@pontalabs/baileys 1.0.6 → 1.0.7

package/lib/Utils/auth-utils.js

@@ -1,290 +1,545 @@
-import NodeCache from '@cacheable/node-cache';
-import { Boom } from '@hapi/boom';
-import { AsyncLocalStorage } from 'async_hooks';
-import { Mutex } from 'async-mutex';
-import { randomBytes } from 'crypto';
-import PQueue from 'p-queue';
-import { DEFAULT_CACHE_TTLS } from '../Defaults/index.js';
-import { Curve, signedKeyPair } from './crypto.js';
-import { delay, generateRegistrationId } from './generics.js';
-import { PreKeyManager } from './pre-key-manager.js';
+"use strict"
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod }
+}
+
+Object.defineProperty(exports, "__esModule", { value: true })
+
+const crypto_1 = require("crypto")
+const node_cache_1 = __importDefault(require("@cacheable/node-cache"))
+const Defaults_1 = require("../Defaults")
+const LRUCache_1 = require("lru-cache") 
+const crypto_2 = require("./crypto")
+const generics_1 = require("./generics")
+const mutex_1 = require("async-mutex") 
+
+
+// Cache bypass for signal-sensitive keys so runtime state doesn't keep stale
+// session/pre-key material alive after decrypt failures or identity rotation.
+const NO_CACHE_TYPES = new Set([
+    'pre-key',
+    'session',
+    'signed-pre-key',
+    'identity-key'
+])
+
 /**
  * Adds caching capability to a SignalKeyStore
  * @param store the store to add caching to
  * @param logger to log trace events
  * @param _cache cache store to use
  */
-export function makeCacheableSignalKeyStore(store, logger, _cache) {
-    const cache = _cache ||
-        new NodeCache({
-            stdTTL: DEFAULT_CACHE_TTLS.SIGNAL_STORE, // 5 minutes
-            useClones: false,
-            deleteOnExpire: true
-        });
+function makeCacheableSignalKeyStore(store, logger, _cache) {
+    const cache = _cache || new node_cache_1.default({
+        stdTTL: Defaults_1.DEFAULT_CACHE_TTLS.SIGNAL_STORE,
+        useClones: false,
+        deleteOnExpire: true,
+    })
+    
     // Mutex for protecting cache operations
-    const cacheMutex = new Mutex();
+    const cacheMutex = new mutex_1.Mutex()
+    
     function getUniqueId(type, id) {
-        return `${type}.${id}`;
+        return `${type}.${id}`
     }
     return {
         async get(type, ids) {
+            if (NO_CACHE_TYPES.has(type)) {
+                logger?.trace({ type, items: ids.length }, 'bypassing cache for sensitive key type')
+                return await store.get(type, ids)
+            }
+
             return cacheMutex.runExclusive(async () => {
-                const data = {};
-                const idsToFetch = [];
+                const data = {}
+                const idsToFetch = []
                 for (const id of ids) {
-                    const item = (await cache.get(getUniqueId(type, id)));
+                    const item = cache.get(getUniqueId(type, id))
                     if (typeof item !== 'undefined') {
-                        data[id] = item;
+                        data[id] = item
                     }
                     else {
-                        idsToFetch.push(id);
+                        idsToFetch.push(id)
                     }
                 }
                 if (idsToFetch.length) {
-                    logger?.trace({ items: idsToFetch.length }, 'loading from store');
-                    const fetched = await store.get(type, idsToFetch);
+                    logger?.trace({ items: idsToFetch.length }, 'loading from store')
+                    const fetched = await store.get(type, idsToFetch)
                     for (const id of idsToFetch) {
-                        const item = fetched[id];
+                        const item = fetched[id]
                         if (item) {
-                            data[id] = item;
-                            // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
-                            await cache.set(getUniqueId(type, id), item);
+                            data[id] = item
+                            cache.set(getUniqueId(type, id), item)
                         }
                     }
                 }
-                return data;
-            });
+                return data
+            })
         },
         async set(data) {
             return cacheMutex.runExclusive(async () => {
-                let keys = 0;
+                let keys = 0
                 for (const type in data) {
+                    if (NO_CACHE_TYPES.has(type)) {
+                        continue
+                    }
                     for (const id in data[type]) {
-                        await cache.set(getUniqueId(type, id), data[type][id]);
-                        keys += 1;
+                        await cache.set(getUniqueId(type, id), data[type][id])
+                        keys += 1
                     }
                 }
-                logger?.trace({ keys }, 'updated cache');
-                await store.set(data);
-            });
+                logger?.trace({ keys }, 'updated cache')
+                await store.set(data)
+            })
         },
         async clear() {
-            await cache.flushAll();
-            await store.clear?.();
+            await cache.flushAll()
+            await store.clear?.call(store)
+        }
+    }
+}
+
+/**
+ * Handles pre-key operations.
