zapo-js 0.2.0 → 1.0.0

package/dist/esm/crypto/core/primitives.js

@@ -1,92 +1,125 @@
-/**
- * Low-level crypto primitives using WebCrypto API
- */
-import { createHash, webcrypto } from 'node:crypto';
-import { EMPTY_BYTES, toBytesView } from '../../util/bytes.js';
-async function digestBytes(algorithm, value) {
-    return toBytesView(await webcrypto.subtle.digest(algorithm, value));
-}
-// ============================================
-// Hash functions
-// ============================================
-export async function sha256(value) {
-    return digestBytes('SHA-256', value);
-}
-export async function sha1(value) {
-    return digestBytes('SHA-1', value);
-}
-export async function sha512(value) {
-    return digestBytes('SHA-512', value);
-}
+import { createCipheriv, createDecipheriv, createHash, createHmac, pbkdf2 } from 'node:crypto';
+import { promisify } from 'node:util';
+import { concatBytes, EMPTY_BYTES, toBytesView } from '../../util/bytes.js';
+const AES_GCM_TAG_LENGTH = 16;
+const pbkdf2Async = promisify(pbkdf2);
+function feed(target, input) {
+    if (Array.isArray(input)) {
+        for (let i = 0; i < input.length; i += 1) {
+            target.update(input[i]);
+        }
+    }
+    else {
+        target.update(input);
+    }
+    return target;
+}
+/** Computes the SHA-1 digest of `value`. Accepts a single chunk or array of chunks. */
+export function sha1(value) {
+    return toBytesView(feed(createHash('sha1'), value).digest());
+}
+/** Computes the SHA-256 digest of `value`. */
+export function sha256(value) {
+    return toBytesView(feed(createHash('sha256'), value).digest());
+}
+/** Computes the SHA-512 digest of `value`. */
+export function sha512(value) {
+    return toBytesView(feed(createHash('sha512'), value).digest());
+}
+/** Computes the MD5 digest of `input`, accepting a string or raw chunks. */
 export function md5Bytes(input) {
-    return toBytesView(createHash('md5').update(input).digest());
-}
-// ============================================
-// AES-GCM (for Noise protocol)
-// ============================================
-export async function importAesGcmKey(raw, usages) {
-    return webcrypto.subtle.importKey('raw', raw, 'AES-GCM', false, usages);
-}
-export async function aesGcmEncrypt(key, nonce, plaintext, aad = EMPTY_BYTES) {
-    return toBytesView(await webcrypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, plaintext));
-}
-export async function aesGcmDecrypt(key, nonce, ciphertext, aad = EMPTY_BYTES) {
-    return toBytesView(await webcrypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce, additionalData: aad }, key, ciphertext));
-}
-// ============================================
-// AES-CBC (for Signal protocol)
-// ============================================
-export async function importAesCbcKey(keyBytes) {
-    return webcrypto.subtle.importKey('raw', keyBytes, { name: 'AES-CBC', length: 256 }, false, [
-        'encrypt',
-        'decrypt'
-    ]);
+    const hash = createHash('md5');
+    if (typeof input === 'string') {
+        hash.update(input);
+    }
+    else {
+        feed(hash, input);
+    }
+    return toBytesView(hash.digest());
 }
-export async function aesCbcEncrypt(key, iv, plaintext) {
-    return toBytesView(await webcrypto.subtle.encrypt({ name: 'AES-CBC', iv }, key, plaintext));
-}
-export async function aesCbcDecrypt(key, iv, ciphertext) {
-    return toBytesView(await webcrypto.subtle.decrypt({ name: 'AES-CBC', iv }, key, ciphertext));
-}
-// ============================================
-// HMAC-SHA256 (for Signal protocol)
-// ============================================
-export async function importHmacKey(keyBytes) {
-    return webcrypto.subtle.importKey('raw', keyBytes, { name: 'HMAC', hash: 'SHA-256' }, false, [
-        'sign'
-    ]);
-}
-export async function importHmacSha512Key(keyBytes) {
-    return webcrypto.subtle.importKey('raw', keyBytes, { name: 'HMAC', hash: 'SHA-512' }, false, [
-        'sign'
-    ]);
-}
-export async function hmacSign(key, data) {
-    return toBytesView(await webcrypto.subtle.sign('HMAC', key, data));
-}
-// ============================================
-// PBKDF2 → AES-CTR (for pairing code crypto)
-// ============================================
