sauruspro-bail 5.0.1 → 5.0.2

package/lib/Utils/dinonic-spr.js

@@ -1,521 +1,739 @@
 /**
- * Do not remove this watermark.
+ * SPR - Selective / Private Relay for sauruspro-bail
  *
- * NIXCODE - Advanced WhatsApp Send Private Relay
+ * Engine kirim pesan grup dengan kontrol siapa yang bisa membaca apa:
+ *   - public   : membaca pesan umum (menerima sender key sekali pakai)
+ *   - personal : membaca pesan khusus miliknya sendiri (enkripsi 1-lawan-1)
+ *   - hidden   : tidak menerima apa-apa
  *
- * Runtime:
- * - sauruspro-bail (SPR, ESM)
+ * Fitur kirim-per-penerima (privat, broadcast {name}, foto profil per orang,
+ * batas target, cache, timeout) diadaptasi dari plugin zapo-js (MIT).
  *
- * Created by Nixel
- * WhatsApp: wa.me/6285188349341
- * Channel: https://whatsapp.com/channel/0029VbCV1ck8fewpdNb2TY2k
- *
- * Copyright (c) 2026 Nixel
- *
- * Permission is granted to use and modify this library
- * for personal or commercial projects.
- *
- * Reuploading, reselling, relicensing, or redistributing
- * this library as a standalone product is prohibited.
- *
- * Do not claim this project as your own original work.
+ * Maintained by Saurus / Dinonic.
  */
 
 "use strict";
 
-import { proto } from '../../WAProto/index.js';
+import crypto from 'crypto';
+import { Boom } from '@hapi/boom';
 import { Curve } from './crypto.js';
-import { generateMessageIDV2, generateParticipantHashV2, encodeWAMessage, encodeNewsletterMessage } from './generics.js';
+import { encodeWAMessage, generateMessageIDV2, generateParticipantHashV2 } from './generics.js';
 import { encodeSignedDeviceIdentity } from './validate-connection.js';
-import { normalizeMessageContent } from './messages.js';
-import { isHostedLidUser, isHostedPnUser, isLidUser, jidDecode, jidEncode } from '../WABinary/index.js';
-import { Boom } from '@hapi/boom';
-import crypto from 'crypto';
+import { normalizeMessageContent, prepareWAMessageMedia } from './messages.js';
+import { getMessageReportingToken, shouldIncludeReportingToken } from './reporting-utils.js';
+import { isTcTokenExpired, resolveTcTokenJid } from './tc-token-utils.js';
+import {
+    isHostedLidUser,
+    isHostedPnUser,
+    isJidGroup,
+    isLidUser,
+    jidDecode,
+    jidEncode
+} from '../WABinary/index.js';
+
+/* -------------------------------------------------------------------------- */
+/*  Konfigurasi & teks default                                                */
+/* -------------------------------------------------------------------------- */
+
+export const SPR_LIMITS = Object.freeze({
+    targets: 100,
+    concurrency: 10,
+    encryptConcurrency: 8,
+    avatarBudgetMs: 10000,
+    avatarHardCapMs: 14000,
+    avatarFetchMs: 8000,
+    cacheSize: 200
+});
+
+export const SPR_TEXT = Object.freeze({
+    publicDefault: 'Pesan ini memiliki isi khusus untuk beberapa penerima.',
+    templateDefault: 'Halo {name}, ada pesan untukmu.',
+    noTarget: 'Tidak ada anggota yang bisa dijadikan target (bot tidak dihitung).',
+    emptyPrivate: 'Isi pesan privat kosong.',
+    needGroup: 'Perintah ini hanya untuk grup.',
+    encryptFailed: 'Enkripsi per-penerima gagal semua. Coba lagi sebentar lagi.'
+});
+
+/* -------------------------------------------------------------------------- */
+/*  Utilitas kecil (safe / timeout / pool / cache)                            */
+/* -------------------------------------------------------------------------- */
+
+const attempt = async (task, fallback = null) => {
+    try {
+        return await task();
+    } catch {
+        return fallback;
+    }
+};
 
+const withTimeout = async (promise, ms, fallback) => {
+    let timer;
+    const limit = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(fallback), ms);
+        timer.unref?.();
+    });
+    try {
+        return await Promise.race([promise, limit]);
+    } finally {
+        clearTimeout(timer);
+    }
+};
 
+const runPool = async (items, limit, task) => {
+    const out = new Array(items.length);
+    let cursor = 0;
+    const worker = async () => {
+        while (cursor < items.length) {
+            const index = cursor++;
+            out[index] = await attempt(() => task(items[index], index));
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(Math.max(limit, 1), items.length) }, worker));
+    return out;
+};
 
-function encodeVarint(value) {
-    const bytes = [];
-    while (value >= 128) {
-        bytes.push((value & 127) | 128);
-        value >>>= 7;
-    }
-    bytes.push(value);
-    return Buffer.from(bytes);
-}
+const makeCache = (size) => {
+    const store = new Map();
+    return {
+        has: (k) => store.has(k),
+        get: (k) => store.get(k),
+        set: (k, v) => {
+            store.set(k, v);
+            if (store.size > size) store.delete(store.keys().next().value);
+            return v;
+        }
+    };
+};
 
-export function generateSigningKeyPair() {
-    const keys = Curve.generateKeyPair();
-    const pubBuffer = Buffer.concat([Buffer.from([0x05]), Buffer.from(keys.public)]);
-    return { privateKey: Buffer.from(keys.private), publicKey: pubBuffer };
-}
+const avatarBytesCache = makeCache(SPR_LIMITS.cacheSize);
+const avatarMediaCache = makeCache(SPR_LIMITS.cacheSize);
 
-export function getMessageKey(seed) {
-    const messageKey = crypto.createHmac("sha256", seed).update(Buffer.from([0x01])).digest();
-    const salt = Buffer.alloc(32, 0);
-    const info = Buffer.from("WhisperGroup");
-    const prk = crypto.createHmac("sha256", salt).update(messageKey).digest();
-    const t1 = crypto.createHmac("sha256", prk).update(Buffer.concat([info, Buffer.from([0x01])])).digest();
-    const t2 = crypto.createHmac("sha256", prk).update(Buffer.concat([t1, info, Buffer.from([0x02])])).digest();
-    const okm = Buffer.concat([t1, t2]);
-    const iv = okm.slice(0, 16);
-    const cipherKey = okm.slice(16, 48);
-    return { iv, cipherKey };
-}
+const userOf = (jid) => (jid ? jidDecode(String(jid))?.user || String(jid).split('@')[0].split(':')[0] : '');
 
