zapo-js 0.1.2 → 0.2.0

package/dist/signal/session/SignalProtocol.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SignalProtocol = void 0;
 const _crypto_1 = require("../../crypto/index.js");
 const ConsoleLogger_1 = require("../../infra/log/ConsoleLogger");
+const StoreLock_1 = require("../../infra/perf/StoreLock");
 const constants_1 = require("../constants");
 const SignalRatchet_1 = require("../session/SignalRatchet");
 const SignalSerializer_1 = require("../session/SignalSerializer");
@@ -11,26 +12,37 @@ const bytes_1 = require("../../util/bytes");
 function signalAddressMapKey(address) {
     return `${address.user}\u0001${address.server ?? ''}\u0001${address.device}`;
 }
+function signalAddressLockKey(address) {
+    return `signal:${signalAddressMapKey(address)}`;
+}
 class SignalProtocol {
     constructor(store, logger = new ConsoleLogger_1.ConsoleLogger('info')) {
         this.store = store;
         this.logger = logger;
+        this.sessionMutationLock = new StoreLock_1.StoreLock();
     }
-    async hasSession(address) {
-        return this.store.hasSession(address);
-    }
-    async hasSessions(addresses) {
-        return this.store.hasSessions(addresses);
-    }
-    async establishOutgoingSession(address, remoteBundle) {
-        const [local, localOneTimeBase] = await Promise.all([
-            (0, SignalSession_1.requireLocalIdentity)(this.store),
-            (0, SignalSession_1.generateSerializedKeyPair)()
-        ]);
-        const session = await (0, SignalSession_1.initiateSessionOutgoing)(local, remoteBundle, localOneTimeBase);
-        await this.store.setRemoteIdentity(address, session.remote.pubKey);
-        await this.store.setSession(address, session);
-        return session;
+    async establishOutgoingSession(address, remoteBundle, options = {}) {
+        return this.runWithAddressLock(address, async () => {
+            if (options.reuseExisting) {
+                const existing = await this.store.getSession(address);
+                if (existing) {
+                    const remoteIdentity = (0, _crypto_1.toSerializedPubKey)(remoteBundle.identity);
+                    if (!(0, bytes_1.uint8Equal)(existing.remote.pubKey, remoteIdentity)) {
+                        throw new Error('identity mismatch');
+                    }
+                    return existing;
+                }
+            }
+            const [local, localOneTimeBase] = await Promise.all([
+                (0, SignalSession_1.requireLocalIdentity)(this.store),
+                (0, SignalSession_1.generateSerializedKeyPair)()
+            ]);
+            const session = await (0, SignalSession_1.initiateSessionOutgoing)(local, remoteBundle, localOneTimeBase);
+            // Keep writes ordered: a stored session without matching remote identity causes false mismatch checks.
+            await this.store.setRemoteIdentity(address, session.remote.pubKey);
+            await this.store.setSession(address, session);
+            return session;
+        });
     }
     async encryptMessage(address, plaintext, expectedIdentity) {
         const [encrypted] = await this.encryptMessagesBatch([
@@ -38,77 +50,140 @@ class SignalProtocol {
         ]);
         return encrypted;
     }
-    async encryptMessagesBatch(requests) {
+    async encryptMessagesBatch(requests, prefetchedSessions) {
         if (requests.length === 0) {
             return [];
         }
-        const addresses = requests.map((request) => request.address);
-        const storedSessions = await this.store.getSessionsBatch(addresses);
-        const latestSessionByAddress = new Map();
-        const sessionUpdatesByAddress = new Map();
-        const identityUpdatesByAddress = new Map();
-        const results = new Array(requests.length);
-        for (let index = 0; index < requests.length; index += 1) {
-            const request = requests[index];
-            const address = request.address;
-            const addressKey = signalAddressMapKey(address);
-            const session = latestSessionByAddress.get(addressKey) ?? storedSessions[index];
-            if (!session) {
-                throw new Error('signal session not found');
+        const lockKeySet = new Set();
+        for (let i = 0; i < requests.length; i += 1)
+            lockKeySet.add(signalAddressLockKey(requests[i].address));
+        const lockKeys = [...lockKeySet];
+        return this.sessionMutationLock.runMany(lockKeys, async () => {
+            const prefetchedByAddress = new Map();
+            if (prefetchedSessions && prefetchedSessions.length > 0) {
+                for (let index = 0; index < prefetchedSessions.length; index += 1) {
+                    const entry = prefetchedSessions[index];
+                    prefetchedByAddress.set(signalAddressMapKey(entry.address), entry.session);
