zapo-js 0.1.1 → 0.2.0

package/dist/esm/appstate/WaAppStateSyncResponseParser.js

@@ -1,13 +1,19 @@
 import { parseCollectionName } from './utils.js';
 import { proto } from '../proto.js';
 import { WA_APP_STATE_COLLECTION_STATES, WA_APP_STATE_ERROR_CODES, WA_IQ_TYPES, WA_NODE_TAGS } from '../protocol/constants.js';
-import { decodeNodeContentBase64OrBytes, findNodeChild, getNodeChildrenByTag } from '../transport/node/helpers.js';
+import { decodeNodeContentBase64OrBytes, findNodeChildrenByTags, findNodeChild, getNodeChildrenByTag } from '../transport/node/helpers.js';
 export function parseSyncResponse(iqNode) {
     if (iqNode.tag !== WA_NODE_TAGS.IQ) {
         throw new Error(`invalid sync response tag ${iqNode.tag}`);
     }
     const syncNode = findNodeChild(iqNode, WA_NODE_TAGS.SYNC);
     if (!syncNode) {
+        if (iqNode.attrs.type === WA_IQ_TYPES.ERROR) {
+            const errorNode = findNodeChild(iqNode, WA_NODE_TAGS.ERROR);
+            const code = errorNode?.attrs.code ?? 'unknown';
+            const text = errorNode?.attrs.text ?? 'unknown';
+            throw new Error(`sync iq failed (${code}: ${text})`);
+        }
         throw new Error('sync response is missing <sync> node');
     }
     const payloads = [];
@@ -26,11 +32,16 @@ export function parseSyncResponse(iqNode) {
             }
             version = parsedVersion;
         }
-        const patchesNode = findNodeChild(collectionNode, WA_NODE_TAGS.PATCHES);
-        const patches = patchesNode
-            ? getNodeChildrenByTag(patchesNode, WA_NODE_TAGS.PATCH).map((node) => proto.SyncdPatch.decode(decodeNodeContentBase64OrBytes(node.content, 'collection.patches.patch')))
-            : [];
-        const snapshotNode = findNodeChild(collectionNode, WA_NODE_TAGS.SNAPSHOT);
+        const [patchesNode, snapshotNode] = findNodeChildrenByTags(collectionNode, [
+            WA_NODE_TAGS.PATCHES,
+            WA_NODE_TAGS.SNAPSHOT
+        ]);
+        const patches = [];
+        if (patchesNode) {
+            for (const patchNode of getNodeChildrenByTag(patchesNode, WA_NODE_TAGS.PATCH)) {
+                patches.push(proto.SyncdPatch.decode(decodeNodeContentBase64OrBytes(patchNode.content, 'collection.patches.patch')));
+            }
+        }
         const snapshotReference = snapshotNode
             ? proto.ExternalBlobReference.decode(decodeNodeContentBase64OrBytes(snapshotNode.content, 'collection.snapshot'))
             : undefined;

package/dist/esm/appstate/constants.js

@@ -11,10 +11,11 @@ export const APP_STATE_IV_LENGTH = 16;
 export const APP_STATE_LT_HASH_SIZE = 128;
 export const APP_STATE_POINT_SIZE = 2;
 export const APP_STATE_EMPTY_LT_HASH = new Uint8Array(APP_STATE_LT_HASH_SIZE);
-export const APP_STATE_DEFAULT_COLLECTIONS = [
+export const APP_STATE_DEFAULT_COLLECTION_VERSION = 0;
+export const APP_STATE_DEFAULT_COLLECTIONS = Object.freeze([
     WA_APP_STATE_COLLECTIONS.CRITICAL_UNBLOCK_LOW,
     WA_APP_STATE_COLLECTIONS.CRITICAL_BLOCK,
     WA_APP_STATE_COLLECTIONS.REGULAR_LOW,
     WA_APP_STATE_COLLECTIONS.REGULAR,
     WA_APP_STATE_COLLECTIONS.REGULAR_HIGH
-];
+]);