-export async function pbkdf2DeriveAesCtrKey(password, salt, iterations) {
-    const imported = await webcrypto.subtle.importKey('raw', password, { name: 'PBKDF2' }, false, [
-        'deriveKey'
-    ]);
-    return webcrypto.subtle.deriveKey({
-        name: 'PBKDF2',
-        hash: 'SHA-256',
-        salt,
-        iterations
-    }, imported, {
-        name: 'AES-CTR',
-        length: 256
-    }, false, ['encrypt', 'decrypt']);
-}
-// ============================================
-// AES-CTR (for pairing code crypto)
-// ============================================
-export async function aesCtrEncrypt(key, counter, plaintext) {
-    return toBytesView(await webcrypto.subtle.encrypt({ name: 'AES-CTR', counter, length: 64 }, key, plaintext));
+/**
+ * AES-256-GCM encrypt. The 16-byte auth tag is appended to the ciphertext.
+ * Pass `aad` when binding the ciphertext to associated data.
+ */
+export function aesGcmEncrypt(key, nonce, plaintext, aad = EMPTY_BYTES) {
+    const cipher = createCipheriv('aes-256-gcm', key, nonce);
+    if (aad.length > 0) {
+        cipher.setAAD(aad);
+    }
+    const head = cipher.update(plaintext);
+    const tail = cipher.final();
+    const tag = cipher.getAuthTag();
+    return concatBytes([head, tail, tag]);
 }
-export async function aesCtrDecrypt(key, counter, ciphertext) {
-    return toBytesView(await webcrypto.subtle.decrypt({ name: 'AES-CTR', counter, length: 64 }, key, ciphertext));
+/**
+ * AES-256-GCM decrypt. Expects the 16-byte auth tag appended to the
+ * ciphertext (matching {@link aesGcmEncrypt}'s layout). Throws on auth failure.
+ */
+export function aesGcmDecrypt(key, nonce, ciphertext, aad = EMPTY_BYTES) {
+    const tagOffset = ciphertext.length - AES_GCM_TAG_LENGTH;
+    const tag = ciphertext.subarray(tagOffset);
+    const ct = ciphertext.subarray(0, tagOffset);
+    const decipher = createDecipheriv('aes-256-gcm', key, nonce);
+    if (aad.length > 0) {
+        decipher.setAAD(aad);
+    }
+    decipher.setAuthTag(tag);
+    const head = decipher.update(ct);
+    const tail = decipher.final();
+    if (tail.length === 0) {
+        return toBytesView(head);
+    }
+    return concatBytes([head, tail]);
+}
+/** AES-256-CBC encrypt with PKCS#7 padding (default Node behavior). */
+export function aesCbcEncrypt(key, iv, plaintext) {
+    const cipher = createCipheriv('aes-256-cbc', key, iv);
+    const head = cipher.update(plaintext);
+    const tail = cipher.final();
+    if (tail.length === 0) {
+        return toBytesView(head);
+    }
+    return concatBytes([head, tail]);
+}
+/** AES-256-CBC decrypt with PKCS#7 padding. */
+export function aesCbcDecrypt(key, iv, ciphertext) {
+    const decipher = createDecipheriv('aes-256-cbc', key, iv);
+    const head = decipher.update(ciphertext);
+    const tail = decipher.final();
+    if (tail.length === 0) {
+        return toBytesView(head);
+    }
+    return concatBytes([head, tail]);
+}
+/** AES-256-CTR encrypt with the given 16-byte counter. */
+export function aesCtrEncrypt(key, counter, plaintext) {
+    const cipher = createCipheriv('aes-256-ctr', key, counter);
+    const head = cipher.update(plaintext);
+    const tail = cipher.final();
+    if (tail.length === 0) {
+        return toBytesView(head);
+    }
+    return concatBytes([head, tail]);
+}
+/** AES-256-CTR decrypt with the given 16-byte counter. */
+export function aesCtrDecrypt(key, counter, ciphertext) {
+    const decipher = createDecipheriv('aes-256-ctr', key, counter);
+    const head = decipher.update(ciphertext);
+    const tail = decipher.final();
+    if (tail.length === 0) {
+        return toBytesView(head);
+    }
+    return concatBytes([head, tail]);
+}
+/** Computes the HMAC-SHA-256 MAC of `data` keyed by `key`. */
+export function hmacSha256Sign(key, data) {
+    return toBytesView(feed(createHmac('sha256', key), data).digest());
+}
+/** Computes the HMAC-SHA-512 MAC of `data` keyed by `key`. */
+export function hmacSha512Sign(key, data) {
+    return toBytesView(feed(createHmac('sha512', key), data).digest());
+}
+/** PBKDF2 over HMAC-SHA-256 – derives `length` bytes from `password` + `salt`. */
+export async function pbkdf2Sha256(password, salt, iterations, length) {
+    return toBytesView(await pbkdf2Async(password, salt, iterations, length, 'sha256'));
 }

