zapo-js 0.1.2 → 0.3.0

package/dist/esm/signal/api/result-map.js

@@ -0,0 +1,10 @@
+function mergePreferredParsedResult(target, key, next, isPreferred) {
+    const current = target.get(key);
+    if (!current || !isPreferred(current)) {
+        target.set(key, next);
+    }
+}
+export function registerParsedResultByRawAndCanonicalKey(parsedByRawKey, parsedByCanonicalKey, rawKey, canonicalKey, result, isPreferred) {
+    mergePreferredParsedResult(parsedByRawKey, rawKey, result, isPreferred);
+    mergePreferredParsedResult(parsedByCanonicalKey, canonicalKey, result, isPreferred);
+}

package/dist/esm/signal/constants.js

@@ -1,11 +1,7 @@
-import { SERIALIZED_PUB_KEY_PREFIX as CORE_SERIALIZED_PUB_KEY_PREFIX } from '../crypto/core/constants.js';
 import { TEXT_ENCODER } from '../util/bytes.js';
 export const SIGNAL_VERSION = 3;
 export const SIGNAL_GROUP_VERSION = 3;
-export const SERIALIZED_PUB_KEY_PREFIX = CORE_SERIALIZED_PUB_KEY_PREFIX;
-export const KEY_TYPE_CURVE25519 = 5;
 export const SIGNAL_MAC_SIZE = 8;
-export const SIGNATURE_SIZE = 64;
 export const MAX_PREV_SESSIONS = 40;
 export const MAX_UNUSED_KEYS = 2000;
 export const FUTURE_MESSAGES_MAX = 2000;

package/dist/esm/signal/crypto/WaAdvSignature.js

@@ -1,56 +1,16 @@
-import { ed25519VerifyRaw, importHmacKey, hmacSign, randomBytesAsync, sha512, toRawPubKey } from '../../crypto/index.js';
-import { clampCurvePrivateKeyInPlace, montgomeryToEdwardsPublic } from '../../crypto/curves/X25519.js';
-import { encodeExtendedPoint, scalarMultBase } from '../../crypto/math/edwards.js';
-import { bytesToBigIntLE, bigIntToBytesLE } from '../../crypto/math/le.js';
-import { modGroup } from '../../crypto/math/mod.js';
-import { ADV_PREFIX_ACCOUNT_SIGNATURE, ADV_PREFIX_DEVICE_SIGNATURE, ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, ADV_PREFIX_HOSTED_DEVICE_SIGNATURE, SIGNAL_PREFIX_SIGNATURE_RANDOM } from '../crypto/constants.js';
-import { assertByteLength, concatBytes } from '../../util/bytes.js';
+import { hmacSign, importHmacKey, toRawPubKey, xeddsaSign, xeddsaVerify } from '../../crypto/index.js';
+import { ADV_PREFIX_ACCOUNT_SIGNATURE, ADV_PREFIX_DEVICE_SIGNATURE, ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, ADV_PREFIX_HOSTED_DEVICE_SIGNATURE } from '../crypto/constants.js';
+import { concatBytes } from '../../util/bytes.js';
 export { ADV_PREFIX_ACCOUNT_SIGNATURE, ADV_PREFIX_DEVICE_SIGNATURE, ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, ADV_PREFIX_HOSTED_DEVICE_SIGNATURE } from '../crypto/constants.js';
-export async function verifySignalSignature(publicKey, message, signature) {
-    if (!assertByteLength(signature, 64, 'invalid signal signature length', false)) {
-        return false;
-    }
-    if ((signature[63] & 0x60) !== 0) {
-        return false;
-    }
-    const signalSignature = new Uint8Array(signature);
-    const signBit = signalSignature[63] & 0x80;
-    signalSignature[63] &= 0x7f;
-    const curvePublic = toRawPubKey(publicKey);
-    const edPublic = montgomeryToEdwardsPublic(curvePublic, signBit);
-    return ed25519VerifyRaw(edPublic, signalSignature, message);
-}
-export async function signSignalMessage(privateKey, message) {
-    assertByteLength(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
-    const clampedPrivateKey = clampCurvePrivateKeyInPlace(privateKey);
-    const privateScalar = bytesToBigIntLE(clampedPrivateKey);
-    const encodedPublic = encodeExtendedPoint(scalarMultBase(privateScalar));
-    const pubKeySignBit = encodedPublic[31] & 0x80;
-    const randomSuffix = await randomBytesAsync(64);
-    const hashInput = concatBytes([
-        SIGNAL_PREFIX_SIGNATURE_RANDOM,
-        clampedPrivateKey,
-        message,
-        randomSuffix
-    ]);
-    const r = modGroup(bytesToBigIntLE(await sha512(hashInput)));
-    const encodedR = encodeExtendedPoint(scalarMultBase(r));
-    const hInput = concatBytes([encodedR, encodedPublic, message]);
-    const h = modGroup(bytesToBigIntLE(await sha512(hInput)));
-    const s = modGroup(r + h * privateScalar);
-    const encodedS = bigIntToBytesLE(s, 32);
-    encodedS[31] = (encodedS[31] & 0x7f) | pubKeySignBit;
-    return concatBytes([encodedR, encodedS]);
-}
 export async function verifyDeviceIdentityAccountSignature(details, accountSignature, identityPublicKey, accountSignatureKey, isHosted = false) {
     const prefix = isHosted ? ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE : ADV_PREFIX_ACCOUNT_SIGNATURE;
     const message = concatBytes([prefix, details, identityPublicKey]);
-    return verifySignalSignature(accountSignatureKey, message, accountSignature);
+    return xeddsaVerify(toRawPubKey(accountSignatureKey), message, accountSignature);
 }
 export async function generateDeviceSignature(details, identityKeyPair, accountSignatureKey, isHosted = false) {
     const prefix = isHosted ? ADV_PREFIX_HOSTED_DEVICE_SIGNATURE : ADV_PREFIX_DEVICE_SIGNATURE;
     const message = concatBytes([prefix, details, identityKeyPair.pubKey, accountSignatureKey]);
-    return signSignalMessage(identityKeyPair.privKey, message);
+    return xeddsaSign(identityKeyPair.privKey, message);
 }
 export async function computeAdvIdentityHmac(secretKey, details) {
     const key = await importHmacKey(secretKey);