-export function deriveReportingTag(message, msgId, remoteJid) {
-    if (!message.messageContextInfo) message.messageContextInfo = {};
-    if (!Buffer.isBuffer(message.messageContextInfo.messageSecret) || message.messageContextInfo.messageSecret.length !== 32) {
-        message.messageContextInfo.messageSecret = crypto.randomBytes(32);
-    }
-    const seed = message.messageContextInfo.messageSecret;
-    const payload = Buffer.from(proto.Message.encode(message).finish());
-    const salt = Buffer.alloc(32, 0);
-    const info = Buffer.concat([
-        Buffer.from(msgId, "utf8"),
-        Buffer.from(remoteJid, "utf8"),
-        Buffer.from(remoteJid, "utf8"),
-        Buffer.from("Report Token", "utf8")
-    ]);
-    const prk = crypto.createHmac("sha256", salt).update(seed).digest();
-    const t1 = crypto.createHmac("sha256", prk).update(Buffer.concat([info, Buffer.from([0x01])])).digest();
-    const mac = crypto.createHmac("sha256", t1).update(payload).digest();
-
-    const iv = Buffer.from([0x7a, 0x3b, 0x91, 0xc4, 0x2e, 0x1f, 0xd0, 0x63]);
-    const vec = Buffer.from([0x29, 0x6b, 0xc3, 0x8a, 0x67, 0x47, 0x95, 0x2f, 0x2c, 0x0a]);
-    const nonce = mac.subarray(0, 4);
-    const stream = crypto.createHmac("sha256", iv).update(nonce).digest();
-
-    const raw = Buffer.alloc(10);
-    for (let i = 0; i < 10; i++) {
-        raw[i] = vec[i] ^ iv[i & 7];
+/* -------------------------------------------------------------------------- */
+/*  Sender key sekali pakai (Signal group cipher)                             */
+/* -------------------------------------------------------------------------- */
+
+const varint = (value) => {
+    const out = [];
+    let v = value >>> 0;
+    while (v >= 0x80) {
+        out.push((v & 0x7f) | 0x80);
+        v >>>= 7;
     }
+    out.push(v);
+    return Buffer.from(out);
+};
 
-    const sig = crypto.createHmac("sha256", iv).update(Buffer.concat([nonce, raw])).digest().subarray(0, 2);
-    const block = Buffer.concat([raw, sig]);
+const fieldVarint = (field, value) => Buffer.concat([varint((field << 3) | 0), varint(value)]);
+const fieldBytes = (field, bytes) => Buffer.concat([varint((field << 3) | 2), varint(bytes.length), bytes]);
 
-    for (let i = 0; i < 12; i++) {
-        block[i] ^= stream[i];
-    }
+const SIGNAL_VERSION = Buffer.from([0x33]);
 
-    return Buffer.concat([nonce, block]);
-}
+/**
+ * Buat sender key baru yang hanya hidup untuk satu pesan.
+ * Karena kuncinya tidak pernah disimpan, hanya device yang diberi SKDM-nya
+ * yang bisa membuka pesan grup ini.
+ */
+export const createOneShotSenderKey = () => {
+    const keyId = crypto.randomBytes(4).readUInt32BE(0) & 0x7fffffff;
+    const chainKey = crypto.randomBytes(32);
+    const pair = Curve.generateKeyPair();
+    const signingPublic = Buffer.concat([Buffer.from([0x05]), Buffer.from(pair.public)]);
+
+    const deriveCipher = () => {
+        const seed = crypto.createHmac('sha256', chainKey).update(Buffer.from([0x01])).digest();
+        const okm = Buffer.from(crypto.hkdfSync('sha256', seed, Buffer.alloc(32), 'WhisperGroup', 48));
+        return { iv: okm.subarray(0, 16), key: okm.subarray(16, 48) };
+    };
 
-export function encryptGroupMessage(plaintext, chainSeed, privateKeyObject, keyId) {
-    const iteration = 0;
-    const { iv, cipherKey } = getMessageKey(chainSeed);
-    const cipher = crypto.createCipheriv("aes-256-cbc", cipherKey, iv);
-    const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-    const idBuf = Buffer.concat([Buffer.from([0x08]), encodeVarint(keyId)]);
-    const iterBuf = Buffer.concat([Buffer.from([0x10]), encodeVarint(iteration)]);
-    const cipherBuf = Buffer.concat([Buffer.from([0x1A]), encodeVarint(ciphertext.length), ciphertext]);
-    const messageProto = Buffer.concat([idBuf, iterBuf, cipherBuf]);
-    const messageToSign = Buffer.concat([Buffer.from([0x33]), messageProto]);
-    const signature = Curve.sign(privateKeyObject, messageToSign);
-    return Buffer.concat([messageToSign, Buffer.from(signature)]);
-}
+    return {
+        keyId,
+        /** Isi senderKeyDistributionMessage.axolotlSenderKeyDistributionMessage */
+        distribution() {
+            const body = Buffer.concat([
+                fieldVarint(1, keyId),
+                fieldVarint(2, 0),
+                fieldBytes(3, chainKey),
+                fieldBytes(4, signingPublic)
+            ]);
+            return Buffer.concat([SIGNAL_VERSION, body]);
+        },
+        /** Enkripsi payload menjadi SenderKeyMessage (iterasi 0) */
+        seal(plaintext) {
+            const { iv, key } = deriveCipher();
+            const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
+            const sealed = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+            const body = Buffer.concat([fieldVarint(1, keyId), fieldVarint(2, 0), fieldBytes(3, sealed)]);
+            const signed = Buffer.concat([SIGNAL_VERSION, body]);
+            const signature = Buffer.from(Curve.sign(pair.private, signed));
+            return Buffer.concat([signed, signature]);
+        }
+    };
+};
 
-export function createSKDM(keyId, iteration, chainSeed, signingPubKey) {
-    const idBuf = Buffer.concat([Buffer.from([0x08]), encodeVarint(keyId)]);
-    const iterBuf = Buffer.concat([Buffer.from([0x10]), encodeVarint(iteration)]);
-    const chainBuf = Buffer.concat([Buffer.from([0x1A]), encodeVarint(chainSeed.length), chainSeed]);
-    const signBuf = Buffer.concat([Buffer.from([0x22]), encodeVarint(signingPubKey.length), signingPubKey]);
-    const message = Buffer.concat([idBuf, iterBuf, chainBuf, signBuf]);
-    return Buffer.concat([Buffer.from([0x33]), message]);
-}
+/* -------------------------------------------------------------------------- */
+/*  Helper tipe pesan                                                         */
+/* -------------------------------------------------------------------------- */
+
+const mediaTypeOf = (m) => {
+    if (!m) return '';
+    if (m.imageMessage) return 'image';
+    if (m.videoMessage) return m.videoMessage.gifPlayback ? 'gif' : 'video';
+    if (m.audioMessage) return m.audioMessage.ptt ? 'ptt' : 'audio';
+    if (m.contactMessage) return 'vcard';
+    if (m.documentMessage) return 'document';
+    if (m.contactsArrayMessage) return 'contact_array';
+    if (m.liveLocationMessage) return 'livelocation';
+    if (m.stickerMessage || m.stickerPackMessage) return 'sticker';
+    if (m.listMessage) return 'list';
+    if (m.listResponseMessage) return 'list_response';
+    if (m.buttonsResponseMessage) return 'buttons_response';
+    if (m.orderMessage) return 'order';
+    if (m.productMessage) return 'product';
+    if (m.interactiveResponseMessage) return 'native_flow_response';
+    if (m.groupInviteMessage) return 'url';
+    return '';
+};
 