package/dist/esm/crypto/core/random.js

@@ -1,11 +1,9 @@
 import { randomBytes, randomFill, randomInt } from 'node:crypto';
 import { promisify } from 'node:util';
-import { toBytesView } from '../../util/bytes.js';
-const randomBytesAsyncImpl = promisify(randomBytes);
-const randomIntAsyncImpl = promisify(randomInt);
-export async function randomBytesAsync(size) {
-    return toBytesView(await randomBytesAsyncImpl(size));
-}
+/**
+ * Cryptographically fills `target` (optionally a sub-range) with random bytes.
+ * Resolves to the same `target` reference for chaining.
+ */
 export async function randomFillAsync(target, offset, size) {
     await new Promise((resolve, reject) => {
         const onDone = (error) => {
@@ -27,4 +25,7 @@ export async function randomFillAsync(target, offset, size) {
     });
     return target;
 }
-export const randomIntAsync = randomIntAsyncImpl;
+/** Returns a cryptographically secure integer in `[min, max)`. */
+export const randomIntAsync = promisify(randomInt);
+/** Returns `size` cryptographically secure random bytes. */
+export const randomBytesAsync = promisify(randomBytes);

package/dist/esm/crypto/core/xeddsa.js

@@ -0,0 +1,55 @@
+import { sha512 } from '../core/primitives.js';
+import { randomBytesAsync } from '../core/random.js';
+import { Ed25519 } from '../curves/Ed25519.js';
+import { clampCurvePrivateKeyInPlace, montgomeryToEdwardsPublic } from '../curves/X25519.js';
+import { encodeExtendedPoint, scalarMultBase } from '../math/edwards.js';
+import { bigIntToBytesLE, bytesToBigIntLE } from '../math/le.js';
+import { modGroup } from '../math/mod.js';
+import { assertByteLength, concatBytes } from '../../util/bytes.js';
+const PREFIX_SIGNATURE_RANDOM = new Uint8Array([
+    0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+]);
+/**
+ * Verifies an XEdDSA signature over `message` against an X25519 (Montgomery)
+ * public key, converting to the Edwards form internally. Returns `false`
+ * on shape mismatch instead of throwing.
+ */
+export async function xeddsaVerify(curvePublicKey, message, signature) {
+    if (signature.length !== 64) {
+        return false;
+    }
+    if ((signature[63] & 0x60) !== 0) {
+        return false;
+    }
+    const lastByteIndex = 63;
+    const originalLastByte = signature[lastByteIndex];
+    const signBit = originalLastByte & 0x80;
+    signature[lastByteIndex] = originalLastByte & 0x7f;
+    const edPublic = montgomeryToEdwardsPublic(curvePublicKey, signBit);
+    try {
+        return await Ed25519.verify(message, signature, edPublic);
+    }
+    finally {
+        signature[lastByteIndex] = originalLastByte;
+    }
+}
+/**
+ * Signs `message` with an X25519 (Montgomery) private key using the XEdDSA
+ * construction. Returns a 64-byte signature.
+ */
+export async function xeddsaSign(privateKey, message) {
+    assertByteLength(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
+    const clampedPrivateKey = clampCurvePrivateKeyInPlace(privateKey);
+    const privateScalar = bytesToBigIntLE(clampedPrivateKey);
+    const encodedPublic = encodeExtendedPoint(scalarMultBase(privateScalar));
+    const pubKeySignBit = encodedPublic[31] & 0x80;
+    const randomSuffix = await randomBytesAsync(64);
+    const r = modGroup(bytesToBigIntLE(sha512([PREFIX_SIGNATURE_RANDOM, clampedPrivateKey, message, randomSuffix])));
+    const encodedR = encodeExtendedPoint(scalarMultBase(r));
+    const h = modGroup(bytesToBigIntLE(sha512([encodedR, encodedPublic, message])));
+    const s = modGroup(r + h * privateScalar);
+    const encodedS = bigIntToBytesLE(s, 32);
+    encodedS[31] = (encodedS[31] & 0x7f) | pubKeySignBit;
+    return concatBytes([encodedR, encodedS]);
+}

