@itsliaaa/baileys 0.3.0-rc.9 → 0.3.0

package/lib/Socket/messages-recv.js

@@ -5,12 +5,12 @@ import Long from 'long';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CACHE_TTLS, KEY_BUNDLE_TYPE, MIN_PREKEY_COUNT, PLACEHOLDER_MAX_AGE_SECONDS, STATUS_EXPIRY_SECONDS } from '../Defaults/index.js';
 import { ReachoutTimelockEnforcementType, WAMessageStatus, WAMessageStubType } from '../Types/index.js';
-import { ACCOUNT_RESTRICTED_TEXT, aesDecryptCTR, aesEncryptGCM, cleanMessage, Curve, decodeMediaRetryNode, decodeMessageNode, decryptMessageNode, delay, derivePairingCodeKey, encodeBigEndian, encodeSignedDeviceIdentity, extractAddressingContext, getCallStatusFromNode, getHistoryMsg, getNextPreKeys, getStatusFromReceiptType, handleIdentityChange, hkdf, MISSING_KEYS_ERROR_TEXT, NACK_REASONS, NO_MESSAGE_FOUND_ERROR_TEXT, SERVER_ERROR_CODES, toNumber, unixTimestampSeconds, xmppPreKey, xmppSignedPreKey } from '../Utils/index.js';
+import { ACCOUNT_RESTRICTED_TEXT, aesDecryptCTR, aesEncryptGCM, cleanMessage, Curve, decodeMediaRetryNode, decodeMessageNode, decryptMessageNode, delay, derivePairingCodeKey, encodeBigEndian, encodeSignedDeviceIdentity, extractAddressingContext, extractE2ESessionFromRetryReceipt, getCallStatusFromNode, getHistoryMsg, getNextPreKeys, getStatusFromReceiptType, handleIdentityChange, hkdf, MISSING_KEYS_ERROR_TEXT, NACK_REASONS, NO_MESSAGE_FOUND_ERROR_TEXT, SERVER_ERROR_CODES, toNumber, unixTimestampSeconds, xmppPreKey, xmppSignedPreKey } from '../Utils/index.js';
 import { makeMutex } from '../Utils/make-mutex.js';
 import { makeOfflineNodeProcessor } from '../Utils/offline-node-processor.js';
 import { buildAckStanza } from '../Utils/stanza-ack.js';
 import { buildMergedTcTokenIndexWrite, isTcTokenExpired, readTcTokenIndex, resolveIssuanceJid, resolveTcTokenJid, storeTcTokensFromIqResult, TC_TOKEN_INDEX_KEY } from '../Utils/tc-token-utils.js';
-import { areJidsSameUser, binaryNodeToString, getAllBinaryNodeChildren, getBinaryNodeChild, getBinaryNodeChildBuffer, getBinaryNodeChildren, getBinaryNodeChildString, isJidGroup, isJidNewsletter, isJidStatusBroadcast, isLidUser, isPnUser, jidDecode, jidNormalizedUser, S_WHATSAPP_NET } from '../WABinary/index.js';
+import { areJidsSameUser, binaryNodeToString, getAllBinaryNodeChildren, getBinaryNodeChild, getBinaryNodeChildBuffer, getBinaryNodeChildren, getBinaryNodeChildString, getBinaryNodeChildUInt, isJidGroup, isJidNewsletter, isJidStatusBroadcast, isLidUser, isPnUser, jidDecode, jidNormalizedUser, S_WHATSAPP_NET } from '../WABinary/index.js';
 import { extractGroupMetadata } from './groups.js';
 import { makeMessagesSocket } from './messages-send.js';
 const ENFORCEMENT_TYPE_VALUES = new Set(Object.values(ReachoutTimelockEnforcementType));
@@ -20,7 +20,7 @@ function isValidEnforcementType(value) {
 export const makeMessagesRecvSocket = (config) => {
     const { logger, retryRequestDelayMs, maxMsgRetryCount, getMessage, shouldIgnoreJid, enableAutoSessionRecreation } = config;
     const sock = makeMessagesSocket(config);
-    const { ev, authState, ws, messageMutex, notificationMutex, receiptMutex, signalRepository, query, upsertMessage, resyncAppState, onUnexpectedError, assertSessions, sendNode, relayMessage, sendReceipt, uploadPreKeys, sendPeerDataOperationMessage, messageRetryManager, issuePrivacyTokens, fetchAccountReachoutTimelock } = sock;
+    const { userDevicesCache, devicesMutex, ev, authState, ws, messageMutex, notificationMutex, receiptMutex, signalRepository, query, upsertMessage, resyncAppState, onUnexpectedError, assertSessions, sendNode, relayMessage, sendReceipt, uploadPreKeys, sendPeerDataOperationMessage, messageRetryManager, registerSocketEndHandler, issuePrivacyTokens, fetchAccountReachoutTimelock, placeholderResendCache } = sock;
     const getLIDForPN = signalRepository.lidMapping.getLIDForPN.bind(signalRepository.lidMapping);
     /** this mutex ensures that each retryRequest will wait for the previous one to finish */
     const retryMutex = makeMutex();
@@ -34,11 +34,6 @@ export const makeMessagesRecvSocket = (config) => {
             stdTTL: DEFAULT_CACHE_TTLS.CALL_OFFER, // 5 mins
             useClones: false
         });
-    const placeholderResendCache = config.placeholderResendCache ||
-        new NodeCache({
-            stdTTL: DEFAULT_CACHE_TTLS.MSG_RETRY, // 1 hour