+ *
+ * IMPORTANT: locking for this function is provided by the CALLER via the
+ * session-scoped `getKeyTypeMutex(keyType)` mutex (the same one used by
+ * get()/set() for that key type). We intentionally do NOT acquire our own
+ * mutex here anymore.
+ *
+ * Previously this used module-level singleton mutexes (`preKeyMutex`,
+ * `signedPreKeyMutex`) declared OUTSIDE `addTransactionCapability`. Because
+ * those were created once per process (not once per auth state / socket),
+ * every session running in the same Node process shared the exact same
+ * lock. That caused two problems:
+ *   1. Unrelated sessions serialized on each other's pre-key writes
+ *      (needless contention/latency when running multiple accounts).
+ *   2. The lock domain didn't match the one used by get()/withMutexes()
+ *      (`getKeyTypeMutex`), so reads/writes and deletion-validation could
+ *      interleave without real mutual exclusion (TOCTOU race on the
+ *      "does this key still exist" check), which is what let pre-key /
+ *      signed-pre-key state get corrupted under concurrent access.
+ */
+async function handlePreKeyOperations(data, keyType, transactionCache, mutations, logger, isInTransaction, state) {
+    const keyData = data[keyType]
+    if (!keyData)
+        return
+
+    // Ensure structures exist
+    transactionCache[keyType] = transactionCache[keyType] || {}
+    mutations[keyType] = mutations[keyType] || {}
+
+    // Separate deletions from updates for batch processing
+    const deletionKeys = []
+    const updateKeys = []
+
+    for (const keyId in keyData) {
+        if (keyData[keyId] === null) {
+            deletionKeys.push(keyId)
+        }
+        else {
+            updateKeys.push(keyId)
+        }
+    }
+
+    // Process updates first (no validation needed)
+    for (const keyId of updateKeys) {
+        if (transactionCache[keyType]) {
+            transactionCache[keyType][keyId] = keyData[keyId]
+        }
+        if (mutations[keyType]) {
+            mutations[keyType][keyId] = keyData[keyId]
+        }
+    }
+
+    // Process deletions with validation
+    if (deletionKeys.length === 0)
+        return
+
+    if (isInTransaction) {
+        // In transaction, only allow deletion if key exists in cache
+        for (const keyId of deletionKeys) {
+            if (transactionCache[keyType]) {
+                transactionCache[keyType][keyId] = null
+                if (mutations[keyType]) {
+                    // Mark for deletion in mutations
+                    mutations[keyType][keyId] = null
+                }
+            }
+            else {
+                logger.warn(`Skipping deletion of non-existent ${keyType} in transaction: ${keyId}`)
+            }
+        }
+        return
+    }
+
+    // Outside transaction, batch validate all deletions
+    if (!state)
+        return
+
+    const existingKeys = await state.get(keyType, deletionKeys)
+    for (const keyId of deletionKeys) {
+        if (existingKeys[keyId]) {
+            if (transactionCache[keyType])
+                transactionCache[keyType][keyId] = null
+            if (mutations[keyType])
+                mutations[keyType][keyId] = null
         }
-    };
+        else {
+            logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`)
+        }
+    }
+}
+
+/**
+ * Handles normal key operations for transactions
+ */
+function handleNormalKeyOperations(data, key, transactionCache, mutations) {
+    Object.assign(transactionCache[key], data[key])
+    mutations[key] = mutations[key] || {}
+    Object.assign(mutations[key], data[key])
+}
+
+/**
+ * Process pre-key / signed-pre-key deletions with validation.