package/dist/esm/signal/crypto/constants.js

@@ -1,7 +1,3 @@
-export const SIGNAL_PREFIX_SIGNATURE_RANDOM = new Uint8Array([
-    0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
-]);
 export const ADV_PREFIX_ACCOUNT_SIGNATURE = new Uint8Array([6, 0]);
 export const ADV_PREFIX_DEVICE_SIGNATURE = new Uint8Array([6, 1]);
 export const ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE = new Uint8Array([6, 5]);

package/dist/esm/signal/{store/sqlite.js → encoding.js}

@@ -1,7 +1,7 @@
-import { proto } from '../../proto.js';
-import { WA_DEFAULTS } from '../../protocol/constants.js';
-import { assertByteLength } from '../../util/bytes.js';
-import { asBytes, asNumber, asOptionalBytes, asOptionalNumber, asString, toBoolOrUndef } from '../../util/coercion.js';
+import { proto } from '../proto.js';
+import { WA_DEFAULTS } from '../protocol/constants.js';
+import { assertByteLength } from '../util/bytes.js';
+import { asBytes, asNumber, asOptionalBytes, asOptionalNumber, asString, toBoolOrUndef } from '../util/coercion.js';
 export function toSignalAddressParts(address) {
     return {
         user: address.user,
@@ -46,7 +46,7 @@ export function decodeSignalSignedPreKeyRow(row) {
         uploaded: toBoolOrUndef(row.uploaded)
     };
 }
-function encodeSignalSessionSnapshot(session) {
+export function encodeSignalSessionSnapshot(session) {
     return {
         sessionVersion: 3,
         localRegistrationId: session.local.regId,
@@ -56,7 +56,7 @@ function encodeSignalSessionSnapshot(session) {
         rootKey: session.rootKey,
         previousCounter: session.prevSendChainHighestIndex,
         senderChain: encodeSignalSendChain(session.sendChain),
-        receiverChains: session.recvChains.map((chain) => encodeSignalRecvChain(chain)),
+        receiverChains: session.recvChains,
         pendingPreKey: session.initialExchangeInfo
             ? {
                 preKeyId: session.initialExchangeInfo.remoteOneTimeId ?? undefined,
@@ -78,22 +78,17 @@ function encodeSignalSendChain(chain) {
         messageKeys: []
     };
 }
-function encodeSignalRecvChain(chain) {
+export function encodeSignalRecvChain(chain) {
     return {
         senderRatchetKey: chain.ratchetPubKey,
         chainKey: {
             index: chain.nextMsgIndex,
             key: chain.chainKey
         },
-        messageKeys: (chain.unusedMsgKeys ?? []).map((messageKey) => ({
-            index: messageKey.index,
-            cipherKey: messageKey.cipherKey,
-            macKey: messageKey.macKey,
-            iv: messageKey.iv
-        }))
+        messageKeys: chain.unusedMsgKeys
     };
 }
-function decodeSignalMessageKey(messageKey, field) {
+export function decodeSignalMessageKey(messageKey, field) {
     const cipherKey = asBytes(messageKey.cipherKey, `${field}.cipherKey`);
     assertByteLength(cipherKey, 32, `invalid ${field}.cipherKey length ${cipherKey.byteLength}`);
     const macKey = asBytes(messageKey.macKey, `${field}.macKey`);
@@ -107,7 +102,7 @@ function decodeSignalMessageKey(messageKey, field) {
         iv
     };
 }
-function decodeSignalRecvChain(chain, field) {
+export function decodeSignalRecvChain(chain, field) {
     const chainKey = chain.chainKey;
     if (!chainKey) {
         throw new Error(`missing ${field}.chainKey`);
@@ -120,7 +115,7 @@ function decodeSignalRecvChain(chain, field) {
         ratchetPubKey,
         nextMsgIndex: asNumber(chainKey.index, `${field}.chainKey.index`),
         chainKey: chainKeyBytes,
-        unusedMsgKeys: (chain.messageKeys ?? []).map((messageKey, index) => decodeSignalMessageKey(messageKey, `${field}.messageKeys[${index}]`))
+        unusedMsgKeys: chain.messageKeys ?? []
     };
 }
 function decodeSignalSendChain(chain, field) {
@@ -146,7 +141,7 @@ function decodeSignalSendChain(chain, field) {
         chainKey: chainKeyBytes
     };
 }
-function decodeSignalSessionSnapshot(session, field) {
+export function decodeSignalSessionSnapshot(session, field) {
     const senderChain = session.senderChain;
     if (!senderChain) {
         throw new Error(`missing ${field}.senderChain`);
