zapo-js 1.4.0 → 1.5.0

package/dist/protocol/group.js

@@ -1,8 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WA_GROUP_PARTICIPANT_TYPES = void 0;
+exports.WA_GROUP_MEMBERSHIP_ACTION_TAGS = exports.WA_GROUP_PARTICIPANT_TYPES = void 0;
 exports.WA_GROUP_PARTICIPANT_TYPES = Object.freeze({
     SUPERADMIN: 'superadmin',
     ADMIN: 'admin',
     REGULAR: 'participant'
 });
+/** `<membership_requests_action>` child tags for approving/rejecting group join requests. */
+exports.WA_GROUP_MEMBERSHIP_ACTION_TAGS = Object.freeze({
+    REQUESTS_ACTION: 'membership_requests_action',
+    APPROVE: 'approve',
+    REJECT: 'reject'
+});

package/dist/protocol/message.d.ts

@@ -5,6 +5,20 @@ export declare const WA_MESSAGE_TAGS: Readonly<{
     readonly ACK: "ack";
     readonly ERROR: "error";
 }>;
+/** `<enc type>` ciphertext kinds (Signal `msg`/`pkmsg`, group `skmsg`, message-secret `msmsg`). */
+export declare const WA_ENC_CIPHERTEXT_TYPES: Readonly<{
+    readonly MESSAGE: "msg";
+    readonly PREKEY: "pkmsg";
+    readonly SENDER_KEY: "skmsg";
+    readonly MESSAGE_SECRET: "msmsg";
+}>;
+export type WaEncCiphertextType = (typeof WA_ENC_CIPHERTEXT_TYPES)[keyof typeof WA_ENC_CIPHERTEXT_TYPES];
+/** `addressing_mode` stanza attr: phone-number vs LID addressing. */
+export declare const WA_ADDRESSING_MODES: Readonly<{
+    readonly PN: "pn";
+    readonly LID: "lid";
+}>;
+export type WaAddressingMode = (typeof WA_ADDRESSING_MODES)[keyof typeof WA_ADDRESSING_MODES];
 export declare const WA_MESSAGE_TYPES: Readonly<{
     readonly ENC_VERSION: "2";
     readonly MEDIA_NOTIFY: "medianotify";

package/dist/protocol/message.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WA_ENC_MEDIA_TYPES = exports.WA_EVENT_META_TYPES = exports.WA_POLL_META_TYPES = exports.WA_EDIT_ATTRS = exports.WA_STANZA_MSG_TYPES = exports.WA_NACK_REASONS = exports.WA_RETRYABLE_ACK_CODES = exports.WA_MESSAGE_TYPES = exports.WA_MESSAGE_TAGS = void 0;
+exports.WA_ENC_MEDIA_TYPES = exports.WA_EVENT_META_TYPES = exports.WA_POLL_META_TYPES = exports.WA_EDIT_ATTRS = exports.WA_STANZA_MSG_TYPES = exports.WA_NACK_REASONS = exports.WA_RETRYABLE_ACK_CODES = exports.WA_MESSAGE_TYPES = exports.WA_ADDRESSING_MODES = exports.WA_ENC_CIPHERTEXT_TYPES = exports.WA_MESSAGE_TAGS = void 0;
 exports.WA_MESSAGE_TAGS = Object.freeze({
     MESSAGE: 'message',
     ENC: 'enc',
@@ -8,6 +8,18 @@ exports.WA_MESSAGE_TAGS = Object.freeze({
     ACK: 'ack',
     ERROR: 'error'
 });
+/** `<enc type>` ciphertext kinds (Signal `msg`/`pkmsg`, group `skmsg`, message-secret `msmsg`). */
+exports.WA_ENC_CIPHERTEXT_TYPES = Object.freeze({
+    MESSAGE: 'msg',
+    PREKEY: 'pkmsg',
+    SENDER_KEY: 'skmsg',
+    MESSAGE_SECRET: 'msmsg'
+});
+/** `addressing_mode` stanza attr: phone-number vs LID addressing. */
+exports.WA_ADDRESSING_MODES = Object.freeze({
+    PN: 'pn',
+    LID: 'lid'
+});
 exports.WA_MESSAGE_TYPES = Object.freeze({
     ENC_VERSION: '2',
     MEDIA_NOTIFY: 'medianotify',

package/dist/protocol/nodes.d.ts

@@ -10,6 +10,7 @@ export declare const WA_NODE_TAGS: Readonly<{
     readonly NOTIFICATION: "notification";
     readonly SUCCESS: "success";
     readonly INFO_BULLETIN: "ib";
+    readonly OFFLINE: "offline";
     readonly DIRTY: "dirty";
     readonly EDGE_ROUTING: "edge_routing";
     readonly ROUTING_INFO: "routing_info";
@@ -81,6 +82,19 @@ export declare const WA_NODE_TAGS: Readonly<{
     readonly TEXT_STATUS: "text_status";
     readonly DISAPPEARING_MODE: "disappearing_mode";
     readonly BUSINESS: "business";
+    readonly PUB_KEY: "pub-key";
+    readonly KEY_INDEX_LIST: "key-index-list";
+    readonly CLIENT_PROPS: "client-props";
+    readonly PEM: "pem";
+    readonly TTL: "ttl";
+    readonly KEY_ID: "key_id";
+    readonly REMOVE_COMPANION_DEVICE: "remove-companion-device";
+    readonly PRIMARY_IDENTITY_PUB: "primary_identity_pub";
+    readonly COMPANION_IDENTITY_PUBLIC: "companion_identity_public";
+    readonly COMPANION_SERVER_AUTH_KEY_PUB: "companion_server_auth_key_pub";
+    readonly LINK_CODE_PAIRING_WRAPPED_PRIMARY_EPHEMERAL_PUB: "link_code_pairing_wrapped_primary_ephemeral_pub";
+    readonly LINK_CODE_PAIRING_WRAPPED_COMPANION_EPHEMERAL_PUB: "link_code_pairing_wrapped_companion_ephemeral_pub";
+    readonly LINK_CODE_PAIRING_WRAPPED_KEY_BUNDLE: "link_code_pairing_wrapped_key_bundle";
 }>;
 export declare const WA_IQ_TYPES: Readonly<{
     readonly GET: "get";