+ *
+ * NOTE: this is only ever called from inside a `withMutexes([..., keyType, ...])`
+ * block in `set()` below, which already holds the session-scoped
+ * `getKeyTypeMutex(keyType)` lock for the duration of the call. It must NOT
+ * acquire its own mutex here - `async-mutex`'s Mutex is not reentrant, so
+ * doing so would either deadlock (if it tried to re-acquire the same lock)
+ * or - as in the previous version - silently acquire a *different*, global
+ * lock that gave no real protection at all.
+ */
+async function processPreKeyDeletions(data, keyType, state, logger) {
+    const keyData = data[keyType]
+    if (!keyData)
+        return
+
+    // Validate deletions
+    const deletionIds = Object.keys(keyData).filter(id => keyData[id] === null)
+    if (deletionIds.length === 0)
+        return
+
+    const existingKeys = await state.get(keyType, deletionIds)
+    for (const keyId of deletionIds) {
+        if (!existingKeys[keyId]) {
+            logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`)
+            if (data[keyType])
+                delete data[keyType][keyId]
+        }
+    }
+}
+
+/**
+ * Executes a function with mutexes acquired for given key types
+ * Uses async-mutex's runExclusive with efficient batching
+ */
+async function withMutexes(keyTypes, getKeyTypeMutex, fn) {
+    if (keyTypes.length === 0) {
+        return fn()
+    }
+    
+    if (keyTypes.length === 1) {
+        return getKeyTypeMutex(keyTypes[0]).runExclusive(fn)
+    }
+    
+    // For multiple mutexes, sort by key type to prevent deadlocks
+    // Then acquire all mutexes in order using Promise.all for better efficiency
+    const sortedKeyTypes = [...keyTypes].sort()
+    const mutexes = sortedKeyTypes.map(getKeyTypeMutex)
+    
+    // Acquire all mutexes in order to prevent deadlocks
+    const releases = []
+    try {
+        for (const mutex of mutexes) {
+            releases.push(await mutex.acquire())
+        }
+        return await fn()
+    }
+    finally {
+        // Release in reverse order
+        while (releases.length > 0) {
+            const release = releases.pop()
+            if (release)
+                release()
+        }
+    }
 }
+
 /**
- * Adds DB-like transaction capability to the SignalKeyStore
- * Uses AsyncLocalStorage for automatic context management
+ * Adds DB like transaction capability (https://en.wikipedia.org/wiki/Database_transaction) to the SignalKeyStore,
+ * this allows batch read & write operations & improves the performance of the lib
  * @param state the key store to apply this capability to
  * @param logger logger to log events
  * @returns SignalKeyStore with transaction capability
  */
-export const addTransactionCapability = (state, logger, { maxCommitRetries, delayBetweenTriesMs }) => {
-    const txStorage = new AsyncLocalStorage();
-    // Queues for concurrency control (keyed by signal data type - bounded set)
-    const keyQueues = new Map();
-    // Transaction mutexes with reference counting for cleanup
-    const txMutexes = new Map();
-    const txMutexRefCounts = new Map();
-    // Pre-key manager for specialized operations
-    const preKeyManager = new PreKeyManager(state, logger);
-    /**
-     * Get or create a queue for a specific key type
-     */
-    function getQueue(key) {
-        if (!keyQueues.has(key)) {
-            keyQueues.set(key, new PQueue({ concurrency: 1 }));
-        }
-        return keyQueues.get(key);
+const addTransactionCapability = (state, logger, { maxCommitRetries, delayBetweenTriesMs }) => {
+    // number of queries made to the DB during the transaction
+    // only there for logging purposes
+    let dbQueriesInTransaction = 0
+    let transactionCache = {}
+    let mutations = {}
+    
+    // LRU Cache to hold mutexes for different key types
+    const mutexCache = new LRUCache_1.LRUCache({
+        ttl: 60 * 60 * 1000, // 1 hour
+        ttlAutopurge: true,
+        updateAgeOnGet: true
+    })
+    
+    let transactionsInProgress = 0
+    
+    function getKeyTypeMutex(type) {
+        return getMutex(`keytype:${type}`)
     }
-    /**
-     * Get or create a transaction mutex
-     */
-    function getTxMutex(key) {
-        if (!txMutexes.has(key)) {
-            txMutexes.set(key, new Mutex());
-            txMutexRefCounts.set(key, 0);
-        }
-        return txMutexes.get(key);
+    
+    function getSenderKeyMutex(senderKeyName) {
+        return getMutex(`senderkey:${senderKeyName}`)
     }
-    /**
