zapo-js 0.2.0 → 1.0.0

package/dist/signal/group/encoding.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeSenderKeyRecord = encodeSenderKeyRecord;
+exports.decodeSenderKeyRecord = decodeSenderKeyRecord;
+exports.decodeSenderKeyDistributionRow = decodeSenderKeyDistributionRow;
+const _proto_1 = require("../../proto.js");
+const coercion_1 = require("../../util/coercion");
+/** Serializes a {@link SenderKeyRecord} into the Signal `SenderKeyRecordStructure` protobuf. */
+function encodeSenderKeyRecord(record) {
+    return _proto_1.proto.SenderKeyRecordStructure.encode({
+        senderKeyStates: [
+            {
+                senderKeyId: record.keyId,
+                senderChainKey: {
+                    iteration: record.iteration,
+                    seed: record.chainKey
+                },
+                senderSigningKey: {
+                    public: record.signingPublicKey,
+                    private: record.signingPrivateKey
+                },
+                senderMessageKeys: (() => {
+                    const src = record.unusedMessageKeys ?? [];
+                    const arr = new Array(src.length);
+                    for (let i = 0; i < src.length; i += 1) {
+                        const messageKey = src[i];
+                        arr[i] = {
+                            iteration: messageKey.iteration,
+                            seed: messageKey.seed
+                        };
+                    }
+                    return arr;
+                })()
+            }
+        ]
+    }).finish();
+}
+function decodeSenderKeyState(state, field) {
+    if (!state.senderChainKey) {
+        throw new Error(`missing ${field}.senderChainKey`);
+    }
+    if (!state.senderSigningKey) {
+        throw new Error(`missing ${field}.senderSigningKey`);
+    }
+    return {
+        keyId: (0, coercion_1.asNumber)(state.senderKeyId, `${field}.senderKeyId`),
+        iteration: (0, coercion_1.asNumber)(state.senderChainKey.iteration, `${field}.senderChainKey.iteration`),
+        chainKey: (0, coercion_1.asBytes)(state.senderChainKey.seed, `${field}.senderChainKey.seed`),
+        signingPublicKey: (0, coercion_1.asBytes)(state.senderSigningKey.public, `${field}.senderSigningKey.public`),
+        signingPrivateKey: state.senderSigningKey.private !== null && state.senderSigningKey.private !== undefined
+            ? (0, coercion_1.asBytes)(state.senderSigningKey.private, `${field}.senderSigningKey.private`)
+            : undefined,
+        unusedMessageKeys: (() => {
+            const src = state.senderMessageKeys ?? [];
+            const arr = new Array(src.length);
+            for (let i = 0; i < src.length; i += 1) {
+                const messageKey = src[i];
+                arr[i] = {
+                    iteration: (0, coercion_1.asNumber)(messageKey.iteration, `${field}.senderMessageKeys[${i}].iteration`),
+                    seed: (0, coercion_1.asBytes)(messageKey.seed, `${field}.senderMessageKeys[${i}].seed`)
+                };
+            }
+            return arr;
+        })()
+    };
+}
+/**
+ * Decodes a stored sender-key blob into a {@link SenderKeyRecord}.
+ * `groupId`/`sender` are re-attached from the row key (not in the protobuf).