+                }
+            }
+            const uniqueAddressKeys = new Array(requests.length);
+            const uniqueAddresses = new Array(requests.length);
+            let uniqueAddressCount = 0;
+            for (let index = 0; index < requests.length; index += 1) {
+                const address = requests[index].address;
+                const addressKey = signalAddressMapKey(address);
+                let isDuplicate = false;
+                for (let dedupIndex = 0; dedupIndex < uniqueAddressCount; dedupIndex += 1) {
+                    if (uniqueAddressKeys[dedupIndex] === addressKey) {
+                        isDuplicate = true;
+                        break;
+                    }
+                }
+                if (isDuplicate) {
+                    continue;
+                }
+                uniqueAddressKeys[uniqueAddressCount] = addressKey;
+                uniqueAddresses[uniqueAddressCount] = address;
+                uniqueAddressCount += 1;
             }
-            if (request.expectedIdentity &&
-                !(0, bytes_1.uint8Equal)((0, _crypto_1.toSerializedPubKey)(request.expectedIdentity), session.remote.pubKey)) {
-                throw new Error('identity mismatch');
+            uniqueAddressKeys.length = uniqueAddressCount;
+            uniqueAddresses.length = uniqueAddressCount;
+            const currentSessions = await this.store.getSessionsBatch(uniqueAddresses);
+            const latestSessionByAddress = new Map();
+            for (let index = 0; index < uniqueAddressCount; index += 1) {
+                const addressKey = uniqueAddressKeys[index];
+                const current = currentSessions[index];
+                if (current) {
+                    latestSessionByAddress.set(addressKey, current);
+                    continue;
+                }
+                const prefetched = prefetchedByAddress.get(addressKey);
+                if (prefetched) {
+                    latestSessionByAddress.set(addressKey, prefetched);
+                }
             }
-            const [updatedSession, encrypted] = await (0, SignalRatchet_1.encryptMsg)(session, request.plaintext);
-            latestSessionByAddress.set(addressKey, updatedSession);
-            sessionUpdatesByAddress.set(addressKey, {
-                address,
-                session: updatedSession
-            });
-            if (!(0, bytes_1.uint8Equal)(updatedSession.remote.pubKey, session.remote.pubKey)) {
-                identityUpdatesByAddress.set(addressKey, {
+            const sessionUpdatesByAddress = new Map();
+            const identityUpdatesByAddress = new Map();
+            const results = new Array(requests.length);
+            for (let index = 0; index < requests.length; index += 1) {
+                const request = requests[index];
+                const address = request.address;
+                const addressKey = signalAddressMapKey(address);
+                const session = latestSessionByAddress.get(addressKey);
+                if (!session) {
+                    throw new Error('signal session not found');
+                }
+                if (request.expectedIdentity &&
+                    !(0, bytes_1.uint8Equal)((0, _crypto_1.toSerializedPubKey)(request.expectedIdentity), session.remote.pubKey)) {
+                    throw new Error('identity mismatch');
+                }
+                const [updatedSession, encrypted] = await (0, SignalRatchet_1.encryptMsg)(session, request.plaintext);
+                latestSessionByAddress.set(addressKey, updatedSession);
+                sessionUpdatesByAddress.set(addressKey, {
                     address,
-                    identityKey: updatedSession.remote.pubKey
+                    session: updatedSession
                 });
+                if (!(0, bytes_1.uint8Equal)(updatedSession.remote.pubKey, session.remote.pubKey)) {
+                    identityUpdatesByAddress.set(addressKey, {
+                        address,
+                        identityKey: updatedSession.remote.pubKey
+                    });
+                }
+                results[index] = {
+                    ...encrypted,
+                    baseKey: updatedSession.aliceBaseKey
+                };
             }
-            results[index] = {
-                ...encrypted,
-                baseKey: updatedSession.aliceBaseKey
-            };
-        }
-        await this.store.setSessionsBatch([...sessionUpdatesByAddress.values()]);
-        if (identityUpdatesByAddress.size > 0) {
-            await this.store.setRemoteIdentities([...identityUpdatesByAddress.values()]);
-        }
-        return results;
+            // Persist remote identities first when needed so session writes never commit ahead of identity data.