@@ -179,7 +174,7 @@ function decodeSignalSessionSnapshot(session, field) {
         },
         rootKey,
         sendChain: decodeSignalSendChain(senderChain, `${field}.senderChain`),
-        recvChains: (session.receiverChains ?? []).map((chain, index) => decodeSignalRecvChain(chain, `${field}.receiverChains[${index}]`)),
+        recvChains: session.receiverChains ?? [],
         initialExchangeInfo: pendingPreKey
             ? {
                 remoteOneTimeId: asOptionalNumber(pendingPreKey.preKeyId, `${field}.pendingPreKey.preKeyId`) ??
@@ -195,7 +190,7 @@ function decodeSignalSessionSnapshot(session, field) {
 export function encodeSignalSessionRecord(record) {
     return proto.RecordStructure.encode({
         currentSession: encodeSignalSessionSnapshot(record),
-        previousSessions: record.prevSessions.map((session) => encodeSignalSessionSnapshot(session))
+        previousSessions: record.prevSessions
     }).finish();
 }
 export function decodeSignalSessionRecord(raw) {
@@ -206,7 +201,7 @@ export function decodeSignalSessionRecord(raw) {
     const current = decodeSignalSessionSnapshot(decoded.currentSession, 'signal_sessions.currentSession');
     return {
         ...current,
-        prevSessions: (decoded.previousSessions ?? []).map((session, index) => decodeSignalSessionSnapshot(session, `signal_sessions.previousSessions[${index}]`))
+        prevSessions: decoded.previousSessions ?? []
     };
 }
 export function encodeSenderKeyRecord(record) {
@@ -222,10 +217,18 @@ export function encodeSenderKeyRecord(record) {
                     public: record.signingPublicKey,
                     private: record.signingPrivateKey
                 },
-                senderMessageKeys: (record.unusedMessageKeys ?? []).map((messageKey) => ({
-                    iteration: messageKey.iteration,
-                    seed: messageKey.seed
-                }))
+                senderMessageKeys: (() => {
+                    const src = record.unusedMessageKeys ?? [];
+                    const arr = new Array(src.length);
+                    for (let i = 0; i < src.length; i += 1) {
+                        const messageKey = src[i];
+                        arr[i] = {
+                            iteration: messageKey.iteration,
+                            seed: messageKey.seed
+                        };
+                    }
+                    return arr;
+                })()
             }
         ]
     }).finish();
@@ -245,10 +248,18 @@ function decodeSenderKeyState(state, field) {
         signingPrivateKey: state.senderSigningKey.private !== null && state.senderSigningKey.private !== undefined
             ? asBytes(state.senderSigningKey.private, `${field}.senderSigningKey.private`)
             : undefined,
-        unusedMessageKeys: (state.senderMessageKeys ?? []).map((messageKey, index) => ({
-            iteration: asNumber(messageKey.iteration, `${field}.senderMessageKeys[${index}].iteration`),
-            seed: asBytes(messageKey.seed, `${field}.senderMessageKeys[${index}].seed`)
-        }))
+        unusedMessageKeys: (() => {
+            const src = state.senderMessageKeys ?? [];
+            const arr = new Array(src.length);
+            for (let i = 0; i < src.length; i += 1) {
+                const messageKey = src[i];
+                arr[i] = {
+                    iteration: asNumber(messageKey.iteration, `${field}.senderMessageKeys[${i}].iteration`),
+                    seed: asBytes(messageKey.seed, `${field}.senderMessageKeys[${i}].seed`)
+                };
+            }
+            return arr;
+        })()
     };
 }
 export function decodeSenderKeyRecord(raw, groupId, sender) {
@@ -281,7 +292,7 @@ export function decodeSenderKeyDistributionRow(row) {
         timestampMs: asNumber(row.timestamp_ms, 'sender_key_distribution.timestamp_ms')
     };
 }
-export function decodeSqliteCount(row, field) {
+export function decodeStoreCount(row, field) {
     return row ? asNumber(row.count, field) : 0;
 }
 export function decodeSignalRemoteIdentity(raw) {