-const getMessageType = (message) => {
-    const normalizedMessage = normalizeMessageContent(message);
-    if (!normalizedMessage) return "text";
-    if (normalizedMessage.reactionMessage || normalizedMessage.encReactionMessage) return "reaction";
-    if (
-        normalizedMessage.pollCreationMessage ||
-        normalizedMessage.pollCreationMessageV2 ||
-        normalizedMessage.pollCreationMessageV3 ||
-        normalizedMessage.pollUpdateMessage
-    ) return "poll";
-    if (normalizedMessage.eventMessage) return "event";
-    if (getMediaType(normalizedMessage) !== "") return "media";
-    return "text";
+const stanzaTypeOf = (message) => {
+    const m = normalizeMessageContent(message);
+    if (!m) return 'text';
+    if (m.reactionMessage || m.encReactionMessage) return 'reaction';
+    if (m.pollCreationMessage || m.pollCreationMessageV2 || m.pollCreationMessageV3 ||
+        m.pollCreationMessageV4 || m.pollCreationMessageV5 || m.pollUpdateMessage) return 'poll';
+    if (m.eventMessage) return 'event';
+    return mediaTypeOf(m) ? 'media' : 'text';
 };
 
-const getMediaType = (message) => {
-    if (message.imageMessage) return "image";
-    if (message.videoMessage) return message.videoMessage.gifPlayback ? "gif" : "video";
-    if (message.audioMessage) return message.audioMessage.ptt ? "ptt" : "audio";
-    if (message.contactMessage) return "vcard";
-    if (message.documentMessage) return "document";
-    if (message.contactsArrayMessage) return "contact_array";
-    if (message.liveLocationMessage) return "livelocation";
-    if (message.stickerMessage) return "sticker";
-    if (message.listMessage) return "list";
-    if (message.listResponseMessage) return "list_response";
-    if (message.buttonsResponseMessage) return "buttons_response";
-    if (message.orderMessage) return "order";
-    if (message.productMessage) return "product";
-    if (message.interactiveResponseMessage) return "native_flow_response";
-    if (message.groupInviteMessage) return "url";
-    return "";
+const decryptFailHidden = (message, hide) => {
+    const m = normalizeMessageContent(message);
+    return hide === true || !!(m?.pinInChatMessage || m?.reactionMessage);
 };
 
-export async function sPR(conn, jid, message, {
-    messageId: msgId,
-    additionalAttributes,
-    useUserDevicesCache,
-    useCachedGroupMetadata,
-    statusJidList,
-    additionalNodes,
-    targetMe,
-    mode = "exclude",
-    target = [],
-    hideDecryptFail = true,
-    deviceMode = "all"
-} = {}) {
-    const meId = conn.authState?.creds?.me?.id || conn.user?.id || "";
-    const meLid = conn.authState?.creds?.me?.lid || conn.user?.lid || "";
-
-    const getLidForPn = async (pnJid) => {
-        try {
-            return await conn.signalRepository?.lidMapping?.getLIDForPN(pnJid);
-        } catch {
-            return null;
-        }
-    };
+/* -------------------------------------------------------------------------- */
+/*  Identitas (PN <-> LID) dan pencocokan target                              */
+/* -------------------------------------------------------------------------- */
 
-    const getPnForLid = async (lidJid) => {
-        try {
-            return await conn.signalRepository?.lidMapping?.getPNForLID(lidJid);
-        } catch {
-            return null;
-        }
-    };
+const participantAliases = (p) =>
+    [p?.id, p?.jid, p?.lid, p?.phoneNumber, p?.pn].filter(Boolean).map(userOf).filter(Boolean);
 
-    const processFilters = async (list) => {
-        const rules = [];
-        if (!Array.isArray(list)) return rules;
-        for (const item of list) {
-            if (!item) continue;
-            const decoded = jidDecode(item);
-            if (!decoded) continue;
-
-            const hasDevice = item.includes(":");
-            const targetDevice = hasDevice ? (decoded.device !== undefined ? decoded.device : 0) : null;
-
-            rules.push({
-                user: decoded.user,
-                device: targetDevice,
-                server: decoded.server
-            });
-
-            if (decoded.server === "s.whatsapp.net") {
-                const lidJid = await getLidForPn(item);
-                if (lidJid) {
-                    const lidDecoded = jidDecode(lidJid);
-                    if (lidDecoded) {
-                        rules.push({
-                            user: lidDecoded.user,
-                            device: targetDevice,
-                            server: lidDecoded.server
-                        });
-                    }
-                }
-            } else if (decoded.server === "lid") {
-                const pnJid = await getPnForLid(item);
-                if (pnJid) {
-                    const pnDecoded = jidDecode(pnJid);
-                    if (pnDecoded) {
-                        rules.push({
-                            user: pnDecoded.user,
-                            device: targetDevice,
-                            server: pnDecoded.server
-                        });
-                    }
-                }
-            }
-        }
-        return rules;
-    };
+/** Peta alias user -> himpunan semua alias user milik orang yang sama */
+const buildAliasIndex = (groupData) => {
+    const index = new Map();
+    for (const p of groupData?.participants || []) {
+        const set = new Set(participantAliases(p));
+        for (const alias of set) index.set(alias, set);
+    }
+    return index;
+};
 
-    const parsedTargets = await processFilters(target);
+const lookupMapped = async (conn, jid) => {
+    const mapping = conn.signalRepository?.lidMapping;
+    if (!mapping) return null;
+    const decoded = jidDecode(jid);
+    if (!decoded) return null;
+    if (decoded.server === 's.whatsapp.net') return attempt(() => mapping.getLIDForPN(jid));
+    if (decoded.server === 'lid') return attempt(() => mapping.getPNForLID(jid));
+    return null;
+};
 
-    const isMatch = (targetJid, rules) => {
-        const decoded = jidDecode(targetJid);
-        if (!decoded) return false;
+/** Ubah daftar JID menjadi aturan {user, device|null} lengkap dengan alias PN/LID */
+const buildRules = async (conn, list, aliasIndex) => {
+    const rules = [];
+    for (const raw of Array.isArray(list) ? list : []) {
+        const decoded = raw ? jidDecode(raw) : null;
+        if (!decoded) continue;
+        const device = String(raw).includes(':') ? (decoded.device ?? 0) : null;
+        const users = new Set([decoded.user, ...(aliasIndex.get(decoded.user) || [])]);
+        const mapped = await lookupMapped(conn, raw);
+        if (mapped) users.add(userOf(mapped));
+        for (const user of users) rules.push({ user, device });
+    }
+    return rules;
+};
 
