@itsliaaa/baileys 0.2.6 → 0.3.0-rc.10

package/lib/Socket/messages-recv.js

@@ -4,23 +4,26 @@ import { randomBytes } from 'crypto';
 import Long from 'long';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CACHE_TTLS, KEY_BUNDLE_TYPE, MIN_PREKEY_COUNT, PLACEHOLDER_MAX_AGE_SECONDS, STATUS_EXPIRY_SECONDS } from '../Defaults/index.js';
-import { WAMessageStatus, WAMessageStubType } from '../Types/index.js';
-import { aesDecryptCTR, aesEncryptGCM, cleanMessage, Curve, decodeMediaRetryNode, decodeMessageNode, decryptMessageNode, delay, derivePairingCodeKey, encodeBigEndian, encodeSignedDeviceIdentity, extractAddressingContext, getCallStatusFromNode, getHistoryMsg, getNextPreKeys, getStatusFromReceiptType, handleIdentityChange, hkdf, MISSING_KEYS_ERROR_TEXT, SERVER_ERROR_CODES, NACK_REASONS, NO_MESSAGE_FOUND_ERROR_TEXT, toNumber, unixTimestampSeconds, xmppPreKey, xmppSignedPreKey } from '../Utils/index.js';
+import { ReachoutTimelockEnforcementType, WAMessageStatus, WAMessageStubType } from '../Types/index.js';
+import { ACCOUNT_RESTRICTED_TEXT, aesDecryptCTR, aesEncryptGCM, cleanMessage, Curve, decodeMediaRetryNode, decodeMessageNode, decryptMessageNode, delay, derivePairingCodeKey, encodeBigEndian, encodeSignedDeviceIdentity, extractAddressingContext, extractE2ESessionFromRetryReceipt, getCallStatusFromNode, getHistoryMsg, getNextPreKeys, getStatusFromReceiptType, handleIdentityChange, hkdf, MISSING_KEYS_ERROR_TEXT, NACK_REASONS, NO_MESSAGE_FOUND_ERROR_TEXT, SERVER_ERROR_CODES, toNumber, unixTimestampSeconds, xmppPreKey, xmppSignedPreKey } from '../Utils/index.js';
 import { makeMutex } from '../Utils/make-mutex.js';
 import { makeOfflineNodeProcessor } from '../Utils/offline-node-processor.js';
 import { buildAckStanza } from '../Utils/stanza-ack.js';
 import { buildMergedTcTokenIndexWrite, isTcTokenExpired, readTcTokenIndex, resolveIssuanceJid, resolveTcTokenJid, storeTcTokensFromIqResult, TC_TOKEN_INDEX_KEY } from '../Utils/tc-token-utils.js';
-import { areJidsSameUser, binaryNodeToString, getAllBinaryNodeChildren, getBinaryNodeChild, getBinaryNodeChildBuffer, getBinaryNodeChildren, getBinaryNodeChildString, isJidGroup, isJidNewsletter, isJidStatusBroadcast, isLidUser, isPnUser, jidDecode, jidNormalizedUser, S_WHATSAPP_NET } from '../WABinary/index.js';
+import { areJidsSameUser, binaryNodeToString, getAllBinaryNodeChildren, getBinaryNodeChild, getBinaryNodeChildBuffer, getBinaryNodeChildren, getBinaryNodeChildString, getBinaryNodeChildUInt, isJidGroup, isJidNewsletter, isJidStatusBroadcast, isLidUser, isPnUser, jidDecode, jidNormalizedUser, S_WHATSAPP_NET } from '../WABinary/index.js';
 import { extractGroupMetadata } from './groups.js';
 import { makeMessagesSocket } from './messages-send.js';
+const ENFORCEMENT_TYPE_VALUES = new Set(Object.values(ReachoutTimelockEnforcementType));
+function isValidEnforcementType(value) {
+    return typeof value === 'string' && ENFORCEMENT_TYPE_VALUES.has(value);
+}
 export const makeMessagesRecvSocket = (config) => {
     const { logger, retryRequestDelayMs, maxMsgRetryCount, getMessage, shouldIgnoreJid, enableAutoSessionRecreation } = config;
     const sock = makeMessagesSocket(config);
-    const { ev, authState, ws, messageMutex, notificationMutex, receiptMutex, signalRepository, query, upsertMessage, resyncAppState, onUnexpectedError, assertSessions, sendNode, relayMessage, sendReceipt, uploadPreKeys, sendPeerDataOperationMessage, generateMessageTag, messageRetryManager, issuePrivacyTokens, registerSocketEndHandler } = sock;
+    const { userDevicesCache, devicesMutex, ev, authState, ws, messageMutex, notificationMutex, receiptMutex, signalRepository, query, upsertMessage, resyncAppState, onUnexpectedError, assertSessions, sendNode, relayMessage, sendReceipt, uploadPreKeys, sendPeerDataOperationMessage, messageRetryManager, registerSocketEndHandler, issuePrivacyTokens, fetchAccountReachoutTimelock, placeholderResendCache } = sock;
     const getLIDForPN = signalRepository.lidMapping.getLIDForPN.bind(signalRepository.lidMapping);
     /** this mutex ensures that each retryRequest will wait for the previous one to finish */
     const retryMutex = makeMutex();
-    const devicesMutex = makeMutex();
     const msgRetryCache = config.msgRetryCounterCache ||
         new NodeCache({
             stdTTL: DEFAULT_CACHE_TTLS.MSG_RETRY, // 1 hour
@@ -31,16 +34,6 @@ export const makeMessagesRecvSocket = (config) => {
             stdTTL: DEFAULT_CACHE_TTLS.CALL_OFFER, // 5 mins
             useClones: false
         });
-    const placeholderResendCache = config.placeholderResendCache ||
-        new NodeCache({
-            stdTTL: DEFAULT_CACHE_TTLS.MSG_RETRY, // 1 hour
-            useClones: false
-        });
-    const userDevicesCache = config.userDevicesCache ??=
-        new NodeCache({
-            stdTTL: DEFAULT_CACHE_TTLS.USER_DEVICES, // 5 minutes
-            useClones: false
-        });
     // Debounce identity-change session refreshes per JID to avoid bursts
     const identityAssertDebounce = new NodeCache({ stdTTL: 5, useClones: false });
     let sendActiveReceipts = false;
@@ -94,25 +87,140 @@ export const makeMessagesRecvSocket = (config) => {
         }, 8000);
         return sendPeerDataOperationMessage(pdoMessage);
     };
-    // Handles mex newsletter notifications
-    const handleMexNewsletterNotification = async (node) => {
+    const handleMexNotification = async (node) => {
+        const updateNode = getBinaryNodeChild(node, 'update');
+        if (updateNode) {
+            const opName = updateNode.attrs?.op_name;
+            if (!opName) {
+                logger.warn({ node: binaryNodeToString(node) }, 'mex notification missing op_name, fallback to legacy');
+                await handleLegacyMexNewsletterNotification(node);
+                return;
+            }
+            let mexResponse;
+            try {
+                mexResponse = JSON.parse(updateNode.content.toString());
