, _crypto_1.aesCbcEncrypt)(await (0, _crypto_1.importAesCbcKey)(keyBytes), iv, plaintext);
+}
+async function aesCbcDecryptFromSeed(seed, ciphertext) {
+    const { keyBytes, iv } = extractAesCbcParams(seed);
+    return (0, _crypto_1.aesCbcDecrypt)(await (0, _crypto_1.importAesCbcKey)(keyBytes), iv, ciphertext);
+}
+class SenderKeyManager {
+    constructor(store) {
+        this.store = store;
+    }
+    async createSenderKeyDistributionMessage(groupId, sender) {
+        const senderKey = await this.ensureSenderKey(groupId, sender);
+        const distributionProto = _proto_1.proto.SenderKeyDistributionMessage.encode({
+            id: senderKey.keyId,
+            iteration: senderKey.iteration,
+            chainKey: senderKey.chainKey,
+            signingKey: senderKey.signingPublicKey
+        }).finish();
+        const payload = (0, _crypto_1.prependVersion)(distributionProto, constants_1.SIGNAL_GROUP_VERSION);
+        await this.store.upsertSenderKeyDistribution({
+            groupId,
+            sender,
+            keyId: senderKey.keyId,
+            timestampMs: Date.now()
+        });
+        return {
+            groupId,
+            axolotlSenderKeyDistributionMessage: payload
+        };
+    }
+    async filterParticipantsNeedingDistribution(groupId, sender, participants) {
+        if (participants.length === 0) {
+            return [];
+        }
+        const senderKey = await this.ensureSenderKey(groupId, sender);
+        const distributed = await this.store.getDeviceSenderKeyDistributions(groupId, participants);
+        return participants.filter((_, index) => {
+            const record = distributed[index];
+            return !record || record.keyId !== senderKey.keyId;
+        });
+    }
+    async markSenderKeyDistributed(groupId, sender, participants) {
+        if (participants.length === 0) {
+            return;
+        }
+        const senderKey = await this.ensureSenderKey(groupId, sender);
+        const timestampMs = Date.now();
+        await this.store.upsertSenderKeyDistributions(participants.map((participant) => ({
+            groupId,
+            sender: participant,
+            keyId: senderKey.keyId,
+            timestampMs
+        })));
+    }
+    async processSenderKeyDistributionPayload(groupId, sender, payload) {
+        if (groupId.length === 0) {
+            throw new Error('sender key distribution missing groupId');
+        }
+        const parsed = (0, SenderKeyCodec_1.parseDistributionPayload)(payload);
+        const record = {
+            groupId,
+            sender,
+            keyId: parsed.keyId,
+            iteration: parsed.iteration,
+            chainKey: parsed.chainKey,
+            signingPublicKey: parsed.signingPublicKey,
+            unusedMessageKeys: []
+        };
+        await this.store.upsertSenderKey(record);
+        await this.store.upsertSenderKeyDistribution({
+            groupId,
+            sender,
+            keyId: parsed.keyId,
+            timestampMs: Date.now()
+        });
+        return record;
+    }
+    async encryptGroupMessage(groupId, sender, plaintext) {
+        const senderKey = await this.ensureSenderKey(groupId, sender);
+        if (!senderKey.signingPrivateKey) {
+            throw new Error('sender private signing key is missing');
+        }
+        const derived = await (0, SenderKeyChain_1.deriveSenderKeyMsgKey)(senderKey.iteration, senderKey.chainKey);
+        const messagePayload = await aesCbcEncryptFromSeed(derived.messageKey.seed, plaintext);
+        const senderKeyMessage = _proto_1.proto.SenderKeyMessage.encode({
+            id: senderKey.keyId,
+            iteration: derived.messageKey.iteration,
+            ciphertext: messagePayload
+        }).finish();