-        const targetDevice = decoded.device !== undefined ? decoded.device : 0;
+const matchesRules = (deviceJid, rules) => {
+    const d = jidDecode(deviceJid);
+    if (!d) return false;
+    const device = d.device ?? 0;
+    return rules.some((r) => r.user === d.user && (r.device === null || r.device === device));
+};
 
-        for (const rule of rules) {
-            if (rule.user === decoded.user) {
-                if (rule.device === null) return true;
-                if (rule.device === targetDevice) return true;
-            }
-        }
-        return false;
-    };
+/**
+ * Normalisasi opsi `personal` menjadi fungsi (deviceUser) -> message | null.
+ * Bentuk yang diterima: function({jid,user}), Map, atau object {jid: message}.
+ */
+const buildPersonalResolver = async (conn, personal, aliasIndex) => {
+    if (!personal) return () => null;
+    if (typeof personal === 'function') {
+        const memo = new Map();
+        return (ctx) => {
+            if (!memo.has(ctx.user)) memo.set(ctx.user, personal(ctx) || null);
+            return memo.get(ctx.user);
+        };
+    }
+    const entries = personal instanceof Map ? [...personal.entries()] : Object.entries(personal);
+    const byUser = new Map();
+    for (const [jid, message] of entries) {
+        if (!message) continue;
+        const users = new Set([userOf(jid), ...(aliasIndex.get(userOf(jid)) || [])]);
+        const mapped = await lookupMapped(conn, jid);
+        if (mapped) users.add(userOf(mapped));
+        for (const user of users) if (user) byUser.set(user, message);
+    }
+    return (ctx) => byUser.get(ctx.user) || null;
+};
+
+/* -------------------------------------------------------------------------- */
+/*  Inti: sPR                                                                 */
+/* -------------------------------------------------------------------------- */
+
+const isHostedDevice = (device) =>
+    isHostedLidUser(device.jid) || isHostedPnUser(device.jid) || device.device === 99;
+
+const runEncrypt = (conn, groups, extraFor) =>
+    runPool(groups, SPR_LIMITS.encryptConcurrency, async ({ jids, message, dsm }) => {
+        const extra = extraFor(message);
+        return conn.createParticipantNodes(jids, message, extra, dsm);
+    });
+
+/**
+ * Kirim pesan dengan kontrol audiens per device.
+ *
+ * @param conn    socket sauruspro-bail
+ * @param jid     grup / chat / status@broadcast
+ * @param message pesan publik (boleh null jika semua penerima punya pesan personal)
+ * @param options
+ *   mode            'exclude' (default) | 'include'  -> berlaku untuk pesan publik
+ *   target          JID yang dikenai mode
+ *   targetMe        true/false memaksa device milik sendiri menerima/tidak
+ *   deviceMode      'all' | 'primary' | 'secondary'
+ *   personal        function({jid,user}) | Map | {jid: message}  -> pesan khusus per orang.
+ *                   Penerima personal TIDAK menerima pesan publik.
+ *   hideDecryptFail sembunyikan placeholder gagal-dekripsi (default true)
+ *   messageId, additionalAttributes, additionalNodes, useUserDevicesCache,
+ *   useCachedGroupMetadata, statusJidList
+ * @returns messageId
+ */
+export async function sPR(conn, jid, message, options = {}) {
+    let {
+        messageId: msgId,
+        additionalAttributes,
+        additionalNodes,
+        useUserDevicesCache,
+        useCachedGroupMetadata,
+        statusJidList,
+        targetMe,
+        mode = 'exclude',
+        target = [],
+        personal,
+        hideDecryptFail = true,
+        deviceMode = 'all'
+    } = options;
+
+    if (!jid) throw new Boom('sPR: jid wajib diisi', { statusCode: 400 });
+    if (!message && !personal) throw new Boom('sPR: message atau personal wajib diisi', { statusCode: 400 });
+
+    const creds = conn.authState?.creds;
+    const meId = creds?.me?.id || conn.user?.id || '';
+    const meLid = creds?.me?.lid || conn.user?.lid || '';
+    const meUsers = new Set([userOf(meId), userOf(meLid)].filter(Boolean));
+    const isSelfDevice = (deviceJid) => meUsers.has(userOf(deviceJid));
+    const isSenderDevice = (deviceJid) => deviceJid === meId || (!!meLid && deviceJid === meLid);
+
+    const statusJid = 'status@broadcast';
+    const { server } = jidDecode(jid);
+
+    // Newsletter & pesan peer tidak punya konsep audiens: serahkan ke relay biasa.
+    if (server === 'newsletter' || additionalAttributes?.category === 'peer') {
+        return conn.relayMessage(jid, message, { messageId: msgId, additionalAttributes, additionalNodes });
+    }
 
-    let shouldIncludeDeviceIdentity = false;
-    const statusJid = "status@broadcast";
-    const { user, server } = jidDecode(jid);
-    const isNewsletter = server === "newsletter";
-    const isGroup = server === "g.us";
+    const isGroup = isJidGroup(jid);
     const isStatus = jid === statusJid;
     const isGroupOrStatus = isGroup || isStatus;
+    const destinationJid = isStatus ? statusJid : jid;
+
     msgId = msgId || generateMessageIDV2(meId);
     useUserDevicesCache = useUserDevicesCache !== false;
     useCachedGroupMetadata = useCachedGroupMetadata !== false && !isStatus;
-    const participants = [];
-    const destinationJid = !isStatus ? jid : statusJid;
-    const binaryNodeContent = [];
-    const devices = [];
-
-    const reportingToken = !isNewsletter && !isStatus ? deriveReportingTag(message, msgId, destinationJid) : null;
-
-    const meMsg = { deviceSentMessage: { destinationJid, message }, messageContextInfo: message.messageContextInfo };
-    const extraAttrs = {};
-    const messages = normalizeMessageContent(message);
-
-    if (isNewsletter) {
-        const patched = conn.patchMessageBeforeSending ? await conn.patchMessageBeforeSending(message, []) : message;
-        const bytes = encodeNewsletterMessage(patched);
-        binaryNodeContent.push({ tag: "plaintext", attrs: {}, content: bytes });
-        const stanza = {
-            tag: "message",
-            attrs: {
-                to: jid,
-                id: msgId,
-                type: getMessageType(message),
-                ...(additionalAttributes || {})
-            },
-            content: binaryNodeContent
-        };
-        await conn.sendNode(stanza);
-        return msgId;
-    }
 
