zapo-js 0.3.0 → 1.0.0

package/dist/esm/auth/WaAuthClient.js

@@ -5,8 +5,18 @@ import { getWaCompanionPlatformId, WA_DEFAULTS } from '../protocol/constants.js'
 import { uint8Equal } from '../util/bytes.js';
 import { toError } from '../util/primitives.js';
 import { getRuntimeOsDisplayName } from '../util/runtime.js';
+/**
+ * Owns the auth/pairing lifecycle and persistence of {@link WaAuthCredentials}.
+ * Exposed as `client.auth` on a {@link WaClient}.
+ *
+ * Lifecycle: construct with options + dependencies, call
+ * {@link loadOrCreateCredentials} to bring credentials online, then either
+ * follow the QR flow (`onQr` callback) or call {@link requestPairingCode} for
+ * the link-code flow.
+ */
 export class WaAuthClient {
     constructor(options, deps) {
+        this.versionOverride = null;
         const deviceBrowser = options.deviceBrowser ?? WA_DEFAULTS.DEVICE_BROWSER;
         const device = Object.freeze({
             browser: deviceBrowser,
@@ -25,6 +35,7 @@ export class WaAuthClient {
         this.authStore = deps.authStore;
         this.signalStore = deps.signalStore;
         this.preKeyStore = deps.preKeyStore;
+        this.isConnected = deps.isConnected;
         this.credentials = null;
         this.qrFlow = new WaQrFlow({
             logger: this.logger,
@@ -49,6 +60,10 @@ export class WaAuthClient {
             dangerous: options.dangerous
         });
     }
+    /**
+     * Returns a snapshot of auth readiness flags (connection, registration,
+     * pending QR/pairing prompts).
+     */
     getState(connected = false) {
         return {
             connected,
@@ -57,9 +72,14 @@ export class WaAuthClient {
             hasPairingCode: this.pairingFlow.hasPairingSession()
         };
     }
+    /** Returns the currently-loaded credentials, or `null` before initialization. */
     getCurrentCredentials() {
         return this.credentials;
     }
+    /**
+     * Loads persisted credentials from the auth store, or generates a fresh
+     * set when none exist. Must be called before connecting.
+     */
     async loadOrCreateCredentials() {
         return this.runHandled(async () => {
             this.logger.debug('auth client loadOrCreateCredentials start');
@@ -76,29 +96,56 @@ export class WaAuthClient {
             return this.credentials;
         });
     }
-    buildCommsConfig(socketOptions, overrides = {}) {
+    /**
+     * Builds a {@link WaCommsConfig} from the current credentials and the
+     * runtime device/transport options – feeds {@link WaComms}.
+     */
+    async buildCommsConfig(socketOptions, overrides = {}) {
         this.logger.trace('auth client building comms config');
+        const override = this.versionOverride;
+        this.versionOverride = null;
         return buildCommsConfig(this.logger, this.requireCredentials(), socketOptions, {
             deviceBrowser: this.options.deviceBrowser,
             deviceOsDisplayName: this.options.deviceOsDisplayName,
             requireFullSync: this.options.requireFullSync,
-            version: this.options.version,
+            version: override ?? this.options.version,
             mobileTransport: this.options.mobileTransport,
             noiseTrustedRootCa: overrides.noiseTrustedRootCa,
             disableNoiseCertificateChainVerification: overrides.disableNoiseCertificateChainVerification ??
                 this.options.dangerous?.disableNoiseCertificateChainVerification
         });
     }
+    /**
+     * One-shot override for the next {@link buildCommsConfig} call: takes
+     * precedence over the user-supplied `version` option, then clears. Used
+     * by the `recoverFromClientTooOld` auto-retry to inject a fresh version
+     * string fetched from `web.whatsapp.com` without mutating the user's
+     * options.
+     */
+    setNextConnectVersion(version) {
+        this.versionOverride = version;
+    }
+    /** Clears the in-memory QR and pairing sessions without touching storage. */
+    // eslint-disable-next-line @typescript-eslint/require-await
     async clearTransientState() {
         this.logger.trace('auth client clear transient state');
         this.qrFlow.clear();
         this.pairingFlow.clearSession();
     }
+    /**
+     * Wipes credentials from memory **and** from the auth store. Does
+     * **not** touch the other store domains (signal, app-state, ...) -
+     * those are cleared separately when {@link WaClient.logout} triggers
+     * the server-side logout path, honoring `options.logoutStoreClear`.