+            if (identityUpdatesByAddress.size > 0) {
+                const identityUpdates = new Array(identityUpdatesByAddress.size);
+                let identityIndex = 0;
+                for (const update of identityUpdatesByAddress.values()) {
+                    identityUpdates[identityIndex] = update;
+                    identityIndex += 1;
+                }
+                await this.store.setRemoteIdentities(identityUpdates);
+            }
+            const sessionUpdates = new Array(sessionUpdatesByAddress.size);
+            let sessionIndex = 0;
+            for (const update of sessionUpdatesByAddress.values()) {
+                sessionUpdates[sessionIndex] = update;
+                sessionIndex += 1;
+            }
+            await this.store.setSessionsBatch(sessionUpdates);
+            return results;
+        });
     }
     async decryptMessage(address, envelope) {
-        const currentSession = await this.store.getSession(address);
-        let outcome;
-        if (envelope.type === 'pkmsg') {
-            const parsedPk = (0, SignalSerializer_1.deserializePkMsg)(envelope.ciphertext);
-            outcome = await this.decryptPkMsg(currentSession, parsedPk);
-        }
-        else {
-            const parsed = (0, SignalSerializer_1.deserializeMsg)(envelope.ciphertext);
-            outcome = await this.decryptMsgInternal(currentSession, parsed);
-        }
-        const nextRemoteIdentity = outcome.newSessionInfo?.newIdentity ?? outcome.updatedSession.remote.pubKey;
-        if (!currentSession || !(0, bytes_1.uint8Equal)(currentSession.remote.pubKey, nextRemoteIdentity)) {
-            await this.store.setRemoteIdentity(address, nextRemoteIdentity);
-        }
-        await this.store.setSession(address, outcome.updatedSession);
-        return outcome.plaintext;
-    }
-    async decryptMsgInternal(session, parsed) {
-        return (0, SignalRatchet_1.decryptMsg)(session, parsed, (error, previousSessionIndex) => {
-            this.logger.debug('signal decrypt fallback session failed', {
-                previousSessionIndex,
-                message: error.message
-            });
+        return this.runWithAddressLock(address, async () => {
+            const currentSession = await this.store.getSession(address);
+            let outcome;
+            if (envelope.type === 'pkmsg') {
+                const parsedPk = (0, SignalSerializer_1.deserializePkMsg)(envelope.ciphertext);
+                outcome = await this.decryptPkMsg(currentSession, parsedPk);
+            }
+            else {
+                const parsed = (0, SignalSerializer_1.deserializeMsg)(envelope.ciphertext);
+                outcome = await (0, SignalRatchet_1.decryptMsg)(currentSession, parsed, (error, previousSessionIndex) => {
+                    this.logger.debug('signal decrypt fallback session failed', {
+                        previousSessionIndex,
+                        message: error.message
+                    });
+                });
+            }
+            const nextRemoteIdentity = outcome.newSessionInfo?.newIdentity ?? outcome.updatedSession.remote.pubKey;
+            const identityChanged = !currentSession || !(0, bytes_1.uint8Equal)(currentSession.remote.pubKey, nextRemoteIdentity);
+            // Keep writes ordered for consistency with resolver identity checks.
