@crysnovax/baileys 2.0.0 → 2.5.2

package/lib/Socket/messages-recv.js

@@ -4,21 +4,26 @@ import { randomBytes } from 'crypto';
 import Long from 'long';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CACHE_TTLS, KEY_BUNDLE_TYPE, MIN_PREKEY_COUNT, PLACEHOLDER_MAX_AGE_SECONDS, STATUS_EXPIRY_SECONDS } from '../Defaults/index.js';
-import { WAMessageStatus, WAMessageStubType } from '../Types/index.js';
-import { aesDecryptCTR, aesEncryptGCM, cleanMessage, Curve, decodeMediaRetryNode, decodeMessageNode, decryptMessageNode, delay, derivePairingCodeKey, encodeBigEndian, encodeSignedDeviceIdentity, extractAddressingContext, getCallStatusFromNode, getHistoryMsg, getNextPreKeys, getStatusFromReceiptType, handleIdentityChange, hkdf, MISSING_KEYS_ERROR_TEXT, NACK_REASONS, NO_MESSAGE_FOUND_ERROR_TEXT, toNumber, unixTimestampSeconds, xmppPreKey, xmppSignedPreKey } from '../Utils/index.js';
+import { ReachoutTimelockEnforcementType, WAMessageStatus, WAMessageStubType } from '../Types/index.js';
+import { ACCOUNT_RESTRICTED_TEXT, aesDecryptCTR, aesEncryptGCM, cleanMessage, Curve, decodeMediaRetryNode, decodeMessageNode, decryptMessageNode, delay, derivePairingCodeKey, encodeBigEndian, encodeSignedDeviceIdentity, extractAddressingContext, extractE2ESessionFromRetryReceipt, getCallStatusFromNode, getHistoryMsg, getNextPreKeys, getStatusFromReceiptType, handleIdentityChange, hkdf, MISSING_KEYS_ERROR_TEXT, NACK_REASONS, NO_MESSAGE_FOUND_ERROR_TEXT, SERVER_ERROR_CODES, toNumber, unixTimestampSeconds, xmppPreKey, xmppSignedPreKey } from '../Utils/index.js';
 import { makeMutex } from '../Utils/make-mutex.js';
 import { makeOfflineNodeProcessor } from '../Utils/offline-node-processor.js';
 import { buildAckStanza } from '../Utils/stanza-ack.js';
-import { areJidsSameUser, binaryNodeToString, getAllBinaryNodeChildren, getBinaryNodeChild, getBinaryNodeChildBuffer, getBinaryNodeChildren, getBinaryNodeChildString, isJidGroup, isJidNewsletter, isJidStatusBroadcast, isLidUser, isPnUser, jidDecode, jidNormalizedUser, S_WHATSAPP_NET } from '../WABinary/index.js';
+import { buildMergedTcTokenIndexWrite, isTcTokenExpired, readTcTokenIndex, resolveIssuanceJid, resolveTcTokenJid, storeTcTokensFromIqResult, TC_TOKEN_INDEX_KEY } from '../Utils/tc-token-utils.js';
+import { areJidsSameUser, binaryNodeToString, getAllBinaryNodeChildren, getBinaryNodeChild, getBinaryNodeChildBuffer, getBinaryNodeChildren, getBinaryNodeChildString, getBinaryNodeChildUInt, isJidGroup, isJidNewsletter, isJidStatusBroadcast, isLidUser, isPnUser, jidDecode, jidNormalizedUser, S_WHATSAPP_NET } from '../WABinary/index.js';
 import { extractGroupMetadata } from './groups.js';
 import { makeMessagesSocket } from './messages-send.js';
+const ENFORCEMENT_TYPE_VALUES = new Set(Object.values(ReachoutTimelockEnforcementType));
+function isValidEnforcementType(value) {
+    return typeof value === 'string' && ENFORCEMENT_TYPE_VALUES.has(value);
+}
 export const makeMessagesRecvSocket = (config) => {
     const { logger, retryRequestDelayMs, maxMsgRetryCount, getMessage, shouldIgnoreJid, enableAutoSessionRecreation } = config;
     const sock = makeMessagesSocket(config);
-    const { ev, authState, ws, messageMutex, notificationMutex, receiptMutex, signalRepository, query, upsertMessage, resyncAppState, onUnexpectedError, assertSessions, sendNode, relayMessage, sendReceipt, uploadPreKeys, sendPeerDataOperationMessage, generateMessageTag, messageRetryManager, registerSocketEndHandler } = sock;
+    const { userDevicesCache, devicesMutex, ev, authState, ws, messageMutex, notificationMutex, receiptMutex, signalRepository, query, upsertMessage, resyncAppState, onUnexpectedError, assertSessions, sendNode, relayMessage, sendReceipt, uploadPreKeys, sendPeerDataOperationMessage, messageRetryManager, registerSocketEndHandler, issuePrivacyTokens, fetchAccountReachoutTimelock, placeholderResendCache } = sock;
+    const getLIDForPN = signalRepository.lidMapping.getLIDForPN.bind(signalRepository.lidMapping);
     /** this mutex ensures that each retryRequest will wait for the previous one to finish */
     const retryMutex = makeMutex();
-    const devicesMutex = makeMutex();
     const msgRetryCache = config.msgRetryCounterCache ||
         new NodeCache({
             stdTTL: DEFAULT_CACHE_TTLS.MSG_RETRY, // 1 hour
@@ -29,16 +34,6 @@ export const makeMessagesRecvSocket = (config) => {
             stdTTL: DEFAULT_CACHE_TTLS.CALL_OFFER, // 5 mins
             useClones: false
         });
-    const placeholderResendCache = config.placeholderResendCache ||
-        new NodeCache({
-            stdTTL: DEFAULT_CACHE_TTLS.MSG_RETRY, // 1 hour
-            useClones: false
-        });
-    const userDevicesCache = config.userDevicesCache ??=
-        new NodeCache({
-            stdTTL: DEFAULT_CACHE_TTLS.USER_DEVICES, // 5 minutes
-            useClones: false
-        });
     // Debounce identity-change session refreshes per JID to avoid bursts
     const identityAssertDebounce = new NodeCache({ stdTTL: 5, useClones: false });
     let sendActiveReceipts = false;
@@ -92,25 +87,140 @@ export const makeMessagesRecvSocket = (config) => {
         }, 8000);
         return sendPeerDataOperationMessage(pdoMessage);
     };
-    // Handles mex newsletter notifications
-    const handleMexNewsletterNotification = async (node) => {
+    const handleMexNotification = async (node) => {
+        const updateNode = getBinaryNodeChild(node, 'update');
+        if (updateNode) {
+            const opName = updateNode.attrs?.op_name;
+            if (!opName) {
+                logger.warn({ node: binaryNodeToString(node) }, 'mex notification missing op_name, fallback to legacy');
+                await handleLegacyMexNewsletterNotification(node);
+                return;
+            }
+            let mexResponse;
+            try {
+                mexResponse = JSON.parse(updateNode.content.toString());
+            }
+            catch (error) {
+                logger.error({ err: error, opName }, 'failed to parse mex notification JSON');
+                return;
+            }
+            if (mexResponse.errors?.length) {
+                logger.warn({ errors: mexResponse.errors, opName }, 'mex notification has GQL errors');
+                return;
+            }
+            const data = mexResponse.data;
+            if (!data) {
+                logger.warn({ opName }, 'mex notification has null data');
+                return;
+            }
+            logger.debug({ opName }, 'processing mex notification');
+            switch (opName) {
+                case 'NotificationUserReachoutTimelockUpdate':
+                    handleReachoutTimelockNotification(data);
+                    break;
+                case 'MessageCappingInfoNotification':
+                    handleMessageCappingNotification(data);
+                    break;
+                // newsletter ops still use the legacy <mex> child structure
+                case 'NotificationNewsletterUpdate':
+                case 'NotificationLinkedProfilesUpdates':
+                case 'NotificationNewsletterAdminPromote':
+                case 'NotificationNewsletterAdminDemote':
+                case 'NotificationNewsletterUserSettingChange':
+                case 'NotificationNewsletterJoin':
+                case 'NotificationNewsletterLeave':
+                case 'NotificationNewsletterStateChange':
+                case 'NotificationNewsletterAdminMetadataUpdate':
+                case 'NotificationNewsletterOwnerUpdate':
+                case 'NotificationNewsletterAdminInviteRevoke':
+                case 'NotificationNewsletterWamoSubStatusChange':
+                case 'NotificationNewsletterBlockUser':
+                case 'NotificationNewsletterPaidPartnership':
+                case 'NotificationNewsletterMilestone':
+                case 'NewsletterResponseStateUpdate':
