zapo-js 0.2.0 → 1.0.0

package/dist/signal/session/SignalRatchet.js

@@ -1,6 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.splitMsgKey = splitMsgKey;
 exports.deriveMsgKey = deriveMsgKey;
 exports.selectMessageKey = selectMessageKey;
 exports.encryptMsg = encryptMsg;
@@ -9,6 +8,7 @@ exports.decryptMsgFromSession = decryptMsgFromSession;
 const _crypto_1 = require("../../crypto/index.js");
 const _proto_1 = require("../../proto.js");
 const constants_1 = require("../constants");
+const encoding_1 = require("../session/encoding");
 const SignalSession_1 = require("../session/SignalSession");
 const bytes_1 = require("../../util/bytes");
 const primitives_1 = require("../../util/primitives");
@@ -24,14 +24,10 @@ function splitMsgKey(index, bytes) {
         iv: bytes.subarray(64, 80)
     };
 }
-async function deriveMsgKey(index, chainKey) {
-    const state = await createDerivedChainState(chainKey);
-    const derived = await deriveMsgKeyFromState(index, state);
-    return {
-        nextChainKey: derived.nextState.chainKey,
-        messageKey: derived.messageKey
-    };
+function deriveMsgKey(index, chainKey) {
+    return deriveMsgKeyFromChainKey(index, chainKey);
 }
+// eslint-disable-next-line @typescript-eslint/require-await
 async function selectMessageKey(chain, targetCounter) {
     const delta = targetCounter - chain.nextMsgIndex;
     if (delta > constants_1.FUTURE_MESSAGES_MAX) {
@@ -43,7 +39,7 @@ async function selectMessageKey(chain, targetCounter) {
         if (idx === -1) {
             throw new Error('duplicate message');
         }
-        const messageKey = unused[idx];
+        const messageKey = (0, encoding_1.decodeSignalMessageKey)(unused[idx], `unusedMsgKeys[${idx}]`);
         const nextUnused = (0, bytes_1.removeAt)(unused, idx);
         return {
             messageKey,
@@ -55,17 +51,17 @@ async function selectMessageKey(chain, targetCounter) {
             }
         };
     }
-    let chainState = await createDerivedChainState(chain.chainKey);
-    const first = await deriveMsgKeyFromState(chain.nextMsgIndex, chainState);
+    let chainKey = chain.chainKey;
+    const first = deriveMsgKeyFromChainKey(chain.nextMsgIndex, chainKey);
     let currentMessageKey = first.messageKey;
-    chainState = first.nextState;
+    chainKey = first.nextChainKey;
     if (delta === 0) {
         return {
             messageKey: currentMessageKey,
             updatedChain: {
                 ratchetPubKey: chain.ratchetPubKey,
                 nextMsgIndex: targetCounter + 1,
-                chainKey: chainState.chainKey,
+                chainKey,
                 unusedMsgKeys: unused
             }
         };
@@ -81,55 +77,41 @@ async function selectMessageKey(chain, targetCounter) {
             overflow -= 1;
         }
         else {
-            nextUnused.push(currentMessageKey);
+            nextUnused.push({
+                index: currentMessageKey.index,
+                cipherKey: currentMessageKey.cipherKey,
+                macKey: currentMessageKey.macKey,
+                iv: currentMessageKey.iv
+            });
         }
-        const derived = await deriveMsgKeyFromState(counter, chainState);
+        const derived = deriveMsgKeyFromChainKey(counter, chainKey);
         currentMessageKey = derived.messageKey;
-        chainState = derived.nextState;
+        chainKey = derived.nextChainKey;
     }
     return {
         messageKey: currentMessageKey,
         updatedChain: {
             ratchetPubKey: chain.ratchetPubKey,
             nextMsgIndex: targetCounter + 1,
-            chainKey: chainState.chainKey,
+            chainKey,
             unusedMsgKeys: nextUnused
         }
     };
 }
-async function createDerivedChainState(chainKey) {