-     * Acquire a reference to a transaction mutex
-     */
-    function acquireTxMutexRef(key) {
-        const count = txMutexRefCounts.get(key) ?? 0;
-        txMutexRefCounts.set(key, count + 1);
+    
+    function getTransactionMutex(key) {
+        return getMutex(`transaction:${key}`)
     }
-    /**
-     * Release a reference to a transaction mutex and cleanup if no longer needed
-     */
-    function releaseTxMutexRef(key) {
-        const count = (txMutexRefCounts.get(key) ?? 1) - 1;
-        txMutexRefCounts.set(key, count);
-        // Cleanup if no more references and mutex is not locked
-        if (count <= 0) {
-            const mutex = txMutexes.get(key);
-            if (mutex && !mutex.isLocked()) {
-                txMutexes.delete(key);
-                txMutexRefCounts.delete(key);
-            }
+    
+    // Get or create a mutex for a specific key name
+    function getMutex(key) {
+        let mutex = mutexCache.get(key)
+        if (!mutex) {
+            mutex = new mutex_1.Mutex()
+            mutexCache.set(key, mutex)
+            logger.info({ key }, 'created new mutex')
         }
+        return mutex
     }
-    /**
-     * Check if currently in a transaction
-     */
+    
+    // Sender key operations with proper mutex sequencing
+    function queueSenderKeyOperation(senderKeyName, operation) {
+        return getSenderKeyMutex(senderKeyName).runExclusive(operation)
+    }
+    
+    // Check if we are currently in a transaction
     function isInTransaction() {
-        return !!txStorage.getStore();
+        return transactionsInProgress > 0
     }
-    /**
-     * Commit transaction with retries
-     */
-    async function commitWithRetry(mutations) {
-        if (Object.keys(mutations).length === 0) {
-            logger.trace('no mutations in transaction');
-            return;
+    
+    // Helper function to handle transaction commit with retries
+    async function commitTransaction() {
+        if (!Object.keys(mutations).length) {
+            logger.trace('no mutations in transaction')
+            return
         }
         logger.trace('committing transaction');
-        for (let attempt = 0; attempt < maxCommitRetries; attempt++) {
+        let tries = maxCommitRetries
+        while (tries > 0) {
+            tries -= 1;
             try {
-                await state.set(mutations);
-                logger.trace({ mutationCount: Object.keys(mutations).length }, 'committed transaction');
-                return;
+                await state.set(mutations)
+                logger.trace({ dbQueriesInTransaction }, 'committed transaction')
+                return
             }
             catch (error) {
-                const retriesLeft = maxCommitRetries - attempt - 1;
-                logger.warn(`failed to commit mutations, retries left=${retriesLeft}`);
-                if (retriesLeft === 0) {
-                    throw error;
+                logger.warn(`failed to commit ${Object.keys(mutations).length} mutations, tries left=${tries}`)
+                if (tries > 0) {
+                    await generics_1.delay(delayBetweenTriesMs)
                 }
-                await delay(delayBetweenTriesMs);
             }
         }
     }
+    
+    // Helper function to clean up transaction state
+    function cleanupTransactionState() {
+        transactionsInProgress -= 1
+        if (transactionsInProgress === 0) {
+            transactionCache = {}
+            mutations = {}
+            dbQueriesInTransaction = 0
+        }
+    }
+    
+    // Helper function to execute work within transaction
+    async function executeTransactionWork(work) {
+        const result = await work()
+        // commit if this is the outermost transaction
+        if (transactionsInProgress === 1) {
+            await commitTransaction()
+        }
+        return result
+    }
+    
     return {
         get: async (type, ids) => {
-            const ctx = txStorage.getStore();
-            if (!ctx) {
-                // No transaction - direct read without exclusive lock for concurrency
-                return state.get(type, ids);
-            }
-            // In transaction - check cache first
-            const cached = ctx.cache[type] || {};
-            const missing = ids.filter(id => !(id in cached));
-            if (missing.length > 0) {
-                ctx.dbQueries++;
-                logger.trace({ type, count: missing.length }, 'fetching missing keys in transaction');
