zapo-js 0.3.0 → 1.0.0

package/dist/client/{history-sync.js → persistence/history-sync.js}

@@ -1,23 +1,48 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.runHistorySyncNotification = runHistorySyncNotification;
 exports.processHistorySyncNotification = processHistorySyncNotification;
 const node_util_1 = require("node:util");
 const node_zlib_1 = require("node:zlib");
-const _proto_1 = require("../proto.js");
-const bytes_1 = require("../util/bytes");
-const primitives_1 = require("../util/primitives");
+const _proto_1 = require("../../proto.js");
+const jid_1 = require("../../protocol/jid");
+const bytes_1 = require("../../util/bytes");
+const primitives_1 = require("../../util/primitives");
 const unzipAsync = (0, node_util_1.promisify)(node_zlib_1.unzip);
 const HANDLED_SYNC_TYPES = new Set([
     _proto_1.proto.Message.HistorySyncType.INITIAL_BOOTSTRAP,
     _proto_1.proto.Message.HistorySyncType.RECENT,
     _proto_1.proto.Message.HistorySyncType.FULL,
-    _proto_1.proto.Message.HistorySyncType.PUSH_NAME
+    _proto_1.proto.Message.HistorySyncType.PUSH_NAME,
+    _proto_1.proto.Message.HistorySyncType.ON_DEMAND,
+    _proto_1.proto.Message.HistorySyncType.NON_BLOCKING_DATA
 ]);
 const HISTORY_SYNC_MAX_PENDING_WRITES = 1024;
+async function runHistorySyncNotification(deps, notification) {
+    try {
+        await processHistorySyncNotification(deps, notification);
+    }
+    catch (error) {
+        deps.logger.warn('failed to process history sync notification', {
+            syncType: notification.syncType,
+            chunkOrder: notification.chunkOrder,
+            message: (0, primitives_1.toError)(error).message
+        });
+    }
+}
 async function processHistorySyncNotification(deps, notification) {
     const syncType = notification.syncType;
-    if (syncType === null || syncType === undefined || !HANDLED_SYNC_TYPES.has(syncType)) {
+    if (syncType === null || syncType === undefined) {
+        deps.logger.debug('skipping history sync notification without syncType');
+        return;
+    }
+    if (!HANDLED_SYNC_TYPES.has(syncType)) {
         deps.logger.debug('skipping unhandled history sync type', { syncType });
+        // INITIAL_STATUS_V3 is the only recognized syncType we do not process today;
+        // still ack it so the primary device does not keep resending the same chunk.
+        if (syncType === _proto_1.proto.Message.HistorySyncType.INITIAL_STATUS_V3 && deps.onProcessed) {
+            await deps.onProcessed(syncType);
+        }
         return;
     }
     const blob = await downloadHistorySyncBlob(deps, notification);
@@ -28,17 +53,67 @@ async function processHistorySyncNotification(deps, notification) {
         chunkOrder: historySync.chunkOrder,
         progress: historySync.progress,
         conversations: historySync.conversations.length,
-        pushnames: historySync.pushnames.length
+        pushnames: historySync.pushnames.length,
+        inlineContacts: historySync.inlineContacts?.length ?? 0
     });
     const nowMs = Date.now();
     const pendingWrites = [];
+    // Build PN -> LID lookup from this chunk's mappings (and inline contacts
+    // and conversation-level pn/lid pairs, which carry the same pair) so
+    // pushnames and mappings land on a single canonical (LID-form) contact
+    // row instead of two mirror rows (one keyed by PN, one keyed by LID).
+    const pnToLid = new Map();
+    for (const map of historySync.phoneNumberToLidMappings ?? []) {
+        if (map.pnJid && map.lidJid) {
+            pnToLid.set(map.pnJid, map.lidJid);
+        }
+    }
+    for (const c of historySync.inlineContacts ?? []) {
+        if (c.pnJid && c.lidJid) {
+            pnToLid.set(c.pnJid, c.lidJid);
+        }
+    }
+    for (const conversation of historySync.conversations) {
+        const pnJid = conversation.pnJid;
+        const lidJid = conversation.lidJid ?? conversation.accountLid;
+        if (pnJid && lidJid) {
+            pnToLid.set(pnJid, lidJid);
+        }
+    }
     for (const pn of historySync.pushnames) {
         if (!pn.id) {
             continue;
         }
+        const lidJid = pnToLid.get(pn.id);
+        pendingWrites[pendingWrites.length] = deps.writeBehind.persistContactAsync(lidJid
+            ? {
+                jid: lidJid,
+                pushName: pn.pushname ?? undefined,
+                phoneNumber: pn.id,
+                lastUpdatedMs: nowMs
+            }
+            : {
+                jid: pn.id,
+                pushName: pn.pushname ?? undefined,
+                lastUpdatedMs: nowMs
+            });
+        if (pendingWrites.length >= HISTORY_SYNC_MAX_PENDING_WRITES) {
+            await flushPendingWrites(pendingWrites);
+        }
+    }
+    for (const c of historySync.inlineContacts ?? []) {
+        const jid = c.lidJid ?? c.pnJid;
+        if (!jid) {
+            continue;
+        }
+        const displayName = c.fullName || c.firstName || undefined;
+        if (!displayName && !c.pnJid) {