+ */
+function decodeSenderKeyRecord(raw, groupId, sender) {
+    const decoded = _proto_1.proto.SenderKeyRecordStructure.decode((0, coercion_1.asBytes)(raw, 'sender_keys.record'));
+    const state = decoded.senderKeyStates?.[0];
+    if (!state) {
+        throw new Error('missing sender_keys.record.senderKeyStates[0]');
+    }
+    const parsed = decodeSenderKeyState(state, 'sender_keys.record.senderKeyStates[0]');
+    return {
+        groupId,
+        sender,
+        keyId: parsed.keyId,
+        iteration: parsed.iteration,
+        chainKey: parsed.chainKey,
+        signingPublicKey: parsed.signingPublicKey,
+        signingPrivateKey: parsed.signingPrivateKey,
+        unusedMessageKeys: parsed.unusedMessageKeys
+    };
+}
+/** Decodes a sender-key-distribution SQL row into a {@link SenderKeyDistributionRecord}. */
+function decodeSenderKeyDistributionRow(row) {
+    return {
+        groupId: (0, coercion_1.asString)(row.group_id, 'sender_key_distribution.group_id'),
+        sender: {
+            user: (0, coercion_1.asString)(row.sender_user, 'sender_key_distribution.sender_user'),
+            server: (0, coercion_1.asString)(row.sender_server, 'sender_key_distribution.sender_server'),
+            device: (0, coercion_1.asNumber)(row.sender_device, 'sender_key_distribution.sender_device')
+        },
+        keyId: (0, coercion_1.asNumber)(row.key_id, 'sender_key_distribution.key_id'),
+        timestampMs: (0, coercion_1.asNumber)(row.timestamp_ms, 'sender_key_distribution.timestamp_ms')
+    };
+}

package/dist/signal/index.js

@@ -1,18 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createSignalSessionResolver = exports.SignalProtocol = exports.createAndStoreInitialKeys = exports.SenderKeyManager = exports.SignalSessionSyncApi = exports.SignalRotateKeyApi = exports.SignalMissingPreKeysSyncApi = exports.SignalIdentitySyncApi = exports.SignalDeviceSyncApi = exports.SignalDigestSyncApi = exports.parsePreKeyUploadFailure = exports.buildPreKeyUploadIq = exports.generateSignedPreKey = exports.generateRegistrationInfo = exports.generateRegistrationId = exports.generatePreKeyPair = exports.toSignalAddressParts = exports.encodeSignalSessionRecord = exports.encodeSenderKeyRecord = exports.decodeStoreCount = exports.decodeSenderKeyRecord = exports.decodeSenderKeyDistributionRow = exports.decodeSignalSignedPreKeyRow = exports.decodeSignalSessionRecord = exports.decodeSignalRemoteIdentity = exports.decodeSignalRegistrationRow = exports.decodeSignalPreKeyRow = void 0;
+exports.createSignalSessionResolver = exports.SignalProtocol = exports.createAndStoreInitialKeys = exports.SenderKeyManager = exports.SignalSessionSyncApi = exports.SignalRotateKeyApi = exports.SignalMissingPreKeysSyncApi = exports.SignalIdentitySyncApi = exports.SignalDeviceSyncApi = exports.SignalDigestSyncApi = exports.parsePreKeyUploadFailure = exports.buildPreKeyUploadIq = exports.generateSignedPreKey = exports.generateRegistrationInfo = exports.generateRegistrationId = exports.generatePreKeyPair = exports.encodeSenderKeyRecord = exports.decodeSenderKeyRecord = exports.decodeSenderKeyDistributionRow = exports.decodeSignalSignedPreKeyRow = exports.decodeSignalRegistrationRow = exports.decodeSignalPreKeyRow = exports.encodeSignalSessionRecord = exports.decodeSignalSessionRecord = exports.decodeSignalRemoteIdentity = exports.toSignalAddressParts = exports.decodeStoreCount = void 0;
 var encoding_1 = require("./encoding");
-Object.defineProperty(exports, "decodeSignalPreKeyRow", { enumerable: true, get: function () { return encoding_1.decodeSignalPreKeyRow; } });
-Object.defineProperty(exports, "decodeSignalRegistrationRow", { enumerable: true, get: function () { return encoding_1.decodeSignalRegistrationRow; } });
-Object.defineProperty(exports, "decodeSignalRemoteIdentity", { enumerable: true, get: function () { return encoding_1.decodeSignalRemoteIdentity; } });
-Object.defineProperty(exports, "decodeSignalSessionRecord", { enumerable: true, get: function () { return encoding_1.decodeSignalSessionRecord; } });
-Object.defineProperty(exports, "decodeSignalSignedPreKeyRow", { enumerable: true, get: function () { return encoding_1.decodeSignalSignedPreKeyRow; } });
-Object.defineProperty(exports, "decodeSenderKeyDistributionRow", { enumerable: true, get: function () { return encoding_1.decodeSenderKeyDistributionRow; } });
-Object.defineProperty(exports, "decodeSenderKeyRecord", { enumerable: true, get: function () { return encoding_1.decodeSenderKeyRecord; } });
 Object.defineProperty(exports, "decodeStoreCount", { enumerable: true, get: function () { return encoding_1.decodeStoreCount; } });