-    return {
-        chainKey,
-        hmacKey: await (0, _crypto_1.importHmacKey)(chainKey)
-    };
-}
-async function deriveMsgKeyFromState(index, state) {
-    const nextChainRawPromise = (0, _crypto_1.hmacSign)(state.hmacKey, constants_1.CHAIN_KEY_LABEL);
-    const messageInputKeyPromise = (0, _crypto_1.hmacSign)(state.hmacKey, constants_1.MESSAGE_KEY_LABEL);
-    const [nextChainRaw, messageInputKey] = await Promise.all([
-        nextChainRawPromise,
-        messageInputKeyPromise
-    ]);
+function deriveMsgKeyFromChainKey(index, chainKey) {
+    const nextChainRaw = (0, _crypto_1.hmacSha256Sign)(chainKey, constants_1.CHAIN_KEY_LABEL);
+    const messageInputKey = (0, _crypto_1.hmacSha256Sign)(chainKey, constants_1.MESSAGE_KEY_LABEL);
     const nextChainKey = nextChainRaw.subarray(0, 32);
-    const [nextHmacKey, expanded] = await Promise.all([
-        (0, _crypto_1.importHmacKey)(nextChainKey),
-        (0, _crypto_1.hkdf)(messageInputKey, null, 'WhisperMessageKeys', 80)
-    ]);
+    const expanded = (0, _crypto_1.hkdf)(messageInputKey, null, constants_1.WHISPER_MESSAGE_KEYS_INFO, 80);
     return {
-        nextState: {
-            chainKey: nextChainKey,
-            hmacKey: nextHmacKey
-        },
+        nextChainKey,
         messageKey: splitMsgKey(index, expanded)
     };
 }
+// eslint-disable-next-line @typescript-eslint/require-await
 async function encryptMsg(session, plaintext) {
-    const { nextChainKey, messageKey } = await deriveMsgKey(session.sendChain.nextMsgIndex, session.sendChain.chainKey);
-    const [cipherKey, macKey] = await Promise.all([
-        (0, _crypto_1.importAesCbcKey)(messageKey.cipherKey),
-        (0, _crypto_1.importHmacKey)(messageKey.macKey)
-    ]);
-    const ciphertext = await (0, _crypto_1.aesCbcEncrypt)(cipherKey, messageKey.iv, plaintext);
+    const { nextChainKey, messageKey } = deriveMsgKey(session.sendChain.nextMsgIndex, session.sendChain.chainKey);
+    const ciphertext = (0, _crypto_1.aesCbcEncrypt)(messageKey.cipherKey, messageKey.iv, plaintext);
     const signalPayload = _proto_1.proto.SignalMessage.encode({
         ratchetKey: session.sendChain.ratchetKey.pubKey,
         counter: messageKey.index,
@@ -137,12 +119,11 @@ async function encryptMsg(session, plaintext) {
         ciphertext
     }).finish();
     const versionedSignalPayload = (0, _crypto_1.prependVersion)(signalPayload, constants_1.SIGNAL_VERSION);
-    const macInput = (0, bytes_1.concatBytes)([
+    const mac = (0, _crypto_1.hmacSha256Sign)(messageKey.macKey, [
         session.local.pubKey,
         session.remote.pubKey,
         versionedSignalPayload
     ]);
-    const mac = await (0, _crypto_1.hmacSign)(macKey, macInput);
     const signalMessage = (0, bytes_1.concatBytes)([versionedSignalPayload, mac.subarray(0, constants_1.SIGNAL_MAC_SIZE)]);
     let type = 'msg';
     let output = signalMessage;
@@ -182,13 +163,14 @@ async function decryptMsg(session, parsed, onPrevSessionDecryptError) {
     }
     catch (error) {
         for (let i = 0; i < session.prevSessions.length; i += 1) {
-            const prevSession = (0, SignalSession_1.snapshotToRecord)(session.prevSessions[i]);
+            const decodedPrev = (0, encoding_1.decodeSignalSessionSnapshot)(session.prevSessions[i], `prevSessions[${i}]`);
+            const prevSession = (0, SignalSession_1.snapshotToRecord)(decodedPrev);
             try {
                 const [updatedPrev, plaintext] = await decryptMsgFromSession(prevSession, parsed);
                 const updatedSession = {
                     ...updatedPrev,
                     prevSessions: [
-                        (0, SignalSession_1.detachSession)(session),
