zapo-js 0.2.0 → 0.3.0

package/dist/esm/transport/noise/WaNoiseCert.js

@@ -1,24 +1,12 @@
-import { Ed25519, toSerializedPubKey } from '../../crypto/index.js';
-import { montgomeryToEdwardsPublic } from '../../crypto/curves/X25519.js';
+import { xeddsaVerify } from '../../crypto/index.js';
 import { proto } from '../../proto.js';
 import { ROOT_CA_PUBLIC_KEY_HEX, ROOT_CA_SERIAL } from '../noise/constants.js';
 import { assertByteLength, decodeProtoBytes, hexToBytes, uint8Equal } from '../../util/bytes.js';
 import { toSafeNumber } from '../../util/primitives.js';
-async function verifySignalVariant(serializedPublicKey, message, signatureInput) {
-    const publicKey = toSerializedPubKey(serializedPublicKey);
-    if (signatureInput.length !== 64) {
-        return false;
-    }
-    const signature = new Uint8Array(signatureInput);
-    const lastByte = signature[63];
-    if ((lastByte & 0x60) !== 0) {
-        return false;
-    }
-    const signBit = lastByte & 0x80;
-    signature[63] = lastByte & 0x7f;
-    const edwardsPublicKey = montgomeryToEdwardsPublic(publicKey.subarray(1), signBit);
-    return Ed25519.verify(message, signature, edwardsPublicKey);
-}
+const PRODUCTION_ROOT_CA = {
+    publicKey: hexToBytes(ROOT_CA_PUBLIC_KEY_HEX),
+    serial: ROOT_CA_SERIAL
+};
 function parseNoiseCertificate(certificate) {
     if (!certificate) {
         throw new Error('missing noise certificate');
@@ -38,21 +26,16 @@ function parseNoiseCertificate(certificate) {
         signature: signatureBytes
     };
 }
-function rootPublicKeySerialized() {
-    const raw = hexToBytes(ROOT_CA_PUBLIC_KEY_HEX);
-    return toSerializedPubKey(raw);
-}
-export async function verifyNoiseCertificateChain(certificateChain, serverStatic) {
+export async function verifyNoiseCertificateChain(certificateChain, serverStatic, rootCa = PRODUCTION_ROOT_CA) {
     const chain = proto.CertChain.decode(certificateChain);
     if (!chain.leaf || !chain.intermediate) {
         throw new Error('noise certificate chain is missing leaf/intermediate');
     }
     const intermediate = parseNoiseCertificate(chain.intermediate);
-    if (intermediate.issuerSerial !== ROOT_CA_SERIAL) {
+    if (intermediate.issuerSerial !== rootCa.serial) {
         throw new Error('intermediate certificate issuer mismatch');
     }
-    const rootKey = rootPublicKeySerialized();
-    const validIntermediate = await verifySignalVariant(rootKey, intermediate.details, intermediate.signature);
+    const validIntermediate = await xeddsaVerify(rootCa.publicKey, intermediate.details, intermediate.signature);
     if (!validIntermediate) {
         throw new Error('intermediate certificate signature is invalid');
     }
@@ -60,8 +43,7 @@ export async function verifyNoiseCertificateChain(certificateChain, serverStatic
     if (leaf.issuerSerial !== intermediate.serial) {
         throw new Error('leaf certificate issuer mismatch');
     }
-    const intermediatePublicSerialized = toSerializedPubKey(intermediate.key);
-    const validLeaf = await verifySignalVariant(intermediatePublicSerialized, leaf.details, leaf.signature);
+    const validLeaf = await xeddsaVerify(intermediate.key, leaf.details, leaf.signature);
     if (!validLeaf) {
         throw new Error('leaf certificate signature is invalid');
     }

package/dist/esm/transport/noise/WaNoiseSession.js

@@ -7,13 +7,13 @@ import { buildLoginPayload, buildRegistrationPayload } from '../noise/WaClientPa
 import { WaFrameCodec } from '../noise/WaFrameCodec.js';
 import { verifyNoiseCertificateChain } from '../noise/WaNoiseCert.js';
 import { WaNoiseHandshake } from '../noise/WaNoiseHandshake.js';
-import { concatBytes, toBytesView } from '../../util/bytes.js';
+import { concatBytes } from '../../util/bytes.js';
 import { toError } from '../../util/primitives.js';
 function resolvePayload(payload) {
     if (payload instanceof Uint8Array) {
         return Promise.resolve(payload);
     }
