whalibmob 5.5.89 → 5.5.93

package/README.md

@@ -1323,8 +1323,10 @@ const [def, ...rest] = await client.queryStatusPrivacy()
 except `list`, `whitelist` to `list` only. Your own JID is always included so
 the post reaches your other devices.
 
-If history has not synced yet the contact list is unknown, and `sendStatus`
-will say so rather than post to nobody — pass `recipients` in that case.
+Recipients are taken from the named contacts history sync brought; when there
+are none, the people you have chats with stand in. If neither is known,
+`sendStatus` says so rather than posting a message no one holds the key for —
+pass `recipients` in that case.
 
 ## Send States in Chat
 
@@ -1495,6 +1497,9 @@ await client.changeGroupPicture('120363000000000000@g.us', fs.readFileSync('./gr
 const blocked = await client.blockContact('919634847671@s.whatsapp.net')
 await client.unblockContact('919634847671@s.whatsapp.net')
 
+// the block list is addressed by LID; a phone number is resolved to one first,
+// looking it up if it is not already known
+
 // blocking done from the phone arrives as an event
 client.on('blocklist', ({ changes }) => console.log(changes))
 ```

package/lib/Client.js

@@ -1099,6 +1099,69 @@ class WhalibmobClient extends EventEmitter {
     return base;
   }
 
+  // The key a privacy token is stored and looked up under.
+  //
+  // Both references resolve it to the contact's LID and fall back to the plain
+  // JID only when no LID is known — whatsmeow's resolveTCTokenStorageLID and
+  // Baileys' resolveTcTokenJid are the same three lines:
+  //
+  //     if (isLidUser(jid)) return jid
+  //     const lid = await getLIDForPN(jid)
+  //     return lid ?? jid
+  //
+  // whalibmob resolved it on the receiving side but not on the sending side,
+  // which put the two halves out of step: a token a contact issued us arrived
+  // on a privacy_token notification and was filed under their LID, while every
+  // send looked it up under their phone JID and found nothing. The token was
+  // therefore never attached to anything, and the server kept counting our
+  // messages as anonymous reach-outs — which is what error 463 is.
+  _resolveTcTokenJid(jid) {
+    const { normalizeJidForTcToken } = require('./messages/TcTokenStore');
+    const norm = normalizeJidForTcToken(jid);
+    if (norm.endsWith('@lid')) return norm;
+    const lidUser = this._pnToLid && this._pnToLid.get(norm.split('@')[0]);
+    return lidUser ? lidUser + '@lid' : norm;
+  }
+
+  // The JID a token is *issued* to, which is not the JID it is *stored* under.
+  //
+  // Storage is always the LID. Issuance follows AB prop 14303
+  // (lid_trusted_token_issue_to_lid), whose WA Web default is off — so the IQ
+  // names the phone JID. Baileys implements exactly this in resolveIssuanceJid
+  // and defaults the prop to false; whatsmeow issues to the LID instead. We
+  // follow WA Web, and more importantly we now follow it in one place: the
+  // send path, the 463 recovery and the post-identity-change re-issue used to
+  // each pick a different address family for the same contact.
+  _resolveTcTokenIssuanceJid(jid) {
+    const { normalizeJidForTcToken } = require('./messages/TcTokenStore');
+    const norm = normalizeJidForTcToken(jid);
+    if (!norm.endsWith('@lid')) return norm;
+    const pnUser = this._lidToPn && this._lidToPn.get(norm.split('@')[0]);
+    return pnUser ? pnUser + '@s.whatsapp.net' : norm;
+  }
+
+  // The one way to read a token that is safe to put on the wire.
+  //
+  // whatsmeow funnels every attach site through ensureTCToken, which returns
+  // nothing for an expired token. whalibmob had the expiry check on the message
+  // path only; presence subscribe, group create, participant add and the
+  // profile-picture query each tested `token.length` and nothing else, so once
+  // a token aged past the 28-day window those four kept sending it. Same rule
+  // everywhere now, and the dead token gets cleared on the way out.
+  _tcTokenFor(jid) {
+    if (!this._tcTokenStore) return null;
+    const { tcTokenExpired } = require('./messages/TcTokenStore');
+    const tcJid = this._resolveTcTokenJid(jid);
+    const entry = this._tcTokenStore.get(tcJid);
+    if (!entry || !entry.token || !entry.token.length) return null;
+    if (tcTokenExpired(entry.timestamp)) {
+      this._tcTokenStore.clearToken(tcJid);
+      _whaDbg('[DBG] TCTOKEN_EXPIRED jid=' + tcJid + ' — cleared');
+      return null;
