zapo-js 0.1.2 → 0.3.0

package/dist/client/coordinators/WaRetryCoordinator.js

@@ -5,15 +5,17 @@ const _proto_1 = require("../../proto.js");
 const constants_1 = require("../../protocol/constants");
 const jid_1 = require("../../protocol/jid");
 const constants_2 = require("../../retry/constants");
-const outbound_1 = require("../../retry/outbound");
 const parse_1 = require("../../retry/parse");
 const reason_1 = require("../../retry/reason");
 const replay_1 = require("../../retry/replay");
 const keygen_1 = require("../../signal/registration/keygen");
-const message_1 = require("../../transport/node/builders/message");
+const global_1 = require("../../transport/node/builders/global");
 const retry_1 = require("../../transport/node/builders/retry");
+const bytes_1 = require("../../util/bytes");
+const collections_1 = require("../../util/collections");
 const primitives_1 = require("../../util/primitives");
 const RETRY_CLEANUP_INTERVAL_MS = 30000;
+const RETRY_SESSION_BASE_KEY_CACHE_MAX_ENTRIES = 8192;
 function getRetryReasonName(code) {
     if (code === undefined) {
         return undefined;
@@ -38,6 +40,8 @@ class WaRetryCoordinator {
         this.retryStore = options.retryStore;
         this.retryTtlMs = this.retryStore.getTtlMs?.() ?? constants_2.RETRY_OUTBOUND_TTL_MS;
         this.signalStore = options.signalStore;
+        this.preKeyStore = options.preKeyStore;
+        this.sessionStore = options.sessionStore;
         this.senderKeyStore = options.senderKeyStore;
         this.signalProtocol = options.signalProtocol;
         this.signalDeviceSync = options.signalDeviceSync;
@@ -55,6 +59,7 @@ class WaRetryCoordinator {
             getCurrentSignedIdentity: this.getCurrentSignedIdentity
         });
         this.retryProcessingByMessageId = new Map();
+        this.retrySessionBaseKeys = new Map();
     }
     async onDecryptFailure(context, error) {
         try {
@@ -79,12 +84,23 @@ class WaRetryCoordinator {
         if (!this.isRetryReceiptNode(receiptNode)) {
             return;
         }
+        let shouldAck = false;
         try {
             await this.maybeCleanupRetryStore(Date.now());
-            const request = (0, parse_1.parseRetryReceiptRequest)(receiptNode);
+            const expectedToJids = [];
+            const meJid = this.getCurrentMeJid()?.trim();
+            const meLid = this.getCurrentMeLid()?.trim();
+            if (meJid) {
+                expectedToJids.push(meJid);
+            }
+            if (meLid) {
+                expectedToJids.push(meLid);
+            }
+            const request = (0, parse_1.parseRetryReceiptRequest)(receiptNode, expectedToJids.length > 0 ? { expectedToJids } : undefined);
             if (!request) {
                 return;
             }
+            shouldAck = true;
             await this.handleParsedRetryRequest(receiptNode, request);
         }
         catch (error) {
@@ -96,7 +112,9 @@ class WaRetryCoordinator {
             });
         }
         finally {
-            await this.sendRetryAckSafe(receiptNode);
+            if (shouldAck) {
+                await this.sendRetryAckSafe(receiptNode);
+            }
         }
     }
     isRetryReceiptNode(node) {
@@ -132,7 +150,6 @@ class WaRetryCoordinator {
             to: context.from,
             participant: context.participant,
             recipient: context.recipient,
-            from: this.getCurrentMeJid() ?? undefined,
             originalMsgId: context.stanzaId,
             retryCount: prepared.retryCount,
             t: prepared.timestamp,
@@ -203,8 +220,9 @@ class WaRetryCoordinator {
         let requesterAddress;
         let requesterNormalizedDeviceJid;
         try {
-            requesterAddress = (0, jid_1.parseSignalAddressFromJid)(requesterJid);
-            requesterNormalizedDeviceJid = (0, jid_1.normalizeDeviceJid)(requesterJid);
+            const requesterParsed = (0, jid_1.parseJidFull)(requesterJid);
+            requesterAddress = requesterParsed.address;
+            requesterNormalizedDeviceJid = requesterParsed.normalizedJid;
         }
         catch (error) {