+        const versionedContent = (0, _crypto_1.prependVersion)(senderKeyMessage, constants_1.SIGNAL_GROUP_VERSION);
+        const signature = await (0, WaAdvSignature_1.signSignalMessage)(senderKey.signingPrivateKey, versionedContent);
+        if (signature.length !== constants_1.SIGNATURE_SIZE) {
+            throw new Error(`invalid sender key signature length ${signature.length}`);
+        }
+        const ciphertext = (0, bytes_1.concatBytes)([versionedContent, signature]);
+        await this.store.upsertSenderKey({
+            ...senderKey,
+            chainKey: derived.nextChainKey,
+            iteration: derived.messageKey.iteration + 1
+        });
+        return {
+            groupId,
+            sender,
+            keyId: senderKey.keyId,
+            iteration: derived.messageKey.iteration,
+            ciphertext
+        };
+    }
+    async decryptGroupMessage(payload) {
+        const parsed = (0, SenderKeyCodec_1.parseSenderKeyMessage)(payload.ciphertext);
+        const senderKey = await this.store.getDeviceSenderKey(payload.groupId, payload.sender);
+        if (!senderKey) {
+            throw new Error('missing sender key');
+        }
+        if (senderKey.keyId !== parsed.keyId) {
+            throw new Error('sender key id mismatch');
+        }
+        if (payload.keyId !== undefined &&
+            payload.keyId !== null &&
+            parsed.keyId !== payload.keyId) {
+            throw new Error('sender key id mismatch');
+        }
+        if (payload.iteration !== undefined &&
+            payload.iteration !== null &&
+            parsed.iteration !== payload.iteration) {
+            throw new Error('sender key iteration mismatch');
+        }
+        const signedContent = parsed.versionContentMac.subarray(0, parsed.versionContentMac.length - constants_1.SIGNATURE_SIZE);
+        const signature = parsed.versionContentMac.subarray(parsed.versionContentMac.length - constants_1.SIGNATURE_SIZE);
+        const validSignature = await (0, WaAdvSignature_1.verifySignalSignature)(senderKey.signingPublicKey, signedContent, signature);
+        if (!validSignature) {
+            throw new Error('invalid sender key signature');
+        }
+        const selected = await (0, SenderKeyChain_1.selectMessageKey)(senderKey, parsed.iteration);
+        const plaintext = await aesCbcDecryptFromSeed(selected.messageKey.seed, parsed.ciphertext);
+        await this.store.upsertSenderKey(selected.updatedRecord);
+        return plaintext;
+    }
+    async ensureSenderKey(groupId, sender) {
+        const existing = await this.store.getDeviceSenderKey(groupId, sender);
+        if (existing) {
+            return existing;
+        }
+        const signingKeyPair = await _crypto_1.X25519.generateKeyPair();
+        const created = {
+            groupId,
+            sender,
+            keyId: await (0, _crypto_1.randomIntAsync)(1, 2147483647),
+            iteration: 0,
+            chainKey: await (0, _crypto_1.randomBytesAsync)(32),
+            signingPublicKey: (0, _crypto_1.toSerializedPubKey)(signingKeyPair.pubKey),
+            signingPrivateKey: signingKeyPair.privKey,
+            unusedMessageKeys: []
+        };
+        await this.store.upsertSenderKey(created);
+        return created;
+    }
+}
+exports.SenderKeyManager = SenderKeyManager;

package/dist/signal/index.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignalProtocol = exports.createAndStoreInitialKeys = exports.SenderKeyManager = exports.SignalSessionSyncApi = exports.SignalRotateKeyApi = exports.SignalMissingPreKeysSyncApi = exports.SignalIdentitySyncApi = exports.SignalDeviceSyncApi = exports.SignalDigestSyncApi = exports.parsePreKeyUploadFailure = exports.buildPreKeyUploadIq = exports.generateSignedPreKey = exports.generateRegistrationInfo = exports.generateRegistrationId = exports.generatePreKeyPair = void 0;