+            }
+            catch (error) {
+                logger.error({ err: error, opName }, 'failed to parse mex notification JSON');
+                return;
+            }
+            if (mexResponse.errors?.length) {
+                logger.warn({ errors: mexResponse.errors, opName }, 'mex notification has GQL errors');
+                return;
+            }
+            const data = mexResponse.data;
+            if (!data) {
+                logger.warn({ opName }, 'mex notification has null data');
+                return;
+            }
+            logger.debug({ opName }, 'processing mex notification');
+            switch (opName) {
+                case 'NotificationUserReachoutTimelockUpdate':
+                    handleReachoutTimelockNotification(data);
+                    break;
+                case 'MessageCappingInfoNotification':
+                    handleMessageCappingNotification(data);
+                    break;
+                // newsletter ops still use the legacy <mex> child structure
+                case 'NotificationNewsletterUpdate':
+                case 'NotificationLinkedProfilesUpdates':
+                case 'NotificationNewsletterAdminPromote':
+                case 'NotificationNewsletterAdminDemote':
+                case 'NotificationNewsletterUserSettingChange':
+                case 'NotificationNewsletterJoin':
+                case 'NotificationNewsletterLeave':
+                case 'NotificationNewsletterStateChange':
+                case 'NotificationNewsletterAdminMetadataUpdate':
+                case 'NotificationNewsletterOwnerUpdate':
+                case 'NotificationNewsletterAdminInviteRevoke':
+                case 'NotificationNewsletterWamoSubStatusChange':
+                case 'NotificationNewsletterBlockUser':
+                case 'NotificationNewsletterPaidPartnership':
+                case 'NotificationNewsletterMilestone':
+                case 'NewsletterResponseStateUpdate':
+                    await handleLegacyMexNewsletterNotification(node);
+                    break;
+                default:
+                    logger.debug({ opName }, 'unhandled mex notification');
+                    break;
+            }
+            return;
+        }
+        await handleLegacyMexNewsletterNotification(node);
+    };
+    const handleReachoutTimelockNotification = (data) => {
+        const payload = data.xwa2_notify_account_reachout_timelock;
+        if (!payload) {
+            logger.warn('reachout timelock notification missing payload');
+            return;
+        }
+        if (!payload.is_active) {
+            logger.info('reachout timelock restriction lifted');
+            ev.emit('connection.update', {
+                reachoutTimeLock: {
+                    isActive: false,
+                    enforcementType: ReachoutTimelockEnforcementType.DEFAULT
+                }
+            });
+            return;
+        }
+        // WA Web defaults to now+60s when the server omits the expiry
+        const timeEnforcementEnds = payload.time_enforcement_ends
+            ? new Date(parseInt(payload.time_enforcement_ends, 10) * 1000)
+            : new Date(Date.now() + 60000);
+        const enforcementType = isValidEnforcementType(payload.enforcement_type)
+            ? payload.enforcement_type
+            : ReachoutTimelockEnforcementType.DEFAULT;
+        logger.info({ enforcementType, timeEnforcementEnds }, 'reachout timelock restriction set');
+        ev.emit('connection.update', {
+            reachoutTimeLock: {
+                isActive: true,
+                timeEnforcementEnds,
+                enforcementType
+            }
+        });
+    };
+    const handleMessageCappingNotification = (data) => {
+        const payload = data.xwa2_notify_new_chat_messages_capping_info_update;
+        if (!payload) {
+            logger.warn('message capping notification missing payload');
+            return;
+        }
+        logger.info({ payload }, 'received message capping update');
+        ev.emit('message-capping.update', payload);
+    };
+    const handleLegacyMexNewsletterNotification = async (node) => {
         const mexNode = getBinaryNodeChild(node, 'mex');
-        if (!mexNode?.content) {
-            logger.warn({ node }, 'Invalid mex newsletter notification');
+        const updateNode = mexNode?.content ? null : getBinaryNodeChild(node, 'update') || getAllBinaryNodeChildren(node)[0];
+        const payloadNode = mexNode?.content ? mexNode : updateNode;
+        if (!payloadNode?.content) {
+            logger.warn({ node: binaryNodeToString(node) }, 'invalid mex newsletter notification');
             return;
         }
         let data;
         try {
-            data = JSON.parse(mexNode.content.toString());
+            const payloadContent = payloadNode.content;
+            if (Array.isArray(payloadContent)) {
+                logger.warn({ payloadNode }, 'invalid mex newsletter notification payload format');
+                return;
+            }
+            const contentBuf = typeof payloadContent === 'string' ? Buffer.from(payloadContent, 'binary') : Buffer.from(payloadContent);
+            data = JSON.parse(contentBuf.toString());
         }
         catch (error) {
-            logger.error({ err: error, node }, 'Failed to parse mex newsletter notification');
+            logger.error({ err: error, node: binaryNodeToString(node) }, 'failed to parse mex newsletter notification');
             return;
         }
-        const operation = data?.operation;
-        const updates = data?.updates;
+        const operation = data?.operation ?? payloadNode?.attrs?.op_name;
+        let updates = data?.updates;
+        if (!updates) {
+            const linkedProfiles = data?.data?.xwa2_notify_linked_profiles;
+            if (linkedProfiles) {
+                updates = [linkedProfiles];
+            }
+        }