-    return Promise.resolve(payload()).then((value) => toBytesView(value));
+    return Promise.resolve(payload());
 }
 async function resolveHandshakePayload(config) {
     if (config.isRegistered) {
@@ -58,6 +58,7 @@ export class WaNoiseSession {
         this.closedError = null;
         this.noiseSocket = null;
         this.serverStaticKey = null;
+        this.trustedRootCa = undefined;
         this.handshakeFrameTimeoutMs = WA_DEFAULTS.CONNECT_TIMEOUT_MS;
         this.sendWire = sendWire;
         this.logger = logger;
@@ -68,9 +69,7 @@ export class WaNoiseSession {
             isRegistered: config.isRegistered,
             hasServerStaticKey: !!config.serverStaticKey
         });
-        const protocolHeader = config.protocolHeader
-            ? toBytesView(config.protocolHeader)
-            : WA_PROTO_HEADER;
+        const protocolHeader = config.protocolHeader ?? WA_PROTO_HEADER;
         const introFrame = config.routingInfo && config.routingInfo.length > 0
             ? concatBytes([buildRoutingInfoPrefix(config.routingInfo), protocolHeader])
             : protocolHeader;
@@ -80,6 +79,7 @@ export class WaNoiseSession {
             resolveHandshakePayload(config)
         ]);
         const verifyCertificates = config.verifyCertificateChain !== false;
+        this.trustedRootCa = config.trustedRootCa;
         if (config.serverStaticKey && config.serverStaticKey.length === 32) {
             this.logger.info('noise session attempting resume handshake (IK)');
             this.noiseSocket = await this.resumeHandshake(config.serverStaticKey, config.clientStaticKeyPair, ephemeralKeyPair, payload, protocolHeader, verifyCertificates);
@@ -181,6 +181,7 @@ export class WaNoiseSession {
         this.closedError = null;
         this.noiseSocket = null;
         this.serverStaticKey = null;
+        this.trustedRootCa = undefined;
         this.writeChain = Promise.resolve();
         this.readChain = Promise.resolve();
     }
@@ -244,7 +245,7 @@ export class WaNoiseSession {
         if (!serverHello.payload) {
             throw new Error('noise resume handshake missing certificate payload');
         }
-        const serverEphemeral = toBytesView(serverHello.ephemeral);
+        const serverEphemeral = serverHello.ephemeral;
         await handshake.authenticate(serverEphemeral);
         const [dh1, dh2] = await Promise.all([
             X25519.scalarMult(ephemeralKeyPair.privKey, serverEphemeral),
@@ -252,7 +253,7 @@ export class WaNoiseSession {
         ]);
         await handshake.mixIntoKey(dh1);
         await handshake.mixIntoKey(dh2);
-        await handshake.decrypt(toBytesView(serverHello.payload));
+        await handshake.decrypt(serverHello.payload);
         this.serverStaticKey = serverStaticKey;
         this.logger.info('noise resume handshake successful without fallback');
         return { socket: await handshake.finish(), serverHelloFrame: null };
@@ -270,14 +271,14 @@ export class WaNoiseSession {
         if (!serverHello?.ephemeral || !serverHello.static || !serverHello.payload) {
             throw new Error('noise full handshake missing server hello fields');
         }
-        const serverEphemeral = toBytesView(serverHello.ephemeral);
+        const serverEphemeral = serverHello.ephemeral;
         await handshake.authenticate(serverEphemeral);
         await handshake.mixIntoKey(await X25519.scalarMult(ephemeralKeyPair.privKey, serverEphemeral));
-        const serverStatic = await handshake.decrypt(toBytesView(serverHello.static));
+        const serverStatic = await handshake.decrypt(serverHello.static);
         await handshake.mixIntoKey(await X25519.scalarMult(ephemeralKeyPair.privKey, serverStatic));
-        const certificate = await handshake.decrypt(toBytesView(serverHello.payload));
+        const certificate = await handshake.decrypt(serverHello.payload);
         if (verifyCertificates) {
-            await verifyNoiseCertificateChain(certificate, serverStatic);