+            continue;
+        }
         pendingWrites[pendingWrites.length] = deps.writeBehind.persistContactAsync({
-            jid: pn.id,
-            pushName: pn.pushname ?? undefined,
+            jid,
+            displayName,
+            phoneNumber: c.pnJid ?? undefined,
             lastUpdatedMs: nowMs
         });
         if (pendingWrites.length >= HISTORY_SYNC_MAX_PENDING_WRITES) {
@@ -65,9 +140,30 @@ async function processHistorySyncNotification(deps, notification) {
         if (pendingWrites.length >= HISTORY_SYNC_MAX_PENDING_WRITES) {
             await flushPendingWrites(pendingWrites);
         }
+        if ((0, jid_1.isUserJid)(threadJid) || (conversation.lidJid ?? conversation.accountLid)) {
+            const contactDisplay = conversation.displayName || conversation.username || undefined;
+            const contactPn = conversation.pnJid ?? undefined;
+            const contactLid = conversation.lidJid ?? conversation.accountLid ?? undefined;
+            if (contactDisplay || contactPn || contactLid) {
+                const contactJid = contactLid ?? threadJid;
+                pendingWrites[pendingWrites.length] = deps.writeBehind.persistContactAsync({
+                    jid: contactJid,
+                    displayName: contactDisplay,
+                    phoneNumber: contactPn,
+                    lastUpdatedMs: nowMs
+                });
+                if (pendingWrites.length >= HISTORY_SYNC_MAX_PENDING_WRITES) {
+                    await flushPendingWrites(pendingWrites);
+                }
+            }
+        }
         for (const histMsg of conversation.messages ?? []) {
             const webMsg = histMsg.message;
-            if (!webMsg?.key?.id) {
+            if (!webMsg?.key?.id || !webMsg.message) {
+                // Stubs (group system events: add/remove/promote, revokes, ephemeral toggles)
+                // arrive as WebMessageInfo with a key + messageStubType but no `.message`. They
+                // duplicate live `notification` stanzas that the client already processes, and
+                // storing them as content-less rows produces "ghost" entries — skip them here.
                 continue;
             }
             const timestampMs = (0, primitives_1.longToNumber)(webMsg.messageTimestamp) * 1000;
@@ -77,9 +173,7 @@ async function processHistorySyncNotification(deps, notification) {
                 senderJid: webMsg.key.participant ?? undefined,
                 fromMe: webMsg.key.fromMe === true,
                 timestampMs: timestampMs || undefined,
-                messageBytes: webMsg.message
-                    ? _proto_1.proto.Message.encode(webMsg.message).finish()
-                    : undefined
+                messageBytes: _proto_1.proto.Message.encode(webMsg.message).finish()
             });
             if (pendingWrites.length >= HISTORY_SYNC_MAX_PENDING_WRITES) {
                 await flushPendingWrites(pendingWrites);
@@ -87,6 +181,19 @@ async function processHistorySyncNotification(deps, notification) {
             messagesCount += 1;
         }
     }
+    // Persist LID<->PN mappings as a single LID-canonical row per contact.
+    // Lookups by PN form fall through to `getByPhoneNumber` via the secondary
+    // index, so the mirror PN row is no longer needed.
+    for (const [pnJid, lidJid] of pnToLid) {
+        pendingWrites[pendingWrites.length] = deps.writeBehind.persistContactAsync({
+            jid: lidJid,
+            phoneNumber: pnJid,
+            lastUpdatedMs: nowMs
+        });
+        if (pendingWrites.length >= HISTORY_SYNC_MAX_PENDING_WRITES) {
+            await flushPendingWrites(pendingWrites);
+        }
+    }
     if (deps.onPrivacyTokens) {
         const tokenConversations = [];
         for (const conversation of historySync.conversations) {
@@ -115,23 +222,23 @@ async function processHistorySyncNotification(deps, notification) {
         messagesCount,
         conversationsCount: historySync.conversations.length,
         pushnamesCount: historySync.pushnames.length,
+        inlineContactsCount: historySync.inlineContacts?.length ?? 0,
         chunkOrder: historySync.chunkOrder ?? undefined,
         progress: historySync.progress ?? undefined
     };
     await flushPendingWrites(pendingWrites);
     deps.emitEvent('history_sync_chunk', event);
+    if (deps.onProcessed) {
+        await deps.onProcessed(syncType);
+    }
 }
 async function flushPendingWrites(pendingWrites) {
     if (pendingWrites.length === 0) {
         return;
     }
-    const pendingCount = pendingWrites.length;
-    const batch = new Array(pendingCount);
-    for (let index = 0; index < pendingCount; index += 1) {
-        batch[index] = pendingWrites[index];
-    }
+    const settled = Promise.all(pendingWrites);
     pendingWrites.length = 0;
-    await Promise.all(batch);
+    await settled;
 }
 async function downloadHistorySyncBlob(deps, notification) {
     if (notification.initialHistBootstrapInlinePayload) {