-Object.defineProperty(exports, "encodeSenderKeyRecord", { enumerable: true, get: function () { return encoding_1.encodeSenderKeyRecord; } });
-Object.defineProperty(exports, "encodeSignalSessionRecord", { enumerable: true, get: function () { return encoding_1.encodeSignalSessionRecord; } });
 Object.defineProperty(exports, "toSignalAddressParts", { enumerable: true, get: function () { return encoding_1.toSignalAddressParts; } });
+var encoding_2 = require("./session/encoding");
+Object.defineProperty(exports, "decodeSignalRemoteIdentity", { enumerable: true, get: function () { return encoding_2.decodeSignalRemoteIdentity; } });
+Object.defineProperty(exports, "decodeSignalSessionRecord", { enumerable: true, get: function () { return encoding_2.decodeSignalSessionRecord; } });
+Object.defineProperty(exports, "encodeSignalSessionRecord", { enumerable: true, get: function () { return encoding_2.encodeSignalSessionRecord; } });
+var encoding_3 = require("./registration/encoding");
+Object.defineProperty(exports, "decodeSignalPreKeyRow", { enumerable: true, get: function () { return encoding_3.decodeSignalPreKeyRow; } });
+Object.defineProperty(exports, "decodeSignalRegistrationRow", { enumerable: true, get: function () { return encoding_3.decodeSignalRegistrationRow; } });
+Object.defineProperty(exports, "decodeSignalSignedPreKeyRow", { enumerable: true, get: function () { return encoding_3.decodeSignalSignedPreKeyRow; } });
+var encoding_4 = require("./group/encoding");
+Object.defineProperty(exports, "decodeSenderKeyDistributionRow", { enumerable: true, get: function () { return encoding_4.decodeSenderKeyDistributionRow; } });
+Object.defineProperty(exports, "decodeSenderKeyRecord", { enumerable: true, get: function () { return encoding_4.decodeSenderKeyRecord; } });
+Object.defineProperty(exports, "encodeSenderKeyRecord", { enumerable: true, get: function () { return encoding_4.encodeSenderKeyRecord; } });
 var keygen_1 = require("./registration/keygen");
 Object.defineProperty(exports, "generatePreKeyPair", { enumerable: true, get: function () { return keygen_1.generatePreKeyPair; } });
 Object.defineProperty(exports, "generateRegistrationId", { enumerable: true, get: function () { return keygen_1.generateRegistrationId; } });

package/dist/signal/registration/encoding.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeSignalRegistrationRow = decodeSignalRegistrationRow;
+exports.decodeSignalPreKeyRow = decodeSignalPreKeyRow;
+exports.decodeSignalSignedPreKeyRow = decodeSignalSignedPreKeyRow;
+const coercion_1 = require("../../util/coercion");
+/** Decodes a stored signal-registration SQL row into a {@link RegistrationInfo}. */
+function decodeSignalRegistrationRow(row) {
+    return {
+        registrationId: (0, coercion_1.asNumber)(row.registration_id, 'signal_registration.registration_id'),
+        identityKeyPair: {
+            pubKey: (0, coercion_1.asBytes)(row.identity_pub_key, 'signal_registration.identity_pub_key'),
+            privKey: (0, coercion_1.asBytes)(row.identity_priv_key, 'signal_registration.identity_priv_key')
+        }
+    };
+}
+/** Decodes a one-time prekey SQL row into a {@link PreKeyRecord}. */
+function decodeSignalPreKeyRow(row) {
+    return {
+        keyId: (0, coercion_1.asNumber)(row.key_id, 'signal_prekey.key_id'),
+        keyPair: {
+            pubKey: (0, coercion_1.asBytes)(row.pub_key, 'signal_prekey.pub_key'),
+            privKey: (0, coercion_1.asBytes)(row.priv_key, 'signal_prekey.priv_key')
+        },
+        uploaded: (0, coercion_1.toBoolOrUndef)(row.uploaded)
+    };
+}
+/** Decodes a signed-prekey SQL row into a {@link SignedPreKeyRecord}. */
+function decodeSignalSignedPreKeyRow(row) {
+    return {
+        keyId: (0, coercion_1.asNumber)(row.key_id, 'signal_signed_prekey.key_id'),
+        keyPair: {
+            pubKey: (0, coercion_1.asBytes)(row.pub_key, 'signal_signed_prekey.pub_key'),
+            privKey: (0, coercion_1.asBytes)(row.priv_key, 'signal_signed_prekey.priv_key')
+        },
+        signature: (0, coercion_1.asBytes)(row.signature, 'signal_signed_prekey.signature'),
+        uploaded: (0, coercion_1.toBoolOrUndef)(row.uploaded)
+    };
+}

package/dist/signal/registration/keygen.js

@@ -7,7 +7,10 @@ exports.generateRegistrationId = generateRegistrationId;
 const _crypto_1 = require("../../crypto/index.js");
 const keys_1 = require("../../crypto/core/keys");
 const X25519_1 = require("../../crypto/curves/X25519");
-const WaAdvSignature_1 = require("../crypto/WaAdvSignature");
+/**
+ * Generates the per-device Signal registration info – a random registration id
+ * plus a fresh identity X25519 key pair.