+                    await handleLegacyMexNewsletterNotification(node);
+                    break;
+                default:
+                    logger.debug({ opName }, 'unhandled mex notification');
+                    break;
+            }
+            return;
+        }
+        await handleLegacyMexNewsletterNotification(node);
+    };
+    const handleReachoutTimelockNotification = (data) => {
+        const payload = data.xwa2_notify_account_reachout_timelock;
+        if (!payload) {
+            logger.warn('reachout timelock notification missing payload');
+            return;
+        }
+        if (!payload.is_active) {
+            logger.info('reachout timelock restriction lifted');
+            ev.emit('connection.update', {
+                reachoutTimeLock: {
+                    isActive: false,
+                    enforcementType: ReachoutTimelockEnforcementType.DEFAULT
+                }
+            });
+            return;
+        }
+        // WA Web defaults to now+60s when the server omits the expiry
+        const timeEnforcementEnds = payload.time_enforcement_ends
+            ? new Date(parseInt(payload.time_enforcement_ends, 10) * 1000)
+            : new Date(Date.now() + 60000);
+        const enforcementType = isValidEnforcementType(payload.enforcement_type)
+            ? payload.enforcement_type
+            : ReachoutTimelockEnforcementType.DEFAULT;
+        logger.info({ enforcementType, timeEnforcementEnds }, 'reachout timelock restriction set');
+        ev.emit('connection.update', {
+            reachoutTimeLock: {
+                isActive: true,
+                timeEnforcementEnds,
+                enforcementType
+            }
+        });
+    };
+    const handleMessageCappingNotification = (data) => {
+        const payload = data.xwa2_notify_new_chat_messages_capping_info_update;
+        if (!payload) {
+            logger.warn('message capping notification missing payload');
+            return;
+        }
+        logger.info({ payload }, 'received message capping update');
+        ev.emit('message-capping.update', payload);
+    };
+    const handleLegacyMexNewsletterNotification = async (node) => {
         const mexNode = getBinaryNodeChild(node, 'mex');
-        if (!mexNode?.content) {
-            logger.warn({ node }, 'Invalid mex newsletter notification');
+        const updateNode = mexNode?.content ? null : getBinaryNodeChild(node, 'update') || getAllBinaryNodeChildren(node)[0];
+        const payloadNode = mexNode?.content ? mexNode : updateNode;
+        if (!payloadNode?.content) {
+            logger.warn({ node: binaryNodeToString(node) }, 'invalid mex newsletter notification');
             return;
         }
         let data;
         try {
-            data = JSON.parse(mexNode.content.toString());
+            const payloadContent = payloadNode.content;
+            if (Array.isArray(payloadContent)) {
+                logger.warn({ payloadNode }, 'invalid mex newsletter notification payload format');
+                return;
+            }
+            const contentBuf = typeof payloadContent === 'string' ? Buffer.from(payloadContent, 'binary') : Buffer.from(payloadContent);
+            data = JSON.parse(contentBuf.toString());
         }
         catch (error) {
-            logger.error({ err: error, node }, 'Failed to parse mex newsletter notification');
+            logger.error({ err: error, node: binaryNodeToString(node) }, 'failed to parse mex newsletter notification');
             return;
         }
-        const operation = data?.operation;
-        const updates = data?.updates;
+        const operation = data?.operation ?? payloadNode?.attrs?.op_name;
+        let updates = data?.updates;
+        if (!updates) {
+            const linkedProfiles = data?.data?.xwa2_notify_linked_profiles;
+            if (linkedProfiles) {
+                updates = [linkedProfiles];
+            }
+        }
         if (!updates || !operation) {
-            logger.warn({ data }, 'Invalid mex newsletter notification content');
+            logger.warn({ data }, 'invalid mex newsletter notification content');
             return;
         }
         logger.info({ operation, updates }, 'got mex newsletter notification');
@@ -138,91 +248,114 @@ export const makeMessagesRecvSocket = (config) => {
                     }
                 }
                 break;
+            case 'NotificationLinkedProfilesUpdates':
+                for (const update of updates) {
+                    const lid = update?.jid;
+                    const addedProfiles = Array.isArray(update?.added_profiles) ? update.added_profiles : [];
+                    const mappings = [];
+                    for (const profile of addedProfiles) {
+                        const pn = typeof profile === 'string' ? profile : (profile?.pn ?? profile?.jid ?? null);
+                        if (lid && pn) {
+                            const mapping = { lid, pn };
+                            ev.emit('lid-mapping.update', mapping);
+                            mappings.push(mapping);
+                        }
+                    }
+                    await signalRepository.lidMapping.storeLIDPNMappings(mappings);
+                }
+                break;
             default:
-                logger.info({ operation, data }, 'Unhandled mex newsletter notification');
+                logger.info({ operation, data }, 'unhandled mex newsletter notification');
                 break;
         }
     };
     // Handles newsletter notifications
     const handleNewsletterNotification = async (node) => {
         const from = node.attrs.from;
-        const child = getAllBinaryNodeChildren(node)[0];
+        const children = getAllBinaryNodeChildren(node);
         const author = node.attrs.participant;
-        logger.info({ from, child }, 'got newsletter notification');
-        switch (child.tag) {
-            case 'reaction':
-                const reactionUpdate = {
-                    id: from,
-                    server_id: child.attrs.message_id,
-                    reaction: {
-                        code: getBinaryNodeChildString(child, 'reaction'),
-                        count: 1
-                    }
-                };
-                ev.emit('newsletter.reaction', reactionUpdate);
-                break;
-            case 'view':
-                const viewUpdate = {
-                    id: from,
-                    server_id: child.attrs.message_id,
-                    count: parseInt(child.content?.toString() || '0', 10)
-                };
-                ev.emit('newsletter.view', viewUpdate);
-                break;
-            case 'participant':
-                const participantUpdate = {
-                    id: from,
-                    author,
-                    user: child.attrs.jid,
-                    action: child.attrs.action,
-                    new_role: child.attrs.role
-                };
-                ev.emit('newsletter-participants.update', participantUpdate);
-                break;
-            case 'update':
-                const settingsNode = getBinaryNodeChild(child, 'settings');
-                if (settingsNode) {
-                    const update = {};
-                    const nameNode = getBinaryNodeChild(settingsNode, 'name');
-                    if (nameNode?.content)
-                        update.name = nameNode.content.toString();
-                    const descriptionNode = getBinaryNodeChild(settingsNode, 'description');
-                    if (descriptionNode?.content)
-                        update.description = descriptionNode.content.toString();
-                    ev.emit('newsletter-settings.update', {
+        for (const child of children) {
+            logger.debug({ from, child }, 'got newsletter notification');
+            switch (child.tag) {
+                case 'reaction': {