package/dist/client/persistence/mailbox.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.persistIncomingMailboxEntities = persistIncomingMailboxEntities;
+const content_1 = require("../../message/encode/content");
+const _proto_1 = require("../../proto.js");
+const jid_1 = require("../../protocol/jid");
+const primitives_1 = require("../../util/primitives");
+function pairLidPn(a, b) {
+    if (!a || !b)
+        return null;
+    if ((0, jid_1.isLidJid)(a) && (0, jid_1.isUserJid)(b))
+        return [a, b];
+    if ((0, jid_1.isLidJid)(b) && (0, jid_1.isUserJid)(a))
+        return [b, a];
+    return null;
+}
+/**
+ * Returns the LID-canonical contact record for a primary jid and (optionally)
+ * its alternate addressing. When both forms are known, the row carries
+ * `jid=<lid>, phoneNumber=<pn>` so lookups by either form converge on a
+ * single row via the contact store's PN-fallback path. When only one form is
+ * known, the row falls back to that jid as canonical.
+ */
+function canonicalContact(primary, alt, nowMs) {
+    const pair = pairLidPn(primary, alt);
+    if (pair) {
+        const [lid, pn] = pair;
+        return { jid: lid, phoneNumber: pn, lastUpdatedMs: nowMs };
+    }
+    return { jid: primary, lastUpdatedMs: nowMs };
+}
+function persistContacts(writeBehind, event, nowMs) {
+    const rawParticipant = event.rawNode.attrs.participant;
+    const participantJid = rawParticipant ? (0, jid_1.toUserJid)(rawParticipant) : undefined;
+    const senderPrimary = event.key.participant ?? rawParticipant ?? event.key.remoteJid;
+    if (!senderPrimary && !participantJid) {
+        return;
+    }
+    const written = new Set();
+    if (senderPrimary) {
+        // For 1:1 chats the sender is the same person as remoteJid, so its
+        // cross-ref pair info lives in remoteJidAlt rather than participantAlt.
+        let alt = event.key.participantAlt;
+        if (!alt && !event.key.isGroup && senderPrimary === event.key.remoteJid) {
+            alt = event.key.remoteJidAlt;
+        }
+        const record = canonicalContact(senderPrimary, alt, nowMs);
+        writeBehind.persistContact(record);
+        written.add(record.jid);
+        if (record.phoneNumber) {
+            written.add(record.phoneNumber);
+        }
+    }
+    if (participantJid && !written.has(participantJid)) {
+        writeBehind.persistContact({ jid: participantJid, lastUpdatedMs: nowMs });
+    }
+}
+function persistIncomingMailboxEntities(options) {
+    const { logger, writeBehind, messageSecretStore, event } = options;
+    const stanzaId = event.key.id;
+    const chatJid = event.key.remoteJid;
+    if (!stanzaId || !chatJid) {
+        return;
+    }
+    const nowMs = Date.now();
+    try {
+        const messageBytes = event.message
+            ? _proto_1.proto.Message.encode(event.message).finish()
+            : undefined;
+        writeBehind.persistMessage({
+            id: stanzaId,
+            threadJid: chatJid,
+            senderJid: event.key.participant ?? event.rawNode.attrs.participant ?? event.key.remoteJid,
+            participantJid: event.rawNode.attrs.participant,
+            fromMe: false,
+            timestampMs: event.timestampSeconds === undefined ? undefined : event.timestampSeconds * 1000,
+            messageBytes
+        });
+        persistContacts(writeBehind, event, nowMs);
+        const rawSecret = event.message?.messageContextInfo?.messageSecret;
+        if (rawSecret &&
+            rawSecret.length > 0 &&
+            event.message &&
+            (0, content_1.needsSecretPersistence)(event.message)) {
+            const rawSender = event.key.participant ?? event.rawNode.attrs.participant ?? event.key.remoteJid;
+            const senderJid = rawSender ? (0, jid_1.toUserJid)(rawSender) : '';
+            void messageSecretStore
+                .set(stanzaId, { secret: rawSecret, senderJid })
+                .catch((error) => {
+                logger.warn('failed to persist message secret', {
+                    id: stanzaId,
+                    message: (0, primitives_1.toError)(error).message
+                });
+            });
+        }
+    }
+    catch (error) {
+        logger.warn('failed to persist incoming mailbox entities', {
+            id: stanzaId,
+            from: chatJid,
+            message: (0, primitives_1.toError)(error).message
+        });
+    }
+}