             this.logger.info('retry request rejected: invalid requester jid', {
@@ -280,20 +298,36 @@ class WaRetryCoordinator {
         if (!nextState) {
             return;
         }
-        const current = await this.retryStore.getOutboundMessage(messageId);
-        if (!current) {
-            return;
-        }
-        const merged = (0, outbound_1.pickRetryStateMax)(current.state, nextState);
-        if (merged === current.state) {
-            return;
-        }
-        const nowMs = Date.now();
-        await this.retryStore.updateOutboundMessageState(messageId, merged, nowMs, nowMs + this.retryTtlMs);
+        await this.runRetryTaskSerialized(messageId, async () => {
+            const current = await this.retryStore.getOutboundMessage(messageId);
+            if (!current) {
+                return;
+            }
+            const nowMs = Date.now();
+            const expiresAtMs = nowMs + this.retryTtlMs;
+            const merged = (0, parse_1.pickRetryStateMax)(current.state, nextState);
+            if (merged !== current.state) {
+                await this.retryStore.updateOutboundMessageState(messageId, merged, nowMs, expiresAtMs);
+            }
+            const requesterJid = receiptNode.attrs.participant ?? receiptNode.attrs.from;
+            if (!requesterJid) {
+                return;
+            }
+            try {
+                await this.retryStore.markOutboundRequesterDelivered(messageId, (0, jid_1.normalizeDeviceJid)(requesterJid), nowMs, expiresAtMs);
+            }
+            catch (error) {
+                this.logger.warn('failed to update outbound requester delivery state', {
+                    id: messageId,
+                    requester: requesterJid,
+                    message: (0, primitives_1.toError)(error).message
+                });
+            }
+        });
     }
     async runRetryTaskSerialized(messageId, task) {
         const previous = this.retryProcessingByMessageId.get(messageId) ?? Promise.resolve();
-        const current = previous.then(task, task);
+        const current = previous.then(task);
         const tracker = current.then(() => undefined, () => undefined);
         this.retryProcessingByMessageId.set(messageId, tracker);
         try {
@@ -309,13 +343,13 @@ class WaRetryCoordinator {
     async buildRetryKeysSection(identity) {
         const [signedPreKey, preKey] = await Promise.all([
             this.signalStore.getSignedPreKey(),
-            this.signalStore.getOrGenSinglePreKey(keygen_1.generatePreKeyPair)
+            this.preKeyStore.getOrGenSinglePreKey(keygen_1.generatePreKeyPair)
         ]);
         if (!signedPreKey) {
             this.logger.warn('retry keys section skipped: signed prekey unavailable');
             return undefined;
         }
-        await this.signalStore.markKeyAsUploaded(preKey.keyId);
+        await this.preKeyStore.markKeyAsUploaded(preKey.keyId);
         const signedIdentity = this.getCurrentSignedIdentity();
         return {
             identity,
@@ -334,15 +368,45 @@ class WaRetryCoordinator {
         };
     }
     async updateLocalSessionFromRetryRequest(request, requesterJid, requesterAddress, requesterNormalizedDeviceJid) {
-        await this.markRetryRequesterSenderKeyAsStale(request, requesterJid, requesterAddress);
-        const currentSession = await this.signalStore.getSession(requesterAddress);
-        if (currentSession && request.regId > 0 && currentSession.remote.regId !== request.regId) {
-            await this.signalStore.deleteSession(requesterAddress);
+        const [, currentSession] = await Promise.all([
+            this.markRetryRequesterSenderKeyAsStale(request, requesterJid, requesterAddress),
+            this.sessionStore.getSession(requesterAddress)
+        ]);
+        const regIdMismatch = !!currentSession && request.regId > 0 && currentSession.remote.regId !== request.regId;
+        if (regIdMismatch && !request.keyBundle) {
+            await this.sessionStore.deleteSession(requesterAddress);
         }
         if (request.keyBundle) {