-            useClones: false
-        });
     // Debounce identity-change session refreshes per JID to avoid bursts
     const identityAssertDebounce = new NodeCache({ stdTTL: 5, useClones: false });
     let sendActiveReceipts = false;
@@ -277,83 +272,90 @@ export const makeMessagesRecvSocket = (config) => {
     // Handles newsletter notifications
     const handleNewsletterNotification = async (node) => {
         const from = node.attrs.from;
-        const child = getAllBinaryNodeChildren(node)[0];
+        const children = getAllBinaryNodeChildren(node);
         const author = node.attrs.participant;
-        logger.info({ from, child }, 'got newsletter notification');
-        switch (child.tag) {
-            case 'reaction':
-                const reactionUpdate = {
-                    id: from,
-                    server_id: child.attrs.message_id,
-                    reaction: {
-                        code: getBinaryNodeChildString(child, 'reaction'),
-                        count: 1
-                    }
-                };
-                ev.emit('newsletter.reaction', reactionUpdate);
-                break;
-            case 'view':
-                const viewUpdate = {
-                    id: from,
-                    server_id: child.attrs.message_id,
-                    count: parseInt(child.content?.toString() || '0', 10)
-                };
-                ev.emit('newsletter.view', viewUpdate);
-                break;
-            case 'participant':
-                const participantUpdate = {
-                    id: from,
-                    author,
-                    user: child.attrs.jid,
-                    action: child.attrs.action,
-                    new_role: child.attrs.role
-                };
-                ev.emit('newsletter-participants.update', participantUpdate);
-                break;
-            case 'update':
-                const settingsNode = getBinaryNodeChild(child, 'settings');
-                if (settingsNode) {
-                    const update = {};
-                    const nameNode = getBinaryNodeChild(settingsNode, 'name');
-                    if (nameNode?.content)
-                        update.name = nameNode.content.toString();
-                    const descriptionNode = getBinaryNodeChild(settingsNode, 'description');
-                    if (descriptionNode?.content)
-                        update.description = descriptionNode.content.toString();
-                    ev.emit('newsletter-settings.update', {
+        for (const child of children) {
+            logger.debug({ from, child }, 'got newsletter notification');
+            switch (child.tag) {
+                case 'reaction': {
+                    const reactionUpdate = {
                         id: from,
-                        update
-                    });
+                        server_id: child.attrs.message_id,
+                        reaction: {
+                            code: getBinaryNodeChildString(child, 'reaction'),
+                            count: 1
+                        }
+                    };
+                    ev.emit('newsletter.reaction', reactionUpdate);
+                    break;
                 }
-                break;
-            case 'message':
-                const plaintextNode = getBinaryNodeChild(child, 'plaintext');
-                if (plaintextNode?.content) {
-                    try {
-                        const contentBuf = typeof plaintextNode.content === 'string'
-                            ? Buffer.from(plaintextNode.content, 'binary')
-                            : Buffer.from(plaintextNode.content);
-                        const messageProto = proto.Message.decode(contentBuf).toJSON();
-                        const fullMessage = proto.WebMessageInfo.fromObject({
-                            key: {
-                                remoteJid: from,
-                                id: child.attrs.message_id || child.attrs.server_id,
-                                fromMe: false // TODO: is this really true though
-                            },
-                            message: messageProto,
-                            messageTimestamp: +child.attrs.t
-                        }).toJSON();