+var keygen_1 = require("./registration/keygen");
+Object.defineProperty(exports, "generatePreKeyPair", { enumerable: true, get: function () { return keygen_1.generatePreKeyPair; } });
+Object.defineProperty(exports, "generateRegistrationId", { enumerable: true, get: function () { return keygen_1.generateRegistrationId; } });
+Object.defineProperty(exports, "generateRegistrationInfo", { enumerable: true, get: function () { return keygen_1.generateRegistrationInfo; } });
+Object.defineProperty(exports, "generateSignedPreKey", { enumerable: true, get: function () { return keygen_1.generateSignedPreKey; } });
+var prekeys_1 = require("./api/prekeys");
+Object.defineProperty(exports, "buildPreKeyUploadIq", { enumerable: true, get: function () { return prekeys_1.buildPreKeyUploadIq; } });
+Object.defineProperty(exports, "parsePreKeyUploadFailure", { enumerable: true, get: function () { return prekeys_1.parsePreKeyUploadFailure; } });
+var SignalDigestSyncApi_1 = require("./api/SignalDigestSyncApi");
+Object.defineProperty(exports, "SignalDigestSyncApi", { enumerable: true, get: function () { return SignalDigestSyncApi_1.SignalDigestSyncApi; } });
+var SignalDeviceSyncApi_1 = require("./api/SignalDeviceSyncApi");
+Object.defineProperty(exports, "SignalDeviceSyncApi", { enumerable: true, get: function () { return SignalDeviceSyncApi_1.SignalDeviceSyncApi; } });
+var SignalIdentitySyncApi_1 = require("./api/SignalIdentitySyncApi");
+Object.defineProperty(exports, "SignalIdentitySyncApi", { enumerable: true, get: function () { return SignalIdentitySyncApi_1.SignalIdentitySyncApi; } });
+var SignalMissingPreKeysSyncApi_1 = require("./api/SignalMissingPreKeysSyncApi");
+Object.defineProperty(exports, "SignalMissingPreKeysSyncApi", { enumerable: true, get: function () { return SignalMissingPreKeysSyncApi_1.SignalMissingPreKeysSyncApi; } });
+var SignalRotateKeyApi_1 = require("./api/SignalRotateKeyApi");
+Object.defineProperty(exports, "SignalRotateKeyApi", { enumerable: true, get: function () { return SignalRotateKeyApi_1.SignalRotateKeyApi; } });
+var SignalSessionSyncApi_1 = require("./api/SignalSessionSyncApi");
+Object.defineProperty(exports, "SignalSessionSyncApi", { enumerable: true, get: function () { return SignalSessionSyncApi_1.SignalSessionSyncApi; } });
+var SenderKeyManager_1 = require("./group/SenderKeyManager");
+Object.defineProperty(exports, "SenderKeyManager", { enumerable: true, get: function () { return SenderKeyManager_1.SenderKeyManager; } });
+var utils_1 = require("./registration/utils");
+Object.defineProperty(exports, "createAndStoreInitialKeys", { enumerable: true, get: function () { return utils_1.createAndStoreInitialKeys; } });
+var SignalProtocol_1 = require("./session/SignalProtocol");
+Object.defineProperty(exports, "SignalProtocol", { enumerable: true, get: function () { return SignalProtocol_1.SignalProtocol; } });

package/dist/signal/registration/keygen.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateRegistrationInfo = generateRegistrationInfo;
+exports.generatePreKeyPair = generatePreKeyPair;
+exports.generateSignedPreKey = generateSignedPreKey;
+exports.generateRegistrationId = generateRegistrationId;
+const _crypto_1 = require("../../crypto/index.js");
+const keys_1 = require("../../crypto/core/keys");
+const X25519_1 = require("../../crypto/curves/X25519");
+const WaAdvSignature_1 = require("../crypto/WaAdvSignature");
+async function generateRegistrationInfo() {
+    return {
+        registrationId: await generateRegistrationId(),
+        identityKeyPair: await X25519_1.X25519.generateKeyPair()
+    };
+}
+async function generatePreKeyPair(keyId) {