+            await verifyNoiseCertificateChain(certificate, serverStatic, this.trustedRootCa);
             this.logger.trace('noise certificate chain verified');
         }
         this.serverStaticKey = serverStatic;

package/dist/infra/perf/StoreLock.js

@@ -28,12 +28,14 @@ class StoreLock {
                 current = Promise.reject(error);
             }
         }
-        const tracker = current.then(() => undefined, () => undefined);
+        const tracker = current.then(StoreLock._noop, StoreLock._noop);
         this.chains.set(key, tracker);
-        void tracker.finally(() => {
-            if (this.chains.get(key) === tracker) {
+        tracker.then(() => {
+            if (this.chains.get(key) === tracker)
+                this.chains.delete(key);
+        }, () => {
+            if (this.chains.get(key) === tracker)
                 this.chains.delete(key);
-            }
         });
         return current;
     }
@@ -79,3 +81,4 @@ class StoreLock {
     }
 }
 exports.StoreLock = StoreLock;
+StoreLock._noop = () => undefined;

package/dist/media/WaMediaCrypto.js

@@ -15,6 +15,87 @@ const constants_1 = require("./constants");
 const constants_2 = require("../protocol/constants");
 const bytes_1 = require("../util/bytes");
 const primitives_2 = require("../util/primitives");
+const AES_BLOCK_SIZE = 16;
+const PKCS7_FULL_BLOCK = new Uint8Array(AES_BLOCK_SIZE).fill(AES_BLOCK_SIZE);
+async function aesCbcEncryptChunk(key, iv, chunk, isFinal) {
+    const encrypted = await (0, primitives_1.aesCbcEncrypt)(key, iv, chunk);
+    if (isFinal) {
+        return {
+            ciphertext: encrypted,
+            nextIv: encrypted.subarray(encrypted.byteLength - AES_BLOCK_SIZE)
+        };
+    }
+    const ciphertext = encrypted.subarray(0, encrypted.byteLength - AES_BLOCK_SIZE);
+    return {
+        ciphertext,
+        nextIv: ciphertext.subarray(ciphertext.byteLength - AES_BLOCK_SIZE)
+    };
+}
+async function aesCbcDecryptChunk(key, iv, ciphertext, isFinal) {
+    const nextIv = (0, bytes_1.toBytesView)(ciphertext.subarray(ciphertext.byteLength - AES_BLOCK_SIZE));
+    if (isFinal) {
+        return { plaintext: await (0, primitives_1.aesCbcDecrypt)(key, iv, ciphertext), nextIv };
+    }
+    const padBlock = (await (0, primitives_1.aesCbcEncrypt)(key, nextIv, PKCS7_FULL_BLOCK)).subarray(0, AES_BLOCK_SIZE);
+    const withPad = (0, bytes_1.concatBytes)([ciphertext, padBlock]);
+    return { plaintext: await (0, primitives_1.aesCbcDecrypt)(key, iv, withPad), nextIv };
+}
+async function computeFirstFrameSidecar(macKey, ivCiphertext, firstFrameLength) {
+    const aligned = Math.ceil(firstFrameLength / AES_BLOCK_SIZE) * AES_BLOCK_SIZE;
+    const slice = ivCiphertext.subarray(0, constants_1.IV_SIZE + aligned);
+    const key = await (0, primitives_1.importHmacKey)(macKey);
+    const digest = await (0, primitives_1.hmacSign)(key, slice);
+    return digest.subarray(0, constants_1.SIDECAR_HMAC_SIZE);
+}
+class SidecarAccumulator {
+    constructor(macKey, estimatedSize = 0) {
+        this.resultOffset = 0;
+        this.totalPushed = 0;
+        this.windowOffset = 0;
+        this.nextChunkStart = 0;
+        this.macKey = macKey;
+        this.window = new Uint8Array(constants_1.IV_SIZE + constants_1.SIDECAR_CHUNK_SIZE);
+        const estimated = Math.max(Math.ceil(estimatedSize / constants_1.SIDECAR_CHUNK_SIZE) + 1, 16);
+        this.result = new Uint8Array(estimated * constants_1.SIDECAR_HMAC_SIZE);
+    }
+    push(data) {
+        let srcOffset = 0;
+        while (srcOffset < data.byteLength) {
+            const windowEnd = this.nextChunkStart + constants_1.IV_SIZE + constants_1.SIDECAR_CHUNK_SIZE;
+            const remaining = windowEnd - this.totalPushed;
+            const toCopy = Math.min(remaining, data.byteLength - srcOffset);
+            this.window.set(data.subarray(srcOffset, srcOffset + toCopy), this.windowOffset);
+            this.windowOffset += toCopy;