+     * Call this manually only when you want to force a re-pair without
+     * going through the server logout IQ.
+     */
     async clearStoredCredentials() {
         this.logger.warn('auth client clearing stored credentials');
         this.credentials = null;
         await Promise.all([this.authStore.clear(), this.clearTransientState()]);
     }
+    /** Stores the server's noise static key for subsequent handshakes. */
     async persistServerStaticKey(serverStaticKey) {
         this.logger.debug('persisting server static key', {
             keyLength: serverStaticKey.byteLength
@@ -108,6 +155,7 @@ export class WaAuthClient {
             serverStaticKey
         }));
     }
+    /** Stores the "server holds prekeys" flag; persists only when the value changes. */
     async persistServerHasPreKeys(serverHasPreKeys) {
         await this.patchCredentials((credentials) => ({
             ...credentials,
@@ -121,6 +169,10 @@ export class WaAuthClient {
             }
         });
     }
+    /**
+     * Stores the routing-info blob received from the server. Skips persistence
+     * when the value matches the one already on disk.
+     */
     async persistRoutingInfo(routingInfo) {
         this.logger.trace('persisting routing info', {
             byteLength: routingInfo.byteLength
@@ -138,6 +190,7 @@ export class WaAuthClient {
             }
         });
     }
+    /** Clears the persisted routing-info blob (used after a routing error). */
     async clearRoutingInfo() {
         return this.patchCredentials((credentials) => ({
             ...credentials,
@@ -149,6 +202,11 @@ export class WaAuthClient {
             }
         });
     }
+    /**
+     * Persists the per-connection success attributes from the server (LID,
+     * display name, companion key, last-success ts, props versions, ...). Only
+     * persists when at least one attribute actually changed.
+     */
     async persistSuccessAttributes(attributes) {
         let persistDiff;
         const computeDiff = (current, next) => ({
@@ -185,24 +243,56 @@ export class WaAuthClient {
             }
         });
     }
-    async requestPairingCode(phoneNumber, shouldShowPushNotification = false, customCode) {
+    /**
+     * Requests an 8-character pairing code for `phoneNumber` (link-code flow).
+     * Pass `customCode` to suggest a specific code; the server still validates
+     * and may return a different one.
+     *
+     * The client must already be connected – kick off `WaClient.connect()` in
+     * parallel, wait for the `auth_pairing_required` event (or any QR), then
+     * call this. The user then enters the returned code in WhatsApp on their
+     * phone under *Linked Devices → Link with phone number instead*.
+     *
+     * @example
+     * ```ts
+     * // Start the handshake; do NOT await – connect() resolves only after pairing
+     * void client.connect()
+     *
+     * // Wait until the pairing screen is ready on the server side
+     * await new Promise<void>((resolve) => client.once('auth_pairing_required', () => resolve()))
+     *
+     * // Phone number in international format, digits only
+     * const code = await client.auth.requestPairingCode('5511999999999')
+     * console.log(`enter this on your phone: ${code.match(/.{1,4}/g)!.join('-')}`)
+     *
+     * // The `connect()` promise resolves after the user types the code:
+     * await new Promise<void>((resolve) => client.once('auth_paired', () => resolve()))
+     * ```
+     */
+    async requestPairingCode(phoneNumber, shouldShowPushNotification = true, customCode) {
+        this.requireConnected();
         this.requireCredentials();
-        this.logger.info('auth client requesting pairing code');
+        this.logger.debug('auth client requesting pairing code');
         return this.runHandled(() => this.pairingFlow.requestPairingCode(phoneNumber, shouldShowPushNotification, customCode));
     }
+    /** Fetches the ISO country code the server resolved for the current account. */