package/dist/esm/signal/group/SenderKeyChain.js

@@ -1,9 +1,9 @@
-import { hkdf, importHmacKey, hmacSign } from '../../crypto/index.js';
+import { hkdf, hmacSign, importHmacKey } from '../../crypto/index.js';
 import { CHAIN_KEY_LABEL, MAX_UNUSED_KEYS, MESSAGE_KEY_LABEL, SENDER_KEY_FUTURE_MESSAGES_MAX, WHISPER_GROUP_INFO } from '../constants.js';
 import { assertByteLength, removeAt } from '../../util/bytes.js';
-export async function selectMessageKey(senderKey, targetIteration) {
+export async function selectMessageKey(senderKey, targetIteration, futureMessagesMax) {
     const delta = targetIteration - senderKey.iteration;
-    if (delta > SENDER_KEY_FUTURE_MESSAGES_MAX) {
+    if (delta > (futureMessagesMax ?? SENDER_KEY_FUTURE_MESSAGES_MAX)) {
         throw new Error('sender key message is too far in future');
     }
     const currentUnused = senderKey.unusedMessageKeys ?? [];

package/dist/esm/signal/group/SenderKeyCodec.js

@@ -1,7 +1,8 @@
 import { readVersionedContent, toSerializedPubKey } from '../../crypto/index.js';
 import { proto } from '../../proto.js';
-import { SIGNATURE_SIZE, SIGNAL_GROUP_VERSION } from '../constants.js';
-import { assertByteLength, toBytesView } from '../../util/bytes.js';
+import { SIGNAL_SIGNATURE_LENGTH } from '../api/constants.js';
+import { SIGNAL_GROUP_VERSION } from '../constants.js';
+import { assertByteLength } from '../../util/bytes.js';
 export function parseDistributionPayload(payload) {
     const body = readVersionedContent(payload, SIGNAL_GROUP_VERSION, 0);
     const decoded = proto.SenderKeyDistributionMessage.decode(body);
@@ -15,17 +16,16 @@ export function parseDistributionPayload(payload) {
         decoded.signingKey === undefined) {
         throw new Error('invalid sender key distribution message');
     }
-    const chainKey = toBytesView(decoded.chainKey);
-    assertByteLength(chainKey, 32, 'sender key distribution chainKey must be 32 bytes');
+    assertByteLength(decoded.chainKey, 32, 'sender key distribution chainKey must be 32 bytes');
     return {
         keyId: decoded.id,
         iteration: decoded.iteration,
-        chainKey,
-        signingPublicKey: toSerializedPubKey(toBytesView(decoded.signingKey))
+        chainKey: decoded.chainKey,
+        signingPublicKey: toSerializedPubKey(decoded.signingKey)
     };
 }
 export function parseSenderKeyMessage(versionContentMac) {
-    const body = readVersionedContent(versionContentMac, SIGNAL_GROUP_VERSION, SIGNATURE_SIZE);
+    const body = readVersionedContent(versionContentMac, SIGNAL_GROUP_VERSION, SIGNAL_SIGNATURE_LENGTH);
     const decoded = proto.SenderKeyMessage.decode(body);
     if (decoded.id === null ||
         decoded.id === undefined ||
@@ -38,7 +38,7 @@ export function parseSenderKeyMessage(versionContentMac) {
     return {
         keyId: decoded.id,
         iteration: decoded.iteration,
-        ciphertext: toBytesView(decoded.ciphertext),
+        ciphertext: decoded.ciphertext,
         versionContentMac
     };
 }