+                        (0, encoding_1.encodeSignalSessionSnapshot)(session),
                         ...session.prevSessions.slice(0, i),
                         ...session.prevSessions.slice(i + 1)
                     ]
@@ -215,7 +197,10 @@ async function decryptMsg(session, parsed, onPrevSessionDecryptError) {
 }
 async function decryptMsgFromSession(session, message) {
     const ratchetPubKey = (0, _crypto_1.toSerializedPubKey)(message.ratchetPubKey);
-    const recvChainIndex = session.recvChains.findIndex((entry) => (0, bytes_1.uint8Equal)(entry.ratchetPubKey, ratchetPubKey));
+    const recvChainIndex = session.recvChains.findIndex((raw) => {
+        const key = raw.senderRatchetKey;
+        return key !== null && key !== undefined && (0, bytes_1.uint8Equal)(key, ratchetPubKey);
+    });
     let selectedMessageKey;
     let updatedSession;
     if (recvChainIndex === -1) {
@@ -233,7 +218,7 @@ async function decryptMsgFromSession(session, message) {
         selectedMessageKey = selected.messageKey;
         const sendRatchet = await (0, SignalSession_1.calculateRatchet)(recvRatchet.rootKey, newSendRatchet, ratchetPubKey);
         const nextRecvChains = session.recvChains.slice(-MAX_TRACKED_RECV_CHAINS);
-        nextRecvChains.push(selected.updatedChain);
+        nextRecvChains.push((0, encoding_1.encodeSignalRecvChain)(selected.updatedChain));
         updatedSession = {
             ...session,
             rootKey: sendRatchet.rootKey,
@@ -248,30 +233,26 @@ async function decryptMsgFromSession(session, message) {
         };
     }
     else {
-        const selected = await selectMessageKey(session.recvChains[recvChainIndex], message.counter);
+        const decoded = (0, encoding_1.decodeSignalRecvChain)(session.recvChains[recvChainIndex], `recvChains[${recvChainIndex}]`);
+        const selected = await selectMessageKey(decoded, message.counter);
         selectedMessageKey = selected.messageKey;
         const nextRecvChains = session.recvChains.slice();
-        nextRecvChains[recvChainIndex] = selected.updatedChain;
+        nextRecvChains[recvChainIndex] = (0, encoding_1.encodeSignalRecvChain)(selected.updatedChain);
         updatedSession = {
             ...session,
             recvChains: nextRecvChains
         };
     }
-    const [cipherKey, macKey] = await Promise.all([
-        (0, _crypto_1.importAesCbcKey)(selectedMessageKey.cipherKey),
-        (0, _crypto_1.importHmacKey)(selectedMessageKey.macKey)
-    ]);
     const payloadWithoutMac = message.versionContentMac.subarray(0, message.versionContentMac.length - constants_1.SIGNAL_MAC_SIZE);
-    const expectedMacInput = (0, bytes_1.concatBytes)([
+    const expectedMac = (0, _crypto_1.hmacSha256Sign)(selectedMessageKey.macKey, [
         session.remote.pubKey,
         session.local.pubKey,
         payloadWithoutMac
     ]);
-    const expectedMac = await (0, _crypto_1.hmacSign)(macKey, expectedMacInput);
     const receivedMac = message.versionContentMac.subarray(message.versionContentMac.length - constants_1.SIGNAL_MAC_SIZE);
-    if (!(0, bytes_1.uint8Equal)(expectedMac.subarray(0, constants_1.SIGNAL_MAC_SIZE), receivedMac)) {
+    if (!(0, bytes_1.uint8TimingSafeEqual)(expectedMac.subarray(0, constants_1.SIGNAL_MAC_SIZE), receivedMac)) {
         throw new Error('invalid message mac');
     }
-    const plaintext = await (0, _crypto_1.aesCbcDecrypt)(cipherKey, selectedMessageKey.iv, message.ciphertext);
+    const plaintext = (0, _crypto_1.aesCbcDecrypt)(selectedMessageKey.cipherKey, selectedMessageKey.iv, message.ciphertext);
     return [updatedSession, plaintext];
 }

package/dist/signal/session/SignalSerializer.js

@@ -7,7 +7,6 @@ exports.requirePreKey = requirePreKey;
 const _crypto_1 = require("../../crypto/index.js");