+            if (identityChanged) {
+                await this.store.setRemoteIdentity(address, nextRemoteIdentity);
+            }
+            await this.store.setSession(address, outcome.updatedSession);
+            return outcome.plaintext;
         });
     }
+    runWithAddressLock(address, task) {
+        return this.sessionMutationLock.run(signalAddressLockKey(address), task);
+    }
     async decryptPkMsg(currentSession, parsed) {
         const matchingSession = (0, SignalSession_1.findMatchingSession)(currentSession, parsed.sessionBaseKey);
         if (matchingSession) {
@@ -144,6 +219,7 @@ class SignalProtocol {
             }
             : incoming;
         const [updatedSession, plaintext] = await (0, SignalRatchet_1.decryptMsgFromSession)(baseSession, parsed);
+        // Only consume one-time prekeys after successful decrypt/session materialization.
         if (parsed.localOneTimeKeyId !== null && parsed.localOneTimeKeyId !== undefined) {
             await this.store.consumePreKeyById(parsed.localOneTimeKeyId);
         }

package/dist/signal/session/resolver.js

@@ -2,32 +2,43 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createSignalSessionResolver = createSignalSessionResolver;
 const keys_1 = require("../../crypto/core/keys");
+const PromiseDedup_1 = require("../../infra/perf/PromiseDedup");
 const jid_1 = require("../../protocol/jid");
 const bytes_1 = require("../../util/bytes");
 const primitives_1 = require("../../util/primitives");
 function createSignalSessionResolver(options) {
     const { signalProtocol, signalStore, signalIdentitySync, signalSessionSync, logger } = options;
-    const ensureSession = async (address, jid, expectedIdentity, reasonIdentity = false) => {
+    const dedup = new PromiseDedup_1.PromiseDedup();
+    const ensureSessionInternal = async (address, jid, expectedIdentity, reasonIdentity = false, prefetchedBundle) => {
         const expectedSerializedIdentity = expectedIdentity
             ? (0, keys_1.toSerializedPubKey)(expectedIdentity)
             : null;
         if (reasonIdentity) {
             await signalIdentitySync.syncIdentityKeys([jid]);
         }
-        if (await signalProtocol.hasSession(address)) {
+        if (await signalStore.hasSession(address)) {
             if (expectedSerializedIdentity) {
                 const storedIdentity = await signalStore.getRemoteIdentity(address);
                 if (!storedIdentity || !(0, bytes_1.uint8Equal)(storedIdentity, expectedSerializedIdentity)) {
                     throw new Error('identity mismatch');
                 }
             }
-            return;
+            return null;
+        }
+        let fetched;
+        if (prefetchedBundle) {
+            fetched = {
+                jid,
+                bundle: prefetchedBundle
+            };
+        }
+        else {
+            logger.info('signal session missing, fetching remote key bundle', { jid });
+            fetched = await signalSessionSync.fetchKeyBundle({
+                jid,
+                reasonIdentity
+            });
         }
-        logger.info('signal session missing, fetching remote key bundle', { jid });
-        const fetched = await signalSessionSync.fetchKeyBundle({
-            jid,
-            reasonIdentity
-        });
         const remoteIdentity = (0, keys_1.toSerializedPubKey)(fetched.bundle.identity);
         if (reasonIdentity) {
             const storedIdentity = await signalStore.getRemoteIdentity(address);
@@ -38,35 +49,49 @@ function createSignalSessionResolver(options) {
         if (expectedSerializedIdentity && !(0, bytes_1.uint8Equal)(remoteIdentity, expectedSerializedIdentity)) {
             throw new Error('identity mismatch');
         }
-        await signalProtocol.establishOutgoingSession(address, fetched.bundle);
+        const session = await signalProtocol.establishOutgoingSession(address, fetched.bundle, {
+            reuseExisting: true
+        });
         logger.info('signal session synchronized', {
             jid,
             regId: fetched.bundle.regId,
             hasOneTimeKey: fetched.bundle.oneTimeKey !== undefined
         });
+        return session;
+    };
+    const ensureSessionWithDedup = (address, jid, expectedIdentity, reasonIdentity = false, prefetchedBundle) => {
+        const expectedIdentityKey = expectedIdentity ? (0, bytes_1.bytesToHex)(expectedIdentity) : 'none';