         if (!updates || !operation) {
-            logger.warn({ data }, 'Invalid mex newsletter notification content');
+            logger.warn({ data }, 'invalid mex newsletter notification content');
             return;
         }
         logger.info({ operation, updates }, 'got mex newsletter notification');
@@ -140,91 +248,114 @@ export const makeMessagesRecvSocket = (config) => {
                     }
                 }
                 break;
+            case 'NotificationLinkedProfilesUpdates':
+                for (const update of updates) {
+                    const lid = update?.jid;
+                    const addedProfiles = Array.isArray(update?.added_profiles) ? update.added_profiles : [];
+                    const mappings = [];
+                    for (const profile of addedProfiles) {
+                        const pn = typeof profile === 'string' ? profile : (profile?.pn ?? profile?.jid ?? null);
+                        if (lid && pn) {
+                            const mapping = { lid, pn };
+                            ev.emit('lid-mapping.update', mapping);
+                            mappings.push(mapping);
+                        }
+                    }
+                    await signalRepository.lidMapping.storeLIDPNMappings(mappings);
+                }
+                break;
             default:
-                logger.info({ operation, data }, 'Unhandled mex newsletter notification');
+                logger.info({ operation, data }, 'unhandled mex newsletter notification');
                 break;
         }
     };
     // Handles newsletter notifications
     const handleNewsletterNotification = async (node) => {
         const from = node.attrs.from;
-        const child = getAllBinaryNodeChildren(node)[0];
+        const children = getAllBinaryNodeChildren(node);
         const author = node.attrs.participant;
-        logger.info({ from, child }, 'got newsletter notification');
-        switch (child.tag) {
-            case 'reaction':
-                const reactionUpdate = {
-                    id: from,
-                    server_id: child.attrs.message_id,
-                    reaction: {
-                        code: getBinaryNodeChildString(child, 'reaction'),
-                        count: 1
-                    }
-                };
-                ev.emit('newsletter.reaction', reactionUpdate);
-                break;
-            case 'view':
-                const viewUpdate = {
-                    id: from,
-                    server_id: child.attrs.message_id,
-                    count: parseInt(child.content?.toString() || '0', 10)
-                };
-                ev.emit('newsletter.view', viewUpdate);
-                break;
-            case 'participant':
-                const participantUpdate = {
-                    id: from,
-                    author,
-                    user: child.attrs.jid,
-                    action: child.attrs.action,
-                    new_role: child.attrs.role
-                };
-                ev.emit('newsletter-participants.update', participantUpdate);
-                break;
-            case 'update':
-                const settingsNode = getBinaryNodeChild(child, 'settings');
-                if (settingsNode) {
-                    const update = {};
-                    const nameNode = getBinaryNodeChild(settingsNode, 'name');
-                    if (nameNode?.content)
-                        update.name = nameNode.content.toString();
-                    const descriptionNode = getBinaryNodeChild(settingsNode, 'description');
-                    if (descriptionNode?.content)
-                        update.description = descriptionNode.content.toString();
-                    ev.emit('newsletter-settings.update', {
+        for (const child of children) {
+            logger.debug({ from, child }, 'got newsletter notification');
+            switch (child.tag) {
+                case 'reaction': {
+                    const reactionUpdate = {
                         id: from,
-                        update
-                    });
+                        server_id: child.attrs.message_id,
+                        reaction: {
+                            code: getBinaryNodeChildString(child, 'reaction'),
+                            count: 1
+                        }
+                    };
+                    ev.emit('newsletter.reaction', reactionUpdate);
+                    break;
                 }
-                break;
-            case 'message':
-                const plaintextNode = getBinaryNodeChild(child, 'plaintext');
-                if (plaintextNode?.content) {
-                    try {
-                        const contentBuf = typeof plaintextNode.content === 'string'
-                            ? Buffer.from(plaintextNode.content, 'binary')
-                            : Buffer.from(plaintextNode.content);
-                        const messageProto = proto.Message.decode(contentBuf).toJSON();
-                        const fullMessage = proto.WebMessageInfo.fromObject({
-                            key: {
-                                remoteJid: from,
-                                id: child.attrs.message_id || child.attrs.server_id,
-                                fromMe: false // TODO: is this really true though
-                            },
-                            message: messageProto,
-                            messageTimestamp: +child.attrs.t
-                        }).toJSON();
-                        await upsertMessage(fullMessage, 'append');
-                        logger.info('Processed plaintext newsletter message');
+                case 'view': {
+                    const viewUpdate = {
+                        id: from,
+                        server_id: child.attrs.message_id,
+                        count: parseInt(child.content?.toString() || '0', 10)