package/dist/esm/crypto/curves/Ed25519.js

@@ -1,37 +1,48 @@
-import { webcrypto } from 'node:crypto';
-import { ED25519_PKCS8_PREFIX } from '../curves/constants.js';
+import { createPrivateKey, createPublicKey, generateKeyPair, sign as nodeSign, verify as nodeVerify } from 'node:crypto';
+import { promisify } from 'node:util';
+import { ED25519_PKCS8_PREFIX, ED25519_SPKI_PREFIX } from '../curves/constants.js';
 import { pkcs8FromRawPrivate } from '../curves/types.js';
-import { assertByteLength, decodeBase64Url, toBytesView } from '../../util/bytes.js';
+import { assertByteLength, concatBytes, decodeBase64Url, toBytesView } from '../../util/bytes.js';
+const generateKeyPairAsync = promisify(generateKeyPair);
+const signAsync = promisify(nodeSign);
+const verifyAsync = promisify(nodeVerify);
+function ed25519PrivateKeyObject(privKey) {
+    return createPrivateKey({
+        key: pkcs8FromRawPrivate(ED25519_PKCS8_PREFIX, privKey),
+        format: 'der',
+        type: 'pkcs8'
+    });
+}
+function ed25519PublicKeyObject(pubKey) {
+    return createPublicKey({
+        key: concatBytes([ED25519_SPKI_PREFIX, pubKey]),
+        format: 'der',
+        type: 'spki'
+    });
+}
+/**
+ * Ed25519 sign/verify backed by Node's native primitives. All operations are
+ * async to keep crypto off the event loop.
+ */
 export class Ed25519 {
+    /** Generates a fresh Ed25519 key pair. */
     static async generateKeyPair() {
-        const keys = (await webcrypto.subtle.generateKey({ name: 'Ed25519' }, true, [
-            'sign',
-            'verify'
-        ]));
-        const privateJwk = await webcrypto.subtle.exportKey('jwk', keys.privateKey);
-        return {
-            pubKey: decodeBase64Url(privateJwk.x, 'ed25519 public key'),
-            privKey: decodeBase64Url(privateJwk.d, 'ed25519 private key')
-        };
-    }
-    static async keyPairFromPrivateKey(privKey) {
-        assertByteLength(privKey, 32, 'ed25519 private key must be 32 bytes');
-        const privateKey = await webcrypto.subtle.importKey('pkcs8', pkcs8FromRawPrivate(ED25519_PKCS8_PREFIX, privKey), { name: 'Ed25519' }, true, ['sign']);
-        const privateJwk = await webcrypto.subtle.exportKey('jwk', privateKey);
+        const { privateKey } = await generateKeyPairAsync('ed25519');
+        const jwk = privateKey.export({ format: 'jwk' });
         return {
-            pubKey: decodeBase64Url(privateJwk.x, 'ed25519 public key'),
-            privKey: decodeBase64Url(privateJwk.d, 'ed25519 private key')
+            pubKey: decodeBase64Url(jwk.x, 'ed25519 public key'),
+            privKey: decodeBase64Url(jwk.d, 'ed25519 private key')
         };
     }
+    /** Signs `message` with a 32-byte Ed25519 private key. Returns a 64-byte signature. */
     static async sign(message, privKey) {
         assertByteLength(privKey, 32, 'ed25519 private key must be 32 bytes');
-        const privateKey = await webcrypto.subtle.importKey('pkcs8', pkcs8FromRawPrivate(ED25519_PKCS8_PREFIX, privKey), { name: 'Ed25519' }, false, ['sign']);
-        const signature = await webcrypto.subtle.sign('Ed25519', privateKey, message);
-        return toBytesView(signature);
+        const sig = await signAsync(null, message, ed25519PrivateKeyObject(privKey));
+        return toBytesView(sig);
     }
+    /** Verifies an Ed25519 `signature` over `message` against a 32-byte public key. */
     static async verify(message, signature, pubKey) {
         assertByteLength(pubKey, 32, 'ed25519 public key must be 32 bytes');
-        const publicKey = await webcrypto.subtle.importKey('raw', pubKey, { name: 'Ed25519' }, false, ['verify']);
-        return webcrypto.subtle.verify('Ed25519', publicKey, signature, message);
+        return verifyAsync(null, message, ed25519PublicKeyObject(pubKey), signature);
     }
 }