package/dist/protocol/nodes.js

@@ -13,6 +13,7 @@ exports.WA_NODE_TAGS = Object.freeze({
     NOTIFICATION: 'notification',
     SUCCESS: 'success',
     INFO_BULLETIN: 'ib',
+    OFFLINE: 'offline',
     DIRTY: 'dirty',
     EDGE_ROUTING: 'edge_routing',
     ROUTING_INFO: 'routing_info',
@@ -83,7 +84,20 @@ exports.WA_NODE_TAGS = Object.freeze({
     USERNAME: 'username',
     TEXT_STATUS: 'text_status',
     DISAPPEARING_MODE: 'disappearing_mode',
-    BUSINESS: 'business'
+    BUSINESS: 'business',
+    PUB_KEY: 'pub-key',
+    KEY_INDEX_LIST: 'key-index-list',
+    CLIENT_PROPS: 'client-props',
+    PEM: 'pem',
+    TTL: 'ttl',
+    KEY_ID: 'key_id',
+    REMOVE_COMPANION_DEVICE: 'remove-companion-device',
+    PRIMARY_IDENTITY_PUB: 'primary_identity_pub',
+    COMPANION_IDENTITY_PUBLIC: 'companion_identity_public',
+    COMPANION_SERVER_AUTH_KEY_PUB: 'companion_server_auth_key_pub',
+    LINK_CODE_PAIRING_WRAPPED_PRIMARY_EPHEMERAL_PUB: 'link_code_pairing_wrapped_primary_ephemeral_pub',
+    LINK_CODE_PAIRING_WRAPPED_COMPANION_EPHEMERAL_PUB: 'link_code_pairing_wrapped_companion_ephemeral_pub',
+    LINK_CODE_PAIRING_WRAPPED_KEY_BUNDLE: 'link_code_pairing_wrapped_key_bundle'
 });
 exports.WA_IQ_TYPES = Object.freeze({
     GET: 'get',

package/dist/retry/replay.js

@@ -200,8 +200,8 @@ class WaRetryReplayService {
             addressingMode: isStatus
                 ? undefined
                 : requesterAddress.server === constants_1.WA_DEFAULTS.LID_SERVER
-                    ? 'lid'
-                    : 'pn',
+                    ? constants_1.WA_ADDRESSING_MODES.LID
+                    : constants_1.WA_ADDRESSING_MODES.PN,
             encType: encrypted.type,
             ciphertext: encrypted.ciphertext,
             retryCount,

package/dist/signal/attestation/WaAdvSignature.d.ts

@@ -1,5 +1,54 @@
 import type { SignalKeyPair } from '../../crypto/curves/types';
-export { ADV_PREFIX_ACCOUNT_SIGNATURE, ADV_PREFIX_DEVICE_SIGNATURE, ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE } from '../attestation/constants';
+export { ADV_PREFIX_ACCOUNT_KEY_INDEX, ADV_PREFIX_ACCOUNT_SIGNATURE, ADV_PREFIX_DEVICE_SIGNATURE, ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE } from '../attestation/constants';
+/**
+ * Companion-side check that the primary's account key signed a device identity.
+ * Verifies `accountSignature` over `prefix || details || identityPublicKey`
+ * against the account signature public key. Inverse of
+ * {@link generateDeviceIdentityAccountSignature}.
+ */
 export declare function verifyDeviceIdentityAccountSignature(details: Uint8Array, accountSignature: Uint8Array, identityPublicKey: Uint8Array, accountSignatureKey: Uint8Array, isHosted?: boolean): Promise<boolean>;
+/**
+ * Companion-side signature proving possession of the identity private key after
+ * adopting a primary-signed identity. Signs
+ * `prefix || details || identityKeyPair.pubKey || accountSignatureKey`, and is
+ * verified by the primary via {@link verifyDeviceSignature}.
+ */
 export declare function generateDeviceSignature(details: Uint8Array, identityKeyPair: SignalKeyPair, accountSignatureKey: Uint8Array, isHosted?: boolean): Promise<Uint8Array>;
+/**
+ * HMAC-SHA256 over an `ADVSignedDeviceIdentity` (or hosted-prefixed variant)
+ * keyed by the shared ADV secret, binding the signed identity to the pairing
+ * secret inside `ADVSignedDeviceIdentityHMAC`.
+ */
 export declare function computeAdvIdentityHmac(secretKey: Uint8Array, details: Uint8Array): Uint8Array;
+/**
+ * Primary-side counterpart to {@link verifyDeviceIdentityAccountSignature}.
+ * Signs a companion's `ADVDeviceIdentity` details with the account (primary)
+ * identity key so a linking companion can prove the primary authorized this
+ * device. The signed message is `prefix || details || companionIdentityPublicKey`.
+ *
+ * `accountIdentityKeyPair` is the primary's own Signal identity key pair; its
+ * public half is what ships as `ADVSignedDeviceIdentity.accountSignatureKey`.
+ * Pass `companionIdentityPublicKey` in the exact byte form the companion will
+ * present at verification (the value carried in its pairing QR / key bundle).
+ */
+export declare function generateDeviceIdentityAccountSignature(details: Uint8Array, companionIdentityPublicKey: Uint8Array, accountIdentityKeyPair: SignalKeyPair, isHosted?: boolean): Promise<Uint8Array>;
+/**
+ * Primary-side counterpart to {@link generateDeviceSignature}. Verifies the
+ * device signature a companion returns after adopting a signed identity, which
+ * proves the companion holds the identity private key it registered. The signed
+ * message is `prefix || details || companionIdentityPublicKey || accountSignatureKey`.
+ */
+export declare function verifyDeviceSignature(details: Uint8Array, deviceSignature: Uint8Array, companionIdentityPublicKey: Uint8Array, accountSignatureKey: Uint8Array, isHosted?: boolean): Promise<boolean>;
+/**
+ * Signs an `ADVKeyIndexList` details blob with the account (primary) identity
+ * key. A primary republishes this list whenever its companion set changes so
+ * every device can validate the current set of key indexes. The signed message
+ * is `prefix || keyIndexListDetails`.
+ */
+export declare function signKeyIndexList(keyIndexListDetails: Uint8Array, accountIdentityKeyPair: SignalKeyPair, isHosted?: boolean): Promise<Uint8Array>;
+/**
+ * Verifies an `ADVSignedKeyIndexList` account signature against the primary's
+ * account signature key. Inverse of {@link signKeyIndexList}; used by a device
+ * to validate a key-index list published by the primary.
+ */
+export declare function verifyKeyIndexListSignature(keyIndexListDetails: Uint8Array, accountSignature: Uint8Array, accountSignatureKey: Uint8Array, isHosted?: boolean): Promise<boolean>;