+                    };
+                    ev.emit('newsletter.view', viewUpdate);
+                    break;
+                }
+                case 'participant': {
+                    const participantUpdate = {
+                        id: from,
+                        author,
+                        user: child.attrs.jid,
+                        action: child.attrs.action,
+                        new_role: child.attrs.role
+                    };
+                    ev.emit('newsletter-participants.update', participantUpdate);
+                    break;
+                }
+                case 'update': {
+                    const settingsNode = getBinaryNodeChild(child, 'settings');
+                    if (settingsNode) {
+                        const update = {};
+                        const nameNode = getBinaryNodeChild(settingsNode, 'name');
+                        if (nameNode?.content)
+                            update.name = nameNode.content.toString();
+                        const descriptionNode = getBinaryNodeChild(settingsNode, 'description');
+                        if (descriptionNode?.content)
+                            update.description = descriptionNode.content.toString();
+                        ev.emit('newsletter-settings.update', {
+                            id: from,
+                            update
+                        });
                     }
-                    catch (error) {
-                        logger.error({ error }, 'Failed to decode plaintext newsletter message');
+                    break;
+                }
+                case 'message': {
+                    const plaintextNode = getBinaryNodeChild(child, 'plaintext');
+                    if (plaintextNode?.content) {
+                        try {
+                            const contentBuf = typeof plaintextNode.content === 'string'
+                                ? Buffer.from(plaintextNode.content, 'binary')
+                                : Buffer.from(plaintextNode.content);
+                            const messageProto = proto.Message.decode(contentBuf).toJSON();
+                            const fullMessage = proto.WebMessageInfo.fromObject({
+                                key: {
+                                    remoteJid: from,
+                                    id: child.attrs.message_id || child.attrs.server_id,
+                                    fromMe: false // TODO: is this really true though
+                                },
+                                message: messageProto,
+                                messageTimestamp: +child.attrs.t
+                            }).toJSON();
+                            await upsertMessage(fullMessage, 'append');
+                            logger.debug('Processed plaintext newsletter message');
+                        }
+                        catch (error) {
+                            logger.error({ error }, 'Failed to decode plaintext newsletter message');
+                        }
                     }
+                    break;
                 }
-                break;
-            default:
-                logger.warn({ node }, 'Unknown newsletter notification');
-                break;
+                default:
+                    logger.warn({ node, child }, 'Unknown newsletter notification child');
+                    break;
+            }
         }
     };
     const sendMessageAck = async (node, errorCode) => {
@@ -253,97 +384,6 @@ export const makeMessagesRecvSocket = (config) => {
         };
         await query(stanza);
     };
-    // Lia@Note 01-03-26 --- Source: https://github.com/koptereli/Baileys/commit/575cd41e6f01a9b3e1d7e2708c2292fa93de91f2
-    const initiateCall = async (jid, options = {}) => {
-        const meId = authState.creds.me?.id;
-        if (!meId) {
-            throw new Boom('Not authenticated');
-        }
-        const callId = randomBytes(8).toString('hex');
-        const isVideo = !!options.isVideo;
-        const isGroup = isJidGroup(jid);
-        const stanza = {
-            tag: 'call',
-            attrs: {
-                id: generateMessageTag(),
-                from: meId,
-                to: jid,
-                t: String(unixTimestampSeconds()),
-                ...(authState.creds.me?.name ? { notify: authState.creds.me.name } : {})
-            },
-            content: [
-                {
-                    tag: 'offer',
-                    attrs: {
-                        'call-id': callId,
-                        'call-creator': meId,
-                        count: '0'
-                    },
-                    content: [
-                        {
-                            tag: isVideo ? 'video' : 'audio',
-                            attrs: {}
-                        },
-                        {
-                            tag: 'net',
-                            attrs: {}
-                        },
-                        {
-                            tag: 'encopt',
-                            attrs: { key: randomBytes(2).toString('hex') }
-                        },
-                        {
-                            tag: 'relaylatency',
-                            attrs: {}
-                        },
-                        {
-                            tag: 'te',
-                            attrs: {}
-                        }
-                    ]
-                }
-            ]
-        };
-        await query(stanza);
-        await callOfferCache.set(callId, {
-            chatId: jid,
-            from: meId,
-            id: callId,
-            date: new Date(),
-            offline: false,
-            status: 'offer',
-            isVideo,
-            isGroup,
-            groupJid: isGroup ? jid : undefined
-        });
-        // TODO: implement ICE/DTLS-SRTP call media setup once full signaling requirements are mapped.