+ */
 async function generateRegistrationInfo() {
     const [registrationId, identityKeyPair] = await Promise.all([
         generateRegistrationId(),
@@ -18,6 +21,7 @@ async function generateRegistrationInfo() {
         identityKeyPair
     };
 }
+/** Generates a fresh one-time prekey record with the given `keyId`. */
 async function generatePreKeyPair(keyId) {
     return {
         keyId,
@@ -25,10 +29,14 @@ async function generatePreKeyPair(keyId) {
         uploaded: false
     };
 }
+/**
+ * Generates a signed prekey: a fresh X25519 keypair plus an XEdDSA signature
+ * over its serialized public key, signed by `signingPrivateKey` (identity key).
+ */
 async function generateSignedPreKey(keyId, signingPrivateKey) {
     const keyPair = await X25519_1.X25519.generateKeyPair();
     const serializedPubKey = (0, keys_1.toSerializedPubKey)(keyPair.pubKey);
-    const signature = await (0, WaAdvSignature_1.signSignalMessage)(signingPrivateKey, serializedPubKey);
+    const signature = await (0, _crypto_1.xeddsaSign)(signingPrivateKey, serializedPubKey);
     return {
         keyId,
         keyPair,
@@ -36,6 +44,7 @@ async function generateSignedPreKey(keyId, signingPrivateKey) {
         uploaded: false
     };
 }
+/** Generates a Signal registration id in the valid `[1, 16380]` range. */
 async function generateRegistrationId() {
     return await (0, _crypto_1.randomIntAsync)(1, 16381);
 }

package/dist/signal/registration/utils.js

@@ -2,7 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAndStoreInitialKeys = createAndStoreInitialKeys;
 const keygen_1 = require("../registration/keygen");
-async function createAndStoreInitialKeys(store) {
+/**
+ * Bootstraps a fresh Signal identity: generates registration info, the first
+ * signed prekey, and the first one-time prekey, then persists them in order
+ * so a partial commit can never split bootstrap state.
+ */
+async function createAndStoreInitialKeys(store, preKeyStore) {
     const [registrationInfo, firstPreKey] = await Promise.all([
         (0, keygen_1.generateRegistrationInfo)(),
         (0, keygen_1.generatePreKeyPair)(1)
@@ -11,7 +16,8 @@ async function createAndStoreInitialKeys(store) {
     // Keep writes ordered so partial commit failures don't leave split registration bootstrap state.
     await store.setRegistrationInfo(registrationInfo);
     await store.setSignedPreKey(signedPreKey);
-    await store.getOrGenSinglePreKey(async () => firstPreKey);
+    // eslint-disable-next-line @typescript-eslint/require-await
+    await preKeyStore.getOrGenSinglePreKey(async () => firstPreKey);
     return {
         registrationInfo,
         signedPreKey,

package/dist/signal/session/SignalProtocol.js

@@ -4,27 +4,38 @@ exports.SignalProtocol = void 0;
 const _crypto_1 = require("../../crypto/index.js");
 const ConsoleLogger_1 = require("../../infra/log/ConsoleLogger");
 const StoreLock_1 = require("../../infra/perf/StoreLock");
+const jid_1 = require("../../protocol/jid");
 const constants_1 = require("../constants");
+const encoding_1 = require("../session/encoding");
 const SignalRatchet_1 = require("../session/SignalRatchet");
 const SignalSerializer_1 = require("../session/SignalSerializer");
 const SignalSession_1 = require("../session/SignalSession");
 const bytes_1 = require("../../util/bytes");
-function signalAddressMapKey(address) {
-    return `${address.user}\u0001${address.server ?? ''}\u0001${address.device}`;
-}
 function signalAddressLockKey(address) {
-    return `signal:${signalAddressMapKey(address)}`;
+    return `signal:${(0, jid_1.signalAddressKey)(address)}`;
 }
+/**
+ * High-level Signal protocol session orchestrator: establishes outgoing
+ * sessions from prekey bundles, encrypts/decrypts ratchet messages, and owns
+ * the per-address session mutation lock.