package/dist/esm/signal/group/SenderKeyManager.js

@@ -1,7 +1,9 @@
-import { aesCbcDecrypt, aesCbcEncrypt, importAesCbcKey, toSerializedPubKey, prependVersion, randomBytesAsync, randomIntAsync, X25519 } from '../../crypto/index.js';
+import { aesCbcDecrypt, aesCbcEncrypt, importAesCbcKey, prependVersion, randomBytesAsync, randomIntAsync, toRawPubKey, toSerializedPubKey, X25519, xeddsaSign, xeddsaVerify } from '../../crypto/index.js';
+import { StoreLock } from '../../infra/perf/StoreLock.js';
 import { proto } from '../../proto.js';
-import { SIGNAL_GROUP_VERSION, SIGNATURE_SIZE } from '../constants.js';
-import { signSignalMessage, verifySignalSignature } from '../crypto/WaAdvSignature.js';
+import { signalAddressKey } from '../../protocol/jid.js';
+import { SIGNAL_SIGNATURE_LENGTH } from '../api/constants.js';
+import { SIGNAL_GROUP_VERSION } from '../constants.js';
 import { deriveSenderKeyMsgKey, selectMessageKey } from '../group/SenderKeyChain.js';
 import { parseDistributionPayload, parseSenderKeyMessage } from '../group/SenderKeyCodec.js';
 import { concatBytes } from '../../util/bytes.js';
@@ -23,144 +25,161 @@ async function aesCbcDecryptFromSeed(seed, ciphertext) {
     return aesCbcDecrypt(await importAesCbcKey(keyBytes), iv, ciphertext);
 }
 export class SenderKeyManager {
-    constructor(store) {
+    constructor(store, options) {
+        this.senderLock = new StoreLock();
         this.store = store;
+        this.getFutureMessagesMax = options?.getFutureMessagesMax;
+        this.skipSignatureVerification = options?.skipSignatureVerification === true;
     }
-    async createSenderKeyDistributionMessage(groupId, sender) {
-        const senderKey = await this.ensureSenderKey(groupId, sender);
-        const distributionProto = proto.SenderKeyDistributionMessage.encode({
-            id: senderKey.keyId,
-            iteration: senderKey.iteration,
-            chainKey: senderKey.chainKey,
-            signingKey: senderKey.signingPublicKey
-        }).finish();
-        const payload = prependVersion(distributionProto, SIGNAL_GROUP_VERSION);
-        await this.store.upsertSenderKeyDistribution({
-            groupId,
-            sender,
-            keyId: senderKey.keyId,
-            timestampMs: Date.now()
+    async prepareGroupEncryption(groupId, sender, plaintext) {
+        return this.runWithSenderLock(groupId, sender, async () => {
+            const senderKey = await this.ensureSenderKeyInternal(groupId, sender);
+            if (!senderKey.signingPrivateKey) {
+                throw new Error('sender private signing key is missing');
+            }
+            const derived = await deriveSenderKeyMsgKey(senderKey.iteration, senderKey.chainKey);
+            await this.store.upsertSenderKey({
+                ...senderKey,
+                chainKey: derived.nextChainKey,
+                iteration: derived.messageKey.iteration + 1
+            });
+            const distributionProto = proto.SenderKeyDistributionMessage.encode({
+                id: senderKey.keyId,
+                iteration: senderKey.iteration,
+                chainKey: senderKey.chainKey,
+                signingKey: senderKey.signingPublicKey
+            }).finish();
+            const distributionMessage = {
+                groupId,
+                axolotlSenderKeyDistributionMessage: prependVersion(distributionProto, SIGNAL_GROUP_VERSION)
+            };
+            const messagePayload = await aesCbcEncryptFromSeed(derived.messageKey.seed, plaintext);
+            const senderKeyMessage = proto.SenderKeyMessage.encode({
+                id: senderKey.keyId,
+                iteration: derived.messageKey.iteration,
+                ciphertext: messagePayload
+            }).finish();
+            const versionedContent = prependVersion(senderKeyMessage, SIGNAL_GROUP_VERSION);
+            const signature = await xeddsaSign(senderKey.signingPrivateKey, versionedContent);
+            if (signature.length !== SIGNAL_SIGNATURE_LENGTH) {
+                throw new Error(`invalid sender key signature length ${signature.length}`);
+            }
+            const ciphertext = {
+                groupId,
+                sender,
+                keyId: senderKey.keyId,
+                iteration: derived.messageKey.iteration,
+                ciphertext: concatBytes([versionedContent, signature])
+            };
+            await this.store.upsertSenderKeyDistribution({
+                groupId,
+                sender,
+                keyId: senderKey.keyId,
+                timestampMs: Date.now()
+            });
+            return {
+                distributionMessage,