-        return { callId, to: jid, isVideo };
-    };
-    const cancelCall = async (callId, callTo) => {
-        const meId = authState.creds.me?.id;
-        if (!meId) {
-            throw new Boom('Not authenticated');
-        }
-        const stanza = {
-            tag: 'call',
-            attrs: {
-                from: meId,
-                to: callTo
-            },
-            content: [
-                {
-                    tag: 'terminate',
-                    attrs: {
-                        'call-id': callId,
-                        'call-creator': meId,
-                        count: '0'
-                    }
-                }
-            ]
-        };
-        await query(stanza);
-        await callOfferCache.del(callId);
-    };
     const sendRetryRequest = async (node, forceIncludeKeys = false) => {
         const { fullMessage } = decodeMessageNode(node, authState.creds.me.id, authState.creds.me.lid || '');
         const { key: msgKey } = fullMessage;
@@ -475,6 +515,8 @@ export const makeMessagesRecvSocket = (config) => {
             logger.info({ msgAttrs: node.attrs, retryCount }, 'sent retry receipt');
         }, authState?.creds?.me?.id || 'sendRetryRequest');
     };
+    // Mirrors WAWeb/Handle/PreKeyLow.js: skip a re-issued notification with the same stanza id.
+    const inFlightPreKeyLow = new Set();
     /**
      * Fire-and-forget tctoken re-issuance after a peer's device identity changed.
      * Mirrors WAWebSendTcTokenWhenDeviceIdentityChange — runs in parallel with
@@ -507,12 +549,24 @@ export const makeMessagesRecvSocket = (config) => {
     const handleEncryptNotification = async (node) => {
         const from = node.attrs.from;
         if (from === S_WHATSAPP_NET) {
+            const stanzaId = node.attrs.id;
+            if (stanzaId && inFlightPreKeyLow.has(stanzaId)) {
+                return;
+            }
             const countChild = getBinaryNodeChild(node, 'count');
             const count = +countChild.attrs.value;
             const shouldUploadMorePreKeys = count < MIN_PREKEY_COUNT;
             logger.debug({ count, shouldUploadMorePreKeys }, 'recv pre-key count');
             if (shouldUploadMorePreKeys) {
-                await uploadPreKeys();
+                if (stanzaId)
+                    inFlightPreKeyLow.add(stanzaId);
+                try {
+                    await uploadPreKeys();
+                }
+                finally {
+                    if (stanzaId)
+                        inFlightPreKeyLow.delete(stanzaId);
+                }
             }
         }
         else {
@@ -659,59 +713,83 @@ export const makeMessagesRecvSocket = (config) => {
     const handleDevicesNotification = async (node) => {
         const [child] = getAllBinaryNodeChildren(node);
         const from = jidNormalizedUser(node.attrs.from);
+        if (!child) {
+            logger.debug({ from }, 'devices notification missing child, skipping');
+            return;
+        }
+        const tag = child.tag;
+        const deviceHash = child.attrs.device_hash;
         const devices = getBinaryNodeChildren(child, 'device');
-        if (areJidsSameUser(from, authState.creds.me.id) ||
-            areJidsSameUser(from, authState.creds.me.lid)) {
+        if (areJidsSameUser(from, authState.creds.me.id) || areJidsSameUser(from, authState.creds.me.lid)) {
             const deviceJids = devices.map(d => d.attrs.jid);
             logger.info({ deviceJids }, 'got my own devices');
         }
-        if (!devices || !devices.length || !devices[0]) {
-            logger.debug({ from }, 'no devices in notification, skipping');
+        if (!devices.length) {
+            logger.debug({ from, tag }, 'no devices in notification, skipping');
             return;
         }
-        const deviceJid = devices[0].attrs.jid;
-        const decoded = jidDecode(deviceJid);
-        if (!decoded)
-            return;
-        const { user, device } = decoded;
-        const tag = child.tag;
-        if (!deviceJid) {
-            logger.debug({ tag }, 'no device jid in notification, skipping');
-            return;
+        const decoded = [];
+        for (const d of devices) {
+            const jid = d.attrs.jid;
+            if (!jid)
+                continue;
+            const parts = jidDecode(jid);
+            if (!parts) {
+                logger.debug({ jid }, 'failed to decode device jid, skipping');
+                continue;
+            }
+            decoded.push({ jid, user: parts.user, server: parts.server, device: parts.device });
         }
+        if (!decoded.length)
+            return;
         await devicesMutex.mutex(async () => {
-            if (tag === 'update') {
-                logger.debug({ user }, `${user}'s device list updated, dropping cached devices`);
-                if (userDevicesCache) {
-                    await userDevicesCache.del(user);
-                }
-                return;
-            }
-            const existingCache = (await (userDevicesCache?.get(user))) || [];
-            if (!existingCache.length) {
-                logger.debug({ user, tag }, 'device list not cached, skipping cache update');
-                return;
+            const byUser = new Map();
+            for (const d of decoded) {
+                const list = byUser.get(d.user) || [];
+                list.push(d);
+                byUser.set(d.user, list);
             }
-            const deviceHash = child.attrs.device_hash;
-            let updatedDevices = [];
-            switch (tag) {
-                case 'add':
-                    logger.info({ deviceHash }, 'device added');
-                    updatedDevices = [
-                        ...existingCache.filter(d => d.device !== device),
-                        { user, device }
-                    ];
-                    break;
-                case 'remove':
-                    logger.info({ deviceHash }, 'device removed');
-                    updatedDevices = existingCache.filter(d => d.device !== device);
-                    break;
-                default:
-                    logger.debug({ tag }, 'Unknown device list change tag');
-                    return;
-            }
-            if (updatedDevices.length > 0 && userDevicesCache) {
-                await userDevicesCache.set(user, updatedDevices);
+            for (const [user, entries] of byUser) {
+                if (tag === 'update') {
+                    logger.debug({ user }, `${user}'s device list updated, dropping cached devices`);
+                    await userDevicesCache?.del(user);
+                    continue;
+                }
+                if (tag === 'remove') {
+                    await signalRepository.deleteSession(entries.map(e => e.jid));
+                }
+                const existingCache = (await userDevicesCache?.get(user)) || [];
+                if (!existingCache.length) {
+                    // No baseline yet; skip applying the delta so getUSyncDevices can
+                    // later fetch the full device list. Caching just the notification
+                    // entries would make a partial list look authoritative.