 const _proto_1 = require("../../proto.js");
 const constants_1 = require("../constants");
-const bytes_1 = require("../../util/bytes");
 function deserializeMsg(versionContentMac) {
     const content = (0, _crypto_1.readVersionedContent)(versionContentMac, constants_1.SIGNAL_VERSION, constants_1.SIGNAL_MAC_SIZE);
     const parsed = _proto_1.proto.SignalMessage.decode(content);
@@ -20,9 +19,9 @@ function deserializeMsg(versionContentMac) {
         throw new Error('invalid signal message');
     }
     return {
-        ratchetPubKey: (0, _crypto_1.toSerializedPubKey)((0, bytes_1.toBytesView)(parsed.ratchetKey)),
+        ratchetPubKey: (0, _crypto_1.toSerializedPubKey)(parsed.ratchetKey),
         counter: parsed.counter,
-        ciphertext: (0, bytes_1.toBytesView)(parsed.ciphertext),
+        ciphertext: parsed.ciphertext,
         versionContentMac
     };
 }
@@ -41,14 +40,14 @@ function deserializePkMsg(versionContent) {
         parsed.message === undefined) {
         throw new Error('invalid prekey signal message');
     }
-    const signal = deserializeMsg((0, bytes_1.toBytesView)(parsed.message));
+    const signal = deserializeMsg(parsed.message);
     return {
         ...signal,
         remote: {
             regId: parsed.registrationId,
-            pubKey: (0, _crypto_1.toSerializedPubKey)((0, bytes_1.toBytesView)(parsed.identityKey))
+            pubKey: (0, _crypto_1.toSerializedPubKey)(parsed.identityKey)
         },
-        sessionBaseKey: (0, _crypto_1.toSerializedPubKey)((0, bytes_1.toBytesView)(parsed.baseKey)),
+        sessionBaseKey: (0, _crypto_1.toSerializedPubKey)(parsed.baseKey),
         localSignedPreKeyId: parsed.signedPreKeyId,
         localOneTimeKeyId: parsed.preKeyId ?? null
     };

package/dist/signal/session/SignalSession.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.snapshotToRecord = snapshotToRecord;
-exports.detachSession = detachSession;
 exports.findMatchingSession = findMatchingSession;
 exports.requireLocalIdentity = requireLocalIdentity;
 exports.initiateSessionOutgoing = initiateSessionOutgoing;
@@ -12,6 +11,7 @@ exports.toSerializedKeyPair = toSerializedKeyPair;
 exports.ecdh = ecdh;
 const _crypto_1 = require("../../crypto/index.js");
 const constants_1 = require("../constants");
+const encoding_1 = require("../session/encoding");
 const bytes_1 = require("../../util/bytes");
 function snapshotToRecord(snapshot) {
     return {
@@ -19,11 +19,6 @@ function snapshotToRecord(snapshot) {
         prevSessions: []
     };
 }
-function detachSession(session) {
-    const { prevSessions, ...snapshot } = session;
-    void prevSessions;
-    return snapshot;
-}
 function findMatchingSession(session, sessionBaseKey) {
     if (!session) {
         return null;
@@ -33,19 +28,19 @@ function findMatchingSession(session, sessionBaseKey) {
         return session;
     }
     for (let index = 0; index < session.prevSessions.length; index += 1) {
-        const previousSession = session.prevSessions[index];
-        if (!previousSession.aliceBaseKey ||
-            !(0, bytes_1.uint8Equal)(previousSession.aliceBaseKey, serializedBaseKey)) {
+        const rawPrev = session.prevSessions[index];
+        if (!rawPrev.aliceBaseKey || !(0, bytes_1.uint8Equal)(rawPrev.aliceBaseKey, serializedBaseKey)) {
             continue;
         }
-        const prevSessions = [detachSession(session)];
+        const decoded = (0, encoding_1.decodeSignalSessionSnapshot)(rawPrev, `prevSessions[${index}]`);
+        const prevSessions = [(0, encoding_1.encodeSignalSessionSnapshot)(session)];
         for (let i = 0; i < session.prevSessions.length; i += 1) {
             if (i !== index) {
                 prevSessions.push(session.prevSessions[i]);