+    }
+    return entry.token;
+  }
+
   // True when a JID names this account, in either address family.
   _isOwnUser(jid) {
     if (!jid) return false;
@@ -1953,6 +2016,7 @@ class WhalibmobClient extends EventEmitter {
   _storeTcTokenFromIqResult(result, fallbackJid, issueTs, opts) {
     const saveSenderTs = !opts || opts.saveSenderTs !== false; // default true
     if (!this._tcTokenStore) return;
+    const { isRegularTcTokenUser } = require('./messages/TcTokenStore');
 
     // ── Debug: dump result structure so we can trace server response ─────────
     if (!result) {
@@ -2002,10 +2066,21 @@ class WhalibmobClient extends EventEmitter {
           // → always prefer fallbackJid; only fall back to a.jid when fallbackJid is absent
           const jid = fallbackJid || String(a.jid);
           const t   = a.t   ? parseInt(String(a.t), 10) : issueTs;
+          // Baileys drops anything that is not a regular user here — the guard
+          // is against a malformed or spoofed notification filing a token under
+          // the PSA account or a bot.
+          if (!isRegularTcTokenUser(jid)) {
+            _whaDbg('[DBG] STORE_TCTOKEN skipped non-user jid=' + jid);
+            continue;
+          }
           if (bytes && bytes.length) {
-            this._tcTokenStore.setToken(jid, bytes, t);
-            tokenStoredCount++;
-            _whaDbg('[DBG] TCTOKEN_STORED jid=' + jid + ' t=' + t + ' len=' + bytes.length);
+            // setToken refuses a timestamp-less or older-than-stored token.
+            if (this._tcTokenStore.setToken(jid, bytes, t)) {
+              tokenStoredCount++;
+              _whaDbg('[DBG] TCTOKEN_STORED jid=' + jid + ' t=' + t + ' len=' + bytes.length);
+            } else {
+              _whaDbg('[DBG] STORE_TCTOKEN rejected (no/older timestamp) jid=' + jid + ' t=' + t);
+            }
           } else {
             _whaDbg('[DBG] STORE_TCTOKEN token node has no bytes jid=' + jid);
           }
@@ -2021,7 +2096,9 @@ class WhalibmobClient extends EventEmitter {
     // ── we flood the server with privacy IQs.                            ─────
     // ── For incoming privacy_token notifications saveSenderTs=false so  ─────
     // ── we don't overwrite our own send-dedupe timestamp with the peer's ─────
-    if (saveSenderTs && issueTs != null) {
+    // Same user gate as the token itself — no dedupe row for the PSA account
+    // or a bot, since we never issue to them in the first place.
+    if (saveSenderTs && issueTs != null && isRegularTcTokenUser(fallbackJid)) {
       try {
         this._tcTokenStore.setSenderTimestamp(fallbackJid, issueTs);
         _whaDbg('[DBG] SENDER_TS_SAVED jid=' + fallbackJid + ' ts=' + issueTs +
@@ -2081,11 +2158,9 @@ class WhalibmobClient extends EventEmitter {
       // from = LID_USER@s.whatsapp.net — WA sends LID notifications this way.
       // The user part is already the LID user; convert domain to @lid.
       storageJid = fromUser + '@lid';
-    } else if (this._pnToLid && this._pnToLid.has(fromUser)) {
-      // from is a PN → convert to LID for storage (Baileys always stores under LID)
-      storageJid = this._pnToLid.get(fromUser) + '@lid';
     } else {
-      storageJid = normalizeJidForTcToken(rawFrom);
+      // Same resolver the send side uses, so both halves agree on the key.
+      storageJid = this._resolveTcTokenJid(rawFrom);
     }
 
     _whaDbg('[DBG] PRIVACY_TOKEN_NOTIF storageJid=' + storageJid);
@@ -2112,11 +2187,7 @@ class WhalibmobClient extends EventEmitter {
 
     void (async () => {
       try {
-        // Resolve storage JID: PN→LID if available, otherwise use from as-is
-        const fromNorm = normalizeJidForTcToken(from);
-        const fromUser = fromNorm.split('@')[0];
-        const lidUser  = this._pnToLid && this._pnToLid.get(fromUser);
-        const tcJid    = lidUser ? (lidUser + '@lid') : fromNorm;
+        const tcJid = this._resolveTcTokenJid(from);
 
         const entry    = this._tcTokenStore.get(tcJid);
         const senderTs = entry && entry.senderTimestamp;
@@ -2128,9 +2199,15 @@ class WhalibmobClient extends EventEmitter {
         _whaDbg('[DBG] REISSUE_TC_TOKEN_AFTER_IDENTITY_CHANGE jid=' + tcJid +
           ' prevSenderTs=' + senderTs);
 
-        const issueTs = Math.floor(Date.now() / 1000);
-        const result  = await this._issuePrivacyTokens(tcJid, issueTs);
-        this._storeTcTokenFromIqResult(result, tcJid, issueTs);