+ */
 class SignalProtocol {
-    constructor(store, logger = new ConsoleLogger_1.ConsoleLogger('info')) {
-        this.store = store;
+    constructor(stores, logger = new ConsoleLogger_1.ConsoleLogger('info')) {
+        this.stores = stores;
         this.logger = logger;
         this.sessionMutationLock = new StoreLock_1.StoreLock();
     }
+    /**
+     * Builds an outgoing Signal session against a remote prekey bundle. Set
+     * `options.reuseExisting` to skip the handshake when a session already
+     * exists for the same remote identity. Set `options.knownAbsent` only
+     * when the caller already proved (within the same logical step) that no
+     * session exists; it skips the in-lock recheck and forces a new handshake.
+     */
     async establishOutgoingSession(address, remoteBundle, options = {}) {
         return this.runWithAddressLock(address, async () => {
-            if (options.reuseExisting) {
-                const existing = await this.store.getSession(address);
+            if (options.reuseExisting && !options.knownAbsent) {
+                const existing = await this.stores.session.getSession(address);
                 if (existing) {
                     const remoteIdentity = (0, _crypto_1.toSerializedPubKey)(remoteBundle.identity);
                     if (!(0, bytes_1.uint8Equal)(existing.remote.pubKey, remoteIdentity)) {
@@ -34,22 +45,110 @@ class SignalProtocol {
                 }
             }
             const [local, localOneTimeBase] = await Promise.all([
-                (0, SignalSession_1.requireLocalIdentity)(this.store),
+                (0, SignalSession_1.requireLocalIdentity)(this.stores.signal),
                 (0, SignalSession_1.generateSerializedKeyPair)()
             ]);
             const session = await (0, SignalSession_1.initiateSessionOutgoing)(local, remoteBundle, localOneTimeBase);
             // Keep writes ordered: a stored session without matching remote identity causes false mismatch checks.
-            await this.store.setRemoteIdentity(address, session.remote.pubKey);
-            await this.store.setSession(address, session);
+            await this.stores.identity.setRemoteIdentity(address, session.remote.pubKey);
+            await this.stores.session.setSession(address, session);
             return session;
         });
     }
+    /**
+     * Compute an outgoing session under the per-address lock without
+     * persisting. Caller batches results and persists via
+     * {@link persistOutgoingSessionsBatch} to collapse N `setRemoteIdentity`
+     * + `setSession` round-trips into one bulk write per store.
+     */
+    async prepareOutgoingSession(address, remoteBundle, options = {}) {
+        return this.runWithAddressLock(address, async () => {
+            if (options.reuseExisting && !options.knownAbsent) {
+                const existing = await this.stores.session.getSession(address);
+                if (existing) {
+                    const remoteIdentity = (0, _crypto_1.toSerializedPubKey)(remoteBundle.identity);
+                    if (!(0, bytes_1.uint8Equal)(existing.remote.pubKey, remoteIdentity)) {
+                        throw new Error('identity mismatch');
+                    }
+                    return {
+                        session: existing,
+                        remoteIdentity: existing.remote.pubKey,
+                        reusedExisting: true
+                    };
+                }
+            }
+            const [local, localOneTimeBase] = await Promise.all([
+                (0, SignalSession_1.requireLocalIdentity)(this.stores.signal),
+                (0, SignalSession_1.generateSerializedKeyPair)()
+            ]);
+            const session = await (0, SignalSession_1.initiateSessionOutgoing)(local, remoteBundle, localOneTimeBase);
+            return {
+                session,
+                remoteIdentity: session.remote.pubKey,
+                reusedExisting: false
+            };
+        });
+    }
+    /**
+     * Persist prepared outgoing sessions while holding every per-address
+     * lock (same discipline as {@link encryptMessagesBatch}). Re-reads
+     * sessions inside the lock; defers to a concurrent writer's session
+     * when identities agree to avoid clobbering a fresher ratchet advance,
+     * and reports identity conflicts via `skipped`.