+            this.totalPushed += toCopy;
+            srcOffset += toCopy;
+            if (this.totalPushed === windowEnd) {
+                this.flushChunk();
+            }
+        }
+    }
+    finish() {
+        if (this.windowOffset > 0) {
+            this.flushChunk();
+        }
+        return this.result.subarray(0, this.resultOffset);
+    }
+    flushChunk() {
+        const digest = (0, node_crypto_1.createHmac)('sha256', this.macKey)
+            .update(this.window.subarray(0, this.windowOffset))
+            .digest();
+        if (this.resultOffset + constants_1.SIDECAR_HMAC_SIZE > this.result.byteLength) {
+            const grown = new Uint8Array(this.result.byteLength * 2);
+            grown.set(this.result);
+            this.result = grown;
+        }
+        this.result.set(digest.subarray(0, constants_1.SIDECAR_HMAC_SIZE), this.resultOffset);
+        this.resultOffset += constants_1.SIDECAR_HMAC_SIZE;
+        this.nextChunkStart += constants_1.SIDECAR_CHUNK_SIZE;
+        const overlapSrc = this.window.subarray(this.windowOffset - constants_1.IV_SIZE, this.windowOffset);
+        this.window.set(overlapSrc, 0);
+        this.windowOffset = constants_1.IV_SIZE;
+    }
+}
 class WaMediaCrypto {
     static async generateMediaKey() {
         return (0, random_1.randomBytesAsync)(32);
@@ -30,24 +111,41 @@ class WaMediaCrypto {
             refKey: expanded.subarray(constants_1.MAC_KEY_END, constants_1.MEDIA_HKDF_SIZE)
         };
     }
-    static async encryptBytes(mediaType, mediaKey, plaintext) {
+    static async encryptBytes(mediaType, mediaKey, plaintext, options) {
         const keys = await WaMediaCrypto.deriveKeys(mediaType, mediaKey);
-        const [aesKey, macKey] = await Promise.all([
+        const [aesKey, hmacKey] = await Promise.all([
             (0, primitives_1.importAesCbcKey)(keys.encKey),
             (0, primitives_1.importHmacKey)(keys.macKey)
         ]);
         const ciphertext = await (0, primitives_1.aesCbcEncrypt)(aesKey, keys.iv, plaintext);
         const ivCiphertext = (0, bytes_1.concatBytes)([keys.iv, ciphertext]);
-        const mac = await (0, primitives_1.hmacSign)(macKey, ivCiphertext);
+        const mac = await (0, primitives_1.hmacSign)(hmacKey, ivCiphertext);
         const signature = mac.subarray(0, constants_1.HMAC_TRUNCATED_SIZE);
         const ciphertextHmac = (0, bytes_1.concatBytes)([ciphertext, signature]);
+        let streamingSidecar;
+        if (options?.sidecar !== false) {
+            const acc = new SidecarAccumulator(keys.macKey);
+            acc.push(keys.iv);
+            acc.push(ciphertext);
+            acc.push(signature);
+            streamingSidecar = acc.finish();
+        }
+        const firstFrameSidecar = options?.firstFrameLength !== undefined
+            ? await computeFirstFrameSidecar(keys.macKey, ivCiphertext, options.firstFrameLength)
+            : undefined;
         const [fileSha256, fileEncSha256] = await Promise.all([
             (0, primitives_1.sha256)(plaintext),
             (0, primitives_1.sha256)(ciphertextHmac)
         ]);
-        return { ciphertextHmac, fileSha256, fileEncSha256 };
+        return {
+            ciphertextHmac,
+            fileSha256,
+            fileEncSha256,
+            streamingSidecar,
+            firstFrameSidecar
+        };
     }
-    static async decryptBytes(mediaType, mediaKey, ciphertextHmac, expectedFileSha256, expectedFileEncSha256) {
+    static async decryptBytes(mediaType, mediaKey, ciphertextHmac, expectedFileSha256, expectedFileEncSha256, skipMacVerification = false) {
         if (ciphertextHmac.byteLength < constants_1.HMAC_TRUNCATED_SIZE) {
             throw new Error(`ciphertext too short: ${ciphertextHmac.byteLength}`);
         }
@@ -58,17 +156,19 @@ class WaMediaCrypto {
             }
         }
         const keys = await WaMediaCrypto.deriveKeys(mediaType, mediaKey);
+        const [aesKey, hmacKey] = await Promise.all([