+                    const reactionUpdate = {
                         id: from,
-                        update
-                    });
+                        server_id: child.attrs.message_id,
+                        reaction: {
+                            code: getBinaryNodeChildString(child, 'reaction'),
+                            count: 1
+                        }
+                    };
+                    ev.emit('newsletter.reaction', reactionUpdate);
+                    break;
                 }
-                break;
-            case 'message':
-                const plaintextNode = getBinaryNodeChild(child, 'plaintext');
-                if (plaintextNode?.content) {
-                    try {
-                        const contentBuf = typeof plaintextNode.content === 'string'
-                            ? Buffer.from(plaintextNode.content, 'binary')
-                            : Buffer.from(plaintextNode.content);
-                        const messageProto = proto.Message.decode(contentBuf).toJSON();
-                        const fullMessage = proto.WebMessageInfo.fromObject({
-                            key: {
-                                remoteJid: from,
-                                id: child.attrs.message_id || child.attrs.server_id,
-                                fromMe: false // TODO: is this really true though
-                            },
-                            message: messageProto,
-                            messageTimestamp: +child.attrs.t
-                        }).toJSON();
-                        await upsertMessage(fullMessage, 'append');
-                        logger.info('Processed plaintext newsletter message');
+                case 'view': {
+                    const viewUpdate = {
+                        id: from,
+                        server_id: child.attrs.message_id,
+                        count: parseInt(child.content?.toString() || '0', 10)
+                    };
+                    ev.emit('newsletter.view', viewUpdate);
+                    break;
+                }
+                case 'participant': {
+                    const participantUpdate = {
+                        id: from,
+                        author,
+                        user: child.attrs.jid,
+                        action: child.attrs.action,
+                        new_role: child.attrs.role
+                    };
+                    ev.emit('newsletter-participants.update', participantUpdate);
+                    break;
+                }
+                case 'update': {
+                    const settingsNode = getBinaryNodeChild(child, 'settings');
+                    if (settingsNode) {
+                        const update = {};
+                        const nameNode = getBinaryNodeChild(settingsNode, 'name');
+                        if (nameNode?.content)
+                            update.name = nameNode.content.toString();
+                        const descriptionNode = getBinaryNodeChild(settingsNode, 'description');
+                        if (descriptionNode?.content)
+                            update.description = descriptionNode.content.toString();
+                        ev.emit('newsletter-settings.update', {
+                            id: from,
+                            update
+                        });
                     }
-                    catch (error) {
-                        logger.error({ error }, 'Failed to decode plaintext newsletter message');
+                    break;
+                }
+                case 'message': {
+                    const plaintextNode = getBinaryNodeChild(child, 'plaintext');
+                    if (plaintextNode?.content) {
+                        try {
+                            const contentBuf = typeof plaintextNode.content === 'string'
+                                ? Buffer.from(plaintextNode.content, 'binary')
+                                : Buffer.from(plaintextNode.content);
+                            const messageProto = proto.Message.decode(contentBuf).toJSON();
+                            const fullMessage = proto.WebMessageInfo.fromObject({
+                                key: {
+                                    remoteJid: from,
+                                    id: child.attrs.message_id || child.attrs.server_id,
+                                    fromMe: false // TODO: is this really true though
+                                },
+                                message: messageProto,
+                                messageTimestamp: +child.attrs.t
+                            }).toJSON();
+                            await upsertMessage(fullMessage, 'append');
+                            logger.debug('Processed plaintext newsletter message');
+                        }
+                        catch (error) {
+                            logger.error({ error }, 'Failed to decode plaintext newsletter message');
+                        }
                     }
+                    break;
                 }
-                break;
-            default:
-                logger.warn({ node }, 'Unknown newsletter notification');
-                break;
+                default:
+                    logger.warn({ node, child }, 'Unknown newsletter notification child');
+                    break;
+            }
         }
     };
     const sendMessageAck = async (node, errorCode) => {
@@ -251,97 +384,6 @@ export const makeMessagesRecvSocket = (config) => {
         };
         await query(stanza);
     };
-    // Lia@Note 01-03-26 --- Source: https://github.com/koptereli/Baileys/commit/575cd41e6f01a9b3e1d7e2708c2292fa93de91f2
-    const initiateCall = async (jid, options = {}) => {
-        const meId = authState.creds.me?.id;
-        if (!meId) {
-            throw new Boom('Not authenticated');
-        }
-        const callId = randomBytes(8).toString('hex');
-        const isVideo = !!options.isVideo;
-        const isGroup = isJidGroup(jid);
-        const stanza = {
-            tag: 'call',
-            attrs: {
-                id: generateMessageTag(),
-                from: meId,
-                to: jid,
-                t: String(unixTimestampSeconds()),
-                ...(authState.creds.me?.name ? { notify: authState.creds.me.name } : {})
-            },
-            content: [
-                {
-                    tag: 'offer',
-                    attrs: {
-                        'call-id': callId,
-                        'call-creator': meId,
-                        count: '0'
-                    },
-                    content: [
-                        {
-                            tag: isVideo ? 'video' : 'audio',
-                            attrs: {}
-                        },
-                        {
-                            tag: 'net',
-                            attrs: {}
-                        },
-                        {
-                            tag: 'encopt',
-                            attrs: { key: randomBytes(2).toString('hex') }
-                        },
-                        {
-                            tag: 'relaylatency',
-                            attrs: {}
-                        },
-                        {
-                            tag: 'te',
-                            attrs: {}
-                        }
-                    ]
-                }
-            ]
-        };
-        await query(stanza);
-        await callOfferCache.set(callId, {
-            chatId: jid,
-            from: meId,
-            id: callId,
-            date: new Date(),
-            offline: false,
-            status: 'offer',
-            isVideo,
-            isGroup,
-            groupJid: isGroup ? jid : undefined
-        });
-        // TODO: implement ICE/DTLS-SRTP call media setup once full signaling requirements are mapped.