     async fetchPairingCountryCodeIso() {
+        this.requireConnected();
         this.requireCredentials();
         this.logger.trace('auth client fetching pairing country code ISO');
         return this.runHandled(() => this.pairingFlow.fetchPairingCountryCodeIso());
     }
+    /** Dispatcher: returns `true` when `node` is a pairing-related IQ-set we handled. */
     async handleIncomingIqSet(node) {
         this.logger.trace('auth client handleIncomingIqSet', { id: node.attrs.id });
         return this.runHandled(() => this.pairingFlow.handleIncomingIqSet(node));
     }
+    /** Dispatcher: returns `true` when `node` is a link-code companion notification. */
     async handleLinkCodeNotification(node) {
         this.logger.trace('auth client handleLinkCodeNotification', { id: node.attrs.id });
         return this.runHandled(() => this.pairingFlow.handleLinkCodeNotification(node));
     }
+    /** Dispatcher: returns `true` when `node` is a companion-registration refresh notification. */
     async handleCompanionRegRefreshNotification(node) {
         this.logger.trace('auth client handleCompanionRegRefreshNotification', {
             id: node.attrs.id
@@ -230,7 +320,7 @@ export class WaAuthClient {
     }
     async updateCredentials(credentials) {
         this.logger.trace('auth client update credentials', {
-            registered: credentials?.meJid !== null && credentials?.meJid !== undefined
+            registered: !!credentials?.meJid
         });
         this.credentials = credentials;
         await persistCredentials({
@@ -240,6 +330,11 @@ export class WaAuthClient {
             preKeyStore: this.preKeyStore
         }, credentials);
     }
+    requireConnected() {
+        if (this.isConnected && !this.isConnected()) {
+            throw new Error('client is not connected');
+        }
+    }
     requireCredentials() {
         if (!this.credentials) {
             throw new Error('credentials are not initialized');

package/dist/esm/auth/credentials-flow.js

@@ -2,7 +2,7 @@ import { randomBytesAsync, toRawPubKey, xeddsaVerify } from '../crypto/index.js'
 import { toSerializedPubKey } from '../crypto/core/keys.js';
 import { X25519 } from '../crypto/curves/X25519.js';
 import { getLoginIdentity } from '../protocol/jid.js';
-import { createAndStoreInitialKeys } from '../signal/registration/utils.js';
+import { createAndStoreInitialKeys } from '../signal/index.js';
 import { WaMobileTcpSocketCtor } from '../transport/node/WaMobileTcpSocket.js';
 import { buildMobileLoginPayload } from '../transport/noise/WaMobileClientPayload.js';
 import { toProxyAgent, toProxyDispatcher } from '../transport/proxy.js';
@@ -48,7 +48,18 @@ function mobileTransportFromCredentials(credentials) {
         ...(credentials.memClass !== undefined ? { memClass: credentials.memClass } : {})
     };
 }
-export function buildCommsConfig(logger, credentials, socketOptions, clientOptions) {
+async function resolveVersion(version) {
+    if (version === undefined)
+        return undefined;
+    if (typeof version === 'string')
+        return version;
+    const resolved = await version();
+    if (typeof resolved !== 'string' || resolved.length === 0) {
+        throw new Error('version resolver returned a non-string value');
+    }
+    return resolved;
+}
+export async function buildCommsConfig(logger, credentials, socketOptions, clientOptions) {
     const meJid = credentials.meJid;
     const registered = meJid !== null && meJid !== undefined;
     const loginIdentity = registered ? getLoginIdentity(meJid) : null;
@@ -70,10 +81,10 @@ export function buildCommsConfig(logger, credentials, socketOptions, clientOptio
     });
     if (effectiveMobileTransport) {
         if (wsProxy) {
-            throw new Error('mobileTransport does not support socketOptions.proxy.ws — remove the proxy option or open an issue to add TCP proxy support');
+            throw new Error('mobileTransport does not support socketOptions.proxy.ws – remove the proxy option or open an issue to add TCP proxy support');