+            (0, primitives_1.importAesCbcKey)(keys.encKey),
+            (0, primitives_1.importHmacKey)(keys.macKey)
+        ]);
         const ciphertext = ciphertextHmac.subarray(0, ciphertextHmac.byteLength - constants_1.HMAC_TRUNCATED_SIZE);
         const expectedMac = ciphertextHmac.subarray(ciphertextHmac.byteLength - constants_1.HMAC_TRUNCATED_SIZE);
         const ivCiphertext = (0, bytes_1.concatBytes)([keys.iv, ciphertext]);
-        const [macKey, aesKey] = await Promise.all([
-            (0, primitives_1.importHmacKey)(keys.macKey),
-            (0, primitives_1.importAesCbcKey)(keys.encKey)
-        ]);
-        const mac = await (0, primitives_1.hmacSign)(macKey, ivCiphertext);
-        const signature = mac.subarray(0, constants_1.HMAC_TRUNCATED_SIZE);
-        if (!(0, bytes_1.uint8TimingSafeEqual)(signature, expectedMac)) {
-            throw new Error('media MAC mismatch');
+        if (!skipMacVerification) {
+            const mac = await (0, primitives_1.hmacSign)(hmacKey, ivCiphertext);
+            const signature = mac.subarray(0, constants_1.HMAC_TRUNCATED_SIZE);
+            if (!(0, bytes_1.uint8TimingSafeEqual)(signature, expectedMac)) {
+                throw new Error('media MAC mismatch');
+            }
         }
         const plaintext = await (0, primitives_1.aesCbcDecrypt)(aesKey, keys.iv, ciphertext);
         const fileSha256 = await (0, primitives_1.sha256)(plaintext);
@@ -78,18 +178,18 @@ class WaMediaCrypto {
         const fileEncSha256 = expectedFileEncSha256 ?? (await (0, primitives_1.sha256)(ciphertextHmac));
         return { plaintext, fileSha256, fileEncSha256 };
     }
-    static async encryptReadable(mediaType, mediaKey, plaintext) {
+    static async encryptReadable(mediaType, mediaKey, plaintext, options) {
         const keys = await WaMediaCrypto.deriveKeys(mediaType, mediaKey);
         const encrypted = new node_stream_1.PassThrough();
-        const metadata = pumpEncryption(plaintext, encrypted, keys);
+        const metadata = pumpEncryption(plaintext, encrypted, keys, options?.sidecar !== false, options?.firstFrameLength);
         return { encrypted, metadata };
     }
-    static async encryptToFile(mediaType, mediaKey, plaintext) {
+    static async encryptToFile(mediaType, mediaKey, plaintext, options) {
         const keys = await WaMediaCrypto.deriveKeys(mediaType, mediaKey);
         const filePath = (0, node_path_1.join)((0, node_os_1.tmpdir)(), `zapo-enc-${Date.now()}-${Math.random().toString(36).slice(2)}`);
         const output = (0, node_fs_1.createWriteStream)(filePath);
         try {
-            const metadata = await pumpEncryptionToWritable(plaintext, output, keys);
+            const metadata = await pumpEncryptionToWritable(plaintext, output, keys, options?.sidecar !== false, options?.firstFrameLength);
             const fileSize = (await (0, promises_1.stat)(filePath)).size;
             return { filePath, fileSize, ...metadata };
         }
@@ -116,42 +216,80 @@ class WaMediaCrypto {
     }
 }
 exports.WaMediaCrypto = WaMediaCrypto;
-async function pumpEncryption(plaintext, encrypted, keys) {
+async function pumpEncryption(plaintext, encrypted, keys, computeSidecar, firstFrameLength) {
+    const aesKey = await (0, primitives_1.importAesCbcKey)(keys.encKey);
     const plainHash = (0, node_crypto_1.createHash)('sha256');
     const encHash = (0, node_crypto_1.createHash)('sha256');
     const hmac = (0, node_crypto_1.createHmac)('sha256', keys.macKey);
-    const cipher = (0, node_crypto_1.createCipheriv)('aes-256-cbc', keys.encKey, keys.iv);
+    const sidecar = computeSidecar ? new SidecarAccumulator(keys.macKey) : null;
+    const ffTarget = firstFrameLength !== undefined
+        ? constants_1.IV_SIZE + Math.ceil(firstFrameLength / AES_BLOCK_SIZE) * AES_BLOCK_SIZE
+        : 0;
+    let ffCollected = 0;
+    const ffChunks = ffTarget > 0 ? [keys.iv] : [];
+    if (ffTarget > 0)