-    if (hideDecryptFail === true) {
-        extraAttrs["decrypt-fail"] = "hide";
+    const baseExtra = {};
+    if (decryptFailHidden(message, hideDecryptFail)) baseExtra['decrypt-fail'] = 'hide';
+    const publicMedia = mediaTypeOf(normalizeMessageContent(message));
+    if (publicMedia) baseExtra.mediatype = publicMedia;
+
+    const extraFor = (msg) => {
+        const media = mediaTypeOf(normalizeMessageContent(msg));
+        const extra = { ...baseExtra };
+        if (media) extra.mediatype = media;
+        else delete extra.mediatype;
+        return extra;
+    };
+
+    /* ---------- kumpulkan device & grup ---------- */
+    let groupData;
+    let devices = [];
+    if (isGroupOrStatus) {
+        groupData = useCachedGroupMetadata && conn.cachedGroupMetadata ? await conn.cachedGroupMetadata(jid) : undefined;
+        if (!(groupData && Array.isArray(groupData.participants)) && !isStatus) groupData = await conn.groupMetadata(jid);
+        const ids = groupData ? groupData.participants.map((p) => p.id) : [];
+        if (isStatus && statusJidList) ids.push(...statusJidList);
+        if (groupData?.ephemeralDuration > 0) {
+            additionalAttributes = { ...additionalAttributes, expiration: String(groupData.ephemeralDuration) };
+        }
+        devices = await conn.getUSyncDevices(ids, !!useUserDevicesCache, false);
+        if (isGroup) {
+            additionalAttributes = { ...additionalAttributes, addressing_mode: groupData?.addressingMode || 'lid' };
+        }
+    } else {
+        const lidChat = isLidUser(jid) && meLid;
+        const self = jidEncode(userOf(lidChat ? meLid : meId), lidChat ? 'lid' : 's.whatsapp.net');
+        devices = await conn.getUSyncDevices([self, jid], true, false);
     }
 
-    const mediaType = getMediaType(messages);
-    if (mediaType) extraAttrs["mediatype"] = mediaType;
+    const aliasIndex = buildAliasIndex(groupData);
+    const rules = await buildRules(conn, target, aliasIndex);
+    const personalFor = await buildPersonalResolver(conn, personal, aliasIndex);
+
+    /* ---------- klasifikasi tiap device ---------- */
+    const publicDevices = [];
+    const personalByUser = new Map(); // user -> { message, jids[] }
+
+    for (const device of devices) {
+        const deviceJid = device.jid;
+        if (isSenderDevice(deviceJid)) continue;
+
+        const d = jidDecode(deviceJid);
+        const deviceId = d?.device ?? 0;
+        if (deviceMode === 'primary' && deviceId !== 0) continue;
+        if (deviceMode === 'secondary' && deviceId === 0) continue;
+
+        const mine = isSelfDevice(deviceJid);
+        const own = mine && typeof targetMe === 'boolean' ? targetMe : null;
+        if (own === false) continue;
+
+        const personalMsg = own === null ? personalFor({ jid: deviceJid, user: d?.user }) : null;
+        if (personalMsg) {
+            const slot = personalByUser.get(d.user) || { message: personalMsg, jids: [] };
+            slot.jids.push(deviceJid);
+            personalByUser.set(d.user, slot);
+            continue;
+        }
 
-    if (messages?.pinInChatMessage || messages?.reactionMessage) {
-        extraAttrs["decrypt-fail"] = "hide";
+        if (!message) continue;
+        let allowed = mode === 'include' ? matchesRules(deviceJid, rules) : !matchesRules(deviceJid, rules);
+        if (own !== null) allowed = own;
+        if (allowed) publicDevices.push(deviceJid);
     }
 
+    const publicRecipients = isGroupOrStatus
+        ? publicDevices.filter((j) => !isHostedLidUser(j) && !isHostedPnUser(j))
+        : publicDevices;
+    const personalGroups = [...personalByUser.values()].map((slot) => ({
+        jids: slot.jids,
+        message: slot.message
+    }));
+    const personalRecipients = personalGroups.flatMap((g) => g.jids);
+
+    await conn.assertSessions([...publicRecipients, ...personalRecipients]);
+
+    /* ---------- enkripsi ---------- */
+    const participantNodes = [];
+    const content = [];
+    let needsIdentity = false;
+    let reportingSource = message;
+
     if (isGroupOrStatus) {
-        let groupData = useCachedGroupMetadata && conn.cachedGroupMetadata ? await conn.cachedGroupMetadata(jid) : undefined;
-        if (!(groupData && Array.isArray(groupData?.participants)) && !isStatus) groupData = await conn.groupMetadata(jid);
-
-        if (groupData?.participants && Array.isArray(target)) {
-            for (const p of groupData.participants) {
-                const pId = p.id || p.jid;
-                const pLid = p.lid;
-                const pPn = p.phoneNumber || p.pn;
-                for (const item of target) {
-                    if (!item) continue;
-                    const decItem = jidDecode(item);
-                    if (!decItem) continue;
-                    const hasDevice = item.includes(":");
-                    const targetDevice = hasDevice ? (decItem.device !== undefined ? decItem.device : 0) : null;
-                    if (
-                        decItem.user === jidDecode(pId)?.user ||
-                        (pLid && decItem.user === jidDecode(pLid)?.user) ||
-                        (pPn && decItem.user === jidDecode(pPn)?.user)
-                    ) {
-                        for (const candidate of [pId, pLid, pPn]) {
-                            const decCand = candidate ? jidDecode(candidate) : null;
-                            if (decCand) {
-                                parsedTargets.push({
-                                    user: decCand.user,
-                                    device: targetDevice,
-                                    server: decCand.server
-                                });
-                            }
-                        }
+        if (message) {
+            const patched = typeof conn.patchMessageBeforeSending === 'function'
+                ? await conn.patchMessageBeforeSending(message)
+                : message;
+            if (Array.isArray(patched)) throw new Boom('Per-jid patching is not supported in groups');
+            reportingSource = patched;
+            const senderKey = createOneShotSenderKey();
+            const skmsg = senderKey.seal(encodeWAMessage(patched));
+
+            if (publicRecipients.length) {
+                const skdm = {
+                    senderKeyDistributionMessage: {
+                        groupId: destinationJid,
+                        axolotlSenderKeyDistributionMessage: senderKey.distribution()
                     }
-                }
+                };
+                const res = await conn.createParticipantNodes(publicRecipients, skdm, baseExtra);
+                participantNodes.push(...res.nodes);
+                needsIdentity ||= res.shouldIncludeDeviceIdentity;
             }
+            content.push({ tag: 'enc', attrs: { v: '2', type: 'skmsg', ...baseExtra }, content: skmsg });
         }
 