-        return { callId, to: jid, isVideo };
-    };
-    const cancelCall = async (callId, callTo) => {
-        const meId = authState.creds.me?.id;
-        if (!meId) {
-            throw new Boom('Not authenticated');
-        }
-        const stanza = {
-            tag: 'call',
-            attrs: {
-                from: meId,
-                to: callTo
-            },
-            content: [
-                {
-                    tag: 'terminate',
-                    attrs: {
-                        'call-id': callId,
-                        'call-creator': meId,
-                        count: '0'
-                    }
-                }
-            ]
-        };
-        await query(stanza);
-        await callOfferCache.del(callId);
-    };
     const sendRetryRequest = async (node, forceIncludeKeys = false) => {
         const { fullMessage } = decodeMessageNode(node, authState.creds.me.id, authState.creds.me.lid || '');
         const { key: msgKey } = fullMessage;
@@ -473,15 +515,58 @@ export const makeMessagesRecvSocket = (config) => {
             logger.info({ msgAttrs: node.attrs, retryCount }, 'sent retry receipt');
         }, authState?.creds?.me?.id || 'sendRetryRequest');
     };
+    // Mirrors WAWeb/Handle/PreKeyLow.js: skip a re-issued notification with the same stanza id.
+    const inFlightPreKeyLow = new Set();
+    /**
+     * Fire-and-forget tctoken re-issuance after a peer's device identity changed.
+     * Mirrors WAWebSendTcTokenWhenDeviceIdentityChange — runs in parallel with
+     * the session refresh (not after it).
+     */
+    const reissueTcTokenAfterIdentityChange = (from) => {
+        void (async () => {
+            const normalizedJid = jidNormalizedUser(from);
+            const tcJid = await resolveTcTokenJid(normalizedJid, getLIDForPN);
+            const tcTokenData = await authState.keys.get('tctoken', [tcJid]);
+            const senderTs = tcTokenData?.[tcJid]?.senderTimestamp;
+            if (senderTs === null || senderTs === undefined || isTcTokenExpired(senderTs)) {
+                return;
+            }
+            logger.debug({ jid: normalizedJid, senderTimestamp: senderTs }, 'identity changed, re-issuing tctoken');
+            const getPNForLID = signalRepository.lidMapping.getPNForLID.bind(signalRepository.lidMapping);
+            const issueJid = await resolveIssuanceJid(normalizedJid, sock.serverProps.lidTrustedTokenIssueToLid, getLIDForPN, getPNForLID);
+            const result = await issuePrivacyTokens([issueJid], senderTs);
+            await storeTcTokensFromIqResult({
+                result,
+                fallbackJid: tcJid,
+                keys: authState.keys,
+                getLIDForPN,
+                onNewJidStored: trackTcTokenJid
+            });
+        })().catch(err => {
+            logger.debug({ jid: from, err: err?.message }, 'failed to re-issue tctoken after identity change');
+        });
+    };
     const handleEncryptNotification = async (node) => {
         const from = node.attrs.from;
         if (from === S_WHATSAPP_NET) {
+            const stanzaId = node.attrs.id;
+            if (stanzaId && inFlightPreKeyLow.has(stanzaId)) {
+                return;
+            }
             const countChild = getBinaryNodeChild(node, 'count');
             const count = +countChild.attrs.value;
             const shouldUploadMorePreKeys = count < MIN_PREKEY_COUNT;
             logger.debug({ count, shouldUploadMorePreKeys }, 'recv pre-key count');
             if (shouldUploadMorePreKeys) {
-                await uploadPreKeys();
+                if (stanzaId)
+                    inFlightPreKeyLow.add(stanzaId);
+                try {
+                    await uploadPreKeys();
+                }
+                finally {
+                    if (stanzaId)
+                        inFlightPreKeyLow.delete(stanzaId);
+                }
             }
         }
         else {
@@ -491,7 +576,8 @@ export const makeMessagesRecvSocket = (config) => {
                 validateSession: signalRepository.validateSession,
                 assertSessions,
                 debounceCache: identityAssertDebounce,
-                logger
+                logger,
+                onBeforeSessionRefresh: reissueTcTokenAfterIdentityChange
             });
             if (result.action === 'no_identity_node') {
                 logger.info({ node }, 'unknown encrypt notification');
@@ -502,6 +588,7 @@ export const makeMessagesRecvSocket = (config) => {
         // TODO: Support PN/LID (Here is only LID now)
         const actingParticipantLid = fullNode.attrs.participant;
         const actingParticipantPn = fullNode.attrs.participant_pn;
+        const actingParticipantUsername = fullNode.attrs.participant_username;
         const affectedParticipantLid = getBinaryNodeChild(child, 'participant')?.attrs?.jid || actingParticipantLid;
         const affectedParticipantPn = getBinaryNodeChild(child, 'participant')?.attrs?.phone_number || actingParticipantPn;
         switch (child?.tag) {
@@ -521,7 +608,8 @@ export const makeMessagesRecvSocket = (config) => {
                     {
                         ...metadata,
                         author: actingParticipantLid,
-                        authorPn: actingParticipantPn
+                        authorPn: actingParticipantPn,
+                        authorUsername: actingParticipantUsername
                     }
                 ]);
                 break;
@@ -552,6 +640,7 @@ export const makeMessagesRecvSocket = (config) => {
                         id: attrs.jid,
                         phoneNumber: isLidUser(attrs.jid) && isPnUser(attrs.phone_number) ? attrs.phone_number : undefined,
                         lid: isPnUser(attrs.jid) && isLidUser(attrs.lid) ? attrs.lid : undefined,
+                        username: attrs.participant_username || attrs.username || undefined,
                         admin: (attrs.type || null)
                     };
                 });
@@ -624,58 +713,83 @@ export const makeMessagesRecvSocket = (config) => {
     const handleDevicesNotification = async (node) => {
         const [child] = getAllBinaryNodeChildren(node);
         const from = jidNormalizedUser(node.attrs.from);
+        if (!child) {
+            logger.debug({ from }, 'devices notification missing child, skipping');
+            return;
+        }
+        const tag = child.tag;
+        const deviceHash = child.attrs.device_hash;
         const devices = getBinaryNodeChildren(child, 'device');
-        if (areJidsSameUser(from, authState.creds.me.id) ||
-            areJidsSameUser(from, authState.creds.me.lid)) {
+        if (areJidsSameUser(from, authState.creds.me.id) || areJidsSameUser(from, authState.creds.me.lid)) {
             const deviceJids = devices.map(d => d.attrs.jid);
             logger.info({ deviceJids }, 'got my own devices');
         }
-        if (!devices || !devices.length || !devices[0]) {
-            logger.debug({ from }, 'no devices in notification, skipping');