+        ffCollected = constants_1.IV_SIZE;
     let plaintextLength = 0;
+    let currentIv = keys.iv;
+    let pending = bytes_1.EMPTY_BYTES;
     hmac.update(keys.iv);
+    sidecar?.push(keys.iv);
     try {
         for await (const chunk of plaintext) {
             const plainChunk = (0, bytes_1.toChunkBytes)(chunk);
-            if (plainChunk.byteLength === 0) {
+            if (plainChunk.byteLength === 0)
                 continue;
-            }
             plaintextLength += plainChunk.byteLength;
             plainHash.update(plainChunk);
-            const encryptedChunk = cipher.update(plainChunk);
-            if (encryptedChunk.byteLength > 0) {
-                hmac.update(encryptedChunk);
-                encHash.update(encryptedChunk);
-                await writeChunk(encrypted, encryptedChunk);
+            const combined = pending.byteLength > 0
+                ? (0, bytes_1.concatBytes)([pending, plainChunk])
+                : (0, bytes_1.toBytesView)(plainChunk);
+            const aligned = combined.byteLength - (combined.byteLength % AES_BLOCK_SIZE);
+            if (aligned === 0) {
+                pending = combined;
+                continue;
             }
+            const toEncrypt = (0, bytes_1.toBytesView)(combined.subarray(0, aligned));
+            pending = (0, bytes_1.toBytesView)(combined.subarray(aligned));
+            const { ciphertext, nextIv } = await aesCbcEncryptChunk(aesKey, currentIv, toEncrypt, false);
+            currentIv = nextIv;
+            hmac.update(ciphertext);
+            encHash.update(ciphertext);
+            sidecar?.push(ciphertext);
+            if (ffCollected < ffTarget) {
+                const need = ffTarget - ffCollected;
+                ffChunks.push(ciphertext.subarray(0, Math.min(need, ciphertext.byteLength)));
+                ffCollected += ciphertext.byteLength;
+            }
+            await writeChunk(encrypted, ciphertext);
         }
-        const encryptedFinal = cipher.final();
-        if (encryptedFinal.byteLength > 0) {
-            hmac.update(encryptedFinal);
-            encHash.update(encryptedFinal);
-            await writeChunk(encrypted, encryptedFinal);
+        const { ciphertext: finalCiphertext } = await aesCbcEncryptChunk(aesKey, currentIv, pending, true);
+        hmac.update(finalCiphertext);
+        encHash.update(finalCiphertext);
+        sidecar?.push(finalCiphertext);
+        if (ffCollected < ffTarget) {
+            const need = ffTarget - ffCollected;
+            ffChunks.push(finalCiphertext.subarray(0, Math.min(need, finalCiphertext.byteLength)));
         }
-        const signature = hmac.digest().subarray(0, constants_1.HMAC_TRUNCATED_SIZE);
+        await writeChunk(encrypted, finalCiphertext);
+        const signature = (0, bytes_1.toBytesView)(hmac.digest().subarray(0, constants_1.HMAC_TRUNCATED_SIZE));
         encHash.update(signature);
+        sidecar?.push(signature);
         await writeChunk(encrypted, signature);
         encrypted.end();
+        let firstFrameSidecar;
+        if (ffTarget > 0) {
+            const ivCiphertextSlice = (0, bytes_1.concatBytes)(ffChunks);
+            const ffKey = await (0, primitives_1.importHmacKey)(keys.macKey);
+            const ffDigest = await (0, primitives_1.hmacSign)(ffKey, ivCiphertextSlice);
+            firstFrameSidecar = ffDigest.subarray(0, constants_1.SIDECAR_HMAC_SIZE);
+        }
         return {
             fileSha256: (0, bytes_1.toBytesView)(plainHash.digest()),
             fileEncSha256: (0, bytes_1.toBytesView)(encHash.digest()),
-            plaintextLength
+            plaintextLength,
+            streamingSidecar: sidecar?.finish(),
+            firstFrameSidecar
         };
     }
     catch (error) {
@@ -186,42 +324,80 @@ async function endWritable(stream) {
         stream.end(() => resolve());
     });
 }
-async function pumpEncryptionToWritable(plaintext, output, keys) {