package/dist/esm/appstate/{store/sqlite.js → encoding.js}

@@ -1,5 +1,5 @@
-import { proto } from '../../proto.js';
-import { asBytes, asNumber, asOptionalBytes, asString } from '../../util/coercion.js';
+import { proto } from '../proto.js';
+import { asBytes, asNumber, asOptionalBytes, asString } from '../util/coercion.js';
 export function encodeAppStateFingerprint(fingerprint) {
     if (!fingerprint) {
         return null;
@@ -20,12 +20,17 @@ export function decodeAppStateFingerprint(raw) {
     }
 }
 export function decodeAppStateSyncKeys(rows) {
-    return rows.map((row) => ({
-        keyId: asBytes(row.key_id, 'appstate_sync_keys.key_id'),
-        keyData: asBytes(row.key_data, 'appstate_sync_keys.key_data'),
-        timestamp: asNumber(row.timestamp, 'appstate_sync_keys.timestamp'),
-        fingerprint: decodeAppStateFingerprint(row.fingerprint)
-    }));
+    const decoded = new Array(rows.length);
+    for (let i = 0; i < rows.length; i += 1) {
+        const row = rows[i];
+        decoded[i] = {
+            keyId: asBytes(row.key_id, 'appstate_sync_keys.key_id'),
+            keyData: asBytes(row.key_data, 'appstate_sync_keys.key_data'),
+            timestamp: asNumber(row.timestamp, 'appstate_sync_keys.timestamp'),
+            fingerprint: decodeAppStateFingerprint(row.fingerprint)
+        };
+    }
+    return decoded;
 }
 export function decodeAppStateCollections(versionRows, valueRows) {
     const valueMapByCollection = new Map();

package/dist/esm/appstate/index.js

@@ -1,6 +1,6 @@
 export * from './constants.js';
+export { encodeAppStateFingerprint, decodeAppStateFingerprint, decodeAppStateCollections, decodeAppStateSyncKeys } from './encoding.js';
 export * from './utils.js';
 export { WaAppStateCrypto } from './WaAppStateCrypto.js';
-export { WaAppStateMissingKeyError } from './WaAppStateSyncClient.js';
-export { parseCollectionState, parseSyncResponse } from './WaAppStateSyncResponseParser.js';
+export { parseSyncResponse } from './WaAppStateSyncResponseParser.js';
 export { WaAppStateSyncClient } from './WaAppStateSyncClient.js';

package/dist/esm/appstate/utils.js

@@ -1,31 +1,16 @@
 import { WA_APP_STATE_COLLECTIONS, WA_APP_STATE_KEY_TYPES } from '../protocol/constants.js';
-import { decodeProtoBytes } from '../util/base64.js';
-import { bytesToHex } from '../util/bytes.js';
-export function keyIdToHex(keyId) {
-    return bytesToHex(keyId);
-}
+import { decodeProtoBytes } from '../util/bytes.js';
+const APP_STATE_COLLECTION_NAMES = new Set(Object.values(WA_APP_STATE_COLLECTIONS));
 export function parseCollectionName(value) {
-    if (!value) {
-        return null;
-    }
-    for (const collection of Object.values(WA_APP_STATE_COLLECTIONS)) {
-        if (collection === value) {
-            return collection;
-        }
-    }
-    return null;
+    return value && APP_STATE_COLLECTION_NAMES.has(value) ? value : null;
 }
-export function keyDeviceId(keyId) {
-    if (keyId.byteLength < 6) {
-        return null;
-    }
-    return (keyId[0] << 8) | keyId[1];
+function keyDeviceId(keyId) {
+    return keyId.byteLength < 6 ? null : (keyId[0] << 8) | keyId[1];
 }
 export function keyEpoch(keyId) {
-    if (keyId.byteLength < 6) {
-        return -1;
-    }
-    return new DataView(keyId.buffer, keyId.byteOffset, keyId.byteLength).getUint32(2, false);
+    return keyId.byteLength < 6
+        ? -1
+        : keyId[2] * 16777216 + keyId[3] * 65536 + keyId[4] * 256 + keyId[5];
 }
 export function pickActiveSyncKey(keys) {
     let active = null;
@@ -51,13 +36,6 @@ export function pickActiveSyncKey(keys) {
     }
     return active;
 }
-export function toNetworkOrder64(value) {
-    const out = new Uint8Array(8);
-    const view = new DataView(out.buffer);
-    view.setUint32(0, Math.floor(value / 4294967296), false);
-    view.setUint32(4, value >>> 0, false);
-    return out;
-}
 export async function downloadExternalBlobReference(mediaTransfer, reference) {
     if (!reference.directPath) {
         throw new Error('external blob reference is missing directPath');