+        if (!devices.length) {
+            logger.debug({ from, tag }, 'no devices in notification, skipping');
             return;
         }
-        const deviceJid = devices[0].attrs.jid;
-        const decoded = jidDecode(deviceJid);
-        if (!decoded) return;
-        const { user, device } = decoded;
-        const tag = child.tag;
-        if (!deviceJid) {
-            logger.debug({ tag }, 'no device jid in notification, skipping');
-            return;
+        const decoded = [];
+        for (const d of devices) {
+            const jid = d.attrs.jid;
+            if (!jid)
+                continue;
+            const parts = jidDecode(jid);
+            if (!parts) {
+                logger.debug({ jid }, 'failed to decode device jid, skipping');
+                continue;
+            }
+            decoded.push({ jid, user: parts.user, server: parts.server, device: parts.device });
         }
+        if (!decoded.length)
+            return;
         await devicesMutex.mutex(async () => {
-            if (tag === 'update') {
-                logger.debug({ user }, `${user}'s device list updated, dropping cached devices`);
-                if (userDevicesCache) {
-                    await userDevicesCache.del(user);
-                }
-                return;
+            const byUser = new Map();
+            for (const d of decoded) {
+                const list = byUser.get(d.user) || [];
+                list.push(d);
+                byUser.set(d.user, list);
             }
-            const existingCache = (await (userDevicesCache?.get(user))) || [];
-            if (!existingCache.length) {
-                logger.debug({ user, tag }, 'device list not cached, skipping cache update')
-                return;
-            }
-            const deviceHash = child.attrs.device_hash;
-            let updatedDevices = [];
-            switch (tag) {
-                case 'add':
-                    logger.info({ deviceHash }, 'device added');
-                    updatedDevices = [
-                        ...existingCache.filter(d => d.device !== device),
-                        { user, device }
-                    ];
-                    break;
-                case 'remove':
-                    logger.info({ deviceHash }, 'device removed');
-                    updatedDevices = existingCache.filter(d => d.device !== device);
-                    break;
-                default:
-                    logger.debug({ tag }, 'Unknown device list change tag');
-                    return;
-            }
-            if (updatedDevices.length > 0 && userDevicesCache) {
-                await userDevicesCache.set(user, updatedDevices);
+            for (const [user, entries] of byUser) {
+                if (tag === 'update') {
+                    logger.debug({ user }, `${user}'s device list updated, dropping cached devices`);
+                    await userDevicesCache?.del(user);
+                    continue;
+                }
+                if (tag === 'remove') {
+                    await signalRepository.deleteSession(entries.map(e => e.jid));
+                }
+                const existingCache = (await userDevicesCache?.get(user)) || [];
+                if (!existingCache.length) {
+                    // No baseline yet; skip applying the delta so getUSyncDevices can
+                    // later fetch the full device list. Caching just the notification
+                    // entries would make a partial list look authoritative.
+                    logger.debug({ user, tag }, 'device list not cached, deferring to USync refresh');
+                    continue;
+                }
+                const affected = new Set(entries.map(e => e.device));
+                let updatedDevices;
+                switch (tag) {
+                    case 'add':
+                        logger.info({ deviceHash, count: entries.length }, 'devices added');
+                        updatedDevices = [
+                            ...existingCache.filter(d => !affected.has(d.device)),
+                            ...entries.map(e => ({ user: e.user, server: e.server, device: e.device }))
+                        ];
+                        break;
+                    case 'remove':
+                        logger.info({ deviceHash, count: entries.length }, 'devices removed');
+                        updatedDevices = existingCache.filter(d => !affected.has(d.device));
+                        break;
+                    default:
+                        logger.debug({ tag }, 'Unknown device list change tag');
+                        continue;
+                }
+                if (updatedDevices.length === 0) {
+                    await userDevicesCache?.del(user);
+                }
+                else {
+                    await userDevicesCache?.set(user, updatedDevices);
+                }
             }
         });
     };
@@ -689,7 +803,7 @@ export const makeMessagesRecvSocket = (config) => {
                 await handleNewsletterNotification(node);
                 break;
             case 'mex':
-                await handleMexNewsletterNotification(node);
+                await handleMexNotification(node);
                 break;
             case 'w:gp2':
                 // TODO: HANDLE PARTICIPANT_PN
@@ -707,7 +821,7 @@ export const makeMessagesRecvSocket = (config) => {
                     await handleDevicesNotification(node);
                 }
                 catch (error) {
-			     		logger.error({ error, node }, 'failed to handle devices notification');
+                    logger.error({ error, node }, 'failed to handle devices notification');
                 }
                 break;
             case 'server_sync':
@@ -834,27 +948,70 @@ export const makeMessagesRecvSocket = (config) => {
             return result;
         }
     };
+    /**
+     * In-memory cache of storage JIDs with stored tctokens, seeded from the persisted index.
+     * Used to coalesce writes during a session; pruning always re-reads the persisted index
+     * to cover writes made by other layers (e.g. history sync).
+     */
+    const tcTokenKnownJids = new Set();
+    const tcTokenIndexLoaded = (async () => {
+        try {
+            const jids = await readTcTokenIndex(authState.keys);
+            for (const jid of jids)
+                tcTokenKnownJids.add(jid);
+            logger.debug({ count: tcTokenKnownJids.size }, 'loaded tctoken index');
+        }
+        catch (err) {
+            logger.warn({ err: err?.message }, 'failed to load tctoken index');
+        }
+    })();
+    let tcTokenIndexTimer;
+    async function flushTcTokenIndex() {
+        if (tcTokenIndexTimer) {
+            clearTimeout(tcTokenIndexTimer);
+            tcTokenIndexTimer = undefined;
+        }
+        // Merge with whatever is already persisted so we don't clobber writes from other
+        // paths (history sync, concurrent sessions on the same store).