-                        await upsertMessage(fullMessage, 'append');
-                        logger.info('Processed plaintext newsletter message');
+                case 'view': {
+                    const viewUpdate = {
+                        id: from,
+                        server_id: child.attrs.message_id,
+                        count: parseInt(child.content?.toString() || '0', 10)
+                    };
+                    ev.emit('newsletter.view', viewUpdate);
+                    break;
+                }
+                case 'participant': {
+                    const participantUpdate = {
+                        id: from,
+                        author,
+                        user: child.attrs.jid,
+                        action: child.attrs.action,
+                        new_role: child.attrs.role
+                    };
+                    ev.emit('newsletter-participants.update', participantUpdate);
+                    break;
+                }
+                case 'update': {
+                    const settingsNode = getBinaryNodeChild(child, 'settings');
+                    if (settingsNode) {
+                        const update = {};
+                        const nameNode = getBinaryNodeChild(settingsNode, 'name');
+                        if (nameNode?.content)
+                            update.name = nameNode.content.toString();
+                        const descriptionNode = getBinaryNodeChild(settingsNode, 'description');
+                        if (descriptionNode?.content)
+                            update.description = descriptionNode.content.toString();
+                        ev.emit('newsletter-settings.update', {
+                            id: from,
+                            update
+                        });
                     }
-                    catch (error) {
-                        logger.error({ error }, 'Failed to decode plaintext newsletter message');
+                    break;
+                }
+                case 'message': {
+                    const plaintextNode = getBinaryNodeChild(child, 'plaintext');
+                    if (plaintextNode?.content) {
+                        try {
+                            const contentBuf = typeof plaintextNode.content === 'string'
+                                ? Buffer.from(plaintextNode.content, 'binary')
+                                : Buffer.from(plaintextNode.content);
+                            const messageProto = proto.Message.decode(contentBuf).toJSON();
+                            const fullMessage = proto.WebMessageInfo.fromObject({
+                                key: {
+                                    remoteJid: from,
+                                    id: child.attrs.message_id || child.attrs.server_id,
+                                    fromMe: false // TODO: is this really true though
+                                },
+                                message: messageProto,
+                                messageTimestamp: +child.attrs.t
+                            }).toJSON();
+                            await upsertMessage(fullMessage, 'append');
+                            logger.debug('Processed plaintext newsletter message');
+                        }
+                        catch (error) {
+                            logger.error({ error }, 'Failed to decode plaintext newsletter message');
+                        }
                     }
+                    break;
                 }
-                break;
-            default:
-                logger.warn({ node }, 'Unknown newsletter notification');
-                break;
+                default:
+                    logger.warn({ node, child }, 'Unknown newsletter notification child');
+                    break;
+            }
         }
     };
     const sendMessageAck = async (node, errorCode) => {
@@ -513,6 +515,8 @@ export const makeMessagesRecvSocket = (config) => {
             logger.info({ msgAttrs: node.attrs, retryCount }, 'sent retry receipt');
         }, authState?.creds?.me?.id || 'sendRetryRequest');
     };
+    // Mirrors WAWeb/Handle/PreKeyLow.js: skip a re-issued notification with the same stanza id.
+    const inFlightPreKeyLow = new Set();
     /**
      * Fire-and-forget tctoken re-issuance after a peer's device identity changed.