package/dist/esm/auth/WaAuthClient.js

@@ -67,7 +67,7 @@ export class WaAuthClient {
                 signalStore: this.signalStore
             });
             this.logger.info('auth client credentials ready', {
-                registered: this.credentials.meJid !== null && this.credentials.meJid !== undefined
+                registered: this.credentials?.meJid !== null && this.credentials?.meJid !== undefined
             });
             return this.credentials;
         });
@@ -77,7 +77,8 @@ export class WaAuthClient {
         return buildCommsConfig(this.logger, this.requireCredentials(), socketOptions, {
             deviceBrowser: this.options.deviceBrowser,
             deviceOsDisplayName: this.options.deviceOsDisplayName,
-            requireFullSync: this.options.requireFullSync
+            requireFullSync: this.options.requireFullSync,
+            version: this.options.version
         });
     }
     async clearTransientState() {
@@ -87,9 +88,8 @@ export class WaAuthClient {
     }
     async clearStoredCredentials() {
         this.logger.warn('auth client clearing stored credentials');
-        await this.authStore.clear();
         this.credentials = null;
-        await this.clearTransientState();
+        await Promise.all([this.authStore.clear(), this.clearTransientState()]);
     }
     async persistServerStaticKey(serverStaticKey) {
         this.logger.debug('persisting server static key', {
@@ -141,51 +141,39 @@ export class WaAuthClient {
             }
         });
     }
-    async persistMeLid(meLid) {
-        await this.persistSuccessAttributes({
-            meLid
-        });
-    }
     async persistSuccessAttributes(attributes) {
-        let changes = {};
-        await this.patchCredentials((credentials) => {
-            const nextMeLid = attributes.meLid ?? credentials.meLid;
-            const nextMeDisplayName = attributes.meDisplayName ?? credentials.meDisplayName;
-            const nextCompanionEncStatic = attributes.companionEncStatic ?? credentials.companionEncStatic;
-            const nextLastSuccessTs = attributes.lastSuccessTs ?? credentials.lastSuccessTs;
-            const nextPropsVersion = attributes.propsVersion ?? credentials.propsVersion;
-            const nextAbPropsVersion = attributes.abPropsVersion ?? credentials.abPropsVersion;
-            const nextConnectionLocation = attributes.connectionLocation ?? credentials.connectionLocation;
-            const nextAccountCreationTs = attributes.accountCreationTs ?? credentials.accountCreationTs;
-            changes = {
-                lidChanged: nextMeLid !== credentials.meLid,
-                displayNameChanged: nextMeDisplayName !== credentials.meDisplayName,
-                companionChanged: (credentials.companionEncStatic === undefined) !==
-                    (nextCompanionEncStatic === undefined) ||
-                    (credentials.companionEncStatic !== undefined &&
-                        nextCompanionEncStatic !== undefined &&
-                        !uint8Equal(credentials.companionEncStatic, nextCompanionEncStatic)),
-                lastSuccessTsChanged: nextLastSuccessTs !== credentials.lastSuccessTs,
-                propsVersionChanged: nextPropsVersion !== credentials.propsVersion,
-                abPropsVersionChanged: nextAbPropsVersion !== credentials.abPropsVersion,
-                connectionLocationChanged: nextConnectionLocation !== credentials.connectionLocation,
-                accountCreationTsChanged: nextAccountCreationTs !== credentials.accountCreationTs
-            };
-            return {
-                ...credentials,
-                meLid: nextMeLid,
-                meDisplayName: nextMeDisplayName,
-                companionEncStatic: nextCompanionEncStatic,
-                lastSuccessTs: nextLastSuccessTs,
-                propsVersion: nextPropsVersion,
-                abPropsVersion: nextAbPropsVersion,
-                connectionLocation: nextConnectionLocation,
-                accountCreationTs: nextAccountCreationTs
-            };
-        }, {
-            shouldPersist: () => Object.values(changes).some(Boolean),
+        let persistDiff;
+        const computeDiff = (current, next) => ({