package/dist/client/tokens/cs-token.js

@@ -7,22 +7,25 @@ const collections_1 = require("../../util/collections");
 const CS_TOKEN_CACHE_MAX = 5;
 class CsTokenGenerator {
     constructor() {
-        this.cachedKey = null;
         this.cachedSalt = null;
         this.cache = new Map();
     }
-    async generate(nctSalt, accountLid) {
-        const cached = this.cache.get(accountLid);
-        if (cached && this.isSameSalt(nctSalt)) {
-            return cached;
+    generate(nctSalt, accountLid) {
+        if (this.isSameSalt(nctSalt)) {
+            const cached = this.cache.get(accountLid);
+            if (cached) {
+                return cached;
+            }
+        }
+        const result = (0, core_1.hmacSha256Sign)(nctSalt, bytes_1.TEXT_ENCODER.encode(accountLid));
+        if (!this.isSameSalt(nctSalt)) {
+            this.cachedSalt = nctSalt;
+            this.cache.clear();
         }
-        const key = await this.resolveKey(nctSalt);
-        const result = await (0, core_1.hmacSign)(key, bytes_1.TEXT_ENCODER.encode(accountLid));
         (0, collections_1.setBoundedMapEntry)(this.cache, accountLid, result, CS_TOKEN_CACHE_MAX);
         return result;
     }
     invalidate() {
-        this.cachedKey = null;
         this.cachedSalt = null;
         this.cache.clear();
     }
@@ -37,14 +40,5 @@ class CsTokenGenerator {
         }
         return true;
     }
-    async resolveKey(salt) {
-        if (this.cachedKey && this.isSameSalt(salt)) {
-            return this.cachedKey;
-        }
-        this.cachedKey = await (0, core_1.importHmacKey)(salt);
-        this.cachedSalt = salt;
-        this.cache.clear();
-        return this.cachedKey;
-    }
 }
 exports.CsTokenGenerator = CsTokenGenerator;

package/dist/crypto/core/hkdf.js

@@ -4,18 +4,18 @@ exports.hkdf = hkdf;
 exports.hkdfSplit = hkdfSplit;
 const node_crypto_1 = require("node:crypto");
 const bytes_1 = require("../../util/bytes");
-async function hkdf(ikm, salt, info, outLength) {
-    const key = await node_crypto_1.webcrypto.subtle.importKey('raw', ikm, 'HKDF', false, ['deriveBits']);
-    const infoBytes = typeof info === 'string' ? (info === '' ? bytes_1.EMPTY_BYTES : bytes_1.TEXT_ENCODER.encode(info)) : info;
-    const bits = await node_crypto_1.webcrypto.subtle.deriveBits({
-        name: 'HKDF',
-        hash: 'SHA-256',
-        salt: salt ?? bytes_1.EMPTY_BYTES,
-        info: infoBytes
-    }, key, outLength * 8);
-    return (0, bytes_1.toBytesView)(bits);
+/**
+ * HKDF (HMAC-SHA-256) – derives `outLength` bytes from `ikm` using the given
+ * `salt` (empty bytes when `null`) and `info` context.
+ */
+function hkdf(ikm, salt, info, outLength) {
+    return (0, bytes_1.toBytesView)((0, node_crypto_1.hkdfSync)('sha256', ikm, salt ?? bytes_1.EMPTY_BYTES, info, outLength));
 }
-async function hkdfSplit(ikm, salt, info) {
-    const out = await hkdf(ikm, salt, info, 64);
+/**
+ * Derives a 64-byte HKDF output and returns it split into two 32-byte halves
+ * (Signal/WhatsApp pair-key derivation pattern).
+ */
+function hkdfSplit(ikm, salt, info) {
+    const out = hkdf(ikm, salt, info, 64);
     return [out.subarray(0, 32), out.subarray(32)];
 }