             if (!request.keyBundle.key || !request.keyBundle.skey.signature) {
                 return false;
             }
+            if (request.offline) {
+                if (!currentSession) {
+                    this.logger.info('retry request rejected: offline retry missing existing session', {
+                        id: request.stanzaId,
+                        originalMsgId: request.originalMsgId,
+                        requester: requesterJid,
+                        remoteRetryCount: request.retryCount,
+                        ...getRemoteRetryReasonLogFields(request.retryReason)
+                    });
+                    await this.sessionStore.deleteSession(requesterAddress);
+                    return false;
+                }
+                if (regIdMismatch) {
+                    this.logger.info('retry request rejected: offline retry registration id mismatch', {
+                        id: request.stanzaId,
+                        originalMsgId: request.originalMsgId,
+                        requester: requesterJid,
+                        remoteRetryCount: request.retryCount,
+                        ...getRemoteRetryReasonLogFields(request.retryReason)
+                    });
+                    await this.sessionStore.deleteSession(requesterAddress);
+                    return false;
+                }
+            }
+            else if (regIdMismatch) {
+                await this.sessionStore.deleteSession(requesterAddress);
+            }
             await this.signalProtocol.establishOutgoingSession(requesterAddress, {
                 regId: request.regId,
                 identity: request.keyBundle.identity,
@@ -356,12 +420,45 @@ class WaRetryCoordinator {
                     publicKey: request.keyBundle.key.publicKey
                 }
             });
+            return this.applySessionBaseKeyPolicy(request, requesterJid, requesterAddress, requesterNormalizedDeviceJid);
+        }
+        const sessionStillExists = currentSession !== null && !regIdMismatch;
+        if (sessionStillExists) {
+            return this.applySessionBaseKeyPolicy(request, requesterJid, requesterAddress, requesterNormalizedDeviceJid);
+        }
+        const fetched = await this.fetchMissingPreKeysSession(requesterJid, requesterAddress, requesterNormalizedDeviceJid, request.regId);
+        if (!fetched) {
+            return false;
+        }
+        await this.signalProtocol.establishOutgoingSession(requesterAddress, fetched);
+        return this.applySessionBaseKeyPolicy(request, requesterJid, requesterAddress, requesterNormalizedDeviceJid);
+    }
+    async applySessionBaseKeyPolicy(request, requesterJid, requesterAddress, requesterNormalizedDeviceJid) {
+        if (request.retryCount < 2) {
             return true;
         }
-        const hasSession = await this.signalProtocol.hasSession(requesterAddress);
-        if (hasSession) {
+        const currentSession = await this.sessionStore.getSession(requesterAddress);
+        const sessionBaseKey = currentSession?.aliceBaseKey ?? null;
+        if (!sessionBaseKey) {
             return true;
         }
+        const expiresAtMs = Date.now() + this.retryTtlMs;
+        if (request.retryCount === 2) {
+            this.setRetrySessionBaseKey(request.originalMsgId, requesterNormalizedDeviceJid, sessionBaseKey, expiresAtMs);
+            return true;
+        }
+        const saved = this.getRetrySessionBaseKey(request.originalMsgId, requesterNormalizedDeviceJid);
+        if (!saved || !(0, bytes_1.uint8Equal)(saved.baseKey, sessionBaseKey)) {
+            return true;
+        }
+        await this.sessionStore.deleteSession(requesterAddress);
+        this.logger.info('retry request forcing session refresh due to repeated base key', {
+            id: request.stanzaId,
+            originalMsgId: request.originalMsgId,
+            requester: requesterJid,
+            remoteRetryCount: request.retryCount,
+            ...getRemoteRetryReasonLogFields(request.retryReason)
+        });
         const fetched = await this.fetchMissingPreKeysSession(requesterJid, requesterAddress, requesterNormalizedDeviceJid, request.regId);