-                const fetched = await getTxMutex(type).runExclusive(() => state.get(type, missing));
-                // Update cache
-                ctx.cache[type] = ctx.cache[type] || {};
-                Object.assign(ctx.cache[type], fetched);
+            if (isInTransaction()) {
+                const dict = transactionCache[type]
+                const idsRequiringFetch = dict ? ids.filter(item => typeof dict[item] === 'undefined') : ids
+                
+                // only fetch if there are any items to fetch
+                if (idsRequiringFetch.length) {
+                    dbQueriesInTransaction += 1
+                    
+                    // Use per-sender-key queue for sender-key operations when possible
+                    if (type === 'sender-key') {
+                        logger.info({ idsRequiringFetch }, 'processing sender keys in transaction')
+                        // For sender keys, process each one with queued operations to maintain serialization
+                        for (const senderKeyName of idsRequiringFetch) {
+                            await queueSenderKeyOperation(senderKeyName, async () => {
+                                logger.info({ senderKeyName }, 'fetching sender key in transaction')
+                                const result = await state.get(type, [senderKeyName])
+                                // Update transaction cache
+                                transactionCache[type] || (transactionCache[type] = {})
+                                Object.assign(transactionCache[type], result)
+                                logger.info({ senderKeyName, hasResult: !!result[senderKeyName] }, 'sender key fetch complete')
+                            })
+                        }
+                    }
+                    else {
+                        // Use runExclusive for cleaner mutex handling
+                        await getKeyTypeMutex(type).runExclusive(async () => {
+                            const result = await state.get(type, idsRequiringFetch)
+                            // Update transaction cache
+                            transactionCache[type] || (transactionCache[type] = {})
+                            Object.assign(transactionCache[type], result)
+                        })
+                    }
+                }
+                return ids.reduce((dict, id) => {
+                    const value = transactionCache[type]?.[id]
+                    if (value) {
+                        dict[id] = value
+                    }
+                    return dict
+                }, {})
             }
-            // Return requested ids from cache
-            const result = {};
-            for (const id of ids) {
-                const value = ctx.cache[type]?.[id];
-                if (value !== undefined && value !== null) {
-                    result[id] = value;
+            else {
+                // Not in transaction, fetch directly with queue protection
+                if (type === 'sender-key') {
+                    // For sender keys, use individual queues to maintain per-key serialization
+                    const results = {}
+                    for (const senderKeyName of ids) {
+                        const result = await queueSenderKeyOperation(senderKeyName, async () => await state.get(type, [senderKeyName]))
+                        Object.assign(results, result)
+                    }
+                    return results
+                }
+                else {
+                    return await getKeyTypeMutex(type).runExclusive(() => state.get(type, ids))
                 }
             }
-            return result;
         },
         set: async (data) => {
-            const ctx = txStorage.getStore();
-            if (!ctx) {
-                // No transaction - direct write with queue protection
-                const types = Object.keys(data);
-                // Process pre-keys with validation
-                for (const type_ of types) {
-                    const type = type_;
-                    if (type === 'pre-key') {
-                        await preKeyManager.validateDeletions(data, type);
+            if (isInTransaction()) {
+                logger.trace({ types: Object.keys(data) }, 'caching in transaction')
+                for (const key_ in data) {
+                    const key = key_
+                    transactionCache[key] = transactionCache[key] || {}
+                    // Special handling for pre-keys and signed-pre-keys.