package/dist/crypto/core/index.js

@@ -3,7 +3,7 @@
  * Cryptographic utilities
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.xeddsaVerify = exports.xeddsaSign = exports.aesCtrDecrypt = exports.aesCtrEncrypt = exports.pbkdf2DeriveAesCtrKey = exports.hmacSign = exports.importHmacSha512Key = exports.importHmacKey = exports.aesCbcDecrypt = exports.aesCbcEncrypt = exports.importAesCbcKey = exports.aesGcmDecrypt = exports.aesGcmEncrypt = exports.importAesGcmKey = exports.sha512 = exports.sha256 = exports.sha1 = exports.randomIntAsync = exports.randomFillAsync = exports.randomBytesAsync = exports.buildNonce = exports.readVersionedContent = exports.prependVersion = exports.toRawPubKey = exports.toSerializedPubKey = exports.hkdfSplit = exports.hkdf = exports.X25519 = exports.Ed25519 = void 0;
+exports.xeddsaVerify = exports.xeddsaSign = exports.pbkdf2Sha256 = exports.hmacSha512Sign = exports.hmacSha256Sign = exports.aesCtrDecrypt = exports.aesCtrEncrypt = exports.aesCbcDecrypt = exports.aesCbcEncrypt = exports.aesGcmDecrypt = exports.aesGcmEncrypt = exports.md5Bytes = exports.sha512 = exports.sha256 = exports.sha1 = exports.randomIntAsync = exports.randomFillAsync = exports.randomBytesAsync = exports.writeNonceCounter = exports.readVersionedContent = exports.prependVersion = exports.toRawPubKey = exports.toSerializedPubKey = exports.hkdfSplit = exports.hkdf = exports.X25519 = exports.Ed25519 = void 0;
 var Ed25519_1 = require("../curves/Ed25519");
 Object.defineProperty(exports, "Ed25519", { enumerable: true, get: function () { return Ed25519_1.Ed25519; } });
 var X25519_1 = require("../curves/X25519");
@@ -17,7 +17,7 @@ Object.defineProperty(exports, "toRawPubKey", { enumerable: true, get: function
 Object.defineProperty(exports, "prependVersion", { enumerable: true, get: function () { return keys_1.prependVersion; } });
 Object.defineProperty(exports, "readVersionedContent", { enumerable: true, get: function () { return keys_1.readVersionedContent; } });
 var nonce_1 = require("../core/nonce");
-Object.defineProperty(exports, "buildNonce", { enumerable: true, get: function () { return nonce_1.buildNonce; } });
+Object.defineProperty(exports, "writeNonceCounter", { enumerable: true, get: function () { return nonce_1.writeNonceCounter; } });
 var random_1 = require("../core/random");
 Object.defineProperty(exports, "randomBytesAsync", { enumerable: true, get: function () { return random_1.randomBytesAsync; } });
 Object.defineProperty(exports, "randomFillAsync", { enumerable: true, get: function () { return random_1.randomFillAsync; } });
@@ -26,18 +26,16 @@ var primitives_1 = require("../core/primitives");
 Object.defineProperty(exports, "sha1", { enumerable: true, get: function () { return primitives_1.sha1; } });
 Object.defineProperty(exports, "sha256", { enumerable: true, get: function () { return primitives_1.sha256; } });
 Object.defineProperty(exports, "sha512", { enumerable: true, get: function () { return primitives_1.sha512; } });
-Object.defineProperty(exports, "importAesGcmKey", { enumerable: true, get: function () { return primitives_1.importAesGcmKey; } });
+Object.defineProperty(exports, "md5Bytes", { enumerable: true, get: function () { return primitives_1.md5Bytes; } });
 Object.defineProperty(exports, "aesGcmEncrypt", { enumerable: true, get: function () { return primitives_1.aesGcmEncrypt; } });
 Object.defineProperty(exports, "aesGcmDecrypt", { enumerable: true, get: function () { return primitives_1.aesGcmDecrypt; } });
-Object.defineProperty(exports, "importAesCbcKey", { enumerable: true, get: function () { return primitives_1.importAesCbcKey; } });
 Object.defineProperty(exports, "aesCbcEncrypt", { enumerable: true, get: function () { return primitives_1.aesCbcEncrypt; } });
 Object.defineProperty(exports, "aesCbcDecrypt", { enumerable: true, get: function () { return primitives_1.aesCbcDecrypt; } });
-Object.defineProperty(exports, "importHmacKey", { enumerable: true, get: function () { return primitives_1.importHmacKey; } });
-Object.defineProperty(exports, "importHmacSha512Key", { enumerable: true, get: function () { return primitives_1.importHmacSha512Key; } });
-Object.defineProperty(exports, "hmacSign", { enumerable: true, get: function () { return primitives_1.hmacSign; } });
-Object.defineProperty(exports, "pbkdf2DeriveAesCtrKey", { enumerable: true, get: function () { return primitives_1.pbkdf2DeriveAesCtrKey; } });
 Object.defineProperty(exports, "aesCtrEncrypt", { enumerable: true, get: function () { return primitives_1.aesCtrEncrypt; } });
 Object.defineProperty(exports, "aesCtrDecrypt", { enumerable: true, get: function () { return primitives_1.aesCtrDecrypt; } });
+Object.defineProperty(exports, "hmacSha256Sign", { enumerable: true, get: function () { return primitives_1.hmacSha256Sign; } });
+Object.defineProperty(exports, "hmacSha512Sign", { enumerable: true, get: function () { return primitives_1.hmacSha512Sign; } });
+Object.defineProperty(exports, "pbkdf2Sha256", { enumerable: true, get: function () { return primitives_1.pbkdf2Sha256; } });
 var xeddsa_1 = require("../core/xeddsa");
 Object.defineProperty(exports, "xeddsaSign", { enumerable: true, get: function () { return xeddsa_1.xeddsaSign; } });
 Object.defineProperty(exports, "xeddsaVerify", { enumerable: true, get: function () { return xeddsa_1.xeddsaVerify; } });