+            lidChanged: next.meLid !== current.meLid,
+            displayNameChanged: next.meDisplayName !== current.meDisplayName,
+            companionChanged: (current.companionEncStatic === undefined) !==
+                (next.companionEncStatic === undefined) ||
+                (current.companionEncStatic !== undefined &&
+                    next.companionEncStatic !== undefined &&
+                    !uint8Equal(current.companionEncStatic, next.companionEncStatic)),
+            lastSuccessTsChanged: next.lastSuccessTs !== current.lastSuccessTs,
+            propsVersionChanged: next.propsVersion !== current.propsVersion,
+            abPropsVersionChanged: next.abPropsVersion !== current.abPropsVersion,
+            connectionLocationChanged: next.connectionLocation !== current.connectionLocation,
+            accountCreationTsChanged: next.accountCreationTs !== current.accountCreationTs
+        });
+        await this.patchCredentials((credentials) => ({
+            ...credentials,
+            meLid: attributes.meLid ?? credentials.meLid,
+            meDisplayName: attributes.meDisplayName ?? credentials.meDisplayName,
+            companionEncStatic: attributes.companionEncStatic ?? credentials.companionEncStatic,
+            lastSuccessTs: attributes.lastSuccessTs ?? credentials.lastSuccessTs,
+            propsVersion: attributes.propsVersion ?? credentials.propsVersion,
+            abPropsVersion: attributes.abPropsVersion ?? credentials.abPropsVersion,
+            connectionLocation: attributes.connectionLocation ?? credentials.connectionLocation,
+            accountCreationTs: attributes.accountCreationTs ?? credentials.accountCreationTs
+        }), {
+            shouldPersist: (current, next) => {
+                persistDiff = computeDiff(current, next);
+                return Object.values(persistDiff).some(Boolean);
+            },
             onPersist: () => {
-                this.logger.debug('persisting success attributes', changes);
+                this.logger.debug('persisting success attributes', persistDiff);
             }
         });
     }
@@ -200,24 +188,18 @@ export class WaAuthClient {
         return this.runHandled(() => this.pairingFlow.fetchPairingCountryCodeIso());
     }
     async handleIncomingIqSet(node) {
-        return this.runHandled(async () => {
-            this.logger.trace('auth client handleIncomingIqSet', { id: node.attrs.id });
-            return this.pairingFlow.handleIncomingIqSet(node);
-        });
+        this.logger.trace('auth client handleIncomingIqSet', { id: node.attrs.id });
+        return this.runHandled(() => this.pairingFlow.handleIncomingIqSet(node));
     }
     async handleLinkCodeNotification(node) {
-        return this.runHandled(async () => {
-            this.logger.trace('auth client handleLinkCodeNotification', { id: node.attrs.id });
-            return this.pairingFlow.handleLinkCodeNotification(node);
-        });
+        this.logger.trace('auth client handleLinkCodeNotification', { id: node.attrs.id });
+        return this.runHandled(() => this.pairingFlow.handleLinkCodeNotification(node));
     }
     async handleCompanionRegRefreshNotification(node) {
-        return this.runHandled(async () => {
-            this.logger.trace('auth client handleCompanionRegRefreshNotification', {
-                id: node.attrs.id
-            });
-            return this.pairingFlow.handleCompanionRegRefreshNotification(node);
+        this.logger.trace('auth client handleCompanionRegRefreshNotification', {
+            id: node.attrs.id
         });
+        return this.runHandled(() => this.pairingFlow.handleCompanionRegRefreshNotification(node));
     }
     async patchCredentials(buildNext, options = {}) {
         const current = this.requireCredentials();
@@ -240,7 +222,7 @@ export class WaAuthClient {
     }
     async updateCredentials(credentials) {
         this.logger.trace('auth client update credentials', {
-            registered: credentials.meJid !== null && credentials.meJid !== undefined
+            registered: credentials?.meJid !== null && credentials?.meJid !== undefined
         });
         this.credentials = credentials;
         await persistCredentials({