      * Mirrors WAWebSendTcTokenWhenDeviceIdentityChange — runs in parallel with
@@ -545,12 +549,24 @@ export const makeMessagesRecvSocket = (config) => {
     const handleEncryptNotification = async (node) => {
         const from = node.attrs.from;
         if (from === S_WHATSAPP_NET) {
+            const stanzaId = node.attrs.id;
+            if (stanzaId && inFlightPreKeyLow.has(stanzaId)) {
+                return;
+            }
             const countChild = getBinaryNodeChild(node, 'count');
             const count = +countChild.attrs.value;
             const shouldUploadMorePreKeys = count < MIN_PREKEY_COUNT;
             logger.debug({ count, shouldUploadMorePreKeys }, 'recv pre-key count');
             if (shouldUploadMorePreKeys) {
-                await uploadPreKeys();
+                if (stanzaId)
+                    inFlightPreKeyLow.add(stanzaId);
+                try {
+                    await uploadPreKeys();
+                }
+                finally {
+                    if (stanzaId)
+                        inFlightPreKeyLow.delete(stanzaId);
+                }
             }
         }
         else {
@@ -694,6 +710,89 @@ export const makeMessagesRecvSocket = (config) => {
                 break;
         }
     };
+    const handleDevicesNotification = async (node) => {
+        const [child] = getAllBinaryNodeChildren(node);
+        const from = jidNormalizedUser(node.attrs.from);
+        if (!child) {
+            logger.debug({ from }, 'devices notification missing child, skipping');
+            return;
+        }
+        const tag = child.tag;
+        const deviceHash = child.attrs.device_hash;
+        const devices = getBinaryNodeChildren(child, 'device');
+        if (areJidsSameUser(from, authState.creds.me.id) || areJidsSameUser(from, authState.creds.me.lid)) {
+            const deviceJids = devices.map(d => d.attrs.jid);
+            logger.info({ deviceJids }, 'got my own devices');
+        }
+        if (!devices.length) {
+            logger.debug({ from, tag }, 'no devices in notification, skipping');
+            return;
+        }
+        const decoded = [];
+        for (const d of devices) {
+            const jid = d.attrs.jid;
+            if (!jid)
+                continue;
+            const parts = jidDecode(jid);
+            if (!parts) {
+                logger.debug({ jid }, 'failed to decode device jid, skipping');
+                continue;
+            }
+            decoded.push({ jid, user: parts.user, server: parts.server, device: parts.device });
+        }
+        if (!decoded.length)
+            return;
+        await devicesMutex.mutex(async () => {
+            const byUser = new Map();
+            for (const d of decoded) {
+                const list = byUser.get(d.user) || [];
+                list.push(d);
+                byUser.set(d.user, list);
+            }
+            for (const [user, entries] of byUser) {
+                if (tag === 'update') {
+                    logger.debug({ user }, `${user}'s device list updated, dropping cached devices`);
+                    await userDevicesCache?.del(user);
+                    continue;
+                }
+                if (tag === 'remove') {
+                    await signalRepository.deleteSession(entries.map(e => e.jid));
+                }
+                const existingCache = (await userDevicesCache?.get(user)) || [];
+                if (!existingCache.length) {
+                    // No baseline yet; skip applying the delta so getUSyncDevices can
+                    // later fetch the full device list. Caching just the notification
+                    // entries would make a partial list look authoritative.