package/dist/signal/attestation/WaAdvSignature.js

@@ -1,26 +1,96 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE = exports.ADV_PREFIX_DEVICE_SIGNATURE = exports.ADV_PREFIX_ACCOUNT_SIGNATURE = void 0;
+exports.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE = exports.ADV_PREFIX_DEVICE_SIGNATURE = exports.ADV_PREFIX_ACCOUNT_SIGNATURE = exports.ADV_PREFIX_ACCOUNT_KEY_INDEX = void 0;
 exports.verifyDeviceIdentityAccountSignature = verifyDeviceIdentityAccountSignature;
 exports.generateDeviceSignature = generateDeviceSignature;
 exports.computeAdvIdentityHmac = computeAdvIdentityHmac;
+exports.generateDeviceIdentityAccountSignature = generateDeviceIdentityAccountSignature;
+exports.verifyDeviceSignature = verifyDeviceSignature;
+exports.signKeyIndexList = signKeyIndexList;
+exports.verifyKeyIndexListSignature = verifyKeyIndexListSignature;
 const _crypto_1 = require("../../crypto");
 const constants_1 = require("../attestation/constants");
 const bytes_1 = require("../../util/bytes");
 var constants_2 = require("../attestation/constants");
+Object.defineProperty(exports, "ADV_PREFIX_ACCOUNT_KEY_INDEX", { enumerable: true, get: function () { return constants_2.ADV_PREFIX_ACCOUNT_KEY_INDEX; } });
 Object.defineProperty(exports, "ADV_PREFIX_ACCOUNT_SIGNATURE", { enumerable: true, get: function () { return constants_2.ADV_PREFIX_ACCOUNT_SIGNATURE; } });
 Object.defineProperty(exports, "ADV_PREFIX_DEVICE_SIGNATURE", { enumerable: true, get: function () { return constants_2.ADV_PREFIX_DEVICE_SIGNATURE; } });
 Object.defineProperty(exports, "ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE", { enumerable: true, get: function () { return constants_2.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE; } });
+/**
+ * Companion-side check that the primary's account key signed a device identity.
+ * Verifies `accountSignature` over `prefix || details || identityPublicKey`
+ * against the account signature public key. Inverse of
+ * {@link generateDeviceIdentityAccountSignature}.
+ */
 async function verifyDeviceIdentityAccountSignature(details, accountSignature, identityPublicKey, accountSignatureKey, isHosted = false) {
     const prefix = isHosted ? constants_1.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE : constants_1.ADV_PREFIX_ACCOUNT_SIGNATURE;
     const message = (0, bytes_1.concatBytes)([prefix, details, identityPublicKey]);
     return (0, _crypto_1.xeddsaVerify)((0, _crypto_1.toRawPubKey)(accountSignatureKey), message, accountSignature);
 }
+/**
+ * Companion-side signature proving possession of the identity private key after
+ * adopting a primary-signed identity. Signs
+ * `prefix || details || identityKeyPair.pubKey || accountSignatureKey`, and is
+ * verified by the primary via {@link verifyDeviceSignature}.
+ */
 async function generateDeviceSignature(details, identityKeyPair, accountSignatureKey, isHosted = false) {
     const prefix = isHosted ? constants_1.ADV_PREFIX_HOSTED_DEVICE_SIGNATURE : constants_1.ADV_PREFIX_DEVICE_SIGNATURE;
     const message = (0, bytes_1.concatBytes)([prefix, details, identityKeyPair.pubKey, accountSignatureKey]);
     return (0, _crypto_1.xeddsaSign)(identityKeyPair.privKey, message);
 }
+/**
+ * HMAC-SHA256 over an `ADVSignedDeviceIdentity` (or hosted-prefixed variant)
+ * keyed by the shared ADV secret, binding the signed identity to the pairing
+ * secret inside `ADVSignedDeviceIdentityHMAC`.
+ */
 function computeAdvIdentityHmac(secretKey, details) {
     return (0, _crypto_1.hmacSha256Sign)(secretKey, details);
 }
+/**
+ * Primary-side counterpart to {@link verifyDeviceIdentityAccountSignature}.
+ * Signs a companion's `ADVDeviceIdentity` details with the account (primary)
+ * identity key so a linking companion can prove the primary authorized this
+ * device. The signed message is `prefix || details || companionIdentityPublicKey`.
+ *
+ * `accountIdentityKeyPair` is the primary's own Signal identity key pair; its
+ * public half is what ships as `ADVSignedDeviceIdentity.accountSignatureKey`.
+ * Pass `companionIdentityPublicKey` in the exact byte form the companion will
+ * present at verification (the value carried in its pairing QR / key bundle).
+ */
+async function generateDeviceIdentityAccountSignature(details, companionIdentityPublicKey, accountIdentityKeyPair, isHosted = false) {
+    const prefix = isHosted ? constants_1.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE : constants_1.ADV_PREFIX_ACCOUNT_SIGNATURE;
+    const message = (0, bytes_1.concatBytes)([prefix, details, companionIdentityPublicKey]);
+    return (0, _crypto_1.xeddsaSign)(accountIdentityKeyPair.privKey, message);
+}
+/**
+ * Primary-side counterpart to {@link generateDeviceSignature}. Verifies the
+ * device signature a companion returns after adopting a signed identity, which
+ * proves the companion holds the identity private key it registered. The signed
+ * message is `prefix || details || companionIdentityPublicKey || accountSignatureKey`.
+ */
+async function verifyDeviceSignature(details, deviceSignature, companionIdentityPublicKey, accountSignatureKey, isHosted = false) {
+    const prefix = isHosted ? constants_1.ADV_PREFIX_HOSTED_DEVICE_SIGNATURE : constants_1.ADV_PREFIX_DEVICE_SIGNATURE;
+    const message = (0, bytes_1.concatBytes)([prefix, details, companionIdentityPublicKey, accountSignatureKey]);
+    return (0, _crypto_1.xeddsaVerify)((0, _crypto_1.toRawPubKey)(companionIdentityPublicKey), message, deviceSignature);
+}
+/**
+ * Signs an `ADVKeyIndexList` details blob with the account (primary) identity
+ * key. A primary republishes this list whenever its companion set changes so
+ * every device can validate the current set of key indexes. The signed message
+ * is `prefix || keyIndexListDetails`.
+ */
+async function signKeyIndexList(keyIndexListDetails, accountIdentityKeyPair, isHosted = false) {
+    const prefix = isHosted ? constants_1.ADV_PREFIX_HOSTED_ACCOUNT_KEY_INDEX : constants_1.ADV_PREFIX_ACCOUNT_KEY_INDEX;
+    const message = (0, bytes_1.concatBytes)([prefix, keyIndexListDetails]);
+    return (0, _crypto_1.xeddsaSign)(accountIdentityKeyPair.privKey, message);
+}
+/**
+ * Verifies an `ADVSignedKeyIndexList` account signature against the primary's
+ * account signature key. Inverse of {@link signKeyIndexList}; used by a device
+ * to validate a key-index list published by the primary.
+ */
+async function verifyKeyIndexListSignature(keyIndexListDetails, accountSignature, accountSignatureKey, isHosted = false) {
+    const prefix = isHosted ? constants_1.ADV_PREFIX_HOSTED_ACCOUNT_KEY_INDEX : constants_1.ADV_PREFIX_ACCOUNT_KEY_INDEX;
+    const message = (0, bytes_1.concatBytes)([prefix, keyIndexListDetails]);
+    return (0, _crypto_1.xeddsaVerify)((0, _crypto_1.toRawPubKey)(accountSignatureKey), message, accountSignature);
+}