package/dist/crypto/core/keys.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.toSerializedPubKey = toSerializedPubKey;
 exports.toRawPubKey = toRawPubKey;
-exports.versionByte = versionByte;
 exports.prependVersion = prependVersion;
 exports.readVersionedContent = readVersionedContent;
 const bytes_1 = require("../../util/bytes");
@@ -35,18 +34,12 @@ function toRawPubKey(key) {
     }
     throw new Error(`invalid signal public key length ${key.length}`);
 }
-/**
- * Creates a version byte from high and low nibbles
- */
-function versionByte(high, low) {
-    return ((high << 4) | low) & 0xff;
-}
 /**
  * Prepends a version byte to content
  */
 function prependVersion(content, version) {
     const out = new Uint8Array(1 + content.length);
-    out[0] = versionByte(version, version);
+    out[0] = ((version << 4) | version) & 0xff;
     out.set(content, 1);
     return out;
 }

package/dist/crypto/core/nonce.js

@@ -1,20 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildNonce = buildNonce;
+exports.writeNonceCounter = writeNonceCounter;
 /**
- * Builds a 12-byte nonce for AES-GCM encryption with counter in the last 4 bytes.
- * Allocates a new buffer per call because concurrent Noise encrypt/decrypt operations
- * may hold references to different nonces simultaneously.
- * Throws if counter exceeds uint32 range to prevent nonce reuse.
+ * Writes a 32-bit big-endian `counter` into the last 4 bytes of a 12-byte
+ * AES-GCM nonce buffer. The first 8 bytes are left untouched so callers can
+ * reuse a per-instance scratch buffer in hot paths.
  */
-function buildNonce(counter) {
+function writeNonceCounter(out, counter) {
+    if (out.length < 12) {
+        throw new Error(`nonce buffer must be at least 12 bytes, got ${out.length}`);
+    }
     if (counter > 0xffffffff) {
         throw new Error('nonce counter overflow: exceeds uint32 range');
     }
-    const nonce = new Uint8Array(12);
-    nonce[8] = (counter >>> 24) & 0xff;
-    nonce[9] = (counter >>> 16) & 0xff;
-    nonce[10] = (counter >>> 8) & 0xff;
-    nonce[11] = counter & 0xff;
-    return nonce;
+    out[8] = (counter >>> 24) & 0xff;
+    out[9] = (counter >>> 16) & 0xff;
+    out[10] = (counter >>> 8) & 0xff;
+    out[11] = counter & 0xff;
 }