         }
         if (!loginIdentity) {
-            throw new Error('mobileTransport requires registered credentials (meJid) — run the mobile bridge flow first');
+            throw new Error('mobileTransport requires registered credentials (meJid) – run the mobile bridge flow first');
         }
         const loginPayload = buildMobileLoginPayload({
             username: loginIdentity.username,
@@ -104,6 +115,7 @@ export function buildCommsConfig(logger, credentials, socketOptions, clientOptio
             }
         };
     }
+    const versionBase = await resolveVersion(clientOptions.version);
     return {
         url: socketOptions.url,
         urls: socketOptions.urls,
@@ -129,7 +141,7 @@ export function buildCommsConfig(logger, credentials, socketOptions, clientOptio
                     device: loginIdentity.device,
                     deviceBrowser: clientOptions.deviceBrowser,
                     deviceOsDisplayName: clientOptions.deviceOsDisplayName,
-                    versionBase: clientOptions.version
+                    versionBase
                 }
                 : undefined,
             registrationPayloadConfig: !loginIdentity
@@ -139,7 +151,7 @@ export function buildCommsConfig(logger, credentials, socketOptions, clientOptio
                     deviceBrowser: clientOptions.deviceBrowser,
                     deviceOsDisplayName: clientOptions.deviceOsDisplayName,
                     requireFullSync: clientOptions.requireFullSync,
-                    versionBase: clientOptions.version
+                    versionBase
                 }
                 : undefined
         }

package/dist/esm/auth/pairing/WaPairingFlow.js

@@ -4,11 +4,11 @@ import { proto } from '../../proto.js';
 import { getWaBrowserDisplayName } from '../../protocol/browser.js';
 import { WA_DEFAULTS, WA_IQ_TYPES, WA_NODE_TAGS, WA_SIGNALING } from '../../protocol/constants.js';
 import { parsePhoneJid } from '../../protocol/jid.js';
-import { ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, computeAdvIdentityHmac, generateDeviceSignature, verifyDeviceIdentityAccountSignature } from '../../signal/crypto/WaAdvSignature.js';
+import { ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, computeAdvIdentityHmac, generateDeviceSignature, verifyDeviceIdentityAccountSignature } from '../../signal/attestation/WaAdvSignature.js';
 import { buildAckNode, buildIqResultNode } from '../../transport/node/builders/global.js';
 import { buildCompanionFinishRequestNode, buildCompanionHelloRequestNode, buildGetCountryCodeRequestNode } from '../../transport/node/builders/pairing.js';
 import { decodeNodeContentUtf8OrBytes, findNodeChild, findNodeChildrenByTags, getFirstNodeChild, getNodeChildrenNonEmptyUtf8ByTag, hasNodeChild } from '../../transport/node/helpers.js';
-import { concatBytes, decodeProtoBytes, uint8Equal } from '../../util/bytes.js';
+import { concatBytes, decodeProtoBytes, uint8Equal, uint8TimingSafeEqual } from '../../util/bytes.js';
 export class WaPairingFlow {
     constructor(options) {
         this.opts = options;
@@ -21,7 +21,7 @@ export class WaPairingFlow {
         this.opts.logger.trace('pairing flow session cleared');
         this.pairingSession = null;
     }
-    async requestPairingCode(phoneNumber, shouldShowPushNotification = false, customCode) {
+    async requestPairingCode(phoneNumber, shouldShowPushNotification = true, customCode) {
         this.opts.logger.info('requesting pairing code', {
             shouldShowPushNotification,
             hasCustomCode: customCode !== undefined
@@ -65,7 +65,7 @@ export class WaPairingFlow {
             finished: false
         };
         this.opts.callbacks.emitPairingCode(companionHello.pairingCode);
-        this.opts.logger.info('pairing code emitted', {
+        this.opts.logger.debug('pairing code emitted', {
             phoneJid,
             createdAtSeconds: this.pairingSession.createdAtSeconds
         });
@@ -83,21 +83,19 @@ export class WaPairingFlow {
         return iso;
     }
     async handleIncomingIqSet(node) {
-        this.opts.logger.trace('pairing flow received iq:set', {
-            id: node.attrs.id,
-            from: node.attrs.from
-        });
+        const iqLogger = this.opts.logger.child({ id: node.attrs.id });
+        iqLogger.trace('pairing flow received iq:set', { from: node.attrs.from });
         const firstChild = getFirstNodeChild(node);
         if (!firstChild) {
             return false;
         }
         if (firstChild.tag === WA_NODE_TAGS.PAIR_DEVICE) {
-            this.opts.logger.debug('handling pair-device stanza', { id: node.attrs.id });
+            iqLogger.debug('handling pair-device stanza');
             await this.handlePairDevice(node, firstChild);
             return true;
         }
         if (firstChild.tag === WA_NODE_TAGS.PAIR_SUCCESS) {
-            this.opts.logger.debug('handling pair-success stanza', { id: node.attrs.id });
+            iqLogger.debug('handling pair-success stanza');
             await this.handlePairSuccess(node, firstChild);
             return true;
         }
@@ -124,7 +122,7 @@ export class WaPairingFlow {
             }
             const ref = decodeNodeContentUtf8OrBytes(refNode.content, 'refresh_code.link_code_pairing_ref');
             if (uint8Equal(ref, this.pairingSession.ref)) {
-                this.opts.logger.info('received pairing refresh notification', {
+                this.opts.logger.debug('received pairing refresh notification', {
                     forceManualRefresh: linkCodeNode.attrs.force_manual_refresh === 'true'
                 });
                 this.opts.callbacks.emitPairingRefresh(linkCodeNode.attrs.force_manual_refresh === 'true');
@@ -150,7 +148,7 @@ export class WaPairingFlow {
             node,
             typeOverride: WA_SIGNALING.COMPANION_REG_REFRESH_NOTIFICATION
         }));
-        this.opts.logger.info('handled companion_reg_refresh notification');
+        this.opts.logger.debug('handled companion_reg_refresh notification');
         this.opts.qrFlow.refreshCurrentQr();
         return true;
     }
@@ -160,10 +158,10 @@ export class WaPairingFlow {
         await this.rotateAdvSecret(this.requireCredentials());
         await this.opts.socket.sendNode(buildIqResultNode(iqNode));
         this.opts.qrFlow.setRefs(refs);
-        this.opts.logger.info('pair-device refs updated', { refsCount: refs.length });
+        this.opts.logger.debug('pair-device refs updated', { refsCount: refs.length });
     }
     async handlePairSuccess(iqNode, pairSuccessNode) {
-        this.opts.logger.info('processing pair-success node');
+        this.opts.logger.debug('processing pair-success node');
         const credentials = this.requireCredentials();
         const [deviceIdentityNode, deviceNode, platformNode] = findNodeChildrenByTags(pairSuccessNode, [WA_NODE_TAGS.DEVICE_IDENTITY, 'device', WA_NODE_TAGS.PLATFORM]);
         if (!deviceIdentityNode || !deviceNode || !platformNode) {
@@ -183,13 +181,18 @@ export class WaPairingFlow {
             const hmacInput = isHosted
                 ? concatBytes([ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, wrappedDetails])
                 : wrappedDetails;
-            const expectedHmac = await computeAdvIdentityHmac(credentials.advSecretKey, hmacInput);
-            if (!uint8Equal(expectedHmac, wrappedHmac)) {
-                this.opts.logger.error('pair-success hmac mismatch');
+            const expectedHmac = computeAdvIdentityHmac(credentials.advSecretKey, hmacInput);
+            if (!uint8TimingSafeEqual(expectedHmac, wrappedHmac)) {
+                this.opts.logger.error('pair-success hmac mismatch', {
+                    meJid: deviceNode.attrs.jid,
+                    meLid: deviceNode.attrs.lid,
+                    platform: platformNode.attrs.name,
+                    isHosted
+                });
                 throw new Error('pair-success HMAC validation failed');
             }
         }
-        const { signedIdentity, keyIndex, responseIdentityBytes } = await this.buildPairSuccessResponseIdentity(credentials, wrappedDetails, isHosted);
+        const { signedIdentity, keyIndex, responseIdentityBytes } = await this.buildPairSuccessResponseIdentity(credentials, wrappedDetails);
         const nextCredentials = {
             ...credentials,
             signedIdentity,
@@ -230,21 +233,25 @@ export class WaPairingFlow {
         this.opts.callbacks.emitPaired(nextCredentials);
         this.opts.logger.debug('pair-success completed and paired event emitted');
     }
-    async buildPairSuccessResponseIdentity(credentials, wrappedDetails, isHosted) {
+    async buildPairSuccessResponseIdentity(credentials, wrappedDetails) {
         const signedIdentity = proto.ADVSignedDeviceIdentity.decode(wrappedDetails);
         const details = decodeProtoBytes(signedIdentity.details, 'ADVSignedDeviceIdentity.details');
         const accountSignature = decodeProtoBytes(signedIdentity.accountSignature, 'ADVSignedDeviceIdentity.accountSignature');
         const accountSignatureKey = decodeProtoBytes(signedIdentity.accountSignatureKey, 'ADVSignedDeviceIdentity.accountSignatureKey');
         const localIdentity = credentials.registrationInfo.identityKeyPair;
+        const advDeviceIdentity = proto.ADVDeviceIdentity.decode(details);
+        const isDeviceHosted = advDeviceIdentity.deviceType === proto.ADVEncryptionType.HOSTED;
         if (this.opts.dangerous?.disableAdvSignatureVerification !== true) {
-            const validAccountSignature = await verifyDeviceIdentityAccountSignature(details, accountSignature, localIdentity.pubKey, accountSignatureKey, isHosted);
+            const validAccountSignature = await verifyDeviceIdentityAccountSignature(details, accountSignature, localIdentity.pubKey, accountSignatureKey, isDeviceHosted);
             if (!validAccountSignature) {
-                this.opts.logger.error('pair-success account signature invalid');
+                this.opts.logger.error('pair-success account signature invalid', {
+                    keyIndex: advDeviceIdentity.keyIndex ?? 0,
+                    isDeviceHosted
+                });
                 throw new Error('pair-success account signature validation failed');
             }
         }
-        signedIdentity.deviceSignature = await generateDeviceSignature(details, localIdentity, accountSignatureKey, isHosted);
-        const advDeviceIdentity = proto.ADVDeviceIdentity.decode(details);
+        signedIdentity.deviceSignature = await generateDeviceSignature(details, localIdentity, accountSignatureKey, false);
         const responseIdentityBytes = proto.ADVSignedDeviceIdentity.encode({
             details: signedIdentity.details,
             accountSignature: signedIdentity.accountSignature,
@@ -280,7 +287,9 @@ export class WaPairingFlow {
         }
         const ref = decodeNodeContentUtf8OrBytes(refNode.content, 'primary_hello.link_code_pairing_ref');
         if (!pairingSession.ref || !uint8Equal(ref, pairingSession.ref)) {
-            this.opts.logger.warn('primary_hello ref mismatch ignored');
+            this.opts.logger.warn('primary_hello ref mismatch ignored', {
+                phoneJid: pairingSession.phoneJid
+            });
             return;
         }
         const nowSeconds = Math.floor(Date.now() / 1000);
@@ -309,7 +318,7 @@ export class WaPairingFlow {
             advSecretKey: finish.advSecret
         });
         pairingSession.finished = true;
-        this.opts.logger.info('primary_hello completed with companion_finish success');
+        this.opts.logger.debug('primary_hello completed with companion_finish success');
     }
     async rotateAdvSecret(credentials) {
         const nextCredentials = {

package/dist/esm/auth/pairing/pairing-code-crypto.js

@@ -1,9 +1,10 @@
-import { aesCtrDecrypt, aesCtrEncrypt, aesGcmEncrypt, hkdf, importAesGcmKey, pbkdf2DeriveAesCtrKey, randomBytesAsync } from '../../crypto/index.js';
+import { aesCtrDecrypt, aesCtrEncrypt, aesGcmEncrypt, hkdf, pbkdf2Sha256, randomBytesAsync } from '../../crypto/index.js';
 import { X25519 } from '../../crypto/curves/X25519.js';
 import { WA_PAIRING_KDF_INFO } from '../../protocol/constants.js';
 import { concatBytes, TEXT_ENCODER } from '../../util/bytes.js';
-export const CROCKFORD_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTVWXYZ';
+const CROCKFORD_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTVWXYZ';
 export const PBKDF2_ITERATIONS = 2 << 16;
+const PAIRING_AES_KEY_BYTES = 32;
 function bytesToCrockford(bytes) {
     let bitCount = 0;
     let value = 0;
@@ -42,8 +43,8 @@ export async function createCompanionHello(options = {}) {
         normalizedCustomCode !== null ? Promise.resolve(null) : randomBytesAsync(5)
     ]);
     const pairingCode = normalizedCustomCode ?? bytesToCrockford(codeBytes);
-    const cipher = await pbkdf2DeriveAesCtrKey(TEXT_ENCODER.encode(pairingCode), salt, PBKDF2_ITERATIONS);
-    const encrypted = await aesCtrEncrypt(cipher, counter, companionEphemeralKeyPair.pubKey);
+    const cipherKey = await pbkdf2Sha256(TEXT_ENCODER.encode(pairingCode), salt, PBKDF2_ITERATIONS, PAIRING_AES_KEY_BYTES);
+    const encrypted = aesCtrEncrypt(cipherKey, counter, companionEphemeralKeyPair.pubKey);
     return {
         pairingCode,
         companionEphemeralKeyPair,
@@ -54,31 +55,28 @@ export async function completeCompanionFinish(args) {
     if (args.wrappedPrimaryEphemeralPub.length <= 48) {
         throw new Error('invalid wrapped primary payload');
     }
-    const pairingCipher = await pbkdf2DeriveAesCtrKey(TEXT_ENCODER.encode(args.pairingCode), args.wrappedPrimaryEphemeralPub.subarray(0, 32), PBKDF2_ITERATIONS);
-    const primaryEphemeralPub = await aesCtrDecrypt(pairingCipher, args.wrappedPrimaryEphemeralPub.subarray(32, 48), args.wrappedPrimaryEphemeralPub.subarray(48));
+    const pairingCipherKey = await pbkdf2Sha256(TEXT_ENCODER.encode(args.pairingCode), args.wrappedPrimaryEphemeralPub.subarray(0, 32), PBKDF2_ITERATIONS, PAIRING_AES_KEY_BYTES);
+    const primaryEphemeralPub = aesCtrDecrypt(pairingCipherKey, args.wrappedPrimaryEphemeralPub.subarray(32, 48), args.wrappedPrimaryEphemeralPub.subarray(48));
     if (primaryEphemeralPub.length === 0) {
         throw new Error('empty primary ephemeral public key');
     }
-    const [sharedEphemeral, bundleSalt, bundleSecret, bundleIv] = await Promise.all([
+    const [sharedEphemeral, sharedIdentity, bundleSalt, bundleSecret, bundleIv] = await Promise.all([
         X25519.scalarMult(args.companionEphemeralPrivKey, primaryEphemeralPub),
+        X25519.scalarMult(args.registrationIdentityKeyPair.privKey, args.primaryIdentityPub),
         randomBytesAsync(32),
         randomBytesAsync(32),
         randomBytesAsync(12)
     ]);
-    const bundleEncryptionKeyRaw = await hkdf(sharedEphemeral, bundleSalt, WA_PAIRING_KDF_INFO.LINK_CODE_BUNDLE, 32);
-    const bundleEncryptionKey = await importAesGcmKey(bundleEncryptionKeyRaw, ['encrypt']);
+    const bundleEncryptionKey = hkdf(sharedEphemeral, bundleSalt, WA_PAIRING_KDF_INFO.LINK_CODE_BUNDLE, 32);
     const plaintextBundle = concatBytes([
         args.registrationIdentityKeyPair.pubKey,
         args.primaryIdentityPub,
         bundleSecret
     ]);
-    const [encryptedBundle, sharedIdentity] = await Promise.all([
-        aesGcmEncrypt(bundleEncryptionKey, bundleIv, plaintextBundle),
-        X25519.scalarMult(args.registrationIdentityKeyPair.privKey, args.primaryIdentityPub)
-    ]);
+    const encryptedBundle = aesGcmEncrypt(bundleEncryptionKey, bundleIv, plaintextBundle);
     const wrappedKeyBundle = concatBytes([bundleSalt, bundleIv, encryptedBundle]);
     const advMaterial = concatBytes([sharedEphemeral, sharedIdentity, bundleSecret]);
-    const advSecret = await hkdf(advMaterial, null, WA_PAIRING_KDF_INFO.ADV_SECRET, 32);
+    const advSecret = hkdf(advMaterial, null, WA_PAIRING_KDF_INFO.ADV_SECRET, 32);
     return {
         wrappedKeyBundle,
         companionIdentityPublic: args.registrationIdentityKeyPair.pubKey,