+                ciphertext,
+                keyId: senderKey.keyId
+            };
         });
-        return {
-            groupId,
-            axolotlSenderKeyDistributionMessage: payload
-        };
     }
-    async filterParticipantsNeedingDistribution(groupId, sender, participants) {
+    async filterParticipantsNeedingDistribution(groupId, senderKeyId, participants) {
         if (participants.length === 0) {
             return [];
         }
-        const senderKey = await this.ensureSenderKey(groupId, sender);
         const distributed = await this.store.getDeviceSenderKeyDistributions(groupId, participants);
-        return participants.filter((_, index) => {
+        const pendingParticipants = new Array(participants.length);
+        let pendingCount = 0;
+        for (let index = 0; index < participants.length; index += 1) {
             const record = distributed[index];
-            return !record || record.keyId !== senderKey.keyId;
-        });
+            if (!record || record.keyId !== senderKeyId) {
+                pendingParticipants[pendingCount] = participants[index];
+                pendingCount += 1;
+            }
+        }
+        pendingParticipants.length = pendingCount;
+        return pendingParticipants;
     }
-    async markSenderKeyDistributed(groupId, sender, participants) {
+    async markSenderKeyDistributed(groupId, senderKeyId, participants) {
         if (participants.length === 0) {
             return;
         }
-        const senderKey = await this.ensureSenderKey(groupId, sender);
         const timestampMs = Date.now();
         const distributions = new Array(participants.length);
         for (let index = 0; index < participants.length; index += 1) {
             distributions[index] = {
                 groupId,
                 sender: participants[index],
-                keyId: senderKey.keyId,
+                keyId: senderKeyId,
                 timestampMs
             };
         }
         await this.store.upsertSenderKeyDistributions(distributions);
     }
     async processSenderKeyDistributionPayload(groupId, sender, payload) {
-        if (groupId.length === 0) {
-            throw new Error('sender key distribution missing groupId');
-        }
-        const parsed = parseDistributionPayload(payload);
-        const record = {
-            groupId,
-            sender,
-            keyId: parsed.keyId,
-            iteration: parsed.iteration,
-            chainKey: parsed.chainKey,
-            signingPublicKey: parsed.signingPublicKey,
-            unusedMessageKeys: []
-        };
-        await Promise.all([
-            this.store.upsertSenderKey(record),
-            this.store.upsertSenderKeyDistribution({
+        return this.runWithSenderLock(groupId, sender, async () => {
+            if (groupId.length === 0) {
+                throw new Error('sender key distribution missing groupId');
+            }
+            const parsed = parseDistributionPayload(payload);
+            const record = {
                 groupId,
                 sender,
                 keyId: parsed.keyId,
-                timestampMs: Date.now()
-            })
-        ]);
-        return record;
-    }
-    async encryptGroupMessage(groupId, sender, plaintext) {
-        const senderKey = await this.ensureSenderKey(groupId, sender);
-        if (!senderKey.signingPrivateKey) {
-            throw new Error('sender private signing key is missing');
-        }
-        const derived = await deriveSenderKeyMsgKey(senderKey.iteration, senderKey.chainKey);
-        const messagePayload = await aesCbcEncryptFromSeed(derived.messageKey.seed, plaintext);
-        const senderKeyMessage = proto.SenderKeyMessage.encode({
-            id: senderKey.keyId,
-            iteration: derived.messageKey.iteration,
-            ciphertext: messagePayload
-        }).finish();
-        const versionedContent = prependVersion(senderKeyMessage, SIGNAL_GROUP_VERSION);
-        const signature = await signSignalMessage(senderKey.signingPrivateKey, versionedContent);
-        if (signature.length !== SIGNATURE_SIZE) {
-            throw new Error(`invalid sender key signature length ${signature.length}`);
-        }
-        const ciphertext = concatBytes([versionedContent, signature]);
-        await this.store.upsertSenderKey({
-            ...senderKey,
-            chainKey: derived.nextChainKey,
-            iteration: derived.messageKey.iteration + 1
+                iteration: parsed.iteration,
+                chainKey: parsed.chainKey,
+                signingPublicKey: parsed.signingPublicKey,