+                    logger.debug({ user, tag }, 'device list not cached, deferring to USync refresh');
+                    continue;
+                }
+                const affected = new Set(entries.map(e => e.device));
+                let updatedDevices;
+                switch (tag) {
+                    case 'add':
+                        logger.info({ deviceHash, count: entries.length }, 'devices added');
+                        updatedDevices = [
+                            ...existingCache.filter(d => !affected.has(d.device)),
+                            ...entries.map(e => ({ user: e.user, server: e.server, device: e.device }))
+                        ];
+                        break;
+                    case 'remove':
+                        logger.info({ deviceHash, count: entries.length }, 'devices removed');
+                        updatedDevices = existingCache.filter(d => !affected.has(d.device));
+                        break;
+                    default:
+                        logger.debug({ tag }, 'Unknown device list change tag');
+                        continue;
+                }
+                if (updatedDevices.length === 0) {
+                    await userDevicesCache?.del(user);
+                }
+                else {
+                    await userDevicesCache?.set(user, updatedDevices);
+                }
             }
         });
     };
@@ -725,7 +803,7 @@ export const makeMessagesRecvSocket = (config) => {
                 await handleNewsletterNotification(node);
                 break;
             case 'mex':
-                await handleMexNewsletterNotification(node);
+                await handleMexNotification(node);
                 break;
             case 'w:gp2':
                 // TODO: HANDLE PARTICIPANT_PN
@@ -879,9 +957,8 @@ export const makeMessagesRecvSocket = (config) => {
     const tcTokenIndexLoaded = (async () => {
         try {
             const jids = await readTcTokenIndex(authState.keys);
-            for (const jid of jids) {
+            for (const jid of jids)
                 tcTokenKnownJids.add(jid);
-            }
             logger.debug({ count: tcTokenKnownJids.size }, 'loaded tctoken index');
         }
         catch (err) {
@@ -899,7 +976,6 @@ export const makeMessagesRecvSocket = (config) => {
         const write = await buildMergedTcTokenIndexWrite(authState.keys, tcTokenKnownJids);
         return authState.keys.set({ tctoken: write });
     }
-    ;
     function scheduleTcTokenIndexSave() {
         if (tcTokenIndexTimer) {
             clearTimeout(tcTokenIndexTimer);
@@ -911,7 +987,6 @@ export const makeMessagesRecvSocket = (config) => {
             });
         }, 5000);
     }
-    ;
     function trackTcTokenJid(jid) {
         if (jid && jid !== TC_TOKEN_INDEX_KEY && !tcTokenKnownJids.has(jid)) {
             tcTokenKnownJids.add(jid);
@@ -962,10 +1037,11 @@ export const makeMessagesRecvSocket = (config) => {
         const newValue = ((await msgRetryCache.get(key)) || 0) + 1;
         await msgRetryCache.set(key, newValue);
     };
-    const sendMessagesAgain = async (key, ids, retryNode) => {
+    const sendMessagesAgain = async (key, ids, retryNode, receiptNode) => {
         const remoteJid = key.remoteJid;
         const participant = key.participant || remoteJid;
         const retryCount = +retryNode.attrs.count || 1;
+        const msgId = ids[0];
         // Try to get messages from cache first, then fallback to getMessage
         const msgs = [];
         for (const id of ids) {
@@ -997,12 +1073,49 @@ export const makeMessagesRecvSocket = (config) => {
         // just re-send the message to everyone
         // prevents the first message decryption failure
         const sendToAll = !jidDecode(participant)?.device;
-        // Check if we should recreate session for this retry
+        const sessionId = signalRepository.jidToSignalProtocolAddress(participant);
+        let injectedFromBundle = false;
+        const bundle = extractE2ESessionFromRetryReceipt(receiptNode);
+        if (bundle) {
+            try {
+                await signalRepository.injectE2ESession({ jid: participant, session: bundle });
+                injectedFromBundle = true;
+                logger.debug({ participant, retryCount }, 'injected session from retry receipt key bundle');
+            }
+            catch (error) {
+                logger.warn({ error, participant }, 'failed to inject session from retry receipt');
+            }
+        }
+        if (!injectedFromBundle) {
+            const receivedRegId = getBinaryNodeChildUInt(receiptNode, 'registration', 4);
+            if (typeof receivedRegId === 'number' && Number.isInteger(receivedRegId)) {
+                const info = await signalRepository.getSessionInfo(participant);
+                if (info && info.registrationId !== 0 && info.registrationId !== receivedRegId) {
+                    logger.info({ participant, stored: info.registrationId, received: receivedRegId }, 'reg id mismatch on retry without bundle, deleting session');
+                    await authState.keys.set({ session: { [sessionId]: null } });
+                }
+            }
+        }
+        const BASE_KEY_CHECK_RETRY = 2;
+        if (msgId && messageRetryManager) {
+            const info = await signalRepository.getSessionInfo(participant);
+            if (info) {
+                if (retryCount === BASE_KEY_CHECK_RETRY) {
+                    messageRetryManager.saveBaseKey(sessionId, msgId, info.baseKey);
+                }
+                else if (retryCount > BASE_KEY_CHECK_RETRY) {
+                    if (messageRetryManager.hasSameBaseKey(sessionId, msgId, info.baseKey)) {
+                        logger.warn({ participant, retryCount }, 'base key collision on retry, forcing fresh session');
+                        await authState.keys.set({ session: { [sessionId]: null } });
+                    }
+                    messageRetryManager.deleteBaseKey(sessionId, msgId);
+                }
+            }
+        }
         let shouldRecreateSession = false;
         let recreateReason = '';
-        if (enableAutoSessionRecreation && messageRetryManager && retryCount > 1) {
+        if (enableAutoSessionRecreation && messageRetryManager && retryCount > 1 && !injectedFromBundle) {