package/dist/esm/auth/flow/WaAuthCredentialsFlow.js

@@ -4,12 +4,13 @@ import { X25519 } from '../../crypto/curves/X25519.js';
 import { getLoginIdentity } from '../../protocol/jid.js';
 import { verifySignalSignature } from '../../signal/crypto/WaAdvSignature.js';
 import { createAndStoreInitialKeys } from '../../signal/registration/utils.js';
+import { toProxyAgent, toProxyDispatcher } from '../../transport/proxy.js';
 import { toError } from '../../util/primitives.js';
 export async function loadOrCreateCredentials(args) {
     args.logger.trace('auth credentials loadOrCreate start');
     const existing = await args.authStore.load();
     if (!existing) {
-        const credentials = await createAndPersistFreshCredentials(args);
+        const credentials = await createFreshAndPersistCredentials(args);
         args.logger.info('created fresh auth credentials');
         return credentials;
     }
@@ -19,7 +20,7 @@ export async function loadOrCreateCredentials(args) {
     });
     if (!existing.meJid && !(await hasValidSignedPreKey(args.logger, existing))) {
         args.logger.warn('signed pre-key is invalid, regenerating credentials');
-        const fresh = await createAndPersistFreshCredentials(args);
+        const fresh = await createFreshAndPersistCredentials(args);
         args.logger.info('regenerated credentials due to invalid signed pre-key');
         return fresh;
     }
@@ -34,8 +35,10 @@ export async function persistCredentials(args, credentials) {
     await args.authStore.save(credentials);
 }
 export function buildCommsConfig(logger, credentials, socketOptions, clientOptions) {
-    const registered = credentials.meJid !== null && credentials.meJid !== undefined;
-    const loginIdentity = registered ? getLoginIdentity(credentials.meJid) : null;
+    const meJid = credentials.meJid;
+    const registered = meJid !== null && meJid !== undefined;
+    const loginIdentity = registered ? getLoginIdentity(meJid) : null;
+    const wsProxy = socketOptions.proxy?.ws;
     logger.debug('building comms config from credentials', {
         registered,
         hasServerStaticKey: credentials.serverStaticKey !== null && credentials.serverStaticKey !== undefined
@@ -44,6 +47,8 @@ export function buildCommsConfig(logger, credentials, socketOptions, clientOptio
         url: socketOptions.url,
         urls: socketOptions.urls,
         protocols: socketOptions.protocols,
+        dispatcher: toProxyDispatcher(wsProxy),
+        agent: toProxyAgent(wsProxy),
         connectTimeoutMs: socketOptions.connectTimeoutMs,
         reconnectIntervalMs: socketOptions.reconnectIntervalMs,
         timeoutIntervalMs: socketOptions.timeoutIntervalMs,
@@ -58,7 +63,8 @@ export function buildCommsConfig(logger, credentials, socketOptions, clientOptio
                     username: loginIdentity.username,
                     device: loginIdentity.device,
                     deviceBrowser: clientOptions.deviceBrowser,
-                    deviceOsDisplayName: clientOptions.deviceOsDisplayName
+                    deviceOsDisplayName: clientOptions.deviceOsDisplayName,
+                    versionBase: clientOptions.version
                 }
                 : undefined,
             registrationPayloadConfig: !loginIdentity
@@ -67,7 +73,8 @@ export function buildCommsConfig(logger, credentials, socketOptions, clientOptio
                     signedPreKey: credentials.signedPreKey,
                     deviceBrowser: clientOptions.deviceBrowser,
                     deviceOsDisplayName: clientOptions.deviceOsDisplayName,
-                    requireFullSync: clientOptions.requireFullSync
+                    requireFullSync: clientOptions.requireFullSync,
+                    versionBase: clientOptions.version
                 }
                 : undefined
         }
@@ -88,9 +95,11 @@ async function createFreshCredentials(signalStore, logger) {
         advSecretKey
     };
 }
-async function createAndPersistFreshCredentials(args) {
+async function createFreshAndPersistCredentials(args) {
     const credentials = await createFreshCredentials(args.signalStore, args.logger);
-    await persistFreshCredentials(args, credentials);
+    // Persist credentials first so signal restore never commits state for credentials that failed to save.
+    await args.authStore.save(credentials);
+    await restoreSignalStore(args.signalStore, credentials);
     return credentials;
 }
 async function hasValidSignedPreKey(logger, credentials) {
@@ -108,11 +117,9 @@ async function hasValidSignedPreKey(logger, credentials) {
     }
 }
 async function restoreSignalStore(signalStore, credentials) {
-    await signalStore.setRegistrationInfo(credentials.registrationInfo);
-    await signalStore.setSignedPreKey(credentials.signedPreKey);
-    await signalStore.setServerHasPreKeys(credentials.serverHasPreKeys === true);
-}
-async function persistFreshCredentials(args, credentials) {
-    await args.authStore.save(credentials);
-    await restoreSignalStore(args.signalStore, credentials);
+    await Promise.all([
+        signalStore.setRegistrationInfo(credentials.registrationInfo),
+        signalStore.setSignedPreKey(credentials.signedPreKey),
+        signalStore.setServerHasPreKeys(credentials.serverHasPreKeys === true)
+    ]);
 }