+                unusedMessageKeys: []
+            };
+            await Promise.all([
+                this.store.upsertSenderKey(record),
+                this.store.upsertSenderKeyDistribution({
+                    groupId,
+                    sender,
+                    keyId: parsed.keyId,
+                    timestampMs: Date.now()
+                })
+            ]);
+            return record;
         });
-        return {
-            groupId,
-            sender,
-            keyId: senderKey.keyId,
-            iteration: derived.messageKey.iteration,
-            ciphertext
-        };
     }
     async decryptGroupMessage(payload) {
-        const parsed = parseSenderKeyMessage(payload.ciphertext);
-        const senderKey = await this.store.getDeviceSenderKey(payload.groupId, payload.sender);
-        if (!senderKey) {
-            throw new Error('missing sender key');
-        }
-        if (senderKey.keyId !== parsed.keyId) {
-            throw new Error('sender key id mismatch');
-        }
-        if (payload.keyId !== undefined &&
-            payload.keyId !== null &&
-            parsed.keyId !== payload.keyId) {
-            throw new Error('sender key id mismatch');
-        }
-        if (payload.iteration !== undefined &&
-            payload.iteration !== null &&
-            parsed.iteration !== payload.iteration) {
-            throw new Error('sender key iteration mismatch');
-        }
-        const signedContent = parsed.versionContentMac.subarray(0, parsed.versionContentMac.length - SIGNATURE_SIZE);
-        const signature = parsed.versionContentMac.subarray(parsed.versionContentMac.length - SIGNATURE_SIZE);
-        const validSignature = await verifySignalSignature(senderKey.signingPublicKey, signedContent, signature);
-        if (!validSignature) {
-            throw new Error('invalid sender key signature');
-        }
-        const selected = await selectMessageKey(senderKey, parsed.iteration);
-        const plaintext = await aesCbcDecryptFromSeed(selected.messageKey.seed, parsed.ciphertext);
-        await this.store.upsertSenderKey(selected.updatedRecord);
-        return plaintext;
+        return this.runWithSenderLock(payload.groupId, payload.sender, async () => {
+            const parsed = parseSenderKeyMessage(payload.ciphertext);
+            const senderKey = await this.store.getDeviceSenderKey(payload.groupId, payload.sender);
+            if (!senderKey) {
+                throw new Error('missing sender key');
+            }
+            if (senderKey.keyId !== parsed.keyId) {
+                throw new Error('sender key id mismatch');
+            }
+            if (payload.keyId !== undefined &&
+                payload.keyId !== null &&
+                parsed.keyId !== payload.keyId) {
+                throw new Error('sender key id mismatch');
+            }
+            if (payload.iteration !== undefined &&
+                payload.iteration !== null &&
+                parsed.iteration !== payload.iteration) {
+                throw new Error('sender key iteration mismatch');
+            }
+            if (!this.skipSignatureVerification) {
+                const signedContent = parsed.versionContentMac.subarray(0, parsed.versionContentMac.length - SIGNAL_SIGNATURE_LENGTH);
+                const signature = parsed.versionContentMac.subarray(parsed.versionContentMac.length - SIGNAL_SIGNATURE_LENGTH);
+                const validSignature = await xeddsaVerify(toRawPubKey(senderKey.signingPublicKey), signedContent, signature);
+                if (!validSignature) {
+                    throw new Error('invalid sender key signature');
+                }
+            }
+            const selected = await selectMessageKey(senderKey, parsed.iteration, this.getFutureMessagesMax?.());
+            // Keep decrypt + persist ordered: failed decrypt must not advance sender-key state.
+            const plaintext = await aesCbcDecryptFromSeed(selected.messageKey.seed, parsed.ciphertext);
+            await this.store.upsertSenderKey(selected.updatedRecord);
+            return plaintext;
+        });
     }
-    async ensureSenderKey(groupId, sender) {
+    async ensureSenderKeyInternal(groupId, sender) {
         const existing = await this.store.getDeviceSenderKey(groupId, sender);
         if (existing) {
             return existing;
@@ -183,4 +202,7 @@ export class SenderKeyManager {
         await this.store.upsertSenderKey(created);
         return created;
     }
+    runWithSenderLock(groupId, sender, task) {
+        return this.senderLock.run(`senderKey:${groupId}:${signalAddressKey(sender)}`, task);
+    }
 }