+        const dedupKey = `signalSession:${(0, jid_1.signalAddressKey)(address)}:${reasonIdentity ? '1' : '0'}:${expectedIdentityKey}`;
+        return dedup.run(dedupKey, () => ensureSessionInternal(address, jid, expectedIdentity, reasonIdentity, prefetchedBundle));
     };
+    const ensureSession = (address, jid, expectedIdentity, reasonIdentity = false) => ensureSessionWithDedup(address, jid, expectedIdentity, reasonIdentity).then(() => { });
     const ensureSessionsBatch = async (targetJids, expectedIdentityByJid) => {
         const seenTargetJids = new Set();
-        const normalizedTargetJids = [];
-        const normalizedTargetAddresses = [];
+        const normalizedTargetJids = new Array(targetJids.length);
+        const normalizedTargetAddresses = new Array(targetJids.length);
+        let normalizedTargetCount = 0;
         for (let index = 0; index < targetJids.length; index += 1) {
             const jid = (0, jid_1.normalizeDeviceJid)(targetJids[index]);
             if (seenTargetJids.has(jid)) {
                 continue;
             }
             seenTargetJids.add(jid);
-            normalizedTargetJids.push(jid);
-            normalizedTargetAddresses.push((0, jid_1.parseSignalAddressFromJid)(jid));
+            normalizedTargetJids[normalizedTargetCount] = jid;
+            normalizedTargetAddresses[normalizedTargetCount] = (0, jid_1.parseSignalAddressFromJid)(jid);
+            normalizedTargetCount += 1;
         }
-        if (normalizedTargetJids.length === 0) {
-            return;
+        if (normalizedTargetCount === 0) {
+            return [];
         }
+        normalizedTargetJids.length = normalizedTargetCount;
+        normalizedTargetAddresses.length = normalizedTargetCount;
         const normalizedExpectedIdentityByJid = expectedIdentityByJid && expectedIdentityByJid.size > 0
             ? new Map()
             : undefined;
         if (normalizedExpectedIdentityByJid && expectedIdentityByJid) {
             for (const [jid, identity] of expectedIdentityByJid.entries()) {
                 try {
+                    (0, keys_1.toSerializedPubKey)(identity);
                     normalizedExpectedIdentityByJid.set((0, jid_1.normalizeDeviceJid)(jid), identity);
                 }
                 catch (error) {
@@ -74,113 +99,123 @@ function createSignalSessionResolver(options) {
                 }
             }
         }
-        const hasSessions = await signalProtocol.hasSessions(normalizedTargetAddresses);
-        if (normalizedExpectedIdentityByJid) {
-            const identityAddresses = [];
-            const expectedSerializedIdentities = [];
+        const resolvedByIndex = (await signalStore.getSessionsBatch(normalizedTargetAddresses));
+        const collectResolvedTargets = () => {
+            const resolvedTargets = new Array(normalizedTargetJids.length);
+            let resolvedTargetCount = 0;
             for (let index = 0; index < normalizedTargetJids.length; index += 1) {
-                if (!hasSessions[index]) {
+                const session = resolvedByIndex[index];
+                if (!session) {
                     continue;
                 }
-                const expectedIdentity = normalizedExpectedIdentityByJid.get(normalizedTargetJids[index]);
-                if (!expectedIdentity) {
-                    continue;
-                }
-                identityAddresses.push(normalizedTargetAddresses[index]);
-                expectedSerializedIdentities.push((0, keys_1.toSerializedPubKey)(expectedIdentity));
+                resolvedTargets[resolvedTargetCount] = {
+                    jid: normalizedTargetJids[index],
+                    address: normalizedTargetAddresses[index],
+                    session
+                };
+                resolvedTargetCount += 1;
             }
-            const storedIdentities = await signalStore.getRemoteIdentities(identityAddresses);
-            for (let index = 0; index < storedIdentities.length; index += 1) {
-                const storedIdentity = storedIdentities[index];
-                if (!storedIdentity ||
-                    !(0, bytes_1.uint8Equal)(storedIdentity, expectedSerializedIdentities[index])) {
+            resolvedTargets.length = resolvedTargetCount;
+            return resolvedTargets;
+        };