         if (!fetched) {
             return false;
@@ -434,13 +531,35 @@ class WaRetryCoordinator {
         if (outbound.state === 'ineligible') {
             return { authorized: false, reason: `state_${outbound.state}` };
         }
+        let requesterStatus = null;
+        try {
+            requesterStatus = await this.retryStore.getOutboundRequesterStatus(outbound.messageId, requesterNormalizedDeviceJid);
+        }
+        catch (error) {
+            this.logger.warn('failed to resolve outbound requester status from retry store', {
+                id: request.stanzaId,
+                originalMsgId: request.originalMsgId,
+                requester: requesterJid,
+                message: (0, primitives_1.toError)(error).message
+            });
+        }
+        if (requesterStatus) {
+            if (!requesterStatus.eligible) {
+                return { authorized: false, reason: 'requester_device_not_eligible' };
+            }
+            if (requesterStatus.delivered) {
+                return { authorized: false, reason: 'requester_already_delivered' };
+            }
+        }
         const isGroupOutbound = (0, jid_1.isGroupOrBroadcastJid)(outbound.toJid);
         if (!isGroupOutbound && (outbound.state === 'read' || outbound.state === 'played')) {
             return { authorized: false, reason: `state_${outbound.state}` };
         }
-        const requesterAuthorized = await this.isRequesterAuthorizedDevice(requesterJid, requesterAddress, requesterNormalizedDeviceJid);
-        if (!requesterAuthorized) {
-            return { authorized: false, reason: 'requester_device_not_authorized' };
+        if (!requesterStatus) {
+            const requesterAuthorized = await this.isRequesterAuthorizedDevice(requesterJid, requesterAddress, requesterNormalizedDeviceJid);
+            if (!requesterAuthorized) {
+                return { authorized: false, reason: 'requester_device_not_authorized' };
+            }
         }
         return { authorized: true };
     }
@@ -498,7 +617,11 @@ class WaRetryCoordinator {
             return;
         }
         try {
-            await this.sendNode((0, message_1.buildInboundRetryReceiptAckNode)(receiptNode));
+            await this.sendNode((0, global_1.buildAckNode)({
+                kind: 'receipt',
+                node: receiptNode,
+                retryType: true
+            }));
         }
         catch (error) {
             this.logger.warn('failed to send retry ack', {
@@ -514,6 +637,7 @@ class WaRetryCoordinator {
             return;
         }
         this.nextRetryCleanupAtMs = nowMs + RETRY_CLEANUP_INTERVAL_MS;
+        this.cleanupRetrySessionBaseKeys(nowMs);
         try {
             await this.retryStore.cleanupExpired(nowMs);
         }
@@ -523,5 +647,35 @@ class WaRetryCoordinator {
             });
         }
     }
+    retrySessionBaseKeyMapKey(originalMsgId, requesterNormalizedDeviceJid) {
+        return `${originalMsgId}|${requesterNormalizedDeviceJid}`;
+    }
+    setRetrySessionBaseKey(originalMsgId, requesterNormalizedDeviceJid, baseKey, expiresAtMs) {
+        const key = this.retrySessionBaseKeyMapKey(originalMsgId, requesterNormalizedDeviceJid);
+        (0, collections_1.setBoundedMapEntry)(this.retrySessionBaseKeys, key, {
+            baseKey: Uint8Array.from(baseKey),
+            expiresAtMs
+        }, RETRY_SESSION_BASE_KEY_CACHE_MAX_ENTRIES);
+    }
+    getRetrySessionBaseKey(originalMsgId, requesterNormalizedDeviceJid) {
+        const key = this.retrySessionBaseKeyMapKey(originalMsgId, requesterNormalizedDeviceJid);
+        const entry = this.retrySessionBaseKeys.get(key);
+        if (!entry) {
+            return null;
+        }
+        if (entry.expiresAtMs <= Date.now()) {
+            this.retrySessionBaseKeys.delete(key);
+            return null;
+        }
+        return entry;
+    }
+    cleanupRetrySessionBaseKeys(nowMs) {
+        for (const [key, entry] of this.retrySessionBaseKeys) {
+            if (entry.expiresAtMs > nowMs) {
+                continue;