package/dist/signal/attestation/constants.d.ts

@@ -1,4 +1,6 @@
 export declare const ADV_PREFIX_ACCOUNT_SIGNATURE: Readonly<Uint8Array>;
 export declare const ADV_PREFIX_DEVICE_SIGNATURE: Readonly<Uint8Array>;
+export declare const ADV_PREFIX_ACCOUNT_KEY_INDEX: Readonly<Uint8Array>;
 export declare const ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE: Readonly<Uint8Array>;
 export declare const ADV_PREFIX_HOSTED_DEVICE_SIGNATURE: Readonly<Uint8Array>;
+export declare const ADV_PREFIX_HOSTED_ACCOUNT_KEY_INDEX: Readonly<Uint8Array>;

package/dist/signal/attestation/constants.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ADV_PREFIX_HOSTED_DEVICE_SIGNATURE = exports.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE = exports.ADV_PREFIX_DEVICE_SIGNATURE = exports.ADV_PREFIX_ACCOUNT_SIGNATURE = void 0;
+exports.ADV_PREFIX_HOSTED_ACCOUNT_KEY_INDEX = exports.ADV_PREFIX_HOSTED_DEVICE_SIGNATURE = exports.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE = exports.ADV_PREFIX_ACCOUNT_KEY_INDEX = exports.ADV_PREFIX_DEVICE_SIGNATURE = exports.ADV_PREFIX_ACCOUNT_SIGNATURE = void 0;
 exports.ADV_PREFIX_ACCOUNT_SIGNATURE = new Uint8Array([6, 0]);
 exports.ADV_PREFIX_DEVICE_SIGNATURE = new Uint8Array([6, 1]);
+exports.ADV_PREFIX_ACCOUNT_KEY_INDEX = new Uint8Array([6, 2]);
 exports.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE = new Uint8Array([6, 5]);
 exports.ADV_PREFIX_HOSTED_DEVICE_SIGNATURE = new Uint8Array([6, 6]);
+exports.ADV_PREFIX_HOSTED_ACCOUNT_KEY_INDEX = new Uint8Array([6, 7]);

package/dist/signal/index.d.ts

@@ -16,3 +16,4 @@ export { SenderKeyManager } from './group/SenderKeyManager';
 export { createAndStoreInitialKeys } from './registration/utils';
 export { SignalProtocol } from './session/SignalProtocol';
 export { createSignalSessionResolver, type SignalSessionResolver } from './session/resolver';
+export { ADV_PREFIX_ACCOUNT_KEY_INDEX, ADV_PREFIX_ACCOUNT_SIGNATURE, ADV_PREFIX_DEVICE_SIGNATURE, ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, computeAdvIdentityHmac, generateDeviceIdentityAccountSignature, generateDeviceSignature, signKeyIndexList, verifyDeviceIdentityAccountSignature, verifyDeviceSignature, verifyKeyIndexListSignature } from './attestation/WaAdvSignature';