             try {
-                const sessionId = signalRepository.jidToSignalProtocolAddress(participant);
                 const hasSession = await signalRepository.validateSession(participant);
                 const result = messageRetryManager.shouldRecreateSession(participant, hasSession.exists);
                 shouldRecreateSession = result.recreate;
@@ -1016,11 +1129,13 @@ export const makeMessagesRecvSocket = (config) => {
                 logger.warn({ error, participant }, 'failed to check session recreation for outgoing retry');
             }
         }
-        await assertSessions([participant], true);
+        if (!injectedFromBundle) {
+            await assertSessions([participant], true);
+        }
         if (isJidGroup(remoteJid)) {
             await authState.keys.set({ 'sender-key-memory': { [remoteJid]: null } });
         }
-        logger.debug({ participant, sendToAll, shouldRecreateSession, recreateReason }, 'forced new session for retry recp');
+        logger.debug({ participant, sendToAll, shouldRecreateSession, recreateReason, injectedFromBundle }, 'prepared session for retry resend');
         for (const [i, msg] of msgs.entries()) {
             if (!ids[i])
                 continue;
@@ -1096,7 +1211,7 @@ export const makeMessagesRecvSocket = (config) => {
                                 try {
                                     await updateSendMessageAgainCount(ids[0], key.participant);
                                     logger.debug({ attrs, key }, 'recv retry request');
-                                    await sendMessagesAgain(key, ids, retryNode);
+                                    await sendMessagesAgain(key, ids, retryNode, node);
                                 }
                                 catch (error) {
                                     logger.error({ key, ids, trace: error instanceof Error ? error.stack : 'Unknown error' }, 'error in sending message again');
@@ -1131,7 +1246,7 @@ export const makeMessagesRecvSocket = (config) => {
                             fromMe,
                             participant: node.attrs.participant,
                             participantAlt,
-                            username: attrs.participant_username || attrs.username || undefined,
+                            participantUsername: node.attrs.participant_username,
                             addressingMode,
                             id: node.attrs.id,
                             ...(msg.key || {})
@@ -1252,29 +1367,14 @@ export const makeMessagesRecvSocket = (config) => {
                                 return sendMessageAck(node);
                             }
                         }
-                        const errorMessage = msg?.messageStubParameters?.[0] || '';
-                        const isPreKeyError = errorMessage.includes('PreKey');
-                        logger.debug(`[handleMessage] Attempting retry request for failed decryption`);
-                        // Handle both pre-key and normal retries in single mutex
+                        logger.debug('[handleMessage] Attempting retry request for failed decryption');
+                        // WAWeb only retry-receipts here; server emits PreKeyLow if prekeys run low.
                         await retryMutex.mutex(async () => {
                             try {
                                 if (!ws.isOpen) {
                                     logger.debug({ node }, 'Connection closed, skipping retry');
                                     return;
                                 }
-                                // Handle pre-key errors with upload and delay
-                                if (isPreKeyError) {
-                                    logger.info({ error: errorMessage }, 'PreKey error detected, uploading and retrying');
-                                    try {
-                                        logger.debug('Uploading pre-keys for error recovery');
-                                        await uploadPreKeys(5);
-                                        logger.debug('Waiting for server to process new pre-keys');
-                                        await delay(1000);
-                                    }
-                                    catch (uploadErr) {
-                                        logger.error({ uploadErr }, 'Pre-key upload failed, proceeding with retry anyway');
-                                    }
-                                }
                                 const encNode = getBinaryNodeChild(node, 'enc');
                                 await sendRetryRequest(node, !encNode);
                                 if (retryRequestDelayMs) {
@@ -1282,15 +1382,7 @@ export const makeMessagesRecvSocket = (config) => {
                                 }
                             }
                             catch (err) {
-                                logger.error({ err, isPreKeyError }, 'Failed to handle retry, attempting basic retry');
-                                // Still attempt retry even if pre-key upload failed
-                                try {
-                                    const encNode = getBinaryNodeChild(node, 'enc');
-                                    await sendRetryRequest(node, !encNode);
-                                }
-                                catch (retryErr) {
-                                    logger.error({ retryErr }, 'Failed to send retry after error handling');
-                                }
+                                logger.error({ err }, 'Failed to send retry');
                             }
                             acked = true;
                             await sendMessageAck(node, NACK_REASONS.UnhandledError);
@@ -1417,16 +1509,49 @@ export const makeMessagesRecvSocket = (config) => {
         // error in acknowledgement,
         // device could not display the message
         if (attrs.error) {
-            if (attrs.error === SERVER_ERROR_CODES.MissingTcToken) {
-                // 463 = account restricted + no tctoken for this contact.
-                // WA Web prevents this client-side (disables compose bar).
-                // No retry — retrying worsens the restriction by counting
-                // as another "reach out" to an unknown contact.