-        const participantsList = groupData ? groupData.participants.map((p) => p.id) : [];
-        if (groupData?.ephemeralDuration && groupData.ephemeralDuration > 0) {
-            additionalAttributes = { ...additionalAttributes, expiration: groupData.ephemeralDuration.toString() };
+        const results = await runEncrypt(conn, personalGroups, extraFor);
+        for (const res of results) {
+            if (!res) continue;
+            participantNodes.push(...res.nodes);
+            needsIdentity ||= res.shouldIncludeDeviceIdentity;
         }
-        if (isStatus && statusJidList) participantsList.push(...statusJidList);
-        devices.push(...(await conn.getUSyncDevices(participantsList, !!useUserDevicesCache, false)));
-        if (isGroup) additionalAttributes = { ...additionalAttributes, addressing_mode: groupData?.addressingMode || "lid" };
-
-        const patched = conn.patchMessageBeforeSending ? await conn.patchMessageBeforeSending(message) : message;
-        if (Array.isArray(patched)) throw new Boom("Per-jid patching is not supported in groups");
-        const bytes = encodeWAMessage(patched);
-
-        const chainSeed = crypto.randomBytes(32);
-        const { privateKey: signingKey, publicKey: signingPubKey } = generateSigningKeyPair();
-        const keyId = crypto.randomBytes(4).readUInt32BE(0) & 0x7FFFFFFF;
-
-        const skmsg = encryptGroupMessage(bytes, chainSeed, signingKey, keyId);
-        const skdm = createSKDM(keyId, 0, chainSeed, signingPubKey);
-
-        const senderKeyRecipients = [];
-        const mePnUserDec = jidDecode(meId);
-        const meLidUserDec = meLid ? jidDecode(meLid) : null;
-
-        for (const device of devices) {
-            const deviceJid = device.jid;
-            const isOwnDevice = (jidDecode(deviceJid)?.user === mePnUserDec?.user) || (meLidUserDec && jidDecode(deviceJid)?.user === meLidUserDec?.user);
-
-            let shouldSendRealKey = true;
-            if (mode === "include") {
-                shouldSendRealKey = isMatch(deviceJid, parsedTargets);
-            } else {
-                shouldSendRealKey = !isMatch(deviceJid, parsedTargets);
-            }
+        if (personalGroups.length && !results.some((r) => r?.nodes?.length) && !publicRecipients.length) {
+            throw new Boom(SPR_TEXT.encryptFailed, { statusCode: 500 });
+        }
+    } else {
+        const meDsm = (msg) => ({
+            deviceSentMessage: { destinationJid, message: msg },
+            messageContextInfo: msg?.messageContextInfo
+        });
+        const groups = [];
+        if (message && publicRecipients.length) {
+            groups.push({ jids: publicRecipients, message, dsm: meDsm(message) });
+        }
+        for (const g of personalGroups) groups.push({ ...g, dsm: meDsm(g.message) });
 
-            if (isOwnDevice && typeof targetMe === "boolean") {
-                shouldSendRealKey = targetMe;
-            }
+        const results = await runEncrypt(conn, groups, extraFor);
+        for (const res of results) {
+            if (!res) continue;
+            participantNodes.push(...res.nodes);
+            needsIdentity ||= res.shouldIncludeDeviceIdentity;
+        }
+        if (groups.length && !participantNodes.length) {
+            throw new Boom(SPR_TEXT.encryptFailed, { statusCode: 500 });
+        }
+        if (participantNodes.length) {
+            additionalAttributes = {
+                ...additionalAttributes,
+                phash: generateParticipantHashV2([...publicRecipients, ...personalRecipients])
+            };
+        }
+    }
 
-            const decDev = jidDecode(deviceJid);
-            const dId = decDev?.device !== undefined ? decDev.device : 0;
-            if (deviceMode === "primary" && dId !== 0) shouldSendRealKey = false;
-            if (deviceMode === "secondary" && dId === 0) shouldSendRealKey = false;
+    if (!participantNodes.length && !content.length) {
+        throw new Boom('sPR: tidak ada penerima yang cocok', { statusCode: 400 });
+    }
 
-            if (shouldSendRealKey && !isHostedLidUser(deviceJid) && !isHostedPnUser(deviceJid) && device.device !== 99) {
-                senderKeyRecipients.push(deviceJid);
-            }
-        }
+    if (participantNodes.length) content.unshift({ tag: 'participants', attrs: {}, content: participantNodes });
 
-        const groupParticipantsNodes = [];
+    /* ---------- susun stanza ---------- */
+    const typeSource = message || personalGroups[0]?.message;
+    const stanza = {
+        tag: 'message',
+        attrs: { id: msgId, to: destinationJid, type: stanzaTypeOf(typeSource), ...(additionalAttributes || {}) },
+        content
+    };
 
-        if (senderKeyRecipients.length > 0) {
-            await conn.assertSessions(senderKeyRecipients);
+    if (needsIdentity && creds?.account) {
+        stanza.content.push({ tag: 'device-identity', attrs: {}, content: encodeSignedDeviceIdentity(creds.account, true) });
+    }
 
-            const senderKeyMsg = {
-                senderKeyDistributionMessage: {
-                    groupId: destinationJid,
-                    axolotlSenderKeyDistributionMessage: skdm
-                }
-            };
-            const { nodes: skdmNodes, shouldIncludeDeviceIdentity: s1 } = await conn.createParticipantNodes(senderKeyRecipients, senderKeyMsg);
-            shouldIncludeDeviceIdentity = shouldIncludeDeviceIdentity || s1;
-            groupParticipantsNodes.push(...skdmNodes);
-        }
+    const hasReportingNode = additionalNodes?.some((n) => n.tag === 'reporting');
+    if (message && reportingSource?.messageContextInfo?.messageSecret && shouldIncludeReportingToken(reportingSource) && !hasReportingNode) {
+        const node = await attempt(() =>
+            getMessageReportingToken(encodeWAMessage(reportingSource), reportingSource, {
+                id: msgId,
+                fromMe: true,
+                remoteJid: destinationJid
+            })
+        );
+        if (node) stanza.content.push(node);
+    }
 
-        if (groupParticipantsNodes.length > 0) {
-            binaryNodeContent.push({ tag: "participants", attrs: {}, content: groupParticipantsNodes });
+    if (!isGroupOrStatus) {
+        const tcJid = await attempt(() => resolveTcTokenJid(destinationJid, (pn) => conn.signalRepository?.lidMapping?.getLIDForPN(pn)), destinationJid);
+        const entry = (await attempt(() => conn.authState.keys.get('tctoken', [tcJid]), {}))?.[tcJid];
+        if (entry?.token?.length && !isTcTokenExpired(entry.timestamp)) {
+            stanza.content.push({ tag: 'tctoken', attrs: {}, content: entry.token });
         }
+    }
 