+                    // Locked via the session-scoped getKeyTypeMutex(key) so this can't
+                    // interleave with a concurrent non-transactional get()/set() for the
+                    // same key type on this SAME auth state - no cross-session locking,
+                    // no lock-domain mismatch.
+                    if (key === 'pre-key' || key === 'signed-pre-key') {
+                        await getKeyTypeMutex(key).runExclusive(() => handlePreKeyOperations(data, key, transactionCache, mutations, logger, true))
+                    }
+                    else {
+                        // Normal handling for other key types
+                        handleNormalKeyOperations(data, key, transactionCache, mutations)
                     }
                 }
-                // Write all data in parallel
-                await Promise.all(types.map(type => getQueue(type).add(async () => {
-                    const typeData = { [type]: data[type] };
-                    await state.set(typeData);
-                })));
-                return;
             }
-            // In transaction - update cache and mutations
-            logger.trace({ types: Object.keys(data) }, 'caching in transaction');
-            for (const key_ in data) {
-                const key = key_;
-                // Ensure structures exist
-                ctx.cache[key] = ctx.cache[key] || {};
-                ctx.mutations[key] = ctx.mutations[key] || {};
-                // Special handling for pre-keys
-                if (key === 'pre-key') {
-                    await preKeyManager.processOperations(data, key, ctx.cache, ctx.mutations, true);
+            else {
+                // Not in transaction, apply directly with mutex protection
+                const hasSenderKeys = 'sender-key' in data
+                const senderKeyNames = hasSenderKeys ? Object.keys(data['sender-key'] || {}) : []
+                if (hasSenderKeys) {
+                    logger.info({ senderKeyNames }, 'processing sender key set operations')
+                    // Handle sender key operations with per-key queues
+                    for (const senderKeyName of senderKeyNames) {
+                        await queueSenderKeyOperation(senderKeyName, async () => {
+                            // Create data subset for this specific sender key
+                            const senderKeyData = {
+                                'sender-key': {
+                                    [senderKeyName]: data['sender-key'][senderKeyName]
+                                }
+                            };
+                            logger.trace({ senderKeyName }, 'storing sender key')
+                            // Apply changes to the store
+                            await state.set(senderKeyData)
+                            logger.trace({ senderKeyName }, 'sender key stored')
+                        })
+                    }
+                    // Handle any non-sender-key data with regular mutexes
+                    const nonSenderKeyData = { ...data }
+                    delete nonSenderKeyData['sender-key']
+                    if (Object.keys(nonSenderKeyData).length > 0) {
+                        await withMutexes(Object.keys(nonSenderKeyData), getKeyTypeMutex, async () => {
+                            // Process pre-keys and signed-pre-keys separately with specialized mutexes
+                            for (const key_ in nonSenderKeyData) {
+                                const keyType = key_
+                                if (keyType === 'pre-key' || keyType === 'signed-pre-key') {
+                                    await processPreKeyDeletions(nonSenderKeyData, keyType, state, logger)
+                                }
+                            }
+                            // Apply changes to the store
+                            await state.set(nonSenderKeyData)
+                        })
+                    }
                 }
                 else {
-                    // Normal key types
-                    Object.assign(ctx.cache[key], data[key]);
-                    Object.assign(ctx.mutations[key], data[key]);
+                    // No sender keys - use original logic
+                    await withMutexes(Object.keys(data), getKeyTypeMutex, async () => {
+                        // Process pre-keys and signed-pre-keys separately with specialized mutexes
+                        for (const key_ in data) {
+                            const keyType = key_
+                            if (keyType === 'pre-key' || keyType === 'signed-pre-key') {