+     */
+    async persistOutgoingSessionsBatch(entries) {
+        if (entries.length === 0)
+            return { resolved: [], skipped: [] };
+        const lockKeys = new Array(entries.length);
+        for (let i = 0; i < entries.length; i += 1) {
+            lockKeys[i] = signalAddressLockKey(entries[i].address);
+        }
+        return this.sessionMutationLock.runMany(lockKeys, async () => {
+            const addresses = entries.map((e) => e.address);
+            const existingSessions = await this.stores.session.getSessionsBatch(addresses);
+            const identityUpdates = [];
+            const sessionUpdates = [];
+            const resolved = [];
+            const skipped = [];
+            for (let i = 0; i < entries.length; i += 1) {
+                const entry = entries[i];
+                const existing = existingSessions[i];
+                if (existing) {
+                    if ((0, bytes_1.uint8Equal)(existing.remote.pubKey, entry.remoteIdentity)) {
+                        resolved.push({ address: entry.address, session: existing });
+                        continue;
+                    }
+                    skipped.push({ address: entry.address, reason: 'identity-mismatch' });
+                    continue;
+                }
+                identityUpdates.push({
+                    address: entry.address,
+                    identityKey: entry.remoteIdentity
+                });
+                sessionUpdates.push({ address: entry.address, session: entry.session });
+                resolved.push({ address: entry.address, session: entry.session });
+            }
+            if (identityUpdates.length > 0) {
+                await this.stores.identity.setRemoteIdentities(identityUpdates);
+            }
+            if (sessionUpdates.length > 0) {
+                await this.stores.session.setSessionsBatch(sessionUpdates);
+            }
+            return { resolved, skipped };
+        });
+    }
+    /**
+     * Encrypts `plaintext` for `address`. Returns `pkmsg` when this is the
+     * first message of the session, `msg` otherwise. `expectedIdentity`
+     * enforces identity continuity.
+     */
     async encryptMessage(address, plaintext, expectedIdentity) {
         const [encrypted] = await this.encryptMessagesBatch([
             { address, plaintext, expectedIdentity }
         ]);
         return encrypted;
     }
+    /** Batch variant of {@link encryptMessage} that shares per-address locks. */
     async encryptMessagesBatch(requests, prefetchedSessions) {
         if (requests.length === 0) {
             return [];
@@ -63,7 +162,7 @@ class SignalProtocol {
             if (prefetchedSessions && prefetchedSessions.length > 0) {
                 for (let index = 0; index < prefetchedSessions.length; index += 1) {
                     const entry = prefetchedSessions[index];
-                    prefetchedByAddress.set(signalAddressMapKey(entry.address), entry.session);
+                    prefetchedByAddress.set((0, jid_1.signalAddressKey)(entry.address), entry.session);
                 }
             }
             const uniqueAddressKeys = new Array(requests.length);
@@ -71,7 +170,7 @@ class SignalProtocol {
             let uniqueAddressCount = 0;
             for (let index = 0; index < requests.length; index += 1) {
                 const address = requests[index].address;
-                const addressKey = signalAddressMapKey(address);
+                const addressKey = (0, jid_1.signalAddressKey)(address);
                 let isDuplicate = false;
                 for (let dedupIndex = 0; dedupIndex < uniqueAddressCount; dedupIndex += 1) {
                     if (uniqueAddressKeys[dedupIndex] === addressKey) {
@@ -88,7 +187,7 @@ class SignalProtocol {
             }
             uniqueAddressKeys.length = uniqueAddressCount;
             uniqueAddresses.length = uniqueAddressCount;
-            const currentSessions = await this.store.getSessionsBatch(uniqueAddresses);
+            const currentSessions = await this.stores.session.getSessionsBatch(uniqueAddresses);
             const latestSessionByAddress = new Map();
             for (let index = 0; index < uniqueAddressCount; index += 1) {
                 const addressKey = uniqueAddressKeys[index];
@@ -108,7 +207,7 @@ class SignalProtocol {
             for (let index = 0; index < requests.length; index += 1) {
                 const request = requests[index];
                 const address = request.address;
-                const addressKey = signalAddressMapKey(address);
+                const addressKey = (0, jid_1.signalAddressKey)(address);
                 const session = latestSessionByAddress.get(addressKey);
                 if (!session) {
                     throw new Error('signal session not found');
@@ -142,7 +241,7 @@ class SignalProtocol {
                     identityUpdates[identityIndex] = update;
                     identityIndex += 1;
                 }
-                await this.store.setRemoteIdentities(identityUpdates);
+                await this.stores.identity.setRemoteIdentities(identityUpdates);
             }
             const sessionUpdates = new Array(sessionUpdatesByAddress.size);
             let sessionIndex = 0;
@@ -150,13 +249,17 @@ class SignalProtocol {
                 sessionUpdates[sessionIndex] = update;
                 sessionIndex += 1;
             }
-            await this.store.setSessionsBatch(sessionUpdates);
+            await this.stores.session.setSessionsBatch(sessionUpdates);
             return results;
         });
     }
+    /**
+     * Decrypts a Signal message (`msg` or `pkmsg`) from `address`. For
+     * `pkmsg`, instantiates the session from the embedded bundle when needed.