package/dist/esm/auth/index.js

@@ -1,5 +1,2 @@
 export * from './types.js';
-export { getLoginIdentity } from '../protocol/jid.js';
 export { WaAuthClient } from './WaAuthClient.js';
-export { completeCompanionFinish, createCompanionHello } from './pairing/WaPairingCodeCrypto.js';
-export { WaAuthSqliteStore } from '../store/providers/sqlite/auth.store.js';

package/dist/esm/auth/pairing/WaPairingCodeCrypto.js

@@ -45,8 +45,8 @@ export async function completeCompanionFinish(args) {
     if (primaryEphemeralPub.length === 0) {
         throw new Error('empty primary ephemeral public key');
     }
-    const sharedEphemeral = await X25519.scalarMult(args.companionEphemeralPrivKey, primaryEphemeralPub);
-    const [bundleSalt, bundleSecret, bundleIv] = await Promise.all([
+    const [sharedEphemeral, bundleSalt, bundleSecret, bundleIv] = await Promise.all([
+        X25519.scalarMult(args.companionEphemeralPrivKey, primaryEphemeralPub),
         randomBytesAsync(32),
         randomBytesAsync(32),
         randomBytesAsync(12)
@@ -58,9 +58,11 @@ export async function completeCompanionFinish(args) {
         args.primaryIdentityPub,
         bundleSecret
     ]);
-    const encryptedBundle = await aesGcmEncrypt(bundleEncryptionKey, bundleIv, plaintextBundle);
+    const [encryptedBundle, sharedIdentity] = await Promise.all([
+        aesGcmEncrypt(bundleEncryptionKey, bundleIv, plaintextBundle),
+        X25519.scalarMult(args.registrationIdentityKeyPair.privKey, args.primaryIdentityPub)
+    ]);
     const wrappedKeyBundle = concatBytes([bundleSalt, bundleIv, encryptedBundle]);
-    const sharedIdentity = await X25519.scalarMult(args.registrationIdentityKeyPair.privKey, args.primaryIdentityPub);
     const advMaterial = concatBytes([sharedEphemeral, sharedIdentity, bundleSecret]);
     const advSecret = await hkdf(advMaterial, null, WA_PAIRING_KDF_INFO.ADV_SECRET, 32);
     return {