+                                await processPreKeyDeletions(data, keyType, state, logger)
+                            }
+                        }
+                        // Apply changes to the store
+                        await state.set(data)
+                    })
                 }
             }
         },
         isInTransaction,
-        transaction: async (work, key) => {
-            const existing = txStorage.getStore();
-            // Nested transaction - reuse existing context
-            if (existing) {
-                logger.trace('reusing existing transaction context');
-                return work();
-            }
-            // New transaction - acquire mutex and create context
-            const mutex = getTxMutex(key);
-            acquireTxMutexRef(key);
+        async transaction(work, key) {
+            const releaseTxMutex = await getTransactionMutex(key).acquire()
             try {
-                return await mutex.runExclusive(async () => {
-                    const ctx = {
-                        cache: {},
-                        mutations: {},
-                        dbQueries: 0
-                    };
-                    logger.trace('entering transaction');
-                    try {
-                        const result = await txStorage.run(ctx, work);
-                        // Commit mutations
-                        await commitWithRetry(ctx.mutations);
-                        logger.trace({ dbQueries: ctx.dbQueries }, 'transaction completed');
-                        return result;
-                    }
-                    catch (error) {
-                        logger.error({ error }, 'transaction failed, rolling back');
-                        throw error;
-                    }
-                });
+                transactionsInProgress += 1;
+                if (transactionsInProgress === 1) {
+                    logger.trace('entering transaction')
+                }
+                try {
+                    return await executeTransactionWork(work)
+                }
+                finally {
+                    cleanupTransactionState();
+                    // Release AFTER commit & cleanup to prevent race conditions
+                    // where another transaction starts before this one finishes writing
+                    releaseTxMutex()
+                }
             }
-            finally {
-                releaseTxMutexRef(key);
+            catch (error) {
+                // Only release here if we haven't already released in the finally block
+                // (i.e., error thrown before transactionsInProgress was incremented)
+                if (transactionsInProgress > 0) {
+                    cleanupTransactionState()
+                }
+                releaseTxMutex()
+                throw error
             }
         }
-    };
-};
-/**
- * Returns the authenticated user's JID, or throws a Boom-401 if creds are not yet authenticated.
- * Use this anywhere we'd otherwise reach for `creds.me!.id` to fail fast with a descriptive error.
- */
-export const assertMeId = (creds) => {
-    const id = creds.me?.id;
-    if (!id) {
-        throw new Boom('Cannot proceed: socket is not authenticated yet (creds.me.id is missing)', { statusCode: 401 });
     }
-    return id;
-};
-export const initAuthCreds = () => {
-    const identityKey = Curve.generateKeyPair();
+}
+
+const initAuthCreds = () => {
+    const identityKey = crypto_2.Curve.generateKeyPair()
     return {
-        noiseKey: Curve.generateKeyPair(),
-        pairingEphemeralKeyPair: Curve.generateKeyPair(),
+        noiseKey: crypto_2.Curve.generateKeyPair(),
+        pairingEphemeralKeyPair: crypto_2.Curve.generateKeyPair(),
         signedIdentityKey: identityKey,
-        signedPreKey: signedKeyPair(identityKey, 1),
-        registrationId: generateRegistrationId(),
-        advSecretKey: randomBytes(32).toString('base64'),
+        signedPreKey: crypto_2.signedKeyPair(identityKey, 1),
+        registrationId: generics_1.generateRegistrationId(),
+        advSecretKey: crypto_1.randomBytes(32).toString('base64'),
         processedHistoryMessages: [],
         nextPreKeyId: 1,
         firstUnuploadedPreKeyId: 1,
@@ -295,8 +550,12 @@ export const initAuthCreds = () => {
         registered: false,
         pairingCode: undefined,
         lastPropHash: undefined,
-        routingInfo: undefined,
-        additionalData: undefined
-    };
-};
-//# sourceMappingURL=auth-utils.js.map
+        routingInfo: undefined
+    }
+}
+
+module.exports = {
+  makeCacheableSignalKeyStore, 
+  addTransactionCapability, 
+  initAuthCreds
+}