+        const write = await buildMergedTcTokenIndexWrite(authState.keys, tcTokenKnownJids);
+        return authState.keys.set({ tctoken: write });
+    }
+    function scheduleTcTokenIndexSave() {
+        if (tcTokenIndexTimer) {
+            clearTimeout(tcTokenIndexTimer);
+        }
+        tcTokenIndexTimer = setTimeout(() => {
+            tcTokenIndexTimer = undefined;
+            flushTcTokenIndex().catch(err => {
+                logger.warn({ err: err?.message }, 'failed to save tctoken index');
+            });
+        }, 5000);
+    }
+    function trackTcTokenJid(jid) {
+        if (jid && jid !== TC_TOKEN_INDEX_KEY && !tcTokenKnownJids.has(jid)) {
+            tcTokenKnownJids.add(jid);
+            scheduleTcTokenIndexSave();
+        }
+    }
     const handlePrivacyTokenNotification = async (node) => {
         const tokensNode = getBinaryNodeChild(node, 'tokens');
-        const from = jidNormalizedUser(node.attrs.from);
         if (!tokensNode)
             return;
-        const tokenNodes = getBinaryNodeChildren(tokensNode, 'token');
-        for (const tokenNode of tokenNodes) {
-            const { attrs, content } = tokenNode;
-            const type = attrs.type;
-            const timestamp = attrs.t;
-            if (type === 'trusted_contact' && content instanceof Buffer) {
-                logger.debug({
-                    from,
-                    timestamp,
-                    tcToken: content
-                }, 'received trusted contact token');
-                await authState.keys.set({
-                    tctoken: { [from]: { token: content, timestamp } }
-                });
-            }
-        }
+        const from = jidNormalizedUser(node.attrs.from);
+        // WA Web uses: senderLid ?? toLid(from) for the storage key
+        // The sender_lid attribute provides the LID directly when available
+        const senderLid = node.attrs.sender_lid && isLidUser(jidNormalizedUser(node.attrs.sender_lid))
+            ? jidNormalizedUser(node.attrs.sender_lid)
+            : undefined;
+        const fallbackJid = senderLid ?? (await resolveTcTokenJid(from, getLIDForPN));
+        logger.debug({ from, storageJid: fallbackJid }, 'processing privacy token notification');
+        await storeTcTokensFromIqResult({
+            result: node,
+            fallbackJid,
+            keys: authState.keys,
+            getLIDForPN,
+            onNewJidStored: trackTcTokenJid
+        });
     };
     async function decipherLinkPublicKey(data) {
         const buffer = toRequiredBuffer(data);
@@ -880,10 +1037,11 @@ export const makeMessagesRecvSocket = (config) => {
         const newValue = ((await msgRetryCache.get(key)) || 0) + 1;
         await msgRetryCache.set(key, newValue);
     };
-    const sendMessagesAgain = async (key, ids, retryNode) => {
+    const sendMessagesAgain = async (key, ids, retryNode, receiptNode) => {
         const remoteJid = key.remoteJid;
         const participant = key.participant || remoteJid;
         const retryCount = +retryNode.attrs.count || 1;
+        const msgId = ids[0];
         // Try to get messages from cache first, then fallback to getMessage
         const msgs = [];
         for (const id of ids) {
@@ -915,12 +1073,49 @@ export const makeMessagesRecvSocket = (config) => {
         // just re-send the message to everyone
         // prevents the first message decryption failure
         const sendToAll = !jidDecode(participant)?.device;
-        // Check if we should recreate session for this retry
+        const sessionId = signalRepository.jidToSignalProtocolAddress(participant);
+        let injectedFromBundle = false;
+        const bundle = extractE2ESessionFromRetryReceipt(receiptNode);
+        if (bundle) {
+            try {
+                await signalRepository.injectE2ESession({ jid: participant, session: bundle });
+                injectedFromBundle = true;
+                logger.debug({ participant, retryCount }, 'injected session from retry receipt key bundle');
+            }
+            catch (error) {
+                logger.warn({ error, participant }, 'failed to inject session from retry receipt');
+            }
+        }
+        if (!injectedFromBundle) {
+            const receivedRegId = getBinaryNodeChildUInt(receiptNode, 'registration', 4);
+            if (typeof receivedRegId === 'number' && Number.isInteger(receivedRegId)) {
+                const info = await signalRepository.getSessionInfo(participant);
+                if (info && info.registrationId !== 0 && info.registrationId !== receivedRegId) {
+                    logger.info({ participant, stored: info.registrationId, received: receivedRegId }, 'reg id mismatch on retry without bundle, deleting session');
+                    await authState.keys.set({ session: { [sessionId]: null } });
+                }
+            }
+        }
+        const BASE_KEY_CHECK_RETRY = 2;
+        if (msgId && messageRetryManager) {
+            const info = await signalRepository.getSessionInfo(participant);
+            if (info) {
+                if (retryCount === BASE_KEY_CHECK_RETRY) {
+                    messageRetryManager.saveBaseKey(sessionId, msgId, info.baseKey);
+                }
+                else if (retryCount > BASE_KEY_CHECK_RETRY) {
+                    if (messageRetryManager.hasSameBaseKey(sessionId, msgId, info.baseKey)) {
+                        logger.warn({ participant, retryCount }, 'base key collision on retry, forcing fresh session');
+                        await authState.keys.set({ session: { [sessionId]: null } });
+                    }
+                    messageRetryManager.deleteBaseKey(sessionId, msgId);
+                }
+            }
+        }
         let shouldRecreateSession = false;
         let recreateReason = '';
-        if (enableAutoSessionRecreation && messageRetryManager && retryCount > 1) {
+        if (enableAutoSessionRecreation && messageRetryManager && retryCount > 1 && !injectedFromBundle) {
             try {
-                const sessionId = signalRepository.jidToSignalProtocolAddress(participant);
                 const hasSession = await signalRepository.validateSession(participant);
                 const result = messageRetryManager.shouldRecreateSession(participant, hasSession.exists);
                 shouldRecreateSession = result.recreate;
@@ -934,11 +1129,13 @@ export const makeMessagesRecvSocket = (config) => {
                 logger.warn({ error, participant }, 'failed to check session recreation for outgoing retry');
             }
         }
-        await assertSessions([participant], true);
+        if (!injectedFromBundle) {
+            await assertSessions([participant], true);
+        }
         if (isJidGroup(remoteJid)) {
             await authState.keys.set({ 'sender-key-memory': { [remoteJid]: null } });
         }
-        logger.debug({ participant, sendToAll, shouldRecreateSession, recreateReason }, 'forced new session for retry recp');
+        logger.debug({ participant, sendToAll, shouldRecreateSession, recreateReason, injectedFromBundle }, 'prepared session for retry resend');
         for (const [i, msg] of msgs.entries()) {
             if (!ids[i])
                 continue;
@@ -973,11 +1170,6 @@ export const makeMessagesRecvSocket = (config) => {
             fromMe,
             participant: attrs.participant
         };
-        if (shouldIgnoreJid(remoteJid) && remoteJid !== S_WHATSAPP_NET) {
-            logger.debug({ remoteJid }, 'ignoring receipt from jid');
-            await sendMessageAck(node);
-            return;
-        }
         const ids = [attrs.id];
         if (Array.isArray(content)) {
             const items = getBinaryNodeChildren(content[0], 'item');
@@ -1019,7 +1211,7 @@ export const makeMessagesRecvSocket = (config) => {
                                 try {
                                     await updateSendMessageAgainCount(ids[0], key.participant);
                                     logger.debug({ attrs, key }, 'recv retry request');
-                                    await sendMessagesAgain(key, ids, retryNode);
+                                    await sendMessagesAgain(key, ids, retryNode, node);
                                 }
                                 catch (error) {
                                     logger.error({ key, ids, trace: error instanceof Error ? error.stack : 'Unknown error' }, 'error in sending message again');
@@ -1042,11 +1234,6 @@ export const makeMessagesRecvSocket = (config) => {
     };
     const handleNotification = async (node) => {
         const remoteJid = node.attrs.from;
-        if (shouldIgnoreJid(remoteJid) && remoteJid !== S_WHATSAPP_NET) {
-            logger.debug({ remoteJid, id: node.attrs.id }, 'ignored notification');
-            await sendMessageAck(node);
-            return;
-        }
         try {
             await Promise.all([
                 notificationMutex.mutex(async () => {
@@ -1059,6 +1246,7 @@ export const makeMessagesRecvSocket = (config) => {
                             fromMe,
                             participant: node.attrs.participant,
                             participantAlt,
+                            participantUsername: node.attrs.participant_username,
                             addressingMode,
                             id: node.attrs.id,
                             ...(msg.key || {})
@@ -1076,11 +1264,6 @@ export const makeMessagesRecvSocket = (config) => {
         }
     };
     const handleMessage = async (node) => {
-        if (shouldIgnoreJid(node.attrs.from) && node.attrs.from !== S_WHATSAPP_NET) {
-            logger.debug({ key: node.attrs.key }, 'ignored message');
-            await sendMessageAck(node, NACK_REASONS.UnhandledError);
-            return;
-        }
         const encNode = getBinaryNodeChild(node, 'enc');
         // TODO: temporary fix for crashes and issues resulting of failed msmsg decryption
         if (encNode?.attrs.type === 'msmsg') {
@@ -1184,29 +1367,14 @@ export const makeMessagesRecvSocket = (config) => {
                                 return sendMessageAck(node);
                             }
                         }
-                        const errorMessage = msg?.messageStubParameters?.[0] || '';
-                        const isPreKeyError = errorMessage.includes('PreKey');
-                        logger.debug(`[handleMessage] Attempting retry request for failed decryption`);
-                        // Handle both pre-key and normal retries in single mutex
+                        logger.debug('[handleMessage] Attempting retry request for failed decryption');
+                        // WAWeb only retry-receipts here; server emits PreKeyLow if prekeys run low.