-        binaryNodeContent.push({ tag: "enc", attrs: { v: "2", type: "skmsg", ...extraAttrs }, content: skmsg });
-    } else {
-        let ownId = isLidUser(jid) && meLid ? meLid : meId;
-        const { user: ownUser } = jidDecode(ownId);
-        const targetUserServer = isLidUser(jid) ? "lid" : "s.whatsapp.net";
-        devices.push({ user, device: 0, jid: jidEncode(user, targetUserServer, 0) });
-        if (user !== ownUser) {
-            const ownUserServer = isLidUser(jid) ? "lid" : "s.whatsapp.net";
-            const ownUserForAddressing = isLidUser(jid) && meLid ? jidDecode(meLid).user : jidDecode(meId).user;
-            devices.push({ user: ownUserForAddressing, device: 0, jid: jidEncode(ownUserForAddressing, ownUserServer, 0) });
-        }
-        if (additionalAttributes?.["category"] !== "peer") {
-            devices.length = 0;
-            const senderIdentity = isLidUser(jid) && meLid ? jidEncode(jidDecode(meLid)?.user, "lid", undefined) : jidEncode(jidDecode(meId)?.user, "s.whatsapp.net", undefined);
-            devices.push(...(await conn.getUSyncDevices([senderIdentity, jid], true, false)));
-        }
+    if (additionalNodes?.length) stanza.content.push(...additionalNodes);
 
-        const allRecipients = [];
-        const meRecipients = [];
-        const otherRecipients = [];
-        const mePnUserDec = jidDecode(meId);
-        const meLidUserDec = meLid ? jidDecode(meLid) : null;
-
-        for (const device of devices) {
-            const deviceJid = device.jid;
-            const isExactSenderDevice = deviceJid === meId || (meLid && deviceJid === meLid);
-            if (isExactSenderDevice) continue;
-
-            let shouldSend = true;
-            if (mode === "include") {
-                shouldSend = isMatch(deviceJid, parsedTargets);
-            } else {
-                shouldSend = !isMatch(deviceJid, parsedTargets);
-            }
+    await conn.sendNode(stanza);
+    return msgId;
+}
 
-            const isMe = (device.user === mePnUserDec?.user) || (meLidUserDec && device.user === meLidUserDec?.user);
+export const selectiveRelay = sPR;
 
-            if (isMe && typeof targetMe === "boolean") {
-                shouldSend = targetMe;
-            }
+/* -------------------------------------------------------------------------- */
+/*  Anggota grup (adaptasi readMembers zapo)                                  */
+/* -------------------------------------------------------------------------- */
 
-            const decDev = jidDecode(deviceJid);
-            const dId = decDev?.device !== undefined ? decDev.device : 0;
-            if (deviceMode === "primary" && dId !== 0) shouldSend = false;
-            if (deviceMode === "secondary" && dId === 0) shouldSend = false;
+/**
+ * Baca anggota grup yang layak jadi target: bot tidak dihitung, tanpa duplikat,
+ * admin didahulukan, dipotong sesuai `limit`.
+ */
+export async function getSPRTargets(conn, groupJid, { limit = SPR_LIMITS.targets, exclude = [] } = {}) {
+    const meta = await conn.groupMetadata(groupJid);
+    const creds = conn.authState?.creds;
+    const skip = new Set(
+        [creds?.me?.id, creds?.me?.lid, conn.user?.id, conn.user?.lid, ...exclude].filter(Boolean).map(userOf)
+    );
+
+    const seen = new Set();
+    const members = [];
+    for (const p of meta?.participants || []) {
+        const aliases = participantAliases(p);
+        if (!aliases.length || aliases.some((a) => skip.has(a) || seen.has(a))) continue;
+        aliases.forEach((a) => seen.add(a));
+        members.push(p);
+    }
 
-            if (!shouldSend) continue;
+    const rank = (p) => (p.admin === 'superadmin' ? 0 : p.admin ? 1 : 2);
+    const ordered = [...members].sort((a, b) => rank(a) - rank(b));
+    const targets = ordered.slice(0, Math.max(0, limit));
+    return { meta, targets, total: members.length, overflow: Math.max(0, members.length - targets.length) };
+}
 
-            if (isMe) {
-                meRecipients.push(deviceJid);
-                allRecipients.push(deviceJid);
-            } else {
-                otherRecipients.push(deviceJid);
-                allRecipients.push(deviceJid);
-            }
-        }
+/* -------------------------------------------------------------------------- */
+/*  Foto profil per penerima (adaptasi avatar loader zapo)                    */
+/* -------------------------------------------------------------------------- */
+
+const fetchAvatarBytes = async (url, timeoutMs) => {
+    if (!url) return null;
+    if (avatarBytesCache.has(url)) return avatarBytesCache.get(url);
+    return attempt(async () => {
+        const res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs), headers: { 'User-Agent': 'Mozilla/5.0' } });
+        if (!res.ok) return null;
+        const bytes = Buffer.from(await res.arrayBuffer());
+        return bytes.length ? avatarBytesCache.set(url, bytes) : null;
+    });
+};
 
-        await conn.assertSessions(allRecipients);
-        const [{ nodes: meNodes, shouldIncludeDeviceIdentity: s1 }, { nodes: otherNodes, shouldIncludeDeviceIdentity: s2 }] = await Promise.all([
-            conn.createParticipantNodes(meRecipients, meMsg || message, extraAttrs),
-            conn.createParticipantNodes(otherRecipients, message, extraAttrs, meMsg)
-        ]);
-        participants.push(...meNodes, ...otherNodes);
-        if (meRecipients.length || otherRecipients.length) extraAttrs["phash"] = generateParticipantHashV2([...meRecipients, ...otherRecipients]);
-        shouldIncludeDeviceIdentity = shouldIncludeDeviceIdentity || s1 || s2;
-    }
+const uploadAvatar = async (conn, bytes) => {
+    if (!bytes?.length || typeof conn.waUploadToServer !== 'function') return null;
+    const hash = crypto.createHash('md5').update(bytes).digest('hex');
+    if (avatarMediaCache.has(hash)) return avatarMediaCache.get(hash);
+    return attempt(async () => {
+        const prepared = await prepareWAMessageMedia({ image: bytes }, { upload: conn.waUploadToServer, logger: conn.logger });
+        return prepared?.imageMessage ? avatarMediaCache.set(hash, prepared.imageMessage) : null;
+    });
+};
 
-    if (participants.length) {
-        if (additionalAttributes?.["category"] === "peer") {
-            const peerNode = participants[0]?.content?.[0];
-            if (peerNode) binaryNodeContent.push(peerNode);
-        } else {
-            binaryNodeContent.push({ tag: "participants", attrs: {}, content: participants });
-        }
+const avatarUrlOf = async (conn, person) => {
+    const candidates = [person.id, person.phoneNumber, person.pn, person.lid, person.jid].filter(Boolean);
+    for (const candidate of [...new Set(candidates)]) {
+        const url = await attempt(() => conn.profilePictureUrl(candidate, 'image'));
+        if (url) return url;
     }
+    return null;
+};
 