+            const isReachoutTimelocked = attrs.error === String(NACK_REASONS.SenderReachoutTimelocked);
+            if (attrs.error === SERVER_ERROR_CODES.MessageAccountRestriction) {
+                // 463 = 1:1 message missing privacy token (tctoken). Usually means the
+                // account is restricted: WhatsApp blocks starting new chats but preserves
+                // existing ones, since established chats already carry a tctoken.
+                // WA Web prevents this client-side (disables the compose bar).
+                // No retry — retrying counts as another "reach out" and worsens the restriction.
                 logger.warn({ msgId: attrs.id, from: attrs.from }, 'error 463: account restricted or missing tctoken for contact');
+                const ackFrom = attrs.from;
+                if (ackFrom && !inFlight463Recoveries.has(ackFrom)) {
+                    inFlight463Recoveries.add(ackFrom);
+                    void (async () => {
+                        try {
+                            const getPNForLID = signalRepository.lidMapping.getPNForLID.bind(signalRepository.lidMapping);
+                            const tcStorageJid = await resolveTcTokenJid(ackFrom, getLIDForPN);
+                            const issueJid = await resolveIssuanceJid(ackFrom, sock.serverProps.lidTrustedTokenIssueToLid, getLIDForPN, getPNForLID);
+                            const result = await issuePrivacyTokens([issueJid], unixTimestampSeconds());
+                            await storeTcTokensFromIqResult({
+                                result,
+                                fallbackJid: tcStorageJid,
+                                keys: authState.keys,
+                                getLIDForPN,
+                                onNewJidStored: trackTcTokenJid
+                            });
+                            logger.debug({ from: ackFrom }, 'completed 463 token recovery issuance');
+                        }
+                        catch (err) {
+                            logger.debug({ from: ackFrom, err: err?.message }, 'failed 463 token recovery issuance');
+                        }
+                        finally {
+                            inFlight463Recoveries.delete(ackFrom);
+                        }
+                    })();
+                }
             }
             else if (attrs.error === SERVER_ERROR_CODES.SmaxInvalid) {
                 logger.warn({ msgId: attrs.id, from: attrs.from }, 'smax-invalid (479): stanza rejected by server — likely stale device session or malformed addressing');
             }
+            else if (isReachoutTimelocked) {
+                // user is temporarily restricted, fetch current restriction details
+                await fetchAccountReachoutTimelock().catch(err => logger.warn({ err }, 'failed to fetch reachout timelock'));
+                logger.warn({ attrs }, 'received error in ack');
+            }
             else {
                 logger.warn({ attrs }, 'received error in ack');
             }
@@ -1435,7 +1560,7 @@ export const makeMessagesRecvSocket = (config) => {
                     key,
                     update: {
                         status: WAMessageStatus.ERROR,
-                        messageStubParameters: [attrs.error]
+                        messageStubParameters: isReachoutTimelocked ? [attrs.error, ACCOUNT_RESTRICTED_TEXT] : [attrs.error]
                     }
                 }
             ]);
@@ -1532,6 +1657,8 @@ export const makeMessagesRecvSocket = (config) => {
     });
     /** timestamp of last tctoken prune run — throttles to once per 24h */
     let lastTcTokenPruneTs = 0;
+    /** dedupe in-flight 463 recovery token issuance by target JID */
+    const inFlight463Recoveries = new Set();
     ev.on('connection.update', ({ isOnline, connection }) => {
         if (typeof isOnline !== 'undefined') {
             sendActiveReceipts = isOnline;
@@ -1561,6 +1688,16 @@ export const makeMessagesRecvSocket = (config) => {
             }
         }
     });
+    registerSocketEndHandler(() => {
+        if (!config.msgRetryCounterCache && msgRetryCache.close) {
+            msgRetryCache.close();
+        }
+        if (!config.callOfferCache && callOfferCache.close) {
+            callOfferCache.close();
+        }
+        identityAssertDebounce.close();
+        sendActiveReceipts = false;
+    });
     async function pruneExpiredTcTokens() {
         try {
             await tcTokenIndexLoaded;
@@ -1568,9 +1705,8 @@ export const makeMessagesRecvSocket = (config) => {
             // (history sync) without needing inter-module wiring.
             const persisted = await readTcTokenIndex(authState.keys);
             const allJids = new Set(tcTokenKnownJids);
-            for (const jid of persisted) {
+            for (const jid of persisted)
                 allJids.add(jid);
-            }
             if (!allJids.size)
                 return;
             const jids = [...allJids];
@@ -1615,36 +1751,19 @@ export const makeMessagesRecvSocket = (config) => {
                 }
             });
             tcTokenKnownJids.clear();
-            for (const jid of survivors) {
+            for (const jid of survivors)
                 tcTokenKnownJids.add(jid);
-            }
             logger.debug({ mutated, remaining: survivors.size }, 'pruned expired tctokens');
         }
         catch (err) {
             logger.warn({ err: err?.message }, 'failed to prune expired tctokens');
         }
     }
-    ;
-    registerSocketEndHandler(() => {
-        if (!config.msgRetryCounterCache && msgRetryCache.close) {
-            msgRetryCache.close();
-        }
-        if (!config.callOfferCache && callOfferCache.close) {
-            callOfferCache.close();
-        }
-        if (!config.placeholderResendCache && placeholderResendCache.close) {
-            placeholderResendCache.close();
-        }
-        identityAssertDebounce.close();
-        sendActiveReceipts = false;
-    });
     return {
         ...sock,
         sendMessageAck,
         sendRetryRequest,
         rejectCall,
-        initiateCall,
-        cancelCall,
         fetchMessageHistory,
         requestPlaceholderResend,
         messageRetryManager