+            }
+            this.retrySessionBaseKeys.delete(key);
+        }
+    }
 }
 exports.WaRetryCoordinator = WaRetryCoordinator;

package/dist/client/coordinators/WaStreamControlCoordinator.js

@@ -19,7 +19,7 @@ function createStreamControlHandler(options) {
     const restartBackendAfterStreamControl = async (reason) => {
         logger.info('restarting backend after stream control', { reason });
         try {
-            await connect();
+            await connect(constants_1.WA_CONNECTION_REASONS.RECONNECTED);
         }
         catch (error) {
             logger.warn('failed to restart backend after stream control', {
@@ -46,29 +46,36 @@ function createStreamControlHandler(options) {
             });
         }
     };
+    const stopCommsImmediately = () => {
+        void getComms()?.stopComms();
+    };
     const forceLoginDueToStreamError = async (code) => {
-        await runStreamControlLifecycle(`stream_error_code_${code}`, async () => {
+        const reason = constants_1.WA_DISCONNECT_REASONS.STREAM_ERROR_FORCE_LOGIN;
+        stopCommsImmediately();
+        await runStreamControlLifecycle(reason, async () => {
             logger.warn('received forced login stream error; starting login lifecycle', {
                 code
             });
-            await disconnect();
+            await disconnect(reason, true, code);
             await clearStoredCredentials();
-            await restartBackendAfterStreamControl(`stream_error_code_${code}`);
+            await restartBackendAfterStreamControl(reason);
         });
     };
-    const disconnectDueToStreamError = async (reason) => {
+    const disconnectDueToStreamError = async (reason, code) => {
+        stopCommsImmediately();
         await runStreamControlLifecycle(reason, async () => {
             logger.warn('disconnecting due to stream control node', { reason });
-            await disconnect();
+            await disconnect(reason, false, code);
         });
     };
-    const logoutDueToStreamError = async (reason, shouldRestartBackend) => {
+    const logoutDueToStreamError = async (reason, code, shouldRestartBackend) => {
+        stopCommsImmediately();
         await runStreamControlLifecycle(reason, async () => {
             logger.warn('logging out due to stream control node', {
                 reason,
                 shouldRestartBackend
             });
-            await disconnect();
+            await disconnect(reason, true, code);
             await clearStoredCredentials();
             if (shouldRestartBackend) {
                 await restartBackendAfterStreamControl(reason);
@@ -89,7 +96,7 @@ function createStreamControlHandler(options) {
                             return;
                         }
                         if (result.code === constants_1.WA_STREAM_SIGNALING.FORCE_LOGOUT_CODE) {
-                            await logoutDueToStreamError(`stream_error_code_${constants_1.WA_STREAM_SIGNALING.FORCE_LOGOUT_CODE}`, true);
+                            await logoutDueToStreamError(constants_1.WA_DISCONNECT_REASONS.STREAM_ERROR_FORCE_LOGOUT, result.code, true);
                             return;
                         }
                     }
@@ -97,11 +104,11 @@ function createStreamControlHandler(options) {
                     return;
                 case 'stream_error_replaced':
                     logger.warn('received stream:error replaced, stopping client');
-                    await disconnectDueToStreamError(constants_1.WA_DISCONNECT_REASONS.STREAM_ERROR_REPLACED);
+                    await disconnectDueToStreamError(constants_1.WA_DISCONNECT_REASONS.STREAM_ERROR_REPLACED, null);
                     return;
                 case 'stream_error_device_removed':
                     logger.warn('received stream:error device removed, logging out');
-                    await logoutDueToStreamError(constants_1.WA_DISCONNECT_REASONS.STREAM_ERROR_DEVICE_REMOVED, false);
+                    await logoutDueToStreamError(constants_1.WA_DISCONNECT_REASONS.STREAM_ERROR_DEVICE_REMOVED, null, false);
                     return;
                 case 'stream_error_ack':
                     logger.warn('received stream:error ack', { id: result.id });

package/dist/client/coordinators/WaTrustedContactTokenCoordinator.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WaTrustedContactTokenCoordinator = void 0;
+const cs_token_1 = require("../tokens/cs-token");
+const tc_token_1 = require("../tokens/tc-token");
+const PromiseDedup_1 = require("../../infra/perf/PromiseDedup");
+const privacy_token_1 = require("../../protocol/privacy-token");
+const privacy_token_2 = require("../../transport/node/builders/privacy-token");
+const primitives_1 = require("../../util/primitives");
+const NCT_SALT_SENTINEL_JID = '__nct_salt__';
+class WaTrustedContactTokenCoordinator {
+    constructor(options) {
+        this.logger = options.logger;
+        this.store = options.store;
+        this.runtime = options.runtime;
+        const maxDurationS = options.maxDurationS ?? privacy_token_1.WA_TC_TOKEN_DEFAULTS.MAX_DURATION_S;
+        this.baseConfig = {
+            durationS: (0, tc_token_1.clampDuration)(options.durationS ?? privacy_token_1.WA_TC_TOKEN_DEFAULTS.DURATION_S, maxDurationS),
+            numBuckets: options.numBuckets ?? privacy_token_1.WA_TC_TOKEN_DEFAULTS.NUM_BUCKETS,
+            senderDurationS: (0, tc_token_1.clampDuration)(options.senderDurationS ?? privacy_token_1.WA_TC_TOKEN_DEFAULTS.SENDER_DURATION_S, maxDurationS),
+            senderNumBuckets: options.senderNumBuckets ?? privacy_token_1.WA_TC_TOKEN_DEFAULTS.SENDER_NUM_BUCKETS,
+            maxDurationS
+        };
+        this.getConfigOverrides = options.getConfigOverrides;
+        this.csTokenGenerator = new cs_token_1.CsTokenGenerator();
+        this.senderTokenDedup = new PromiseDedup_1.PromiseDedup();
+        this.cachedNctSalt = null;
+        this.nctSaltHydrated = false;
+    }
+    resolveConfig() {
+        const overrides = this.getConfigOverrides?.();
+        if (!overrides) {
+            return this.baseConfig;
+        }
+        const maxDurationS = overrides.maxDurationS ?? this.baseConfig.maxDurationS;
+        return {
+            durationS: (0, tc_token_1.clampDuration)(overrides.durationS ?? this.baseConfig.durationS, maxDurationS),
+            numBuckets: overrides.numBuckets ?? this.baseConfig.numBuckets,
+            senderDurationS: (0, tc_token_1.clampDuration)(overrides.senderDurationS ?? this.baseConfig.senderDurationS, maxDurationS),
+            senderNumBuckets: overrides.senderNumBuckets ?? this.baseConfig.senderNumBuckets,
+            maxDurationS
+        };
+    }
+    async resolveTokenForMessage(recipientJid) {
+        const record = await this.store.getByJid(recipientJid);
+        const nowS = Math.floor(Date.now() / 1000);
+        const config = this.resolveConfig();
+        if (record?.tcToken &&
+            record.tcTokenTimestamp !== undefined &&
+            !(0, tc_token_1.isTokenExpired)(record.tcTokenTimestamp, nowS, config.durationS, config.numBuckets)) {
+            return (0, privacy_token_2.buildTcTokenMessageNode)(record.tcToken);
+        }
+        const nctSalt = await this.getNctSalt();
+        if (!nctSalt) {
+            return null;
+        }
+        const meLid = this.runtime.getCurrentMeLid();
+        if (!meLid) {
+            return null;
+        }
+        const hash = await this.csTokenGenerator.generate(nctSalt, meLid);
+        return (0, privacy_token_2.buildCsTokenMessageNode)(hash);
+    }
+    async handleIncomingToken(fromJid, tokens) {
+        const nowMs = Date.now();
+        for (let i = 0; i < tokens.length; i += 1) {
+            const token = tokens[i];
+            if (token.type !== privacy_token_1.WA_PRIVACY_TOKEN_TYPES.TRUSTED_CONTACT) {
+                this.logger.warn('ignoring unknown privacy token type', { type: token.type });
+                continue;
+            }
+            await this.store.upsert({
+                jid: fromJid,
+                tcToken: token.tokenBytes,
+                tcTokenTimestamp: token.timestampS,
+                updatedAtMs: nowMs
+            });
+            this.runtime.emitEvent('privacy_token_update', {
+                jid: fromJid,
+                timestampS: token.timestampS,
+                type: token.type,
+                source: 'notification'
+            });
+        }
+    }
+    async maybeIssueSenderToken(recipientJid) {
+        return this.senderTokenDedup.run(recipientJid, async () => {
+            const nowS = Math.floor(Date.now() / 1000);
+            const record = await this.store.getByJid(recipientJid);
+            const senderTimestampS = record?.tcTokenSenderTimestamp;
+            const config = this.resolveConfig();
+            if (senderTimestampS !== undefined && senderTimestampS > 0) {
+                if (!(0, tc_token_1.shouldSendNewToken)(senderTimestampS, nowS, config.senderDurationS)) {
+                    return;
+                }
+            }
+            await this.issuePrivacyToken(recipientJid, nowS);
+            await this.store.upsert({
+                jid: recipientJid,
+                tcTokenSenderTimestamp: nowS,
+                updatedAtMs: Date.now()
+            });
+        });
+    }
+    async reissueOnIdentityChange(jid) {
+        const record = await this.store.getByJid(jid);
+        if (!record?.tcTokenSenderTimestamp) {
+            return;
+        }
+        const nowS = Math.floor(Date.now() / 1000);
+        const config = this.resolveConfig();
+        if ((0, tc_token_1.isTokenExpired)(record.tcTokenSenderTimestamp, nowS, config.senderDurationS, config.senderNumBuckets)) {
+            return;
+        }
+        try {
+            await this.issuePrivacyToken(jid, record.tcTokenSenderTimestamp);
+        }
+        catch (error) {
+            this.logger.warn('send-tc-token-device-identity-change-failed', {
+                jid,
+                message: (0, primitives_1.toError)(error).message
+            });
+        }
+    }
+    async hydrateFromHistorySync(conversations) {
+        const nowMs = Date.now();
+        const records = [];
+        for (let i = 0; i < conversations.length; i += 1) {
+            const conv = conversations[i];
+            if (!conv.tcToken && !conv.tcTokenTimestamp && !conv.tcTokenSenderTimestamp) {
+                continue;
+            }
+            records[records.length] = {
+                jid: conv.jid,
+                tcToken: conv.tcToken ?? undefined,
+                tcTokenTimestamp: conv.tcTokenTimestamp ?? undefined,
+                tcTokenSenderTimestamp: conv.tcTokenSenderTimestamp ?? undefined,
+                updatedAtMs: nowMs
+            };
+        }
+        if (records.length > 0) {
+            await this.store.upsertBatch(records);
+        }
+    }
+    async handleNctSaltSync(salt) {
+        if (salt) {
+            await this.store.upsert({
+                jid: NCT_SALT_SENTINEL_JID,
+                nctSalt: salt,
+                updatedAtMs: Date.now()
+            });
+            this.cachedNctSalt = salt;
+        }
+        else {
+            await this.store.deleteByJid(NCT_SALT_SENTINEL_JID);
+            this.cachedNctSalt = null;
+        }
+        this.nctSaltHydrated = true;
+        this.csTokenGenerator.invalidate();
+    }
+    async hydrateNctSaltFromHistorySync(salt) {
+        await this.store.upsert({
+            jid: NCT_SALT_SENTINEL_JID,
+            nctSalt: salt,
+            updatedAtMs: Date.now()
+        });
+        this.cachedNctSalt = salt;
+        this.nctSaltHydrated = true;
+    }
+    async getNctSalt() {
+        if (this.nctSaltHydrated) {
+            return this.cachedNctSalt;
+        }
+        const record = await this.store.getByJid(NCT_SALT_SENTINEL_JID);
+        this.cachedNctSalt = record?.nctSalt ?? null;
+        this.nctSaltHydrated = true;
+        return this.cachedNctSalt;
+    }
+    async issuePrivacyToken(jid, timestampS) {
+        const node = (0, privacy_token_2.buildPrivacyTokenIqNode)({ jid, timestampS });
+        await this.runtime.queryWithContext('issue-privacy-token', node);
+    }
+}
+exports.WaTrustedContactTokenCoordinator = WaTrustedContactTokenCoordinator;