package/dist/esm/signal/index.js

@@ -1,3 +1,4 @@
+export { decodeSignalPreKeyRow, decodeSignalRegistrationRow, decodeSignalRemoteIdentity, decodeSignalSessionRecord, decodeSignalSignedPreKeyRow, decodeSenderKeyDistributionRow, decodeSenderKeyRecord, decodeStoreCount, encodeSenderKeyRecord, encodeSignalSessionRecord, toSignalAddressParts } from './encoding.js';
 export { generatePreKeyPair, generateRegistrationId, generateRegistrationInfo, generateSignedPreKey } from './registration/keygen.js';
 export { buildPreKeyUploadIq, parsePreKeyUploadFailure } from './api/prekeys.js';
 export { SignalDigestSyncApi } from './api/SignalDigestSyncApi.js';

package/dist/esm/signal/registration/keygen.js

@@ -1,11 +1,14 @@
-import { randomIntAsync } from '../../crypto/index.js';
+import { randomIntAsync, xeddsaSign } from '../../crypto/index.js';
 import { toSerializedPubKey } from '../../crypto/core/keys.js';
 import { X25519 } from '../../crypto/curves/X25519.js';
-import { signSignalMessage } from '../crypto/WaAdvSignature.js';
 export async function generateRegistrationInfo() {
+    const [registrationId, identityKeyPair] = await Promise.all([
+        generateRegistrationId(),
+        X25519.generateKeyPair()
+    ]);
     return {
-        registrationId: await generateRegistrationId(),
-        identityKeyPair: await X25519.generateKeyPair()
+        registrationId,
+        identityKeyPair
     };
 }
 export async function generatePreKeyPair(keyId) {
@@ -18,7 +21,7 @@ export async function generatePreKeyPair(keyId) {
 export async function generateSignedPreKey(keyId, signingPrivateKey) {
     const keyPair = await X25519.generateKeyPair();
     const serializedPubKey = toSerializedPubKey(keyPair.pubKey);
-    const signature = await signSignalMessage(signingPrivateKey, serializedPubKey);
+    const signature = await xeddsaSign(signingPrivateKey, serializedPubKey);
     return {
         keyId,
         keyPair,