                         await retryMutex.mutex(async () => {
                             try {
                                 if (!ws.isOpen) {
                                     logger.debug({ node }, 'Connection closed, skipping retry');
                                     return;
                                 }
-                                // Handle pre-key errors with upload and delay
-                                if (isPreKeyError) {
-                                    logger.info({ error: errorMessage }, 'PreKey error detected, uploading and retrying');
-                                    try {
-                                        logger.debug('Uploading pre-keys for error recovery');
-                                        await uploadPreKeys(5);
-                                        logger.debug('Waiting for server to process new pre-keys');
-                                        await delay(1000);
-                                    }
-                                    catch (uploadErr) {
-                                        logger.error({ uploadErr }, 'Pre-key upload failed, proceeding with retry anyway');
-                                    }
-                                }
                                 const encNode = getBinaryNodeChild(node, 'enc');
                                 await sendRetryRequest(node, !encNode);
                                 if (retryRequestDelayMs) {
@@ -1214,15 +1382,7 @@ export const makeMessagesRecvSocket = (config) => {
                                 }
                             }
                             catch (err) {
-                                logger.error({ err, isPreKeyError }, 'Failed to handle retry, attempting basic retry');
-                                // Still attempt retry even if pre-key upload failed
-                                try {
-                                    const encNode = getBinaryNodeChild(node, 'enc');
-                                    await sendRetryRequest(node, !encNode);
-                                }
-                                catch (retryErr) {
-                                    logger.error({ retryErr }, 'Failed to send retry after error handling');
-                                }
+                                logger.error({ err }, 'Failed to send retry');
                             }
                             acked = true;
                             await sendMessageAck(node, NACK_REASONS.UnhandledError);
@@ -1298,6 +1458,13 @@ export const makeMessagesRecvSocket = (config) => {
                 offline: !!attrs.offline,
                 status
             };
+            if (status === 'relaylatency') {
+                const latencyValue = infoChild.attrs.latency || infoChild.attrs['latency_ms'] || infoChild.attrs['latency-ms'];
+                const latencyMs = latencyValue ? Number(latencyValue) : undefined;
+                if (Number.isFinite(latencyMs)) {
+                    call.latencyMs = latencyMs;
+                }
+            }
             if (status === 'offer') {
                 call.isVideo = !!getBinaryNodeChild(infoChild, 'video');
                 call.isGroup = infoChild.attrs.type === 'group' || !!infoChild.attrs['group-jid'];
@@ -1342,29 +1509,61 @@ export const makeMessagesRecvSocket = (config) => {
         // error in acknowledgement,
         // device could not display the message
         if (attrs.error) {
-            logger.warn({ attrs }, 'received error in ack');
+            const isReachoutTimelocked = attrs.error === String(NACK_REASONS.SenderReachoutTimelocked);
+            if (attrs.error === SERVER_ERROR_CODES.MessageAccountRestriction) {
+                // 463 = 1:1 message missing privacy token (tctoken). Usually means the
+                // account is restricted: WhatsApp blocks starting new chats but preserves
+                // existing ones, since established chats already carry a tctoken.
+                // WA Web prevents this client-side (disables the compose bar).
+                // No retry — retrying counts as another "reach out" and worsens the restriction.