+                    logger.debug({ user, tag }, 'device list not cached, deferring to USync refresh');
+                    continue;
+                }
+                const affected = new Set(entries.map(e => e.device));
+                let updatedDevices;
+                switch (tag) {
+                    case 'add':
+                        logger.info({ deviceHash, count: entries.length }, 'devices added');
+                        updatedDevices = [
+                            ...existingCache.filter(d => !affected.has(d.device)),
+                            ...entries.map(e => ({ user: e.user, server: e.server, device: e.device }))
+                        ];
+                        break;
+                    case 'remove':
+                        logger.info({ deviceHash, count: entries.length }, 'devices removed');
+                        updatedDevices = existingCache.filter(d => !affected.has(d.device));
+                        break;
+                    default:
+                        logger.debug({ tag }, 'Unknown device list change tag');
+                        continue;
+                }
+                if (updatedDevices.length === 0) {
+                    await userDevicesCache?.del(user);
+                }
+                else {
+                    await userDevicesCache?.set(user, updatedDevices);
+                }
+            }
+        });
+    };
     const processNotification = async (node) => {
         const result = {};
         const [child] = getAllBinaryNodeChildren(node);
@@ -718,13 +817,12 @@ export const makeMessagesRecvSocket = (config) => {
                 await handleEncryptNotification(node);
                 break;
             case 'devices':
-                const devices = getBinaryNodeChildren(child, 'device');
-                if (areJidsSameUser(child.attrs.jid, authState.creds.me.id) ||
-                    areJidsSameUser(child.attrs.lid, authState.creds.me.lid)) {
-                    const deviceData = devices.map(d => ({ id: d.attrs.jid, lid: d.attrs.lid }));
-                    logger.info({ deviceData }, 'my own devices changed');
+                try {
+                    await handleDevicesNotification(node);
+                }
+                catch (error) {
+                    logger.error({ error, node }, 'failed to handle devices notification');
                 }
-                //TODO: drop a new event, add hashes
                 break;
             case 'server_sync':
                 const update = getBinaryNodeChild(node, 'collection');
@@ -939,10 +1037,11 @@ export const makeMessagesRecvSocket = (config) => {
         const newValue = ((await msgRetryCache.get(key)) || 0) + 1;
         await msgRetryCache.set(key, newValue);
     };
-    const sendMessagesAgain = async (key, ids, retryNode) => {
+    const sendMessagesAgain = async (key, ids, retryNode, receiptNode) => {
         const remoteJid = key.remoteJid;
         const participant = key.participant || remoteJid;
         const retryCount = +retryNode.attrs.count || 1;
+        const msgId = ids[0];
         // Try to get messages from cache first, then fallback to getMessage
         const msgs = [];
         for (const id of ids) {
@@ -974,12 +1073,49 @@ export const makeMessagesRecvSocket = (config) => {
         // just re-send the message to everyone
         // prevents the first message decryption failure
         const sendToAll = !jidDecode(participant)?.device;
-        // Check if we should recreate session for this retry
+        const sessionId = signalRepository.jidToSignalProtocolAddress(participant);
+        let injectedFromBundle = false;
+        const bundle = extractE2ESessionFromRetryReceipt(receiptNode);
+        if (bundle) {
+            try {
+                await signalRepository.injectE2ESession({ jid: participant, session: bundle });
+                injectedFromBundle = true;
+                logger.debug({ participant, retryCount }, 'injected session from retry receipt key bundle');
+            }
+            catch (error) {
+                logger.warn({ error, participant }, 'failed to inject session from retry receipt');
+            }
+        }
+        if (!injectedFromBundle) {
+            const receivedRegId = getBinaryNodeChildUInt(receiptNode, 'registration', 4);
+            if (typeof receivedRegId === 'number' && Number.isInteger(receivedRegId)) {
+                const info = await signalRepository.getSessionInfo(participant);
+                if (info && info.registrationId !== 0 && info.registrationId !== receivedRegId) {
+                    logger.info({ participant, stored: info.registrationId, received: receivedRegId }, 'reg id mismatch on retry without bundle, deleting session');
+                    await authState.keys.set({ session: { [sessionId]: null } });
+                }
+            }
+        }
+        const BASE_KEY_CHECK_RETRY = 2;
+        if (msgId && messageRetryManager) {
+            const info = await signalRepository.getSessionInfo(participant);
+            if (info) {
+                if (retryCount === BASE_KEY_CHECK_RETRY) {
+                    messageRetryManager.saveBaseKey(sessionId, msgId, info.baseKey);
+                }
+                else if (retryCount > BASE_KEY_CHECK_RETRY) {
+                    if (messageRetryManager.hasSameBaseKey(sessionId, msgId, info.baseKey)) {
+                        logger.warn({ participant, retryCount }, 'base key collision on retry, forcing fresh session');
+                        await authState.keys.set({ session: { [sessionId]: null } });
+                    }
+                    messageRetryManager.deleteBaseKey(sessionId, msgId);
+                }
+            }
+        }
         let shouldRecreateSession = false;
         let recreateReason = '';