package/dist/esm/crypto/curves/X25519.js

@@ -1,9 +1,30 @@
-import { webcrypto } from 'node:crypto';
-import { X25519_PKCS8_PREFIX } from '../curves/constants.js';
+import { createPrivateKey, createPublicKey, diffieHellman, generateKeyPair, generateKeyPairSync } from 'node:crypto';
+import { promisify } from 'node:util';
+const generateKeyPairAsync = promisify(generateKeyPair);
+import { X25519_PKCS8_PREFIX, X25519_SPKI_PREFIX } from '../curves/constants.js';
 import { pkcs8FromRawPrivate } from '../curves/types.js';
 import { FE_ONE } from '../math/constants.js';
 import { fe, feAdd, feFromBytes, feInv, feMul, fePack, feSub } from '../math/fe.js';
-import { assertByteLength, decodeBase64Url, toBytesView } from '../../util/bytes.js';
+import { assertByteLength, concatBytes, decodeBase64Url, toBytesView } from '../../util/bytes.js';
+const diffieHellmanWithCallback = diffieHellman;
+let diffieHellmanAsync = null;
+let diffieHellmanAsyncProbed = false;
+function resolveDiffieHellmanAsync() {
+    if (diffieHellmanAsyncProbed)
+        return diffieHellmanAsync;
+    diffieHellmanAsyncProbed = true;
+    try {
+        const probe = generateKeyPairSync('x25519');
+        const result = diffieHellman({ privateKey: probe.privateKey, publicKey: probe.publicKey }, () => { });
+        if (result === undefined) {
+            diffieHellmanAsync = promisify(diffieHellmanWithCallback);
+        }
+    }
+    catch {
+        // callback form not supported by this runtime; stay on sync path
+    }
+    return diffieHellmanAsync;
+}
 // Pre-allocated temps for montgomeryToEdwardsPublic (safe: single-threaded)
 const _mx = fe();
 const _m1 = fe();
@@ -19,6 +40,10 @@ function isFieldPMinus1(b) {
             return false;
     return true;
 }
+/**
+ * Applies the standard curve25519 scalar clamping in place and returns the
+ * same buffer for chaining. Throws on non-32-byte inputs.
+ */
 export function clampCurvePrivateKeyInPlace(privateKey) {
     assertByteLength(privateKey, 32, `invalid curve25519 private key length ${privateKey.length}`);
     privateKey[0] &= 248;
@@ -26,6 +51,11 @@ export function clampCurvePrivateKeyInPlace(privateKey) {
     privateKey[31] |= 64;
     return privateKey;
 }
+/**
+ * Converts a 32-byte Montgomery (curve25519) public key to its Edwards form
+ * for XEdDSA verification, applying the supplied `signBit` (`0x80` mask).
+ * Throws on the field-`p-1` low-order point.
+ */
 export function montgomeryToEdwardsPublic(curvePublicKey, signBit) {
     assertByteLength(curvePublicKey, 32, `invalid curve25519 public key length ${curvePublicKey.length}`);
     if (isFieldPMinus1(curvePublicKey)) {
@@ -41,34 +71,58 @@ export function montgomeryToEdwardsPublic(curvePublicKey, signBit) {
     encoded[31] = (encoded[31] & 0x7f) | (signBit & 0x80);
     return encoded;
 }
+function x25519PrivateKeyObject(privKey) {
+    return createPrivateKey({
+        key: pkcs8FromRawPrivate(X25519_PKCS8_PREFIX, privKey),
+        format: 'der',
+        type: 'pkcs8'
+    });
+}
+function x25519PublicKeyObject(pubKey) {
+    return createPublicKey({
+        key: concatBytes([X25519_SPKI_PREFIX, pubKey]),
+        format: 'der',
+        type: 'spki'
+    });
+}
+/**
+ * X25519 key-pair generation and Diffie-Hellman scalar multiplication
+ * backed by Node's native primitives.
+ */
 export class X25519 {
+    /** Generates a fresh X25519 key pair. */
     static async generateKeyPair() {
-        const keys = (await webcrypto.subtle.generateKey({ name: 'X25519' }, true, [
-            'deriveBits'
-        ]));
-        const privateJwk = await webcrypto.subtle.exportKey('jwk', keys.privateKey);
+        const { privateKey } = await generateKeyPairAsync('x25519');
+        const jwk = privateKey.export({ format: 'jwk' });
         return {
-            pubKey: decodeBase64Url(privateJwk.x, 'x25519 public key'),
-            privKey: decodeBase64Url(privateJwk.d, 'x25519 private key')
+            pubKey: decodeBase64Url(jwk.x, 'x25519 public key'),
+            privKey: decodeBase64Url(jwk.d, 'x25519 private key')
         };
     }
-    static async keyPairFromPrivateKey(privKey) {
+    /** Derives the matching public key from a 32-byte X25519 private key. */
+    static keyPairFromPrivateKey(privKey) {
         assertByteLength(privKey, 32, 'x25519 private key must be 32 bytes');
-        const privateKey = await webcrypto.subtle.importKey('pkcs8', pkcs8FromRawPrivate(X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, true, ['deriveBits']);
-        const privateJwk = await webcrypto.subtle.exportKey('jwk', privateKey);
+        const jwk = x25519PrivateKeyObject(privKey).export({ format: 'jwk' });
         return {
-            pubKey: decodeBase64Url(privateJwk.x, 'x25519 public key'),
-            privKey: decodeBase64Url(privateJwk.d, 'x25519 private key')
+            pubKey: decodeBase64Url(jwk.x, 'x25519 public key'),
+            privKey
         };
     }
+    /**
+     * Computes the X25519 shared secret between `privKey` and `pubKey`.
+     * Uses Node's async DH path when supported, otherwise falls back to sync.
+     */
     static async scalarMult(privKey, pubKey) {
         assertByteLength(privKey, 32, 'x25519 private key must be 32 bytes');
         assertByteLength(pubKey, 32, 'x25519 public key must be 32 bytes');
-        const [privateKey, publicKey] = await Promise.all([
-            webcrypto.subtle.importKey('pkcs8', pkcs8FromRawPrivate(X25519_PKCS8_PREFIX, privKey), { name: 'X25519' }, false, ['deriveBits']),
-            webcrypto.subtle.importKey('raw', pubKey, { name: 'X25519' }, false, [])
-        ]);
-        const sharedBits = await webcrypto.subtle.deriveBits({ name: 'X25519', public: publicKey }, privateKey, 256);
-        return toBytesView(sharedBits);
+        const opts = {
+            privateKey: x25519PrivateKeyObject(privKey),
+            publicKey: x25519PublicKeyObject(pubKey)
+        };
+        const dhAsync = resolveDiffieHellmanAsync();
+        if (dhAsync) {
+            return toBytesView(await dhAsync(opts));
+        }
+        return toBytesView(diffieHellman(opts));
     }
 }