+                logger.warn({ msgId: attrs.id, from: attrs.from }, 'error 463: account restricted or missing tctoken for contact');
+                const ackFrom = attrs.from;
+                if (ackFrom && !inFlight463Recoveries.has(ackFrom)) {
+                    inFlight463Recoveries.add(ackFrom);
+                    void (async () => {
+                        try {
+                            const getPNForLID = signalRepository.lidMapping.getPNForLID.bind(signalRepository.lidMapping);
+                            const tcStorageJid = await resolveTcTokenJid(ackFrom, getLIDForPN);
+                            const issueJid = await resolveIssuanceJid(ackFrom, sock.serverProps.lidTrustedTokenIssueToLid, getLIDForPN, getPNForLID);
+                            const result = await issuePrivacyTokens([issueJid], unixTimestampSeconds());
+                            await storeTcTokensFromIqResult({
+                                result,
+                                fallbackJid: tcStorageJid,
+                                keys: authState.keys,
+                                getLIDForPN,
+                                onNewJidStored: trackTcTokenJid
+                            });
+                            logger.debug({ from: ackFrom }, 'completed 463 token recovery issuance');
+                        }
+                        catch (err) {
+                            logger.debug({ from: ackFrom, err: err?.message }, 'failed 463 token recovery issuance');
+                        }
+                        finally {
+                            inFlight463Recoveries.delete(ackFrom);
+                        }
+                    })();
+                }
+            }
+            else if (attrs.error === SERVER_ERROR_CODES.SmaxInvalid) {
+                logger.warn({ msgId: attrs.id, from: attrs.from }, 'smax-invalid (479): stanza rejected by server — likely stale device session or malformed addressing');
+            }
+            else if (isReachoutTimelocked) {
+                // user is temporarily restricted, fetch current restriction details
+                await fetchAccountReachoutTimelock().catch(err => logger.warn({ err }, 'failed to fetch reachout timelock'));
+                logger.warn({ attrs }, 'received error in ack');
+            }
+            else {
+                logger.warn({ attrs }, 'received error in ack');
+            }
             ev.emit('messages.update', [
                 {
                     key,
                     update: {
                         status: WAMessageStatus.ERROR,
-                        messageStubParameters: [attrs.error]
+                        messageStubParameters: isReachoutTimelocked ? [attrs.error, ACCOUNT_RESTRICTED_TEXT] : [attrs.error]
                     }
                 }
             ]);
-            // resend the message with device_fanout=false, use at your own risk
-            // if (attrs.error === '475') {
-            // 	const msg = await getMessage(key)
-            // 	if (msg) {
-            // 		await relayMessage(key.remoteJid!, msg, {
-            // 			messageId: key.id!,
-            // 			useUserDevicesCache: false,
-            // 			additionalAttributes: {
-            // 				device_fanout: 'false'
-            // 			}
-            // 		})
-            // 	}
-            // }
         }
     };
     /// processes a node with the given function
@@ -1388,6 +1587,19 @@ export const makeMessagesRecvSocket = (config) => {
         yieldToEventLoop: () => new Promise(resolve => setImmediate(resolve))
     });
     const processNode = async (type, node, identifier, exec) => {
+        // Fast path: ack and drop ignored JIDs before entering the buffer/queue
+        const from = node.attrs.from;
+        let ignoreJid = from;
+        if (type === 'receipt' && from) {
+            const attrs = node.attrs;
+            const isLid = attrs.from.includes('lid');
+            const isNodeFromMe = areJidsSameUser(attrs.participant || attrs.from, isLid ? authState.creds.me?.lid : authState.creds.me?.id);
+            ignoreJid = !isNodeFromMe || isJidGroup(attrs.from) ? attrs.from : attrs.recipient;
+        }
+        if (ignoreJid && ignoreJid !== S_WHATSAPP_NET && shouldIgnoreJid(ignoreJid)) {
+            await sendMessageAck(node, type === 'message' ? NACK_REASONS.UnhandledError : undefined);
+            return;
+        }
         const isOffline = !!node.attrs.offline;
         if (isOffline) {
             offlineNodeProcessor.enqueue(type, node);
@@ -1443,11 +1655,38 @@ export const makeMessagesRecvSocket = (config) => {
             await upsertMessage(protoMsg, call.offline ? 'append' : 'notify');
         }
     });
-    ev.on('connection.update', ({ isOnline }) => {
+    /** timestamp of last tctoken prune run — throttles to once per 24h */
+    let lastTcTokenPruneTs = 0;
+    /** dedupe in-flight 463 recovery token issuance by target JID */
+    const inFlight463Recoveries = new Set();
+    ev.on('connection.update', ({ isOnline, connection }) => {
         if (typeof isOnline !== 'undefined') {
             sendActiveReceipts = isOnline;
             logger.trace(`sendActiveReceipts set to "${sendActiveReceipts}"`);
         }
+        // Flush pending tctoken index save on disconnect to avoid writing after close
+        if (connection === 'close' && tcTokenIndexTimer) {
+            clearTimeout(tcTokenIndexTimer);
+            tcTokenIndexTimer = undefined;
+            // Best-effort flush — may fail if store is already closed
+            try {
+                void Promise.resolve(flushTcTokenIndex()).catch(() => { });
+            }
+            catch {
+                /* ignore sync errors */
+            }
+        }
+        // Prune expired tctokens when coming online, at most once per 24 hours
+        // Matches WA Web's CLEAN_TC_TOKENS task
+        // Note: don't gate on tcTokenKnownJids.size — the index may still be loading
+        if (isOnline) {
+            const now = Date.now();
+            const DAY_MS = 24 * 60 * 60 * 1000;
+            if (now - lastTcTokenPruneTs >= DAY_MS) {
+                lastTcTokenPruneTs = now;
+                void pruneExpiredTcTokens();
+            }
+        }
     });
     registerSocketEndHandler(() => {
         if (!config.msgRetryCounterCache && msgRetryCache.close) {
@@ -1456,21 +1695,78 @@ export const makeMessagesRecvSocket = (config) => {
         if (!config.callOfferCache && callOfferCache.close) {
             callOfferCache.close();
         }
-        if (!config.placeholderResendCache && placeholderResendCache.close) {
-            placeholderResendCache.close();
-        }
         identityAssertDebounce.close();
         sendActiveReceipts = false;
     });
+    async function pruneExpiredTcTokens() {
+        try {
+            await tcTokenIndexLoaded;
+            // Union with the persisted index picks up JIDs added by other layers
+            // (history sync) without needing inter-module wiring.
+            const persisted = await readTcTokenIndex(authState.keys);
+            const allJids = new Set(tcTokenKnownJids);
+            for (const jid of persisted)
+                allJids.add(jid);
+            if (!allJids.size)
+                return;
+            const jids = [...allJids];
+            const allTokens = await authState.keys.get('tctoken', jids);
+            const writes = {};
+            const survivors = new Set();
+            let mutated = 0;
+            for (const jid of jids) {
+                const entry = allTokens[jid];
+                if (!entry) {
+                    // Tracked but nothing in store — drop from index.
+                    mutated++;
+                    continue;
+                }
+                const hasPeerToken = !!entry.token?.length;
+                const peerTokenExpired = hasPeerToken && isTcTokenExpired(entry.timestamp);
+                const hasSenderTs = entry.senderTimestamp !== undefined;
+                const senderTsExpired = hasSenderTs && isTcTokenExpired(entry.senderTimestamp);
+                const keepPeerToken = hasPeerToken && !peerTokenExpired;
+                const keepSenderTs = hasSenderTs && !senderTsExpired;
+                if (!keepPeerToken && !keepSenderTs) {
+                    writes[jid] = null;
+                    mutated++;
+                }
+                else if (peerTokenExpired && keepSenderTs) {
+                    writes[jid] = { token: Buffer.alloc(0), senderTimestamp: entry.senderTimestamp };
+                    survivors.add(jid);
+                    mutated++;
+                }
+                else {
+                    survivors.add(jid);
+                }
+            }
+            if (mutated === 0)
+                return;
+            await authState.keys.set({
+                tctoken: {
+                    ...writes,
+                    [TC_TOKEN_INDEX_KEY]: {
+                        token: Buffer.from(JSON.stringify([...survivors]))
+                    }
+                }
+            });
+            tcTokenKnownJids.clear();
+            for (const jid of survivors)
+                tcTokenKnownJids.add(jid);
+            logger.debug({ mutated, remaining: survivors.size }, 'pruned expired tctokens');
+        }
+        catch (err) {
+            logger.warn({ err: err?.message }, 'failed to prune expired tctokens');
+        }
+    }
     return {
         ...sock,
         sendMessageAck,
         sendRetryRequest,
         rejectCall,
-        initiateCall,
-        cancelCall,
         fetchMessageHistory,
         requestPlaceholderResend,
         messageRetryManager
     };
-};
+};
+//# sourceMappingURL=messages-recv.js.map