package/dist/signal/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createSignalSessionResolver = exports.SignalProtocol = exports.createAndStoreInitialKeys = exports.SenderKeyManager = exports.SignalSessionSyncApi = exports.SignalRotateKeyApi = exports.SignalMissingPreKeysSyncApi = exports.SignalIdentitySyncApi = exports.SignalDeviceSyncApi = exports.SignalDigestSyncApi = exports.parsePreKeyUploadFailure = exports.buildPreKeyUploadIq = exports.generateSignedPreKey = exports.generateRegistrationInfo = exports.generateRegistrationId = exports.generatePreKeyPair = exports.encodeSenderKeyRecord = exports.decodeSenderKeyRecord = exports.decodeSenderKeyDistributionRow = exports.decodeSignalSignedPreKeyRow = exports.decodeSignalRegistrationRow = exports.decodeSignalPreKeyRow = exports.encodeSignalSessionRecord = exports.decodeSignalSessionRecord = exports.decodeSignalRemoteIdentity = exports.toSignalAddressParts = exports.decodeStoreCount = void 0;
+exports.verifyKeyIndexListSignature = exports.verifyDeviceSignature = exports.verifyDeviceIdentityAccountSignature = exports.signKeyIndexList = exports.generateDeviceSignature = exports.generateDeviceIdentityAccountSignature = exports.computeAdvIdentityHmac = exports.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE = exports.ADV_PREFIX_DEVICE_SIGNATURE = exports.ADV_PREFIX_ACCOUNT_SIGNATURE = exports.ADV_PREFIX_ACCOUNT_KEY_INDEX = exports.createSignalSessionResolver = exports.SignalProtocol = exports.createAndStoreInitialKeys = exports.SenderKeyManager = exports.SignalSessionSyncApi = exports.SignalRotateKeyApi = exports.SignalMissingPreKeysSyncApi = exports.SignalIdentitySyncApi = exports.SignalDeviceSyncApi = exports.SignalDigestSyncApi = exports.parsePreKeyUploadFailure = exports.buildPreKeyUploadIq = exports.generateSignedPreKey = exports.generateRegistrationInfo = exports.generateRegistrationId = exports.generatePreKeyPair = exports.encodeSenderKeyRecord = exports.decodeSenderKeyRecord = exports.decodeSenderKeyDistributionRow = exports.decodeSignalSignedPreKeyRow = exports.decodeSignalRegistrationRow = exports.decodeSignalPreKeyRow = exports.encodeSignalSessionRecord = exports.decodeSignalSessionRecord = exports.decodeSignalRemoteIdentity = exports.toSignalAddressParts = exports.decodeStoreCount = void 0;
 var encoding_1 = require("./encoding");
 Object.defineProperty(exports, "decodeStoreCount", { enumerable: true, get: function () { return encoding_1.decodeStoreCount; } });
 Object.defineProperty(exports, "toSignalAddressParts", { enumerable: true, get: function () { return encoding_1.toSignalAddressParts; } });
@@ -44,3 +44,15 @@ var SignalProtocol_1 = require("./session/SignalProtocol");
 Object.defineProperty(exports, "SignalProtocol", { enumerable: true, get: function () { return SignalProtocol_1.SignalProtocol; } });
 var resolver_1 = require("./session/resolver");
 Object.defineProperty(exports, "createSignalSessionResolver", { enumerable: true, get: function () { return resolver_1.createSignalSessionResolver; } });
+var WaAdvSignature_1 = require("./attestation/WaAdvSignature");
+Object.defineProperty(exports, "ADV_PREFIX_ACCOUNT_KEY_INDEX", { enumerable: true, get: function () { return WaAdvSignature_1.ADV_PREFIX_ACCOUNT_KEY_INDEX; } });
+Object.defineProperty(exports, "ADV_PREFIX_ACCOUNT_SIGNATURE", { enumerable: true, get: function () { return WaAdvSignature_1.ADV_PREFIX_ACCOUNT_SIGNATURE; } });
+Object.defineProperty(exports, "ADV_PREFIX_DEVICE_SIGNATURE", { enumerable: true, get: function () { return WaAdvSignature_1.ADV_PREFIX_DEVICE_SIGNATURE; } });
+Object.defineProperty(exports, "ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE", { enumerable: true, get: function () { return WaAdvSignature_1.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE; } });
+Object.defineProperty(exports, "computeAdvIdentityHmac", { enumerable: true, get: function () { return WaAdvSignature_1.computeAdvIdentityHmac; } });
+Object.defineProperty(exports, "generateDeviceIdentityAccountSignature", { enumerable: true, get: function () { return WaAdvSignature_1.generateDeviceIdentityAccountSignature; } });
+Object.defineProperty(exports, "generateDeviceSignature", { enumerable: true, get: function () { return WaAdvSignature_1.generateDeviceSignature; } });
+Object.defineProperty(exports, "signKeyIndexList", { enumerable: true, get: function () { return WaAdvSignature_1.signKeyIndexList; } });
+Object.defineProperty(exports, "verifyDeviceIdentityAccountSignature", { enumerable: true, get: function () { return WaAdvSignature_1.verifyDeviceIdentityAccountSignature; } });
+Object.defineProperty(exports, "verifyDeviceSignature", { enumerable: true, get: function () { return WaAdvSignature_1.verifyDeviceSignature; } });
+Object.defineProperty(exports, "verifyKeyIndexListSignature", { enumerable: true, get: function () { return WaAdvSignature_1.verifyKeyIndexListSignature; } });