package/dist/esm/crypto/curves/constants.js

@@ -1,3 +1,5 @@
 import { hexToBytes } from '../../util/bytes.js';
 export const X25519_PKCS8_PREFIX = hexToBytes('302e020100300506032b656e04220420');
+export const X25519_SPKI_PREFIX = hexToBytes('302a300506032b656e032100');
 export const ED25519_PKCS8_PREFIX = hexToBytes('302e020100300506032b657004220420');
+export const ED25519_SPKI_PREFIX = hexToBytes('302a300506032b6570032100');

package/dist/esm/crypto/math/constants.js

@@ -1,8 +1,7 @@
-import { fe, feFromBigInt } from '../math/fe.js';
+import { feFromBigInt } from '../math/fe.js';
 export const FIELD_P = (1n << 255n) - 19n;
 export const GROUP_L = (1n << 252n) + 27742317777372353535851937790883648493n;
 export const FE_TWO_D = feFromBigInt(16295367250680780974490674513165176452449235426866156013048779062215315747161n);
-export const FE_ZERO = fe();
 export const FE_ONE = feFromBigInt(1n);
 export const BASE_POINT = Object.freeze({
     x: feFromBigInt(15112221349535400772501151409588531511454012693041857206046113283949847762202n),

package/dist/esm/crypto/math/mod.js

@@ -1,5 +1,4 @@
 import { FIELD_P, GROUP_L } from '../math/constants.js';
-import { fe, feFromBigInt, feInv, feToBigInt } from '../math/fe.js';
 export function mod(value, modulus = FIELD_P) {
     const remainder = value % modulus;
     return remainder >= 0n ? remainder : remainder + modulus;
@@ -7,34 +6,3 @@ export function mod(value, modulus = FIELD_P) {
 export function modGroup(value) {
     return mod(value, GROUP_L);
 }
-export function modInv(value, modulus = FIELD_P) {
-    if (value === 0n) {
-        throw new Error('field inversion by zero');
-    }
-    if (modulus === FIELD_P) {
-        return fieldInv(value);
-    }
-    return modPow(value, modulus - 2n, modulus);
-}
-function fieldInv(x) {
-    const a = feFromBigInt(mod(x));
-    const out = fe();
-    feInv(out, a);
-    return feToBigInt(out);
-}
-function modPow(base, exponent, modulus) {
-    if (modulus <= 0n) {
-        throw new Error('modulus must be positive');
-    }
-    let result = 1n;
-    let current = ((base % modulus) + modulus) % modulus;
-    let e = exponent;
-    while (e > 0n) {
-        if ((e & 1n) === 1n) {
-            result = (result * current) % modulus;
-        }
-        current = (current * current) % modulus;
-        e >>= 1n;
-    }
-    return result;
-}

package/dist/esm/index.js

@@ -1,6 +1,11 @@
 export { WaClient } from './client/index.js';
+export { parseUsyncResultEnvelope } from './transport/node/builders/usync.js';
+export { getContentType, resolveMessageTarget } from './message/encode/content.js';