-        if (enableAutoSessionRecreation && messageRetryManager && retryCount > 1) {
+        if (enableAutoSessionRecreation && messageRetryManager && retryCount > 1 && !injectedFromBundle) {
             try {
-                const sessionId = signalRepository.jidToSignalProtocolAddress(participant);
                 const hasSession = await signalRepository.validateSession(participant);
                 const result = messageRetryManager.shouldRecreateSession(participant, hasSession.exists);
                 shouldRecreateSession = result.recreate;
@@ -993,11 +1129,13 @@ export const makeMessagesRecvSocket = (config) => {
                 logger.warn({ error, participant }, 'failed to check session recreation for outgoing retry');
             }
         }
-        await assertSessions([participant], true);
+        if (!injectedFromBundle) {
+            await assertSessions([participant], true);
+        }
         if (isJidGroup(remoteJid)) {
             await authState.keys.set({ 'sender-key-memory': { [remoteJid]: null } });
         }
-        logger.debug({ participant, sendToAll, shouldRecreateSession, recreateReason }, 'forced new session for retry recp');
+        logger.debug({ participant, sendToAll, shouldRecreateSession, recreateReason, injectedFromBundle }, 'prepared session for retry resend');
         for (const [i, msg] of msgs.entries()) {
             if (!ids[i])
                 continue;
@@ -1073,7 +1211,7 @@ export const makeMessagesRecvSocket = (config) => {
                                 try {
                                     await updateSendMessageAgainCount(ids[0], key.participant);
                                     logger.debug({ attrs, key }, 'recv retry request');
-                                    await sendMessagesAgain(key, ids, retryNode);
+                                    await sendMessagesAgain(key, ids, retryNode, node);
                                 }
                                 catch (error) {
                                     logger.error({ key, ids, trace: error instanceof Error ? error.stack : 'Unknown error' }, 'error in sending message again');
@@ -1229,29 +1367,14 @@ export const makeMessagesRecvSocket = (config) => {
                                 return sendMessageAck(node);
                             }
                         }
-                        const errorMessage = msg?.messageStubParameters?.[0] || '';
-                        const isPreKeyError = errorMessage.includes('PreKey');
-                        logger.debug(`[handleMessage] Attempting retry request for failed decryption`);
-                        // Handle both pre-key and normal retries in single mutex
+                        logger.debug('[handleMessage] Attempting retry request for failed decryption');
+                        // WAWeb only retry-receipts here; server emits PreKeyLow if prekeys run low.
                         await retryMutex.mutex(async () => {
                             try {
                                 if (!ws.isOpen) {
                                     logger.debug({ node }, 'Connection closed, skipping retry');
                                     return;
                                 }
-                                // Handle pre-key errors with upload and delay
-                                if (isPreKeyError) {
-                                    logger.info({ error: errorMessage }, 'PreKey error detected, uploading and retrying');
-                                    try {
-                                        logger.debug('Uploading pre-keys for error recovery');
-                                        await uploadPreKeys(5);
-                                        logger.debug('Waiting for server to process new pre-keys');
-                                        await delay(1000);
-                                    }
-                                    catch (uploadErr) {
-                                        logger.error({ uploadErr }, 'Pre-key upload failed, proceeding with retry anyway');
-                                    }
-                                }
                                 const encNode = getBinaryNodeChild(node, 'enc');
                                 await sendRetryRequest(node, !encNode);
                                 if (retryRequestDelayMs) {
@@ -1259,15 +1382,7 @@ export const makeMessagesRecvSocket = (config) => {
                                 }
                             }
                             catch (err) {
-                                logger.error({ err, isPreKeyError }, 'Failed to handle retry, attempting basic retry');
-                                // Still attempt retry even if pre-key upload failed
-                                try {
-                                    const encNode = getBinaryNodeChild(node, 'enc');
-                                    await sendRetryRequest(node, !encNode);
-                                }
-                                catch (retryErr) {
-                                    logger.error({ retryErr }, 'Failed to send retry after error handling');
-                                }
+                                logger.error({ err }, 'Failed to send retry');
                             }
                             acked = true;
                             await sendMessageAck(node, NACK_REASONS.UnhandledError);
@@ -1395,12 +1510,39 @@ export const makeMessagesRecvSocket = (config) => {
         // device could not display the message
         if (attrs.error) {
             const isReachoutTimelocked = attrs.error === String(NACK_REASONS.SenderReachoutTimelocked);
-            if (attrs.error === SERVER_ERROR_CODES.MissingTcToken) {
-                // 463 = account restricted + no tctoken for this contact.