package/dist/transport/index.d.ts

@@ -1,8 +1,8 @@
 export type { BinaryNode, RawWebSocket, RawWebSocketConstructor, WaRawWebSocketInit, SocketCloseInfo, SocketOpenInfo, WaCommsConfig, WaCommsState, WaNoiseConfig, WaProxyAgent, WaProxyDispatcher, WaProxyTransport, WaSocketConfig, WaSocketHandlers } from './types';
 export { decodeBinaryNode, decodeBinaryNodeStanza, encodeBinaryNode, encodeBinaryNodeStanza } from './binary';
 export { isProxyAgent, isProxyDispatcher, isProxyTransport, toProxyAgent, toProxyDispatcher } from './proxy';
-export { fetchLatestWaWebVersion } from './wa-web-version-fetcher';
-export type { WaFetchLatestWebVersionOptions, WaLatestWebVersion } from './wa-web-version-fetcher';
+export { fetchLatestWaWebVersion, fetchLatestWaMobileVersion } from './wa-version-fetcher';
+export type { WaFetchVersionOptions, WaFetchLatestWebVersionOptions, WaFetchLatestMobileVersionOptions, WaLatestWebVersion, WaLatestMobileVersion } from './wa-version-fetcher';
 export { WaComms } from './WaComms';
 export { verifyNoiseCertificateChain, type WaNoiseRootCa } from './noise/WaNoiseCert';
 export { WaNoiseHandshake } from './noise/WaNoiseHandshake';

package/dist/transport/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hasNodeChild = exports.getNodeTextContent = exports.getNodeChildrenByTag = exports.getNodeChildren = exports.getFirstNodeChild = exports.findNodeChild = exports.buildReceiptNode = exports.buildAckNode = exports.queryWithContext = exports.parseIqError = exports.buildIqNode = exports.assertIqResult = exports.buildMobileLoginPayload = exports.WaMobileTcpSocketCtor = exports.WaMobileTcpSocket = exports.WaNodeTransport = exports.WaNodeOrchestrator = exports.WaKeepAlive = exports.WaWebSocket = exports.WaNoiseSocket = exports.WaNoiseHandshake = exports.verifyNoiseCertificateChain = exports.WaComms = exports.fetchLatestWaWebVersion = exports.toProxyDispatcher = exports.toProxyAgent = exports.isProxyTransport = exports.isProxyDispatcher = exports.isProxyAgent = exports.encodeBinaryNodeStanza = exports.encodeBinaryNode = exports.decodeBinaryNodeStanza = exports.decodeBinaryNode = void 0;
+exports.hasNodeChild = exports.getNodeTextContent = exports.getNodeChildrenByTag = exports.getNodeChildren = exports.getFirstNodeChild = exports.findNodeChild = exports.buildReceiptNode = exports.buildAckNode = exports.queryWithContext = exports.parseIqError = exports.buildIqNode = exports.assertIqResult = exports.buildMobileLoginPayload = exports.WaMobileTcpSocketCtor = exports.WaMobileTcpSocket = exports.WaNodeTransport = exports.WaNodeOrchestrator = exports.WaKeepAlive = exports.WaWebSocket = exports.WaNoiseSocket = exports.WaNoiseHandshake = exports.verifyNoiseCertificateChain = exports.WaComms = exports.fetchLatestWaMobileVersion = exports.fetchLatestWaWebVersion = exports.toProxyDispatcher = exports.toProxyAgent = exports.isProxyTransport = exports.isProxyDispatcher = exports.isProxyAgent = exports.encodeBinaryNodeStanza = exports.encodeBinaryNode = exports.decodeBinaryNodeStanza = exports.decodeBinaryNode = void 0;
 var binary_1 = require("./binary");
 Object.defineProperty(exports, "decodeBinaryNode", { enumerable: true, get: function () { return binary_1.decodeBinaryNode; } });
 Object.defineProperty(exports, "decodeBinaryNodeStanza", { enumerable: true, get: function () { return binary_1.decodeBinaryNodeStanza; } });
@@ -12,8 +12,9 @@ Object.defineProperty(exports, "isProxyDispatcher", { enumerable: true, get: fun
 Object.defineProperty(exports, "isProxyTransport", { enumerable: true, get: function () { return proxy_1.isProxyTransport; } });
 Object.defineProperty(exports, "toProxyAgent", { enumerable: true, get: function () { return proxy_1.toProxyAgent; } });
 Object.defineProperty(exports, "toProxyDispatcher", { enumerable: true, get: function () { return proxy_1.toProxyDispatcher; } });
-var wa_web_version_fetcher_1 = require("./wa-web-version-fetcher");
-Object.defineProperty(exports, "fetchLatestWaWebVersion", { enumerable: true, get: function () { return wa_web_version_fetcher_1.fetchLatestWaWebVersion; } });
+var wa_version_fetcher_1 = require("./wa-version-fetcher");
+Object.defineProperty(exports, "fetchLatestWaWebVersion", { enumerable: true, get: function () { return wa_version_fetcher_1.fetchLatestWaWebVersion; } });
+Object.defineProperty(exports, "fetchLatestWaMobileVersion", { enumerable: true, get: function () { return wa_version_fetcher_1.fetchLatestWaMobileVersion; } });
 var WaComms_1 = require("./WaComms");
 Object.defineProperty(exports, "WaComms", { enumerable: true, get: function () { return WaComms_1.WaComms; } });
 var WaNoiseCert_1 = require("./noise/WaNoiseCert");

package/dist/transport/node/builders/group.js

@@ -12,6 +12,7 @@ exports.buildSetGroupMemberShareGroupHistoryModeIq = buildSetGroupMemberShareGro
 exports.buildSetGroupEphemeralIq = buildSetGroupEphemeralIq;
 exports.buildJoinLinkedGroupIq = buildJoinLinkedGroupIq;
 const defaults_1 = require("../../../protocol/defaults");
+const group_1 = require("../../../protocol/group");
 const nodes_1 = require("../../../protocol/nodes");
 const query_1 = require("../../node/query");
 function buildCreateGroupIq(input) {
@@ -89,20 +90,20 @@ function buildMembershipRequestsActionIq(input) {
     const children = [];
     if (approve.length > 0) {
         children.push({
-            tag: 'approve',
+            tag: group_1.WA_GROUP_MEMBERSHIP_ACTION_TAGS.APPROVE,
             attrs: {},
             content: approve.map((jid) => ({ tag: 'participant', attrs: { jid } }))
         });
     }
     if (reject.length > 0) {
         children.push({
-            tag: 'reject',
+            tag: group_1.WA_GROUP_MEMBERSHIP_ACTION_TAGS.REJECT,
             attrs: {},
             content: reject.map((jid) => ({ tag: 'participant', attrs: { jid } }))
         });
     }
     return (0, query_1.buildIqNode)(nodes_1.WA_IQ_TYPES.SET, input.groupJid, nodes_1.WA_XMLNS.GROUPS, [
-        { tag: 'membership_requests_action', attrs: {}, content: children }
+        { tag: group_1.WA_GROUP_MEMBERSHIP_ACTION_TAGS.REQUESTS_ACTION, attrs: {}, content: children }
     ]);
 }
 function buildCancelMembershipRequestsIq(input) {

package/dist/transport/node/builders/mobile.d.ts

@@ -0,0 +1,68 @@
+import type { BinaryNode } from '../../types';
+/**
+ * `ClientPairingProps` the primary declares in the `<client-props>` pair-device
+ * element. A LID-native account must send `isChatDbLidMigrated: true` (with
+ * `isSyncdPureLidSession`) so the companion runs `setIsLidMigrated` before
+ * fetching its LID-addressed blocklist; without it the companion self-removes
+ * with `lid_blocklist_chat_db_unmigrated`.
+ */
+export interface ClientPairingProps {
+    readonly isChatDbLidMigrated: boolean;
+    readonly isSyncdPureLidSession: boolean;
+    readonly isSyncdSnapshotRecoveryEnabled: boolean;
+}
+export interface PairDeviceIqInput {
+    readonly ref: string;
+    readonly companionNoisePublicKey: Uint8Array;
+    readonly deviceIdentityBytes: Uint8Array;
+    readonly keyIndexListBytes: Uint8Array;
+    readonly keyIndexListTimestampSeconds: number;
+    readonly clientProps?: ClientPairingProps;
+    readonly pem?: {
+        readonly aesGcmKeyBytes: Uint8Array;
+        readonly ttlSeconds: number;
+    };
+}
+/**
+ * Builds the primary's `<iq type="set" xmlns="md">` carrying `<pair-device>`
+ * with `ref`, `pub-key`, `device-identity`, `key-index-list`, and optional
+ * `client-props`/`pem` children. The `id` is assigned by the send path.
+ */
+export declare function buildPairDeviceIq(input: PairDeviceIqInput): BinaryNode;
+/**
+ * Builds the standalone key-index-list publish `<iq>` the primary sends when its
+ * companion set changes.
+ */
+export declare function buildKeyIndexListPublishIq(input: {
+    readonly keyIndexListBytes: Uint8Array;
+    readonly timestampSeconds: number;
+}): BinaryNode;
+/**
+ * Builds the `remove-companion-device` IQ that unlinks a companion from the
+ * account. The device is identified by its full device jid; `reason` is a
+ * free-form label the server records.
+ */
+export declare function buildRemoveCompanionDeviceIq(input: {
+    readonly deviceJid: string;
+    readonly reason: string;
+}): BinaryNode;
+/**
+ * Builds the `remove-companion-device` IQ that unlinks EVERY companion in one
+ * stanza: `all="true"` (no `jid`), mirroring the phone's "log out all companion
+ * devices". `excludeHostedCompanion` adds `exclude_hosted_companion="true"` to
+ * spare companions this account itself hosts.
+ */
+export declare function buildRemoveAllCompanionDevicesIq(input: {
+    readonly reason: string;
+    readonly excludeHostedCompanion?: boolean;
+}): BinaryNode;
+/**
+ * Builds the `primary_hello` IQ the primary sends to drive a link-code (pairing
+ * code) handshake: the code-wrapped primary ephemeral, the primary ADV identity
+ * public key, and the companion's pairing ref.
+ */
+export declare function buildPrimaryHelloIq(input: {
+    readonly ref: string;
+    readonly wrappedPrimaryEphemeralPub: Uint8Array;
+    readonly primaryIdentityPub: Uint8Array;
+}): BinaryNode;

package/dist/transport/node/builders/mobile.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPairDeviceIq = buildPairDeviceIq;
+exports.buildKeyIndexListPublishIq = buildKeyIndexListPublishIq;
+exports.buildRemoveCompanionDeviceIq = buildRemoveCompanionDeviceIq;
+exports.buildRemoveAllCompanionDevicesIq = buildRemoveAllCompanionDevicesIq;
+exports.buildPrimaryHelloIq = buildPrimaryHelloIq;
+const _proto_1 = require("../../../proto");
+const defaults_1 = require("../../../protocol/defaults");
+const nodes_1 = require("../../../protocol/nodes");
+const query_1 = require("../../node/query");
+/**
+ * Builds the primary's `<iq type="set" xmlns="md">` carrying `<pair-device>`
+ * with `ref`, `pub-key`, `device-identity`, `key-index-list`, and optional
+ * `client-props`/`pem` children. The `id` is assigned by the send path.
+ */
+function buildPairDeviceIq(input) {
+    const children = [
+        { tag: nodes_1.WA_NODE_TAGS.REF, attrs: {}, content: input.ref },
+        { tag: nodes_1.WA_NODE_TAGS.PUB_KEY, attrs: {}, content: input.companionNoisePublicKey },
+        { tag: nodes_1.WA_NODE_TAGS.DEVICE_IDENTITY, attrs: {}, content: input.deviceIdentityBytes },
+        {
+            tag: nodes_1.WA_NODE_TAGS.KEY_INDEX_LIST,
+            attrs: { ts: String(input.keyIndexListTimestampSeconds) },
+            content: input.keyIndexListBytes
+        }
+    ];
+    if (input.clientProps) {
+        children.push({
+            tag: nodes_1.WA_NODE_TAGS.CLIENT_PROPS,
+            attrs: {},
+            content: _proto_1.proto.ClientPairingProps.encode({
+                isChatDbLidMigrated: input.clientProps.isChatDbLidMigrated,
+                isSyncdPureLidSession: input.clientProps.isSyncdPureLidSession,
+                isSyncdSnapshotRecoveryEnabled: input.clientProps.isSyncdSnapshotRecoveryEnabled
+            }).finish()
+        });
+    }
+    if (input.pem) {
+        children.push({
+            tag: nodes_1.WA_NODE_TAGS.PEM,
+            attrs: { version: '1', algorithm: 'rsa2048' },
+            content: [
+                { tag: nodes_1.WA_NODE_TAGS.PEM, attrs: {}, content: input.pem.aesGcmKeyBytes },
+                { tag: nodes_1.WA_NODE_TAGS.TTL, attrs: { ts_s: String(input.pem.ttlSeconds) } },
+                { tag: nodes_1.WA_NODE_TAGS.KEY_ID, attrs: {}, content: '1' }
+            ]
+        });
+    }
+    return (0, query_1.buildIqNode)(nodes_1.WA_IQ_TYPES.SET, defaults_1.WA_DEFAULTS.HOST_DOMAIN, nodes_1.WA_XMLNS.MD, [
+        { tag: nodes_1.WA_NODE_TAGS.PAIR_DEVICE, attrs: {}, content: children }
+    ]);
+}
+/**
+ * Builds the standalone key-index-list publish `<iq>` the primary sends when its
+ * companion set changes.
+ */
+function buildKeyIndexListPublishIq(input) {
+    return (0, query_1.buildIqNode)(nodes_1.WA_IQ_TYPES.SET, defaults_1.WA_DEFAULTS.HOST_DOMAIN, nodes_1.WA_XMLNS.MD, [
+        {
+            tag: nodes_1.WA_NODE_TAGS.KEY_INDEX_LIST,
+            attrs: { ts: String(input.timestampSeconds) },
+            content: input.keyIndexListBytes
+        }
+    ]);
+}
+/**
+ * Builds the `remove-companion-device` IQ that unlinks a companion from the
+ * account. The device is identified by its full device jid; `reason` is a
+ * free-form label the server records.
+ */
+function buildRemoveCompanionDeviceIq(input) {
+    return (0, query_1.buildIqNode)(nodes_1.WA_IQ_TYPES.SET, defaults_1.WA_DEFAULTS.HOST_DOMAIN, nodes_1.WA_XMLNS.MD, [
+        {
+            tag: nodes_1.WA_NODE_TAGS.REMOVE_COMPANION_DEVICE,
+            attrs: { jid: input.deviceJid, reason: input.reason }
+        }
+    ]);
+}
+/**
+ * Builds the `remove-companion-device` IQ that unlinks EVERY companion in one
+ * stanza: `all="true"` (no `jid`), mirroring the phone's "log out all companion
+ * devices". `excludeHostedCompanion` adds `exclude_hosted_companion="true"` to
+ * spare companions this account itself hosts.
+ */
+function buildRemoveAllCompanionDevicesIq(input) {
+    const attrs = { all: 'true', reason: input.reason };
+    if (input.excludeHostedCompanion) {
+        attrs.exclude_hosted_companion = 'true';
+    }
+    return (0, query_1.buildIqNode)(nodes_1.WA_IQ_TYPES.SET, defaults_1.WA_DEFAULTS.HOST_DOMAIN, nodes_1.WA_XMLNS.MD, [
+        { tag: nodes_1.WA_NODE_TAGS.REMOVE_COMPANION_DEVICE, attrs }
+    ]);
+}
+/**
+ * Builds the `primary_hello` IQ the primary sends to drive a link-code (pairing
+ * code) handshake: the code-wrapped primary ephemeral, the primary ADV identity
+ * public key, and the companion's pairing ref.
+ */
+function buildPrimaryHelloIq(input) {
+    return (0, query_1.buildIqNode)(nodes_1.WA_IQ_TYPES.SET, defaults_1.WA_DEFAULTS.HOST_DOMAIN, nodes_1.WA_XMLNS.MD, [
+        {
+            tag: nodes_1.WA_NODE_TAGS.LINK_CODE_COMPANION_REG,
+            attrs: { stage: 'primary_hello' },
+            content: [
+                {
+                    tag: nodes_1.WA_NODE_TAGS.LINK_CODE_PAIRING_WRAPPED_PRIMARY_EPHEMERAL_PUB,
+                    attrs: {},
+                    content: input.wrappedPrimaryEphemeralPub
+                },
+                {
+                    tag: nodes_1.WA_NODE_TAGS.PRIMARY_IDENTITY_PUB,
+                    attrs: {},
+                    content: input.primaryIdentityPub
+                },
+                { tag: nodes_1.WA_NODE_TAGS.LINK_CODE_PAIRING_REF, attrs: {}, content: input.ref }
+            ]
+        }
+    ]);
+}