+export { fetchLatestWaWebVersion } from './transport/wa-web-version-fetcher.js';
 export { ConsoleLogger } from './infra/log/ConsoleLogger.js';
 export { PinoLogger, createPinoLogger } from './infra/log/PinoLogger.js';
-export { createStore } from './store/index.js';
-export { getLoginIdentity, getWaCompanionPlatformId, getWaMediaHkdfInfo, isGroupJid, normalizeDeviceJid, normalizeRecipientJid, parsePhoneJid, parseSignalAddressFromJid, splitJid, toUserJid, WA_ACCOUNT_SYNC_PROTOCOLS, WA_APP_STATE_COLLECTIONS, WA_APP_STATE_COLLECTION_STATES, WA_APP_STATE_ERROR_CODES, WA_APP_STATE_KDF_INFO, WA_APP_STATE_KEY_TYPES, WA_APP_STATE_SYNC_DATA_TYPE, WA_BROWSERS, WA_COMPANION_PLATFORM_IDS, WA_DEFAULTS, WA_DIRTY_PROTOCOLS, WA_DIRTY_TYPES, WA_DISCONNECT_REASONS, WA_IQ_TYPES, WA_LOGOUT_REASONS, WA_MESSAGE_TAGS, WA_MESSAGE_TYPES, WA_MEDIA_HKDF_INFO, WA_NODE_TAGS, WA_PAIRING_KDF_INFO, WA_PREVIEW_MEDIA_HKDF_INFO, WA_READY_STATES, WA_RETRYABLE_ACK_CODES, WA_SIGNALING, WA_STREAM_SIGNALING, WA_SUPPORTED_DIRTY_TYPES, WA_PRIVACY_CATEGORIES, WA_PRIVACY_CATEGORY_TO_SETTING, WA_PRIVACY_DISALLOWED_LIST_CATEGORIES, WA_PRIVACY_SETTING_TO_CATEGORY, WA_PRIVACY_TAGS, WA_PRIVACY_VALUES, WA_XMLNS } from './protocol/index.js';
+export { createNoopLogger } from './infra/log/types.js';
+export { createStore, WaAuthMemoryStore } from './store/index.js';
+export { delay } from './util/async.js';
+export { buildDeviceJid, canonicalizeSignalJid, canonicalizeSignalServer, getLoginIdentity, getWaCompanionPlatformId, getWaMediaHkdfInfo, isBotJid, isBroadcastJid, isGroupJid, isGroupOrBroadcastJid, isHostedDeviceId, isHostedDeviceJid, isHostedServer, isLidJid, isNewsletterJid, isStatusBroadcastJid, isUserJid, normalizeDeviceJid, normalizeRecipientJid, parseJidFull, parsePhoneJid, parseSignalAddressFromJid, signalAddressKey, splitJid, toUserJid, WA_ACCOUNT_SYNC_PROTOCOLS, WA_APP_STATE_COLLECTIONS, WA_APP_STATE_COLLECTION_STATES, WA_APP_STATE_ERROR_CODES, WA_APP_STATE_KDF_INFO, WA_APP_STATE_KEY_TYPES, WA_APP_STATE_SYNC_DATA_TYPE, WA_BROWSERS, WA_BUSINESS_HOURS_DAYS, WA_BUSINESS_HOURS_MODES, WA_COMPANION_PLATFORM_IDS, WA_DEFAULTS, WA_DIRTY_PROTOCOLS, WA_DIRTY_TYPES, WA_DISCONNECT_REASONS, WA_IQ_TYPES, WA_LOGOUT_REASONS, WA_MESSAGE_TAGS, WA_MESSAGE_TYPES, WA_MEDIA_HKDF_INFO, WA_NODE_TAGS, WA_PAIRING_KDF_INFO, WA_PREVIEW_MEDIA_HKDF_INFO, WA_READY_STATES, WA_RETRYABLE_ACK_CODES, WA_SIGNALING, WA_STREAM_SIGNALING, WA_SUPPORTED_DIRTY_TYPES, WA_PRIVACY_CATEGORIES, WA_PRIVACY_CATEGORY_TO_SETTING, WA_PRIVACY_DISALLOWED_LIST_CATEGORIES, WA_PRIVACY_SETTING_TO_CATEGORY, WA_PRIVACY_TAGS, WA_PRIVACY_VALUES, WA_XMLNS } from './protocol/index.js';
 export { proto } from './proto.js';