-                // WA Web prevents this client-side (disables compose bar).
-                // No retry — retrying worsens the restriction by counting
-                // as another "reach out" to an unknown contact.
+            if (attrs.error === SERVER_ERROR_CODES.MessageAccountRestriction) {
+                // 463 = 1:1 message missing privacy token (tctoken). Usually means the
+                // account is restricted: WhatsApp blocks starting new chats but preserves
+                // existing ones, since established chats already carry a tctoken.
+                // WA Web prevents this client-side (disables the compose bar).
+                // No retry — retrying counts as another "reach out" and worsens the restriction.
                 logger.warn({ msgId: attrs.id, from: attrs.from }, 'error 463: account restricted or missing tctoken for contact');
+                const ackFrom = attrs.from;
+                if (ackFrom && !inFlight463Recoveries.has(ackFrom)) {
+                    inFlight463Recoveries.add(ackFrom);
+                    void (async () => {
+                        try {
+                            const getPNForLID = signalRepository.lidMapping.getPNForLID.bind(signalRepository.lidMapping);
+                            const tcStorageJid = await resolveTcTokenJid(ackFrom, getLIDForPN);
+                            const issueJid = await resolveIssuanceJid(ackFrom, sock.serverProps.lidTrustedTokenIssueToLid, getLIDForPN, getPNForLID);
+                            const result = await issuePrivacyTokens([issueJid], unixTimestampSeconds());
+                            await storeTcTokensFromIqResult({
+                                result,
+                                fallbackJid: tcStorageJid,
+                                keys: authState.keys,
+                                getLIDForPN,
+                                onNewJidStored: trackTcTokenJid
+                            });
+                            logger.debug({ from: ackFrom }, 'completed 463 token recovery issuance');
+                        }
+                        catch (err) {
+                            logger.debug({ from: ackFrom, err: err?.message }, 'failed 463 token recovery issuance');
+                        }
+                        finally {
+                            inFlight463Recoveries.delete(ackFrom);
+                        }
+                    })();
+                }
             }
             else if (attrs.error === SERVER_ERROR_CODES.SmaxInvalid) {
                 logger.warn({ msgId: attrs.id, from: attrs.from }, 'smax-invalid (479): stanza rejected by server — likely stale device session or malformed addressing');
@@ -1515,6 +1657,8 @@ export const makeMessagesRecvSocket = (config) => {
     });
     /** timestamp of last tctoken prune run — throttles to once per 24h */
     let lastTcTokenPruneTs = 0;
+    /** dedupe in-flight 463 recovery token issuance by target JID */
+    const inFlight463Recoveries = new Set();
     ev.on('connection.update', ({ isOnline, connection }) => {
         if (typeof isOnline !== 'undefined') {
             sendActiveReceipts = isOnline;
@@ -1544,6 +1688,16 @@ export const makeMessagesRecvSocket = (config) => {
             }
         }
     });
+    registerSocketEndHandler(() => {
+        if (!config.msgRetryCounterCache && msgRetryCache.close) {
+            msgRetryCache.close();
+        }
+        if (!config.callOfferCache && callOfferCache.close) {
+            callOfferCache.close();
+        }
+        identityAssertDebounce.close();
+        sendActiveReceipts = false;
+    });
     async function pruneExpiredTcTokens() {
         try {
             await tcTokenIndexLoaded;