+async function pumpEncryptionToWritable(plaintext, output, keys, computeSidecar, firstFrameLength) {
+    const aesKey = await (0, primitives_1.importAesCbcKey)(keys.encKey);
     const plainHash = (0, node_crypto_1.createHash)('sha256');
     const encHash = (0, node_crypto_1.createHash)('sha256');
     const hmac = (0, node_crypto_1.createHmac)('sha256', keys.macKey);
-    const cipher = (0, node_crypto_1.createCipheriv)('aes-256-cbc', keys.encKey, keys.iv);
+    const sidecar = computeSidecar ? new SidecarAccumulator(keys.macKey) : null;
+    const ffTarget = firstFrameLength !== undefined
+        ? constants_1.IV_SIZE + Math.ceil(firstFrameLength / AES_BLOCK_SIZE) * AES_BLOCK_SIZE
+        : 0;
+    let ffCollected = 0;
+    const ffChunks = ffTarget > 0 ? [keys.iv] : [];
+    if (ffTarget > 0)
+        ffCollected = constants_1.IV_SIZE;
     let plaintextLength = 0;
+    let currentIv = keys.iv;
+    let pending = bytes_1.EMPTY_BYTES;
     hmac.update(keys.iv);
+    sidecar?.push(keys.iv);
     try {
         for await (const chunk of plaintext) {
             const plainChunk = (0, bytes_1.toChunkBytes)(chunk);
-            if (plainChunk.byteLength === 0) {
+            if (plainChunk.byteLength === 0)
                 continue;
-            }
             plaintextLength += plainChunk.byteLength;
             plainHash.update(plainChunk);
-            const encryptedChunk = cipher.update(plainChunk);
-            if (encryptedChunk.byteLength > 0) {
-                hmac.update(encryptedChunk);
-                encHash.update(encryptedChunk);
-                await writeChunkToWritable(output, encryptedChunk);
+            const combined = pending.byteLength > 0
+                ? (0, bytes_1.concatBytes)([pending, plainChunk])
+                : (0, bytes_1.toBytesView)(plainChunk);
+            const aligned = combined.byteLength - (combined.byteLength % AES_BLOCK_SIZE);
+            if (aligned === 0) {
+                pending = combined;
+                continue;
+            }
+            const toEncrypt = (0, bytes_1.toBytesView)(combined.subarray(0, aligned));
+            pending = (0, bytes_1.toBytesView)(combined.subarray(aligned));
+            const { ciphertext, nextIv } = await aesCbcEncryptChunk(aesKey, currentIv, toEncrypt, false);
+            currentIv = nextIv;
+            hmac.update(ciphertext);
+            encHash.update(ciphertext);
+            sidecar?.push(ciphertext);
+            if (ffCollected < ffTarget) {
+                const need = ffTarget - ffCollected;
+                ffChunks.push(ciphertext.subarray(0, Math.min(need, ciphertext.byteLength)));
+                ffCollected += ciphertext.byteLength;
             }
+            await writeChunkToWritable(output, ciphertext);
         }
-        const encryptedFinal = cipher.final();
-        if (encryptedFinal.byteLength > 0) {
-            hmac.update(encryptedFinal);
-            encHash.update(encryptedFinal);
-            await writeChunkToWritable(output, encryptedFinal);
+        const { ciphertext: finalCiphertext } = await aesCbcEncryptChunk(aesKey, currentIv, pending, true);
+        hmac.update(finalCiphertext);
+        encHash.update(finalCiphertext);
+        sidecar?.push(finalCiphertext);
+        if (ffCollected < ffTarget) {
+            const need = ffTarget - ffCollected;
+            ffChunks.push(finalCiphertext.subarray(0, Math.min(need, finalCiphertext.byteLength)));
         }
-        const signature = hmac.digest().subarray(0, constants_1.HMAC_TRUNCATED_SIZE);
+        await writeChunkToWritable(output, finalCiphertext);
+        const signature = (0, bytes_1.toBytesView)(hmac.digest().subarray(0, constants_1.HMAC_TRUNCATED_SIZE));
         encHash.update(signature);
+        sidecar?.push(signature);
         await writeChunkToWritable(output, signature);
         await endWritable(output);
+        let firstFrameSidecar;
+        if (ffTarget > 0) {
+            const ivCiphertextSlice = (0, bytes_1.concatBytes)(ffChunks);