+     */
     async decryptMessage(address, envelope) {
         return this.runWithAddressLock(address, async () => {
-            const currentSession = await this.store.getSession(address);
+            const currentSession = await this.stores.session.getSession(address);
             let outcome;
             if (envelope.type === 'pkmsg') {
                 const parsedPk = (0, SignalSerializer_1.deserializePkMsg)(envelope.ciphertext);
@@ -175,9 +278,9 @@ class SignalProtocol {
             const identityChanged = !currentSession || !(0, bytes_1.uint8Equal)(currentSession.remote.pubKey, nextRemoteIdentity);
             // Keep writes ordered for consistency with resolver identity checks.
             if (identityChanged) {
-                await this.store.setRemoteIdentity(address, nextRemoteIdentity);
+                await this.stores.identity.setRemoteIdentity(address, nextRemoteIdentity);
             }
-            await this.store.setSession(address, outcome.updatedSession);
+            await this.stores.session.setSession(address, outcome.updatedSession);
             return outcome.plaintext;
         });
     }
@@ -195,11 +298,11 @@ class SignalProtocol {
             };
         }
         const [local, signedPreKey, oneTimePreKey] = await Promise.all([
-            (0, SignalSession_1.requireLocalIdentity)(this.store),
-            (0, SignalSerializer_1.requireSignedPreKey)(this.store, parsed.localSignedPreKeyId),
+            (0, SignalSession_1.requireLocalIdentity)(this.stores.signal),
+            (0, SignalSerializer_1.requireSignedPreKey)(this.stores.signal, parsed.localSignedPreKeyId),
             parsed.localOneTimeKeyId === null || parsed.localOneTimeKeyId === undefined
                 ? Promise.resolve(null)
-                : (0, SignalSerializer_1.requirePreKey)(this.store, parsed.localOneTimeKeyId)
+                : (0, SignalSerializer_1.requirePreKey)(this.stores.preKey, parsed.localOneTimeKeyId)
         ]);
         const incoming = await (0, SignalSession_1.initiateSessionIncoming)(local, parsed.remote, parsed.sessionBaseKey, {
             signed: (0, SignalSession_1.toSerializedKeyPair)(signedPreKey.keyPair),
@@ -213,7 +316,7 @@ class SignalProtocol {
             ? {
                 ...incoming,
                 prevSessions: [
-                    (0, SignalSession_1.detachSession)(currentSession),
+                    (0, encoding_1.encodeSignalSessionSnapshot)(currentSession),
                     ...currentSession.prevSessions.slice(0, constants_1.MAX_PREV_SESSIONS - 1)
                 ]
             }
@@ -221,7 +324,7 @@ class SignalProtocol {
         const [updatedSession, plaintext] = await (0, SignalRatchet_1.decryptMsgFromSession)(baseSession, parsed);
         // Only consume one-time prekeys after successful decrypt/session materialization.
         if (parsed.localOneTimeKeyId !== null && parsed.localOneTimeKeyId !== undefined) {
-            await this.store.consumePreKeyById(parsed.localOneTimeKeyId);
+            await this.stores.preKey.consumePreKeyById(parsed.localOneTimeKeyId);
         }
         return {
             updatedSession,