+        const missingIndices = [];
+        for (let index = 0; index < normalizedTargetJids.length; index += 1) {
+            const session = resolvedByIndex[index];
+            const expectedIdentity = normalizedExpectedIdentityByJid?.get(normalizedTargetJids[index]);
+            if (session && expectedIdentity) {
+                if (!(0, bytes_1.uint8Equal)(session.remote.pubKey, (0, keys_1.toSerializedPubKey)(expectedIdentity))) {
                     throw new Error('identity mismatch');
                 }
             }
-        }
-        const missingIndices = [];
-        for (let index = 0; index < normalizedTargetJids.length; index += 1) {
-            if (!hasSessions[index]) {
+            if (!session) {
                 missingIndices.push(index);
             }
         }
         if (missingIndices.length === 0) {
-            return;
+            return collectResolvedTargets();
+        }
+        const batchRequest = new Array(missingIndices.length);
+        for (let index = 0; index < missingIndices.length; index += 1) {
+            batchRequest[index] = { jid: normalizedTargetJids[missingIndices[index]] };
         }
+        let batchResults;
         try {
-            const batchRequest = [];
-            for (let index = 0; index < missingIndices.length; index += 1) {
-                batchRequest.push({ jid: normalizedTargetJids[missingIndices[index]] });
-            }
-            const batchResults = await signalSessionSync.fetchKeyBundles(batchRequest);
-            const fallbackIndices = [];
-            const establishedIndices = [];
-            const establishPromises = [];
-            for (let index = 0; index < missingIndices.length; index += 1) {
-                const targetIndex = missingIndices[index];
-                const result = batchResults[index];
-                if (!result || !('bundle' in result)) {
-                    fallbackIndices.push(targetIndex);
-                    continue;
-                }
-                const targetJid = normalizedTargetJids[targetIndex];
-                const expectedIdentity = normalizedExpectedIdentityByJid?.get(targetJid);
-                const remoteIdentity = (0, keys_1.toSerializedPubKey)(result.bundle.identity);
-                if (expectedIdentity &&
-                    !(0, bytes_1.uint8Equal)(remoteIdentity, (0, keys_1.toSerializedPubKey)(expectedIdentity))) {
-                    throw new Error('identity mismatch');
-                }
-                establishedIndices.push(targetIndex);
-                establishPromises.push(signalProtocol
-                    .establishOutgoingSession(normalizedTargetAddresses[targetIndex], result.bundle)
-                    .then(() => {
-                    logger.debug('signal session synchronized from batch key fetch', {
-                        jid: targetJid,
-                        regId: result.bundle.regId,
-                        hasOneTimeKey: result.bundle.oneTimeKey !== undefined
-                    });
-                }));
+            batchResults = await signalSessionSync.fetchKeyBundles(batchRequest);
+        }
+        catch (error) {
+            logger.warn('signal batch key fetch failed', {
+                requested: missingIndices.length,
+                message: (0, primitives_1.toError)(error).message
+            });
+            return collectResolvedTargets();
+        }
+        const ensuredTargetIndices = new Array(missingIndices.length);
+        const ensurePromises = new Array(missingIndices.length);
+        let ensureCount = 0;
+        for (let index = 0; index < missingIndices.length; index += 1) {
+            const targetIndex = missingIndices[index];
+            const targetJid = normalizedTargetJids[targetIndex];
+            const batchResult = batchResults[index];
+            if (!batchResult?.bundle) {
+                logger.warn('signal batch key fetch returned target without bundle', {
+                    jid: targetJid,
+                    message: batchResult?.errorText ?? 'missing key bundle user in response'
+                });
+                continue;
             }
-            const establishmentResults = await Promise.allSettled(establishPromises);
-            for (let index = 0; index < establishmentResults.length; index += 1) {
-                const result = establishmentResults[index];