+    return {
+        keyId,
+        keyPair: await X25519_1.X25519.generateKeyPair(),
+        uploaded: false
+    };
+}
+async function generateSignedPreKey(keyId, signingPrivateKey) {
+    const keyPair = await X25519_1.X25519.generateKeyPair();
+    const serializedPubKey = (0, keys_1.toSerializedPubKey)(keyPair.pubKey);
+    const signature = await (0, WaAdvSignature_1.signSignalMessage)(signingPrivateKey, serializedPubKey);
+    return {
+        keyId,
+        keyPair,
+        signature,
+        uploaded: false
+    };
+}
+async function generateRegistrationId() {
+    return await (0, _crypto_1.randomIntAsync)(1, 16381);
+}

package/dist/signal/registration/utils.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAndStoreInitialKeys = createAndStoreInitialKeys;
+const keygen_1 = require("../registration/keygen");
+async function createAndStoreInitialKeys(store) {
+    const [registrationInfo, firstPreKey] = await Promise.all([
+        (0, keygen_1.generateRegistrationInfo)(),
+        (0, keygen_1.generatePreKeyPair)(1)
+    ]);
+    const signedPreKey = await (0, keygen_1.generateSignedPreKey)(1, registrationInfo.identityKeyPair.privKey);
+    await store.setRegistrationInfo(registrationInfo);
+    await store.setSignedPreKey(signedPreKey);
+    await store.getOrGenSinglePreKey(async () => firstPreKey);
+    return {
+        registrationInfo,
+        signedPreKey,
+        firstPreKey
+    };
+}

package/dist/signal/session/SignalProtocol.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignalProtocol = void 0;
+const _crypto_1 = require("../../crypto/index.js");
+const ConsoleLogger_1 = require("../../infra/log/ConsoleLogger");
+const constants_1 = require("../constants");
+const SignalRatchet_1 = require("../session/SignalRatchet");
+const SignalSerializer_1 = require("../session/SignalSerializer");
+const SignalSession_1 = require("../session/SignalSession");
+const bytes_1 = require("../../util/bytes");
+class SignalProtocol {
+    constructor(store, logger = new ConsoleLogger_1.ConsoleLogger('info')) {
+        this.store = store;
+        this.logger = logger;
+    }
+    async hasSession(address) {
+        return this.store.hasSession(address);
+    }
+    async hasSessions(addresses) {
+        return this.store.hasSessions(addresses);
+    }
+    async establishOutgoingSession(address, remoteBundle) {
+        const [local, localOneTimeBase] = await Promise.all([
+            (0, SignalSession_1.requireLocalIdentity)(this.store),
+            (0, SignalSession_1.generateSerializedKeyPair)()
+        ]);
+        const session = await (0, SignalSession_1.initiateSessionOutgoing)(local, remoteBundle, localOneTimeBase);
+        await this.store.setRemoteIdentity(address, session.remote.pubKey);
+        await this.store.setSession(address, session);
+        return session;
+    }
+    async encryptMessage(address, plaintext, expectedIdentity) {
+        const session = await this.store.getSession(address);
+        if (!session) {
+            throw new Error('signal session not found');
+        }
+        if (expectedIdentity &&
+            !(0, bytes_1.uint8Equal)((0, _crypto_1.toSerializedPubKey)(expectedIdentity), session.remote.pubKey)) {
+            throw new Error('identity mismatch');
+        }
+        const [updatedSession, encrypted] = await (0, SignalRatchet_1.encryptMsg)(session, plaintext);
+        await this.store.setSession(address, updatedSession);
+        if (!(0, bytes_1.uint8Equal)(updatedSession.remote.pubKey, session.remote.pubKey)) {
+            await this.store.setRemoteIdentity(address, updatedSession.remote.pubKey);
+        }
+        return {
+            ...encrypted,
+            baseKey: updatedSession.aliceBaseKey
+        };
+    }
+    async decryptMessage(address, envelope) {
+        const currentSession = await this.store.getSession(address);
+        let outcome;
+        if (envelope.type === 'pkmsg') {
+            const parsedPk = (0, SignalSerializer_1.deserializePkMsg)(envelope.ciphertext);
+            outcome = await this.decryptPkMsg(currentSession, parsedPk);
+        }
+        else {
+            const parsed = (0, SignalSerializer_1.deserializeMsg)(envelope.ciphertext);
+            outcome = await this.decryptMsgInternal(currentSession, parsed);
+        }
+        const nextRemoteIdentity = outcome.newSessionInfo?.newIdentity ?? outcome.updatedSession.remote.pubKey;
+        if (!currentSession || !(0, bytes_1.uint8Equal)(currentSession.remote.pubKey, nextRemoteIdentity)) {
+            await this.store.setRemoteIdentity(address, nextRemoteIdentity);
+        }
+        await this.store.setSession(address, outcome.updatedSession);
+        return outcome.plaintext;
+    }
+    async decryptMsgInternal(session, parsed) {
+        return (0, SignalRatchet_1.decryptMsg)(session, parsed, (error, previousSessionIndex) => {
+            this.logger.debug('signal decrypt fallback session failed', {
+                previousSessionIndex,
+                message: error.message
+            });
+        });
+    }
+    async decryptPkMsg(currentSession, parsed) {
+        const matchingSession = (0, SignalSession_1.findMatchingSession)(currentSession, parsed.sessionBaseKey);
+        if (matchingSession) {
+            const [updatedSession, plaintext] = await (0, SignalRatchet_1.decryptMsgFromSession)(matchingSession, parsed);
+            return {
+                updatedSession,
+                plaintext,
+                newSessionInfo: null
+            };
+        }
+        const [local, signedPreKey, oneTimePreKey] = await Promise.all([
+            (0, SignalSession_1.requireLocalIdentity)(this.store),
+            (0, SignalSerializer_1.requireSignedPreKey)(this.store, parsed.localSignedPreKeyId),
+            parsed.localOneTimeKeyId === null || parsed.localOneTimeKeyId === undefined
+                ? Promise.resolve(null)
+                : (0, SignalSerializer_1.requirePreKey)(this.store, parsed.localOneTimeKeyId)
+        ]);
+        const incoming = await (0, SignalSession_1.initiateSessionIncoming)(local, parsed.remote, parsed.sessionBaseKey, {
+            signed: (0, SignalSession_1.toSerializedKeyPair)(signedPreKey.keyPair),
+            oneTime: oneTimePreKey ? (0, SignalSession_1.toSerializedKeyPair)(oneTimePreKey.keyPair) : undefined,
+            ratchet: (0, SignalSession_1.toSerializedKeyPair)(signedPreKey.keyPair)
+        });
+        const newIdentity = !currentSession || !(0, bytes_1.uint8Equal)(incoming.remote.pubKey, currentSession.remote.pubKey)
+            ? incoming.remote.pubKey
+            : null;
+        const baseSession = currentSession
+            ? {
+                ...incoming,
+                prevSessions: [
+                    (0, SignalSession_1.detachSession)(currentSession),
+                    ...currentSession.prevSessions.slice(0, constants_1.MAX_PREV_SESSIONS - 1)
+                ]
+            }
+            : incoming;
+        const [updatedSession, plaintext] = await (0, SignalRatchet_1.decryptMsgFromSession)(baseSession, parsed);
+        if (parsed.localOneTimeKeyId !== null && parsed.localOneTimeKeyId !== undefined) {
+            await this.store.consumePreKeyById(parsed.localOneTimeKeyId);
+        }
+        return {
+            updatedSession,
+            plaintext,
+            newSessionInfo: {
+                newIdentity,
+                baseSession,
+                usedPreKey: parsed.localOneTimeKeyId
+            }
+        };
+    }
+}
+exports.SignalProtocol = SignalProtocol;

package/dist/signal/session/SignalRatchet.js

@@ -0,0 +1,268 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.splitMsgKey = splitMsgKey;
+exports.deriveMsgKey = deriveMsgKey;
+exports.selectMessageKey = selectMessageKey;
+exports.encryptMsg = encryptMsg;
+exports.decryptMsg = decryptMsg;
+exports.decryptMsgFromSession = decryptMsgFromSession;
+const _crypto_1 = require("../../crypto/index.js");
+const _proto_1 = require("../../proto.js");
+const constants_1 = require("../constants");
+const SignalSession_1 = require("../session/SignalSession");
+const bytes_1 = require("../../util/bytes");
+const primitives_1 = require("../../util/primitives");
+const MAX_TRACKED_RECV_CHAINS = 4;
+function splitMsgKey(index, bytes) {
+    if (bytes.length < 80) {
+        throw new Error('invalid message key length');
+    }
+    return {
+        index,
+        cipherKey: bytes.subarray(0, 32),
+        macKey: bytes.subarray(32, 64),
+        iv: bytes.subarray(64, 80)
+    };
+}
+async function deriveMsgKey(index, chainKey) {
+    const state = await createDerivedChainState(chainKey);
+    const derived = await deriveMsgKeyFromState(index, state);
+    return {
+        nextChainKey: derived.nextState.chainKey,
+        messageKey: derived.messageKey
+    };
+}
+async function selectMessageKey(chain, targetCounter) {
+    const delta = targetCounter - chain.nextMsgIndex;
+    if (delta > constants_1.FUTURE_MESSAGES_MAX) {
+        throw new Error('message too far in future');
+    }
+    const unused = chain.unusedMsgKeys;
+    if (delta < 0) {
+        const idx = unused.findIndex((entry) => entry.index === targetCounter);
+        if (idx === -1) {
+            throw new Error('duplicate message');
+        }
+        const messageKey = unused[idx];
+        const nextUnused = (0, bytes_1.removeAt)(unused, idx);
+        return {
+            messageKey,
+            updatedChain: {
+                ratchetPubKey: chain.ratchetPubKey,
+                nextMsgIndex: chain.nextMsgIndex,
+                chainKey: chain.chainKey,
+                unusedMsgKeys: nextUnused
+            }
+        };
+    }
+    let chainState = await createDerivedChainState(chain.chainKey);
+    const first = await deriveMsgKeyFromState(chain.nextMsgIndex, chainState);
+    let currentMessageKey = first.messageKey;
+    chainState = first.nextState;
+    let nextUnused = unused.slice();
+    if (delta > 0) {
+        let overflow = delta + unused.length - constants_1.MAX_UNUSED_KEYS;
+        if (overflow > 0) {
+            nextUnused = nextUnused.slice(overflow);
+            overflow -= unused.length;
+        }
+        for (let counter = chain.nextMsgIndex + 1; counter <= targetCounter; counter += 1) {
+            if (overflow > 0) {
+                overflow -= 1;
+            }
+            else {
+                nextUnused.push(currentMessageKey);
+            }
+            const derived = await deriveMsgKeyFromState(counter, chainState);
+            currentMessageKey = derived.messageKey;
+            chainState = derived.nextState;
+        }
+    }
+    return {
+        messageKey: currentMessageKey,
+        updatedChain: {
+            ratchetPubKey: chain.ratchetPubKey,
+            nextMsgIndex: targetCounter + 1,
+            chainKey: chainState.chainKey,
+            unusedMsgKeys: nextUnused
+        }
+    };
+}
+async function createDerivedChainState(chainKey) {
+    return {
+        chainKey,
+        hmacKey: await (0, _crypto_1.importHmacKey)(chainKey)
+    };
+}
+async function deriveMsgKeyFromState(index, state) {
+    const nextChainRawPromise = (0, _crypto_1.hmacSign)(state.hmacKey, constants_1.CHAIN_KEY_LABEL);
+    const messageInputKeyPromise = (0, _crypto_1.hmacSign)(state.hmacKey, constants_1.MESSAGE_KEY_LABEL);
+    const [nextChainRaw, messageInputKey] = await Promise.all([
+        nextChainRawPromise,
+        messageInputKeyPromise
+    ]);
+    const nextChainKey = nextChainRaw.subarray(0, 32);
+    const [nextHmacKey, expanded] = await Promise.all([
+        (0, _crypto_1.importHmacKey)(nextChainKey),
+        (0, _crypto_1.hkdf)(messageInputKey, null, 'WhisperMessageKeys', 80)
+    ]);
+    return {
+        nextState: {
+            chainKey: nextChainKey,
+            hmacKey: nextHmacKey
+        },
+        messageKey: splitMsgKey(index, expanded)
+    };
+}
+async function encryptMsg(session, plaintext) {
+    const { nextChainKey, messageKey } = await deriveMsgKey(session.sendChain.nextMsgIndex, session.sendChain.chainKey);
+    const [cipherKey, macKey] = await Promise.all([
+        (0, _crypto_1.importAesCbcKey)(messageKey.cipherKey),
+        (0, _crypto_1.importHmacKey)(messageKey.macKey)
+    ]);
+    const ciphertext = await (0, _crypto_1.aesCbcEncrypt)(cipherKey, messageKey.iv, plaintext);
+    const signalPayload = _proto_1.proto.SignalMessage.encode({
+        ratchetKey: session.sendChain.ratchetKey.pubKey,
+        counter: messageKey.index,
+        previousCounter: session.prevSendChainHighestIndex,
+        ciphertext
+    }).finish();
+    const versionedSignalPayload = (0, _crypto_1.prependVersion)(signalPayload, constants_1.SIGNAL_VERSION);
+    const macInput = (0, bytes_1.concatBytes)([
+        session.local.pubKey,
+        session.remote.pubKey,
+        versionedSignalPayload
+    ]);
+    const mac = await (0, _crypto_1.hmacSign)(macKey, macInput);
+    const signalMessage = (0, bytes_1.concatBytes)([versionedSignalPayload, mac.subarray(0, constants_1.SIGNAL_MAC_SIZE)]);
+    let type = 'msg';
+    let output = signalMessage;
+    if (session.initialExchangeInfo) {
+        const preKeyPayload = _proto_1.proto.PreKeySignalMessage.encode({
+            registrationId: session.local.regId,
+            preKeyId: session.initialExchangeInfo.remoteOneTimeId ?? undefined,
+            signedPreKeyId: session.initialExchangeInfo.remoteSignedId,
+            baseKey: session.initialExchangeInfo.localOneTimePubKey,
+            identityKey: session.local.pubKey,
+            message: signalMessage
+        }).finish();
+        type = 'pkmsg';
+        output = (0, _crypto_1.prependVersion)(preKeyPayload, constants_1.SIGNAL_VERSION);
+    }
+    const updated = {
+        ...session,
+        sendChain: {
+            ratchetKey: session.sendChain.ratchetKey,
+            nextMsgIndex: messageKey.index + 1,
+            chainKey: nextChainKey
+        }
+    };
+    return [updated, { type, ciphertext: output }];
+}
+async function decryptMsg(session, parsed, onPrevSessionDecryptError) {
+    if (!session) {
+        throw new Error('signal session not found');
+    }
+    try {
+        const [updatedSession, plaintext] = await decryptMsgFromSession(session, parsed);
+        return {
+            updatedSession,
+            plaintext,
+            newSessionInfo: null
+        };
+    }
+    catch (error) {
+        for (let i = 0; i < session.prevSessions.length; i += 1) {
+            const prevSession = (0, SignalSession_1.snapshotToRecord)(session.prevSessions[i]);
+            try {
+                const [updatedPrev, plaintext] = await decryptMsgFromSession(prevSession, parsed);
+                const updatedSession = {
+                    ...updatedPrev,
+                    prevSessions: [
+                        (0, SignalSession_1.detachSession)(session),
+                        ...session.prevSessions.slice(0, i),
+                        ...session.prevSessions.slice(i + 1)
+                    ]