package/dist/esm/auth/pairing/WaPairingFlow.js

@@ -4,10 +4,11 @@ import { proto } from '../../proto.js';
 import { WA_DEFAULTS, WA_IQ_TYPES, WA_NODE_TAGS, WA_SIGNALING } from '../../protocol/constants.js';
 import { parsePhoneJid } from '../../protocol/jid.js';
 import { ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, computeAdvIdentityHmac, generateDeviceSignature, verifyDeviceIdentityAccountSignature } from '../../signal/crypto/WaAdvSignature.js';
-import { buildCompanionFinishRequestNode, buildCompanionHelloRequestNode, buildGetCountryCodeRequestNode, buildIqResultNode, buildNotificationAckNode } from '../../transport/node/builders/pairing.js';
-import { decodeNodeContentUtf8OrBytes, findNodeChild, getFirstNodeChild, getNodeChildrenByTag, hasNodeChild } from '../../transport/node/helpers.js';
-import { decodeProtoBytes } from '../../util/base64.js';
-import { concatBytes, TEXT_DECODER, uint8Equal } from '../../util/bytes.js';
+import { buildAckNode, buildIqResultNode } from '../../transport/node/builders/global.js';
+import { buildCompanionFinishRequestNode, buildCompanionHelloRequestNode, buildGetCountryCodeRequestNode } from '../../transport/node/builders/pairing.js';
+import { decodeNodeContentUtf8OrBytes, findNodeChildrenByTags, findNodeChild, getFirstNodeChild, getNodeChildrenNonEmptyUtf8ByTag, hasNodeChild } from '../../transport/node/helpers.js';
+import { decodeProtoBytes } from '../../util/bytes.js';
+import { concatBytes, uint8Equal } from '../../util/bytes.js';
 export class WaPairingFlow {
     constructor(options) {
         this.opts = options;
@@ -118,7 +119,10 @@ export class WaPairingFlow {
             id: node.attrs.id,
             stage: linkCodeNode.attrs.stage
         });
-        await this.opts.socket.sendNode(buildNotificationAckNode(node));
+        await this.opts.socket.sendNode(buildAckNode({
+            kind: 'notification',
+            node
+        }));
         const stage = linkCodeNode.attrs.stage;
         if (stage === WA_SIGNALING.LINK_CODE_STAGE_REFRESH_CODE) {
             const refNode = findNodeChild(linkCodeNode, WA_NODE_TAGS.LINK_CODE_PAIRING_REF);
@@ -146,27 +150,29 @@ export class WaPairingFlow {
         if (!hasExpectedChild) {
             return false;
         }
-        await this.opts.socket.sendNode(buildNotificationAckNode(node, WA_SIGNALING.COMPANION_REG_REFRESH_NOTIFICATION));
+        // Rotate first so we don't ack success before local credential state is durably updated.
         await this.rotateAdvSecret(this.requireCredentials());
+        await this.opts.socket.sendNode(buildAckNode({
+            kind: 'notification',
+            node,
+            typeOverride: WA_SIGNALING.COMPANION_REG_REFRESH_NOTIFICATION
+        }));
         this.opts.logger.info('handled companion_reg_refresh notification');
         this.opts.qrFlow.refreshCurrentQr();
         return true;
     }
     async handlePairDevice(iqNode, pairDeviceNode) {
-        const refs = getNodeChildrenByTag(pairDeviceNode, WA_NODE_TAGS.REF)
-            .map((child) => TEXT_DECODER.decode(decodeNodeContentUtf8OrBytes(child.content, 'pair-device.ref')))
-            .filter((ref) => ref.length > 0);
+        const refs = getNodeChildrenNonEmptyUtf8ByTag(pairDeviceNode, WA_NODE_TAGS.REF, 'pair-device.ref');
+        // Commit adv-secret rotation before sending IQ success to avoid protocol/state divergence.
         await this.rotateAdvSecret(this.requireCredentials());
+        await this.opts.socket.sendNode(buildIqResultNode(iqNode));
         this.opts.qrFlow.setRefs(refs);
         this.opts.logger.info('pair-device refs updated', { refsCount: refs.length });
-        await this.opts.socket.sendNode(buildIqResultNode(iqNode));
     }
     async handlePairSuccess(iqNode, pairSuccessNode) {
         this.opts.logger.info('processing pair-success node');
         const credentials = this.requireCredentials();
-        const deviceIdentityNode = findNodeChild(pairSuccessNode, WA_NODE_TAGS.DEVICE_IDENTITY);
-        const deviceNode = findNodeChild(pairSuccessNode, 'device');
-        const platformNode = findNodeChild(pairSuccessNode, WA_NODE_TAGS.PLATFORM);
+        const [deviceIdentityNode, deviceNode, platformNode] = findNodeChildrenByTags(pairSuccessNode, [WA_NODE_TAGS.DEVICE_IDENTITY, 'device', WA_NODE_TAGS.PLATFORM]);
         if (!deviceIdentityNode || !deviceNode || !platformNode) {
             this.opts.logger.error('pair-success missing required nodes', {
                 hasDeviceIdentity: !!deviceIdentityNode,
@@ -267,9 +273,11 @@ export class WaPairingFlow {
         if (pairingSession.attempts > 3) {
             throw new Error('pairing code exceeded maximum primary hello attempts');
         }
-        const refNode = findNodeChild(linkCodeNode, WA_NODE_TAGS.LINK_CODE_PAIRING_REF);
-        const wrappedPrimaryNode = findNodeChild(linkCodeNode, 'link_code_pairing_wrapped_primary_ephemeral_pub');
-        const primaryIdentityNode = findNodeChild(linkCodeNode, 'primary_identity_pub');
+        const [refNode, wrappedPrimaryNode, primaryIdentityNode] = findNodeChildrenByTags(linkCodeNode, [
+            WA_NODE_TAGS.LINK_CODE_PAIRING_REF,
+            'link_code_pairing_wrapped_primary_ephemeral_pub',
+            'primary_identity_pub'
+        ]);
         if (!refNode || !wrappedPrimaryNode || !primaryIdentityNode) {
             throw new Error('primary_hello notification is missing fields');
         }
@@ -290,10 +298,6 @@ export class WaPairingFlow {
             companionEphemeralPrivKey: pairingSession.companionEphemeralKeyPair.privKey,
             registrationIdentityKeyPair: credentials.registrationInfo.identityKeyPair
         });
-        await this.opts.auth.updateCredentials({
-            ...credentials,
-            advSecretKey: finish.advSecret
-        });
         const result = await this.opts.socket.query(buildCompanionFinishRequestNode({
             phoneJid: pairingSession.phoneJid,
             wrappedKeyBundle: finish.wrappedKeyBundle,
@@ -303,6 +307,10 @@ export class WaPairingFlow {
         if (result.attrs.type === WA_IQ_TYPES.ERROR) {
             throw new Error('companion_finish returned error');
         }
+        await this.opts.auth.updateCredentials({
+            ...credentials,
+            advSecretKey: finish.advSecret
+        });
         pairingSession.finished = true;
         this.opts.logger.info('primary_hello completed with companion_finish success');
     }