-    const stanza = {
-        tag: "message",
-        attrs: { id: msgId, to: destinationJid, type: getMessageType(message), ...(additionalAttributes || {}) },
-        content: binaryNodeContent
+/**
+ * Ambil foto profil beberapa orang sekaligus (konkuren, ada budget & hard cap).
+ * @returns Map<user, imageMessage> (kunci: semua alias user orang tsb)
+ */
+export async function loadSPRAvatars(conn, people, {
+    concurrency = SPR_LIMITS.concurrency,
+    budgetMs = SPR_LIMITS.avatarBudgetMs,
+    hardCapMs = SPR_LIMITS.avatarHardCapMs,
+    fetchMs = SPR_LIMITS.avatarFetchMs
+} = {}) {
+    const map = new Map();
+    if (typeof conn.profilePictureUrl !== 'function') return map;
+    const started = Date.now();
+
+    const job = async () => {
+        const rows = await runPool(people, concurrency, async (person) => {
+            if (Date.now() - started > budgetMs) return null;
+            const url = await avatarUrlOf(conn, person);
+            const image = await uploadAvatar(conn, await fetchAvatarBytes(url, fetchMs));
+            return image ? { keys: participantAliases(person), image } : null;
+        });
+        for (const row of rows) {
+            if (row) for (const key of row.keys) map.set(key, row.image);
+        }
+        return map;
     };
 
-    if (shouldIncludeDeviceIdentity) {
-        stanza.content.push({ tag: "device-identity", attrs: {}, content: encodeSignedDeviceIdentity(conn.authState.creds.account, true) });
-    }
+    await withTimeout(attempt(job), hardCapMs, null);
+    return map;
+};
 
-    if (reportingToken && !(additionalNodes && additionalNodes.some((n) => n.tag === "reporting"))) {
-        stanza.content.push({
-            tag: "reporting",
-            attrs: {},
-            content: [
-                {
-                    tag: "reporting_token",
-                    attrs: { v: "2" },
-                    content: reportingToken
-                }
-            ]
-        });
+/* -------------------------------------------------------------------------- */
+/*  Pesan personal (gambar profil + caption + mention)                        */
+/* -------------------------------------------------------------------------- */
+
+const personalMessage = (image, caption, mentions) => {
+    const contextInfo = { mentionedJid: mentions };
+    return image
+        ? { imageMessage: { ...image, caption, contextInfo } }
+        : { extendedTextMessage: { text: caption, contextInfo } };
+};
+
+/* -------------------------------------------------------------------------- */
+/*  sPRPrivate  (setara `!spr publik | privat` di plugin zapo)                */
+/* -------------------------------------------------------------------------- */
+
+/**
+ * Anggota grup lain melihat `publicText`, `targetJid` melihat `privateText`
+ * (dengan foto profilnya sendiri bila `avatar` aktif).
+ */
+export async function sPRPrivate(conn, groupJid, targetJid, {
+    publicText = SPR_TEXT.publicDefault,
+    privateText,
+    avatar = true,
+    mentionTarget = false,
+    ...relayOptions
+} = {}) {
+    if (!isJidGroup(groupJid)) throw new Boom(SPR_TEXT.needGroup, { statusCode: 400 });
+    if (!targetJid) throw new Boom('sPRPrivate: targetJid wajib diisi', { statusCode: 400 });
+    if (!privateText?.trim()) throw new Boom(SPR_TEXT.emptyPrivate, { statusCode: 400 });
+
+    let image = null;
+    if (avatar) {
+        const avatars = await loadSPRAvatars(conn, [{ id: targetJid }]);
+        image = avatars.get(userOf(targetJid)) || null;
     }
+    const mentions = mentionTarget ? [targetJid] : [];
 
-    const contactTcTokenData = !isGroup && !isStatus ? await conn.authState.keys.get("tctoken", [destinationJid]) : {};
-    const tcTokenBuffer = contactTcTokenData[destinationJid]?.token;
-    if (tcTokenBuffer) stanza.content.push({ tag: "tctoken", attrs: {}, content: tcTokenBuffer });
+    const id = await sPR(conn, groupJid, { extendedTextMessage: { text: publicText, contextInfo: { mentionedJid: [] } } }, {
+        ...relayOptions,
+        personal: new Map([[targetJid, personalMessage(image, privateText, mentions)]])
+    });
+    return { id, avatar: !!image };
+}
 
-    if (additionalNodes && additionalNodes.length > 0) stanza.content.push(...additionalNodes);
+/* -------------------------------------------------------------------------- */
+/*  sPRBroadcast  (setara `!sbpr` / `!sbrp`)                                   */
+/* -------------------------------------------------------------------------- */
 
-    await conn.sendNode(stanza);
+/**
+ * Kirim pesan yang dipersonalisasi ke tiap anggota: `{name}` jadi @mention
+ * orang itu, lengkap dengan foto profilnya. Anggota di luar batas `limit`
+ * melihat `publicText`.
+ */
+export async function sPRBroadcast(conn, groupJid, {
+    template = SPR_TEXT.templateDefault,
+    publicText,
+    limit = SPR_LIMITS.targets,
+    exclude = [],
+    avatar = true,
+    ...relayOptions
+} = {}) {
+    if (!isJidGroup(groupJid)) throw new Boom(SPR_TEXT.needGroup, { statusCode: 400 });
+    const info = await getSPRTargets(conn, groupJid, { limit, exclude });
+    if (!info.targets.length) throw new Boom(SPR_TEXT.noTarget, { statusCode: 400 });
+
+    const text = template || SPR_TEXT.templateDefault;
+    const hasSlot = text.includes('{name}');
+    const avatars = avatar ? await loadSPRAvatars(conn, info.targets) : new Map();
+
+    const personal = new Map();
+    let withAvatar = 0;
+    for (const person of info.targets) {
+        const id = person.id || person.jid;
+        const anchor = `@${userOf(id)}`;
+        const caption = hasSlot ? text.replaceAll('{name}', anchor) : `${anchor} ${text}`;
+        const image = avatars.get(userOf(id)) || null;
+        if (image) withAvatar++;
+        personal.set(id, personalMessage(image, caption, [id]));
+    }
 
-    return msgId;
+    const pub = publicText || text.replaceAll('{name}', 'semua');
+    const id = await sPR(conn, groupJid, { extendedTextMessage: { text: pub, contextInfo: { mentionedJid: [] } } }, {
+        ...relayOptions,
+        personal
+    });
+
+    return { id, targets: info.targets.length, total: info.total, overflow: info.overflow, withAvatar };
 }
 
-export const selectiveRelay = sPR;
 export default sPR;