-                if (result.status === 'fulfilled') {
-                    continue;
-                }
-                const error = (0, primitives_1.toError)(result.reason);
-                if (error.message === 'identity mismatch') {
-                    throw error;
+            const expectedIdentity = normalizedExpectedIdentityByJid?.get(targetJid);
+            ensuredTargetIndices[ensureCount] = targetIndex;
+            ensurePromises[ensureCount] = ensureSessionWithDedup(normalizedTargetAddresses[targetIndex], targetJid, expectedIdentity, false, batchResult.bundle);
+            ensureCount += 1;
+        }
+        if (ensureCount === 0) {
+            return collectResolvedTargets();
+        }
+        ensuredTargetIndices.length = ensureCount;
+        ensurePromises.length = ensureCount;
+        const ensureResults = await Promise.allSettled(ensurePromises);
+        const fallbackIndices = [];
+        for (let index = 0; index < ensuredTargetIndices.length; index += 1) {
+            const targetIndex = ensuredTargetIndices[index];
+            const ensureResult = ensureResults[index];
+            if (ensureResult.status === 'rejected') {
+                const normalized = (0, primitives_1.toError)(ensureResult.reason);
+                if (normalized.message === 'identity mismatch') {
+                    throw normalized;
                 }
-                fallbackIndices.push(establishedIndices[index]);
+                logger.warn('signal session ensure failed during batch resolution', {
+                    jid: normalizedTargetJids[targetIndex],
+                    message: normalized.message
+                });
+                continue;
             }
-            if (fallbackIndices.length === 0) {
-                return;
+            const session = ensureResult.value;
+            if (session) {
+                resolvedByIndex[targetIndex] = session;
             }
-            logger.warn('signal batch key fetch returned partial errors, falling back to single requests', {
-                requested: missingIndices.length,
-                fallbackTargets: fallbackIndices.length
-            });
-            for (let index = 0; index < fallbackIndices.length; index += 1) {
-                const targetIndex = fallbackIndices[index];
-                const jid = normalizedTargetJids[targetIndex];
-                await ensureSession(normalizedTargetAddresses[targetIndex], jid, normalizedExpectedIdentityByJid?.get(jid));
+            else {
+                fallbackIndices.push(targetIndex);
             }
         }
-        catch (error) {
-            const normalized = (0, primitives_1.toError)(error);
-            if (normalized.message === 'identity mismatch') {
-                throw normalized;
+        if (fallbackIndices.length > 0) {
+            const fallbackAddresses = new Array(fallbackIndices.length);
+            for (let i = 0; i < fallbackIndices.length; i++) {
+                fallbackAddresses[i] = normalizedTargetAddresses[fallbackIndices[i]];
             }
-            logger.warn('signal batch key fetch failed, falling back to single requests', {
-                requested: missingIndices.length,
-                message: normalized.message
-            });
-            for (let index = 0; index < missingIndices.length; index += 1) {
-                const targetIndex = missingIndices[index];
-                const jid = normalizedTargetJids[targetIndex];
-                await ensureSession(normalizedTargetAddresses[targetIndex], jid, normalizedExpectedIdentityByJid?.get(jid));
+            const fallbackSessions = await signalStore.getSessionsBatch(fallbackAddresses);
+            for (let i = 0; i < fallbackIndices.length; i++) {
+                const session = fallbackSessions[i];
+                if (session) {
+                    resolvedByIndex[fallbackIndices[i]] = session;
+                }
+                else {
+                    logger.warn('signal session ensure completed without persisted session', {
+                        jid: normalizedTargetJids[fallbackIndices[i]]
+                    });
+                }
             }
         }
+        return collectResolvedTargets();
     };
     return {
         ensureSession,

package/dist/store/contracts/privacy-token.store.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });