zapo-js 0.1.2 → 0.3.0

package/dist/esm/client/coordinators/WaRetryCoordinator.js

@@ -1,16 +1,18 @@
 import { proto } from '../../proto.js';
 import { WA_MESSAGE_TAGS } from '../../protocol/constants.js';
-import { isGroupOrBroadcastJid, normalizeDeviceJid, parseSignalAddressFromJid } from '../../protocol/jid.js';
+import { isGroupOrBroadcastJid, normalizeDeviceJid, parseJidFull } from '../../protocol/jid.js';
 import { MAX_RETRY_ATTEMPTS, RETRY_KEYS_MIN_COUNT, RETRY_OUTBOUND_TTL_MS, RETRY_REASON } from '../../retry/constants.js';
-import { pickRetryStateMax } from '../../retry/outbound.js';
-import { parseRetryReceiptRequest } from '../../retry/parse.js';
+import { parseRetryReceiptRequest, pickRetryStateMax } from '../../retry/parse.js';
 import { mapRetryReasonFromError } from '../../retry/reason.js';
 import { WaRetryReplayService } from '../../retry/replay.js';
 import { generatePreKeyPair } from '../../signal/registration/keygen.js';
-import { buildInboundRetryReceiptAckNode } from '../../transport/node/builders/message.js';
+import { buildAckNode } from '../../transport/node/builders/global.js';
 import { buildRetryReceiptNode } from '../../transport/node/builders/retry.js';
+import { uint8Equal } from '../../util/bytes.js';
+import { setBoundedMapEntry } from '../../util/collections.js';
 import { toError } from '../../util/primitives.js';
 const RETRY_CLEANUP_INTERVAL_MS = 30000;
+const RETRY_SESSION_BASE_KEY_CACHE_MAX_ENTRIES = 8192;
 function getRetryReasonName(code) {
     if (code === undefined) {
         return undefined;
@@ -35,6 +37,8 @@ export class WaRetryCoordinator {
         this.retryStore = options.retryStore;
         this.retryTtlMs = this.retryStore.getTtlMs?.() ?? RETRY_OUTBOUND_TTL_MS;
         this.signalStore = options.signalStore;
+        this.preKeyStore = options.preKeyStore;
+        this.sessionStore = options.sessionStore;
         this.senderKeyStore = options.senderKeyStore;
         this.signalProtocol = options.signalProtocol;
         this.signalDeviceSync = options.signalDeviceSync;
@@ -52,6 +56,7 @@ export class WaRetryCoordinator {
             getCurrentSignedIdentity: this.getCurrentSignedIdentity
         });
         this.retryProcessingByMessageId = new Map();
+        this.retrySessionBaseKeys = new Map();
     }
     async onDecryptFailure(context, error) {
         try {
@@ -76,12 +81,23 @@ export class WaRetryCoordinator {
         if (!this.isRetryReceiptNode(receiptNode)) {
             return;
         }
+        let shouldAck = false;
         try {
             await this.maybeCleanupRetryStore(Date.now());
-            const request = parseRetryReceiptRequest(receiptNode);
+            const expectedToJids = [];
+            const meJid = this.getCurrentMeJid()?.trim();
+            const meLid = this.getCurrentMeLid()?.trim();
+            if (meJid) {
+                expectedToJids.push(meJid);
+            }
+            if (meLid) {
+                expectedToJids.push(meLid);
+            }
+            const request = parseRetryReceiptRequest(receiptNode, expectedToJids.length > 0 ? { expectedToJids } : undefined);
             if (!request) {
                 return;
             }
+            shouldAck = true;
             await this.handleParsedRetryRequest(receiptNode, request);
         }
         catch (error) {
@@ -93,7 +109,9 @@ export class WaRetryCoordinator {
             });
         }
         finally {
-            await this.sendRetryAckSafe(receiptNode);
+            if (shouldAck) {
+                await this.sendRetryAckSafe(receiptNode);
+            }
         }
     }
     isRetryReceiptNode(node) {
@@ -129,7 +147,6 @@ export class WaRetryCoordinator {
             to: context.from,
             participant: context.participant,
             recipient: context.recipient,
-            from: this.getCurrentMeJid() ?? undefined,
             originalMsgId: context.stanzaId,
             retryCount: prepared.retryCount,
             t: prepared.timestamp,
@@ -200,8 +217,9 @@ export class WaRetryCoordinator {
         let requesterAddress;
         let requesterNormalizedDeviceJid;
         try {
-            requesterAddress = parseSignalAddressFromJid(requesterJid);
-            requesterNormalizedDeviceJid = normalizeDeviceJid(requesterJid);
+            const requesterParsed = parseJidFull(requesterJid);
+            requesterAddress = requesterParsed.address;
+            requesterNormalizedDeviceJid = requesterParsed.normalizedJid;
         }
         catch (error) {
             this.logger.info('retry request rejected: invalid requester jid', {
@@ -277,20 +295,36 @@ export class WaRetryCoordinator {
         if (!nextState) {
             return;
         }
-        const current = await this.retryStore.getOutboundMessage(messageId);
-        if (!current) {
-            return;
-        }
-        const merged = pickRetryStateMax(current.state, nextState);
-        if (merged === current.state) {
-            return;
-        }
-        const nowMs = Date.now();
-        await this.retryStore.updateOutboundMessageState(messageId, merged, nowMs, nowMs + this.retryTtlMs);
+        await this.runRetryTaskSerialized(messageId, async () => {
+            const current = await this.retryStore.getOutboundMessage(messageId);
+            if (!current) {
+                return;
+            }
+            const nowMs = Date.now();
+            const expiresAtMs = nowMs + this.retryTtlMs;
+            const merged = pickRetryStateMax(current.state, nextState);
+            if (merged !== current.state) {
+                await this.retryStore.updateOutboundMessageState(messageId, merged, nowMs, expiresAtMs);
+            }
+            const requesterJid = receiptNode.attrs.participant ?? receiptNode.attrs.from;
+            if (!requesterJid) {
+                return;
+            }
+            try {
+                await this.retryStore.markOutboundRequesterDelivered(messageId, normalizeDeviceJid(requesterJid), nowMs, expiresAtMs);
+            }
+            catch (error) {
+                this.logger.warn('failed to update outbound requester delivery state', {
+                    id: messageId,
+                    requester: requesterJid,
+                    message: toError(error).message
+                });
+            }
+        });
     }
     async runRetryTaskSerialized(messageId, task) {
         const previous = this.retryProcessingByMessageId.get(messageId) ?? Promise.resolve();
-        const current = previous.then(task, task);
+        const current = previous.then(task);
         const tracker = current.then(() => undefined, () => undefined);
         this.retryProcessingByMessageId.set(messageId, tracker);
         try {
@@ -306,13 +340,13 @@ export class WaRetryCoordinator {
     async buildRetryKeysSection(identity) {
         const [signedPreKey, preKey] = await Promise.all([
             this.signalStore.getSignedPreKey(),
-            this.signalStore.getOrGenSinglePreKey(generatePreKeyPair)
+            this.preKeyStore.getOrGenSinglePreKey(generatePreKeyPair)
         ]);
         if (!signedPreKey) {
             this.logger.warn('retry keys section skipped: signed prekey unavailable');
             return undefined;
         }
-        await this.signalStore.markKeyAsUploaded(preKey.keyId);
+        await this.preKeyStore.markKeyAsUploaded(preKey.keyId);
         const signedIdentity = this.getCurrentSignedIdentity();
         return {
             identity,
@@ -331,15 +365,45 @@ export class WaRetryCoordinator {
         };
     }
     async updateLocalSessionFromRetryRequest(request, requesterJid, requesterAddress, requesterNormalizedDeviceJid) {
-        await this.markRetryRequesterSenderKeyAsStale(request, requesterJid, requesterAddress);
-        const currentSession = await this.signalStore.getSession(requesterAddress);
-        if (currentSession && request.regId > 0 && currentSession.remote.regId !== request.regId) {
-            await this.signalStore.deleteSession(requesterAddress);
+        const [, currentSession] = await Promise.all([
+            this.markRetryRequesterSenderKeyAsStale(request, requesterJid, requesterAddress),
+            this.sessionStore.getSession(requesterAddress)
+        ]);
+        const regIdMismatch = !!currentSession && request.regId > 0 && currentSession.remote.regId !== request.regId;
+        if (regIdMismatch && !request.keyBundle) {
+            await this.sessionStore.deleteSession(requesterAddress);
         }
         if (request.keyBundle) {
             if (!request.keyBundle.key || !request.keyBundle.skey.signature) {
                 return false;
             }
+            if (request.offline) {
+                if (!currentSession) {
+                    this.logger.info('retry request rejected: offline retry missing existing session', {
+                        id: request.stanzaId,
+                        originalMsgId: request.originalMsgId,
+                        requester: requesterJid,
+                        remoteRetryCount: request.retryCount,
+                        ...getRemoteRetryReasonLogFields(request.retryReason)
+                    });
+                    await this.sessionStore.deleteSession(requesterAddress);
+                    return false;
+                }
+                if (regIdMismatch) {
+                    this.logger.info('retry request rejected: offline retry registration id mismatch', {
+                        id: request.stanzaId,
+                        originalMsgId: request.originalMsgId,
+                        requester: requesterJid,
+                        remoteRetryCount: request.retryCount,
+                        ...getRemoteRetryReasonLogFields(request.retryReason)
+                    });
+                    await this.sessionStore.deleteSession(requesterAddress);
+                    return false;
+                }
+            }
+            else if (regIdMismatch) {
+                await this.sessionStore.deleteSession(requesterAddress);
+            }
             await this.signalProtocol.establishOutgoingSession(requesterAddress, {
                 regId: request.regId,
                 identity: request.keyBundle.identity,
@@ -353,12 +417,45 @@ export class WaRetryCoordinator {
                     publicKey: request.keyBundle.key.publicKey
                 }
             });
+            return this.applySessionBaseKeyPolicy(request, requesterJid, requesterAddress, requesterNormalizedDeviceJid);
+        }
+        const sessionStillExists = currentSession !== null && !regIdMismatch;
+        if (sessionStillExists) {
+            return this.applySessionBaseKeyPolicy(request, requesterJid, requesterAddress, requesterNormalizedDeviceJid);
+        }
+        const fetched = await this.fetchMissingPreKeysSession(requesterJid, requesterAddress, requesterNormalizedDeviceJid, request.regId);
+        if (!fetched) {
+            return false;
+        }
+        await this.signalProtocol.establishOutgoingSession(requesterAddress, fetched);
+        return this.applySessionBaseKeyPolicy(request, requesterJid, requesterAddress, requesterNormalizedDeviceJid);
+    }
+    async applySessionBaseKeyPolicy(request, requesterJid, requesterAddress, requesterNormalizedDeviceJid) {
+        if (request.retryCount < 2) {
             return true;
         }
-        const hasSession = await this.signalProtocol.hasSession(requesterAddress);
-        if (hasSession) {
+        const currentSession = await this.sessionStore.getSession(requesterAddress);
+        const sessionBaseKey = currentSession?.aliceBaseKey ?? null;
+        if (!sessionBaseKey) {
             return true;
         }
+        const expiresAtMs = Date.now() + this.retryTtlMs;
+        if (request.retryCount === 2) {
+            this.setRetrySessionBaseKey(request.originalMsgId, requesterNormalizedDeviceJid, sessionBaseKey, expiresAtMs);
+            return true;
+        }
+        const saved = this.getRetrySessionBaseKey(request.originalMsgId, requesterNormalizedDeviceJid);
+        if (!saved || !uint8Equal(saved.baseKey, sessionBaseKey)) {
+            return true;
+        }
+        await this.sessionStore.deleteSession(requesterAddress);
+        this.logger.info('retry request forcing session refresh due to repeated base key', {
+            id: request.stanzaId,
+            originalMsgId: request.originalMsgId,
+            requester: requesterJid,
+            remoteRetryCount: request.retryCount,
+            ...getRemoteRetryReasonLogFields(request.retryReason)
+        });
         const fetched = await this.fetchMissingPreKeysSession(requesterJid, requesterAddress, requesterNormalizedDeviceJid, request.regId);
         if (!fetched) {
             return false;
@@ -431,13 +528,35 @@ export class WaRetryCoordinator {
         if (outbound.state === 'ineligible') {
             return { authorized: false, reason: `state_${outbound.state}` };
         }
+        let requesterStatus = null;
+        try {
+            requesterStatus = await this.retryStore.getOutboundRequesterStatus(outbound.messageId, requesterNormalizedDeviceJid);
+        }
+        catch (error) {
+            this.logger.warn('failed to resolve outbound requester status from retry store', {
+                id: request.stanzaId,
+                originalMsgId: request.originalMsgId,
+                requester: requesterJid,
+                message: toError(error).message
+            });
+        }
+        if (requesterStatus) {
+            if (!requesterStatus.eligible) {
+                return { authorized: false, reason: 'requester_device_not_eligible' };
+            }
+            if (requesterStatus.delivered) {
+                return { authorized: false, reason: 'requester_already_delivered' };
+            }
+        }
         const isGroupOutbound = isGroupOrBroadcastJid(outbound.toJid);
         if (!isGroupOutbound && (outbound.state === 'read' || outbound.state === 'played')) {
             return { authorized: false, reason: `state_${outbound.state}` };
         }
-        const requesterAuthorized = await this.isRequesterAuthorizedDevice(requesterJid, requesterAddress, requesterNormalizedDeviceJid);
-        if (!requesterAuthorized) {
-            return { authorized: false, reason: 'requester_device_not_authorized' };
+        if (!requesterStatus) {
+            const requesterAuthorized = await this.isRequesterAuthorizedDevice(requesterJid, requesterAddress, requesterNormalizedDeviceJid);
+            if (!requesterAuthorized) {
+                return { authorized: false, reason: 'requester_device_not_authorized' };
+            }
         }
         return { authorized: true };
     }
@@ -495,7 +614,11 @@ export class WaRetryCoordinator {
             return;
         }
         try {
-            await this.sendNode(buildInboundRetryReceiptAckNode(receiptNode));
+            await this.sendNode(buildAckNode({
+                kind: 'receipt',
+                node: receiptNode,
+                retryType: true
+            }));
         }
         catch (error) {
             this.logger.warn('failed to send retry ack', {
@@ -511,6 +634,7 @@ export class WaRetryCoordinator {
             return;
         }
         this.nextRetryCleanupAtMs = nowMs + RETRY_CLEANUP_INTERVAL_MS;
+        this.cleanupRetrySessionBaseKeys(nowMs);
         try {
             await this.retryStore.cleanupExpired(nowMs);
         }
@@ -520,4 +644,34 @@ export class WaRetryCoordinator {
             });
         }
     }
+    retrySessionBaseKeyMapKey(originalMsgId, requesterNormalizedDeviceJid) {
+        return `${originalMsgId}|${requesterNormalizedDeviceJid}`;
+    }
+    setRetrySessionBaseKey(originalMsgId, requesterNormalizedDeviceJid, baseKey, expiresAtMs) {
+        const key = this.retrySessionBaseKeyMapKey(originalMsgId, requesterNormalizedDeviceJid);
+        setBoundedMapEntry(this.retrySessionBaseKeys, key, {
+            baseKey: Uint8Array.from(baseKey),
+            expiresAtMs
+        }, RETRY_SESSION_BASE_KEY_CACHE_MAX_ENTRIES);
+    }
+    getRetrySessionBaseKey(originalMsgId, requesterNormalizedDeviceJid) {
+        const key = this.retrySessionBaseKeyMapKey(originalMsgId, requesterNormalizedDeviceJid);
+        const entry = this.retrySessionBaseKeys.get(key);
+        if (!entry) {
+            return null;
+        }
+        if (entry.expiresAtMs <= Date.now()) {
+            this.retrySessionBaseKeys.delete(key);
+            return null;
+        }
+        return entry;
+    }
+    cleanupRetrySessionBaseKeys(nowMs) {
+        for (const [key, entry] of this.retrySessionBaseKeys) {
+            if (entry.expiresAtMs > nowMs) {
+                continue;
+            }
+            this.retrySessionBaseKeys.delete(key);
+        }
+    }
 }

package/dist/esm/client/coordinators/WaStreamControlCoordinator.js

@@ -1,4 +1,4 @@
-import { WA_DISCONNECT_REASONS, WA_STREAM_SIGNALING } from '../../protocol/constants.js';
+import { WA_CONNECTION_REASONS, WA_DISCONNECT_REASONS, WA_STREAM_SIGNALING } from '../../protocol/constants.js';
 import { toError } from '../../util/primitives.js';
 export function createStreamControlHandler(options) {
     const { logger, getComms, clearPendingQueries, clearMediaConnCache, disconnect, clearStoredCredentials, connect } = options;
@@ -16,7 +16,7 @@ export function createStreamControlHandler(options) {
     const restartBackendAfterStreamControl = async (reason) => {
         logger.info('restarting backend after stream control', { reason });
         try {
-            await connect();
+            await connect(WA_CONNECTION_REASONS.RECONNECTED);
         }
         catch (error) {
             logger.warn('failed to restart backend after stream control', {
@@ -43,29 +43,36 @@ export function createStreamControlHandler(options) {
             });
         }
     };
+    const stopCommsImmediately = () => {
+        void getComms()?.stopComms();
+    };
     const forceLoginDueToStreamError = async (code) => {
-        await runStreamControlLifecycle(`stream_error_code_${code}`, async () => {
+        const reason = WA_DISCONNECT_REASONS.STREAM_ERROR_FORCE_LOGIN;
+        stopCommsImmediately();
+        await runStreamControlLifecycle(reason, async () => {
             logger.warn('received forced login stream error; starting login lifecycle', {
                 code
             });
-            await disconnect();
+            await disconnect(reason, true, code);
             await clearStoredCredentials();
-            await restartBackendAfterStreamControl(`stream_error_code_${code}`);
+            await restartBackendAfterStreamControl(reason);
         });
     };
-    const disconnectDueToStreamError = async (reason) => {
+    const disconnectDueToStreamError = async (reason, code) => {
+        stopCommsImmediately();
         await runStreamControlLifecycle(reason, async () => {
             logger.warn('disconnecting due to stream control node', { reason });
-            await disconnect();
+            await disconnect(reason, false, code);
         });
     };
-    const logoutDueToStreamError = async (reason, shouldRestartBackend) => {
+    const logoutDueToStreamError = async (reason, code, shouldRestartBackend) => {
+        stopCommsImmediately();
         await runStreamControlLifecycle(reason, async () => {
             logger.warn('logging out due to stream control node', {
                 reason,
                 shouldRestartBackend
             });
-            await disconnect();
+            await disconnect(reason, true, code);
             await clearStoredCredentials();
             if (shouldRestartBackend) {
                 await restartBackendAfterStreamControl(reason);
@@ -86,7 +93,7 @@ export function createStreamControlHandler(options) {
                             return;
                         }
                         if (result.code === WA_STREAM_SIGNALING.FORCE_LOGOUT_CODE) {
-                            await logoutDueToStreamError(`stream_error_code_${WA_STREAM_SIGNALING.FORCE_LOGOUT_CODE}`, true);
+                            await logoutDueToStreamError(WA_DISCONNECT_REASONS.STREAM_ERROR_FORCE_LOGOUT, result.code, true);
                             return;
                         }
                     }
@@ -94,11 +101,11 @@ export function createStreamControlHandler(options) {
                     return;
                 case 'stream_error_replaced':
                     logger.warn('received stream:error replaced, stopping client');
-                    await disconnectDueToStreamError(WA_DISCONNECT_REASONS.STREAM_ERROR_REPLACED);
+                    await disconnectDueToStreamError(WA_DISCONNECT_REASONS.STREAM_ERROR_REPLACED, null);
                     return;
                 case 'stream_error_device_removed':
                     logger.warn('received stream:error device removed, logging out');
-                    await logoutDueToStreamError(WA_DISCONNECT_REASONS.STREAM_ERROR_DEVICE_REMOVED, false);
+                    await logoutDueToStreamError(WA_DISCONNECT_REASONS.STREAM_ERROR_DEVICE_REMOVED, null, false);
                     return;
                 case 'stream_error_ack':
                     logger.warn('received stream:error ack', { id: result.id });

package/dist/esm/client/coordinators/WaTrustedContactTokenCoordinator.js

@@ -0,0 +1,180 @@
+import { CsTokenGenerator } from '../tokens/cs-token.js';
+import { clampDuration, isTokenExpired, shouldSendNewToken } from '../tokens/tc-token.js';
+import { PromiseDedup } from '../../infra/perf/PromiseDedup.js';
+import { WA_PRIVACY_TOKEN_TYPES, WA_TC_TOKEN_DEFAULTS } from '../../protocol/privacy-token.js';
+import { buildCsTokenMessageNode, buildPrivacyTokenIqNode, buildTcTokenMessageNode } from '../../transport/node/builders/privacy-token.js';
+import { toError } from '../../util/primitives.js';
+const NCT_SALT_SENTINEL_JID = '__nct_salt__';
+export class WaTrustedContactTokenCoordinator {
+    constructor(options) {
+        this.logger = options.logger;
+        this.store = options.store;
+        this.runtime = options.runtime;
+        const maxDurationS = options.maxDurationS ?? WA_TC_TOKEN_DEFAULTS.MAX_DURATION_S;
+        this.baseConfig = {
+            durationS: clampDuration(options.durationS ?? WA_TC_TOKEN_DEFAULTS.DURATION_S, maxDurationS),
+            numBuckets: options.numBuckets ?? WA_TC_TOKEN_DEFAULTS.NUM_BUCKETS,
+            senderDurationS: clampDuration(options.senderDurationS ?? WA_TC_TOKEN_DEFAULTS.SENDER_DURATION_S, maxDurationS),
+            senderNumBuckets: options.senderNumBuckets ?? WA_TC_TOKEN_DEFAULTS.SENDER_NUM_BUCKETS,
+            maxDurationS
+        };
+        this.getConfigOverrides = options.getConfigOverrides;
+        this.csTokenGenerator = new CsTokenGenerator();
+        this.senderTokenDedup = new PromiseDedup();
+        this.cachedNctSalt = null;
+        this.nctSaltHydrated = false;
+    }
+    resolveConfig() {
+        const overrides = this.getConfigOverrides?.();
+        if (!overrides) {
+            return this.baseConfig;
+        }
+        const maxDurationS = overrides.maxDurationS ?? this.baseConfig.maxDurationS;
+        return {
+            durationS: clampDuration(overrides.durationS ?? this.baseConfig.durationS, maxDurationS),
+            numBuckets: overrides.numBuckets ?? this.baseConfig.numBuckets,
+            senderDurationS: clampDuration(overrides.senderDurationS ?? this.baseConfig.senderDurationS, maxDurationS),
+            senderNumBuckets: overrides.senderNumBuckets ?? this.baseConfig.senderNumBuckets,
+            maxDurationS
+        };
+    }
+    async resolveTokenForMessage(recipientJid) {
+        const record = await this.store.getByJid(recipientJid);
+        const nowS = Math.floor(Date.now() / 1000);
+        const config = this.resolveConfig();
+        if (record?.tcToken &&
+            record.tcTokenTimestamp !== undefined &&
+            !isTokenExpired(record.tcTokenTimestamp, nowS, config.durationS, config.numBuckets)) {
+            return buildTcTokenMessageNode(record.tcToken);
+        }
+        const nctSalt = await this.getNctSalt();
+        if (!nctSalt) {
+            return null;
+        }
+        const meLid = this.runtime.getCurrentMeLid();
+        if (!meLid) {
+            return null;
+        }
+        const hash = await this.csTokenGenerator.generate(nctSalt, meLid);
+        return buildCsTokenMessageNode(hash);
+    }
+    async handleIncomingToken(fromJid, tokens) {
+        const nowMs = Date.now();
+        for (let i = 0; i < tokens.length; i += 1) {
+            const token = tokens[i];
+            if (token.type !== WA_PRIVACY_TOKEN_TYPES.TRUSTED_CONTACT) {
+                this.logger.warn('ignoring unknown privacy token type', { type: token.type });
+                continue;
+            }
+            await this.store.upsert({
+                jid: fromJid,
+                tcToken: token.tokenBytes,
+                tcTokenTimestamp: token.timestampS,
+                updatedAtMs: nowMs
+            });
+            this.runtime.emitEvent('privacy_token_update', {
+                jid: fromJid,
+                timestampS: token.timestampS,
+                type: token.type,
+                source: 'notification'
+            });
+        }
+    }
+    async maybeIssueSenderToken(recipientJid) {
+        return this.senderTokenDedup.run(recipientJid, async () => {
+            const nowS = Math.floor(Date.now() / 1000);
+            const record = await this.store.getByJid(recipientJid);
+            const senderTimestampS = record?.tcTokenSenderTimestamp;
+            const config = this.resolveConfig();
+            if (senderTimestampS !== undefined && senderTimestampS > 0) {
+                if (!shouldSendNewToken(senderTimestampS, nowS, config.senderDurationS)) {
+                    return;
+                }
+            }
+            await this.issuePrivacyToken(recipientJid, nowS);
+            await this.store.upsert({
+                jid: recipientJid,
+                tcTokenSenderTimestamp: nowS,
+                updatedAtMs: Date.now()
+            });
+        });
+    }
+    async reissueOnIdentityChange(jid) {
+        const record = await this.store.getByJid(jid);
+        if (!record?.tcTokenSenderTimestamp) {
+            return;
+        }
+        const nowS = Math.floor(Date.now() / 1000);
+        const config = this.resolveConfig();
+        if (isTokenExpired(record.tcTokenSenderTimestamp, nowS, config.senderDurationS, config.senderNumBuckets)) {
+            return;
+        }
+        try {
+            await this.issuePrivacyToken(jid, record.tcTokenSenderTimestamp);
+        }
+        catch (error) {
+            this.logger.warn('send-tc-token-device-identity-change-failed', {
+                jid,
+                message: toError(error).message
+            });
+        }
+    }
+    async hydrateFromHistorySync(conversations) {
+        const nowMs = Date.now();
+        const records = [];
+        for (let i = 0; i < conversations.length; i += 1) {
+            const conv = conversations[i];
+            if (!conv.tcToken && !conv.tcTokenTimestamp && !conv.tcTokenSenderTimestamp) {
+                continue;
+            }
+            records[records.length] = {
+                jid: conv.jid,
+                tcToken: conv.tcToken ?? undefined,
+                tcTokenTimestamp: conv.tcTokenTimestamp ?? undefined,
+                tcTokenSenderTimestamp: conv.tcTokenSenderTimestamp ?? undefined,
+                updatedAtMs: nowMs
+            };
+        }
+        if (records.length > 0) {
+            await this.store.upsertBatch(records);
+        }
+    }
+    async handleNctSaltSync(salt) {
+        if (salt) {
+            await this.store.upsert({
+                jid: NCT_SALT_SENTINEL_JID,
+                nctSalt: salt,
+                updatedAtMs: Date.now()
+            });
+            this.cachedNctSalt = salt;
+        }
+        else {
+            await this.store.deleteByJid(NCT_SALT_SENTINEL_JID);
+            this.cachedNctSalt = null;
+        }
+        this.nctSaltHydrated = true;
+        this.csTokenGenerator.invalidate();
+    }
+    async hydrateNctSaltFromHistorySync(salt) {
+        await this.store.upsert({
+            jid: NCT_SALT_SENTINEL_JID,
+            nctSalt: salt,
+            updatedAtMs: Date.now()
+        });
+        this.cachedNctSalt = salt;
+        this.nctSaltHydrated = true;
+    }
+    async getNctSalt() {
+        if (this.nctSaltHydrated) {
+            return this.cachedNctSalt;
+        }
+        const record = await this.store.getByJid(NCT_SALT_SENTINEL_JID);
+        this.cachedNctSalt = record?.nctSalt ?? null;
+        this.nctSaltHydrated = true;
+        return this.cachedNctSalt;
+    }
+    async issuePrivacyToken(jid, timestampS) {
+        const node = buildPrivacyTokenIqNode({ jid, timestampS });
+        await this.runtime.queryWithContext('issue-privacy-token', node);
+    }
+}