             }
         }
         return {
-            ...previousSession,
+            ...decoded,
             prevSessions
         };
     }
@@ -83,12 +78,11 @@ async function initiateSessionOutgoing(local, remoteBundle, localOneTimeBase) {
         baseDh,
         ...(oneTimeDh ? [oneTimeDh] : [])
     ]);
-    const [rootKey, chainKey] = await (0, _crypto_1.hkdfSplit)(secret, null, 'WhisperText');
+    const [rootKey, chainKey] = (0, _crypto_1.hkdfSplit)(secret, null, constants_1.WHISPER_TEXT_INFO);
     const recvChain = {
-        ratchetPubKey: remoteRatchetKey,
-        nextMsgIndex: 0,
-        chainKey,
-        unusedMsgKeys: []
+        senderRatchetKey: remoteRatchetKey,
+        chainKey: { index: 0, key: chainKey },
+        messageKeys: []
     };
     const sendRatchet = await generateSerializedKeyPair();
     const sendRatchetResult = await calculateRatchet(rootKey, sendRatchet, remoteRatchetKey);
@@ -130,7 +124,7 @@ async function initiateSessionIncoming(local, remote, sessionBaseKey, localKeys)
         signedDh,
         ...(oneTimeDh ? [oneTimeDh] : [])
     ]);
-    const [rootKey, chainKey] = await (0, _crypto_1.hkdfSplit)(secret, null, 'WhisperText');
+    const [rootKey, chainKey] = (0, _crypto_1.hkdfSplit)(secret, null, constants_1.WHISPER_TEXT_INFO);
     return {
         local: { regId: local.regId, pubKey: local.staticKeyPair.pubKey },
         remote: { regId: remote.regId, pubKey: remotePub },
@@ -149,7 +143,7 @@ async function initiateSessionIncoming(local, remote, sessionBaseKey, localKeys)
 }
 async function calculateRatchet(rootKey, localRatchet, remoteRatchetPubKey) {
     const sharedSecret = await ecdh(localRatchet.privKey, remoteRatchetPubKey);
-    const [nextRootKey, chainKey] = await (0, _crypto_1.hkdfSplit)(sharedSecret, rootKey, 'WhisperRatchet');
+    const [nextRootKey, chainKey] = (0, _crypto_1.hkdfSplit)(sharedSecret, rootKey, constants_1.WHISPER_RATCHET_INFO);
     return {
         rootKey: nextRootKey,
         chainKey
@@ -166,5 +160,5 @@ function toSerializedKeyPair(pair) {
     };
 }
 async function ecdh(privateKey, publicKey) {
-    return _crypto_1.X25519.scalarMult(privateKey, (0, _crypto_1.toRawPubKey)(publicKey));
+    return await _crypto_1.X25519.scalarMult(privateKey, (0, _crypto_1.toRawPubKey)(publicKey));
 }

package/dist/signal/session/encoding.js

@@ -0,0 +1,183 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeSignalSessionSnapshot = encodeSignalSessionSnapshot;
+exports.encodeSignalRecvChain = encodeSignalRecvChain;
+exports.decodeSignalMessageKey = decodeSignalMessageKey;
+exports.decodeSignalRecvChain = decodeSignalRecvChain;
+exports.decodeSignalSessionSnapshot = decodeSignalSessionSnapshot;
+exports.encodeSignalSessionRecord = encodeSignalSessionRecord;
+exports.decodeSignalSessionRecord = decodeSignalSessionRecord;
+exports.decodeSignalRemoteIdentity = decodeSignalRemoteIdentity;
+const _proto_1 = require("../../proto.js");
+const bytes_1 = require("../../util/bytes");
+const coercion_1 = require("../../util/coercion");
+function encodeSignalSessionSnapshot(session) {
+    return {
+        sessionVersion: 3,
+        localRegistrationId: session.local.regId,
+        localIdentityPublic: session.local.pubKey,
+        remoteRegistrationId: session.remote.regId,
+        remoteIdentityPublic: session.remote.pubKey,
+        rootKey: session.rootKey,
+        previousCounter: session.prevSendChainHighestIndex,
+        senderChain: encodeSignalSendChain(session.sendChain),
+        receiverChains: session.recvChains,
+        pendingPreKey: session.initialExchangeInfo
+            ? {
+                preKeyId: session.initialExchangeInfo.remoteOneTimeId ?? undefined,