+                };
+                return {
+                    updatedSession,
+                    plaintext,
+                    newSessionInfo: {
+                        newIdentity: (0, bytes_1.uint8Equal)(updatedSession.remote.pubKey, session.remote.pubKey)
+                            ? null
+                            : updatedSession.remote.pubKey,
+                        baseSession: prevSession,
+                        usedPreKey: null
+                    }
+                };
+            }
+            catch (prevError) {
+                onPrevSessionDecryptError?.((0, primitives_1.toError)(prevError), i);
+                continue;
+            }
+        }
+        throw error;
+    }
+}
+async function decryptMsgFromSession(session, message) {
+    const ratchetPubKey = (0, _crypto_1.toSerializedPubKey)(message.ratchetPubKey);
+    const recvChainIndex = session.recvChains.findIndex((entry) => (0, bytes_1.uint8Equal)(entry.ratchetPubKey, ratchetPubKey));
+    let selectedMessageKey;
+    let updatedSession;
+    if (recvChainIndex === -1) {
+        const recvRatchet = await (0, SignalSession_1.calculateRatchet)(session.rootKey, session.sendChain.ratchetKey, ratchetPubKey);
+        const freshRecvChain = {
+            ratchetPubKey,
+            nextMsgIndex: 0,
+            chainKey: recvRatchet.chainKey,
+            unusedMsgKeys: []
+        };
+        const [selected, newSendRatchet] = await Promise.all([
+            selectMessageKey(freshRecvChain, message.counter),
+            (0, SignalSession_1.generateSerializedKeyPair)()
+        ]);
+        selectedMessageKey = selected.messageKey;
+        const sendRatchet = await (0, SignalSession_1.calculateRatchet)(recvRatchet.rootKey, newSendRatchet, ratchetPubKey);
+        const nextRecvChains = session.recvChains.slice(-MAX_TRACKED_RECV_CHAINS);
+        nextRecvChains.push(selected.updatedChain);
+        updatedSession = {
+            ...session,
+            rootKey: sendRatchet.rootKey,
+            recvChains: nextRecvChains,
+            sendChain: {
+                ratchetKey: newSendRatchet,
+                nextMsgIndex: 0,
+                chainKey: sendRatchet.chainKey
+            },
+            initialExchangeInfo: null,
+            prevSendChainHighestIndex: Math.max(session.sendChain.nextMsgIndex - 1, 0)
+        };
+    }
+    else {
+        const selected = await selectMessageKey(session.recvChains[recvChainIndex], message.counter);
+        selectedMessageKey = selected.messageKey;
+        const nextRecvChains = session.recvChains.slice();
+        nextRecvChains[recvChainIndex] = selected.updatedChain;
+        updatedSession = {
+            ...session,
+            recvChains: nextRecvChains
+        };
+    }
+    const [cipherKey, macKey] = await Promise.all([
+        (0, _crypto_1.importAesCbcKey)(selectedMessageKey.cipherKey),
+        (0, _crypto_1.importHmacKey)(selectedMessageKey.macKey)
+    ]);
+    const payloadWithoutMac = message.versionContentMac.subarray(0, message.versionContentMac.length - constants_1.SIGNAL_MAC_SIZE);
+    const expectedMacInput = (0, bytes_1.concatBytes)([
+        session.remote.pubKey,
+        session.local.pubKey,
+        payloadWithoutMac
+    ]);
+    const expectedMac = await (0, _crypto_1.hmacSign)(macKey, expectedMacInput);
+    const receivedMac = message.versionContentMac.subarray(message.versionContentMac.length - constants_1.SIGNAL_MAC_SIZE);
+    if (!(0, bytes_1.uint8Equal)(expectedMac.subarray(0, constants_1.SIGNAL_MAC_SIZE), receivedMac)) {
+        throw new Error('invalid message mac');
+    }
+    const plaintext = await (0, _crypto_1.aesCbcDecrypt)(cipherKey, selectedMessageKey.iv, message.ciphertext);
+    return [updatedSession, plaintext];
+}