package/dist/esm/infra/log/ConsoleLogger.js

@@ -6,36 +6,60 @@ const LOG_LEVEL_PRIORITY = {
     error: 50
 };
 const CONSOLE_WRITERS = {
-    trace: console.debug,
-    debug: console.debug,
-    info: console.info,
-    warn: console.warn,
-    error: console.error
+    trace: (...args) => console.debug(...args),
+    debug: (...args) => console.debug(...args),
+    info: (...args) => console.info(...args),
+    warn: (...args) => console.warn(...args),
+    error: (...args) => console.error(...args)
 };
+/**
+ * Default zero-dependency {@link Logger} that writes structured records to
+ * the standard `console` sinks. Messages below the configured `level` are
+ * dropped without formatting cost.
+ */
 export class ConsoleLogger {
-    constructor(level = 'info') {
+    /** @param level Minimum level to emit. Defaults to `'info'`. */
+    constructor(level = 'info', bindings = null) {
         this.level = level;
         this.minLevelPriority = LOG_LEVEL_PRIORITY[level];
+        this.bindings = bindings;
     }
+    /** Emits a `trace` record. */
     trace(message, context) {
         this.write('trace', message, context);
     }
+    /** Emits a `debug` record. */
     debug(message, context) {
         this.write('debug', message, context);
     }
+    /** Emits an `info` record. */
     info(message, context) {
         this.write('info', message, context);
     }
+    /** Emits a `warn` record. */
     warn(message, context) {
         this.write('warn', message, context);
     }
+    /** Emits an `error` record. */
     error(message, context) {
         this.write('error', message, context);
     }
+    /**
+     * Returns a derived logger with `bindings` merged into the parent's
+     * bindings. Per-call context still wins on key conflicts.
+     */
+    child(bindings) {
+        const merged = this.bindings ? { ...this.bindings, ...bindings } : { ...bindings };
+        return new ConsoleLogger(this.level, merged);
+    }
     write(level, message, context) {
         if (LOG_LEVEL_PRIORITY[level] < this.minLevelPriority) {
             return;
         }
+        if (this.bindings) {
+            CONSOLE_WRITERS[level](message, { ...this.bindings, ...context });
+            return;
+        }
         CONSOLE_WRITERS[level](message, context);
     }
 }