+                signedPreKeyId: session.initialExchangeInfo.remoteSignedId,
+                baseKey: session.initialExchangeInfo.localOneTimePubKey
+            }
+            : undefined,
+        aliceBaseKey: session.aliceBaseKey ?? undefined
+    };
+}
+function encodeSignalSendChain(chain) {
+    return {
+        senderRatchetKey: chain.ratchetKey.pubKey,
+        senderRatchetKeyPrivate: chain.ratchetKey.privKey,
+        chainKey: {
+            index: chain.nextMsgIndex,
+            key: chain.chainKey
+        },
+        messageKeys: []
+    };
+}
+function encodeSignalRecvChain(chain) {
+    return {
+        senderRatchetKey: chain.ratchetPubKey,
+        chainKey: {
+            index: chain.nextMsgIndex,
+            key: chain.chainKey
+        },
+        messageKeys: chain.unusedMsgKeys
+    };
+}
+function decodeSignalMessageKey(messageKey, field) {
+    const cipherKey = (0, coercion_1.asBytes)(messageKey.cipherKey, `${field}.cipherKey`);
+    (0, bytes_1.assertByteLength)(cipherKey, 32, `invalid ${field}.cipherKey length ${cipherKey.byteLength}`);
+    const macKey = (0, coercion_1.asBytes)(messageKey.macKey, `${field}.macKey`);
+    (0, bytes_1.assertByteLength)(macKey, 32, `invalid ${field}.macKey length ${macKey.byteLength}`);
+    const iv = (0, coercion_1.asBytes)(messageKey.iv, `${field}.iv`);
+    (0, bytes_1.assertByteLength)(iv, 16, `invalid ${field}.iv length ${iv.byteLength}`);
+    return {
+        index: (0, coercion_1.asNumber)(messageKey.index, `${field}.index`),
+        cipherKey,
+        macKey,
+        iv
+    };
+}
+function decodeSignalRecvChain(chain, field) {
+    const chainKey = chain.chainKey;
+    if (!chainKey) {
+        throw new Error(`missing ${field}.chainKey`);
+    }
+    const ratchetPubKey = (0, coercion_1.asBytes)(chain.senderRatchetKey, `${field}.senderRatchetKey`);
+    (0, bytes_1.assertByteLength)(ratchetPubKey, 33, `invalid ${field}.senderRatchetKey length ${ratchetPubKey.byteLength}`);
+    const chainKeyBytes = (0, coercion_1.asBytes)(chainKey.key, `${field}.chainKey.key`);
+    (0, bytes_1.assertByteLength)(chainKeyBytes, 32, `invalid ${field}.chainKey.key length ${chainKeyBytes.byteLength}`);
+    return {
+        ratchetPubKey,
+        nextMsgIndex: (0, coercion_1.asNumber)(chainKey.index, `${field}.chainKey.index`),
+        chainKey: chainKeyBytes,
+        unusedMsgKeys: chain.messageKeys ?? []
+    };
+}
+function decodeSignalSendChain(chain, field) {
+    const chainKey = chain.chainKey;
+    if (!chainKey) {
+        throw new Error(`missing ${field}.chainKey`);
+    }
+    const privateKey = (0, coercion_1.asOptionalBytes)(chain.senderRatchetKeyPrivate, `${field}.senderRatchetKeyPrivate`);
+    if (!privateKey) {
+        throw new Error(`missing ${field}.senderRatchetKeyPrivate`);
+    }
+    (0, bytes_1.assertByteLength)(privateKey, 32, `invalid ${field}.senderRatchetKeyPrivate length ${privateKey.byteLength}`);
+    const ratchetPubKey = (0, coercion_1.asBytes)(chain.senderRatchetKey, `${field}.senderRatchetKey`);
+    (0, bytes_1.assertByteLength)(ratchetPubKey, 33, `invalid ${field}.senderRatchetKey length ${ratchetPubKey.byteLength}`);
+    const chainKeyBytes = (0, coercion_1.asBytes)(chainKey.key, `${field}.chainKey.key`);
+    (0, bytes_1.assertByteLength)(chainKeyBytes, 32, `invalid ${field}.chainKey.key length ${chainKeyBytes.byteLength}`);
+    return {
+        ratchetKey: {
+            pubKey: ratchetPubKey,
+            privKey: privateKey
+        },
+        nextMsgIndex: (0, coercion_1.asNumber)(chainKey.index, `${field}.chainKey.index`),
+        chainKey: chainKeyBytes
+    };
+}
+function decodeSignalSessionSnapshot(session, field) {
+    const senderChain = session.senderChain;
+    if (!senderChain) {