+            const ffKey = await (0, primitives_1.importHmacKey)(keys.macKey);
+            const ffDigest = await (0, primitives_1.hmacSign)(ffKey, ivCiphertextSlice);
+            firstFrameSidecar = ffDigest.subarray(0, constants_1.SIDECAR_HMAC_SIZE);
+        }
         return {
             fileSha256: (0, bytes_1.toBytesView)(plainHash.digest()),
             fileEncSha256: (0, bytes_1.toBytesView)(encHash.digest()),
-            plaintextLength
+            plaintextLength,
+            streamingSidecar: sidecar?.finish(),
+            firstFrameSidecar
         };
     }
     catch (error) {
@@ -231,10 +407,12 @@ async function pumpEncryptionToWritable(plaintext, output, keys) {
     }
 }
 async function pumpDecryption(encrypted, plaintext, keys, options) {
+    const aesKey = await (0, primitives_1.importAesCbcKey)(keys.encKey);
     const plainHash = (0, node_crypto_1.createHash)('sha256');
     const encHash = (0, node_crypto_1.createHash)('sha256');
     const hmac = (0, node_crypto_1.createHmac)('sha256', keys.macKey);
-    const decipher = (0, node_crypto_1.createDecipheriv)('aes-256-cbc', keys.encKey, keys.iv);
+    let currentIv = keys.iv;
+    let pending = bytes_1.EMPTY_BYTES;
     hmac.update(keys.iv);
     try {
         let trailing = bytes_1.EMPTY_BYTES;
@@ -252,20 +430,37 @@ async function pumpDecryption(encrypted, plaintext, keys, options) {
             const ciphertextChunk = merged.subarray(0, merged.byteLength - constants_1.HMAC_TRUNCATED_SIZE);
             trailing = merged.subarray(merged.byteLength - constants_1.HMAC_TRUNCATED_SIZE);
             hmac.update(ciphertextChunk);
-            const plainChunk = decipher.update(ciphertextChunk);
-            if (plainChunk.byteLength > 0) {
-                plainHash.update(plainChunk);
-                await writeChunk(plaintext, plainChunk);
+            const combined = pending.byteLength > 0
+                ? (0, bytes_1.concatBytes)([pending, ciphertextChunk])
+                : (0, bytes_1.toBytesView)(ciphertextChunk);
+            const aligned = combined.byteLength - (combined.byteLength % AES_BLOCK_SIZE);
+            if (aligned > AES_BLOCK_SIZE) {
+                const toDecrypt = combined.subarray(0, aligned - AES_BLOCK_SIZE);
+                const { plaintext: plainChunk, nextIv } = await aesCbcDecryptChunk(aesKey, currentIv, toDecrypt, false);
+                currentIv = nextIv;
+                if (plainChunk.byteLength > 0) {
+                    plainHash.update(plainChunk);
+                    await writeChunk(plaintext, plainChunk);
+                }
+                pending = (0, bytes_1.toBytesView)(combined.subarray(aligned - AES_BLOCK_SIZE));
+            }
+            else {
+                pending = combined;
             }
         }
         if (trailing.byteLength !== constants_1.HMAC_TRUNCATED_SIZE) {
             throw new Error(`ciphertext too short: ${trailing.byteLength}`);
         }
-        const signature = hmac.digest().subarray(0, constants_1.HMAC_TRUNCATED_SIZE);
-        if (!(0, bytes_1.uint8TimingSafeEqual)(signature, trailing)) {
-            throw new Error('media MAC mismatch');
+        if (!options.skipMacVerification) {
+            const signature = hmac.digest().subarray(0, constants_1.HMAC_TRUNCATED_SIZE);
+            if (!(0, bytes_1.uint8TimingSafeEqual)(signature, trailing)) {
+                throw new Error('media MAC mismatch');
+            }
+        }
+        if (pending.byteLength < AES_BLOCK_SIZE || pending.byteLength % AES_BLOCK_SIZE !== 0) {
+            throw new Error(`invalid ciphertext length: ${pending.byteLength}`);
         }
-        const plainFinal = decipher.final();
+        const { plaintext: plainFinal } = await aesCbcDecryptChunk(aesKey, currentIv, pending, true);
         if (plainFinal.byteLength > 0) {
             plainHash.update(plainFinal);
             await writeChunk(plaintext, plainFinal);