+        throw new Error(`missing ${field}.senderChain`);
+    }
+    const pendingPreKey = session.pendingPreKey;
+    const localPubKey = (0, coercion_1.asBytes)(session.localIdentityPublic, `${field}.localIdentityPublic`);
+    (0, bytes_1.assertByteLength)(localPubKey, 33, `invalid ${field}.localIdentityPublic length ${localPubKey.byteLength}`);
+    const remotePubKey = (0, coercion_1.asBytes)(session.remoteIdentityPublic, `${field}.remoteIdentityPublic`);
+    (0, bytes_1.assertByteLength)(remotePubKey, 33, `invalid ${field}.remoteIdentityPublic length ${remotePubKey.byteLength}`);
+    const rootKey = (0, coercion_1.asBytes)(session.rootKey, `${field}.rootKey`);
+    (0, bytes_1.assertByteLength)(rootKey, 32, `invalid ${field}.rootKey length ${rootKey.byteLength}`);
+    const localOneTimePubKey = pendingPreKey
+        ? (0, coercion_1.asBytes)(pendingPreKey.baseKey, `${field}.pendingPreKey.baseKey`)
+        : null;
+    if (localOneTimePubKey) {
+        (0, bytes_1.assertByteLength)(localOneTimePubKey, 33, `invalid ${field}.pendingPreKey.baseKey length ${localOneTimePubKey.byteLength}`);
+    }
+    const aliceBaseKey = (0, coercion_1.asOptionalBytes)(session.aliceBaseKey, `${field}.aliceBaseKey`) ?? null;
+    if (aliceBaseKey) {
+        (0, bytes_1.assertByteLength)(aliceBaseKey, 33, `invalid ${field}.aliceBaseKey length ${aliceBaseKey.byteLength}`);
+    }
+    return {
+        local: {
+            regId: (0, coercion_1.asNumber)(session.localRegistrationId, `${field}.localRegistrationId`),
+            pubKey: localPubKey
+        },
+        remote: {
+            regId: (0, coercion_1.asNumber)(session.remoteRegistrationId, `${field}.remoteRegistrationId`),
+            pubKey: remotePubKey
+        },
+        rootKey,
+        sendChain: decodeSignalSendChain(senderChain, `${field}.senderChain`),
+        recvChains: session.receiverChains ?? [],
+        initialExchangeInfo: pendingPreKey
+            ? {
+                remoteOneTimeId: (0, coercion_1.asOptionalNumber)(pendingPreKey.preKeyId, `${field}.pendingPreKey.preKeyId`) ??
+                    null,
+                remoteSignedId: (0, coercion_1.asNumber)(pendingPreKey.signedPreKeyId, `${field}.pendingPreKey.signedPreKeyId`),
+                localOneTimePubKey: localOneTimePubKey
+            }
+            : null,
+        prevSendChainHighestIndex: (0, coercion_1.asOptionalNumber)(session.previousCounter, `${field}.previousCounter`) ?? 0,
+        aliceBaseKey
+    };
+}
+/**
+ * Serializes a {@link SignalSessionRecord} (current + previous sessions) into
+ * the Signal `RecordStructure` protobuf encoding used by the session stores.
+ */
+function encodeSignalSessionRecord(record) {
+    return _proto_1.proto.RecordStructure.encode({
+        currentSession: encodeSignalSessionSnapshot(record),
+        previousSessions: record.prevSessions
+    }).finish();
+}
+/**
+ * Decodes a Signal `RecordStructure` payload (as stored on disk) back into a
+ * {@link SignalSessionRecord}. Throws when the current session is missing.
+ */
+function decodeSignalSessionRecord(raw) {
+    const decoded = _proto_1.proto.RecordStructure.decode((0, coercion_1.asBytes)(raw, 'signal_sessions.record'));
+    if (!decoded.currentSession) {
+        throw new Error('missing signal_sessions.record.currentSession');
+    }
+    const current = decodeSignalSessionSnapshot(decoded.currentSession, 'signal_sessions.currentSession');
+    return {
+        ...current,
+        prevSessions: decoded.previousSessions ?? []
+    };
+}
+/** Reads a stored remote identity blob into a Uint8Array (validates byte-shape). */
+function decodeSignalRemoteIdentity(raw) {
+    return (0, coercion_1.asBytes)(raw, 'signal_identity.identity_key');
+}