+        // Baileys re-issues with the *previous* senderTimestamp, not a fresh
+        // one, and stores the result without touching the dedupe state. That
+        // matters: this is a repair of an existing grant after the peer's
+        // device changed, not a new grant, so it must not move the 7-day
+        // bucket that governs regular issuance. We were stamping it with
+        // Date.now(), which silently skipped the next scheduled issuance.
+        const issueJid = this._resolveTcTokenIssuanceJid(from);
+        const result   = await this._issuePrivacyTokens(issueJid, senderTs);
+        this._storeTcTokenFromIqResult(result, tcJid, senderTs, { saveSenderTs: false });
       } catch (e) {
         _whaDbg('[DBG] REISSUE_TC_TOKEN_ERR from=' + from +
           ' err=' + (e && e.message));
@@ -2539,15 +2616,13 @@ class WhalibmobClient extends EventEmitter {
   subscribeToPresence(jids) {
     if (!this._socket || !this._connected) return;
     const arr = Array.isArray(jids) ? jids : [jids];
-    const { normalizeJidForTcToken } = require('./messages/TcTokenStore');
+    const { isRegularTcTokenUser } = require('./messages/TcTokenStore');
     for (const raw of arr) {
       const jid   = makeJid(raw);
-      const entry = this._tcTokenStore && this._tcTokenStore.get(
-        normalizeJidForTcToken(jid)
-      );
-      const children = (entry && entry.token && entry.token.length)
-        ? [new BinaryNode('tctoken', {}, entry.token)]
-        : null;
+      // Groups and newsletters have no privacy token; Baileys guards the same
+      // way before building the node.
+      const token = isRegularTcTokenUser(jid) ? this._tcTokenFor(jid) : null;
+      const children = token ? [new BinaryNode('tctoken', {}, token)] : null;
       this._socket.sendNode(new BinaryNode('presence', {
         to:   jidStrToObj(jid),
         type: 'subscribe'
@@ -2682,12 +2757,8 @@ class WhalibmobClient extends EventEmitter {
       iqAttrs = { id: this._genMsgId(), xmlns: 'w:g2', to: jidStrToObj(jidFull), type: 'get' };
       content = [new BinaryNode('pictures', {}, [new BinaryNode('picture', attrs, null)])];
     } else {
-      const { normalizeJidForTcToken } = require('./messages/TcTokenStore');
-      const entry = this._tcTokenStore &&
-        this._tcTokenStore.get(normalizeJidForTcToken(jidFull));
-      const picChildren = (entry && entry.token && entry.token.length)
-        ? [new BinaryNode('tctoken', {}, entry.token)]
-        : null;
+      const picToken    = this._tcTokenFor(jidFull);
+      const picChildren = picToken ? [new BinaryNode('tctoken', {}, picToken)] : null;
       iqAttrs = {
         id:     this._genMsgId(),
         xmlns:  'w:profile:picture',
@@ -3007,26 +3078,39 @@ class WhalibmobClient extends EventEmitter {
     }
 
     const ownJid = String(this._store.phoneNumber) + '@s.whatsapp.net';
-    let recipients;
+    let recipients, source;
 
     if (privacy.type === 'whitelist') {
       recipients = privacy.list.slice();
+      source = 'whitelist';
     } else {
-      const hist = this.getHistoryStore();
-      const contacts = (hist && hist.contacts) ? Object.keys(hist.contacts) : [];
-      // Only real contacts — an entry the history sync created purely to hold a
-      // push name is not somebody you have in your address book.
-      const named = contacts.filter(jid => {
+      const hist = this.getHistoryStore() || {};
+      const isPerson = (jid) => !jid.endsWith('@g.us') && !jid.endsWith('@broadcast') &&
+        !jid.endsWith('@newsletter') && !this._isOwnUser(jid);
+
+      // Contacts proper: entries the history sync gave a name to.
+      const contacts = Object.keys(hist.contacts || {}).filter(jid => {
         const c = hist.contacts[jid];
-        return c && (c.name || c.displayName) && !jid.endsWith('@g.us') &&
-          !jid.endsWith('@broadcast');
+        return c && (c.name || c.displayName) && isPerson(jid);
       });
+
+      // A named contact list is what WhatsApp itself posts to. When history has
+      // not brought one — a fresh session, or a sync that carried chats without
+      // names — the people you actually have conversations with are the next
+      // best thing, and far better than posting to nobody.
+      let pool = contacts;
+      source = 'contacts';
+      if (pool.length === 0) {
+        pool = Object.keys(hist.chats || {}).filter(isPerson);
+        source = 'chats';
+      }
+
       const blocked = new Set(privacy.type === 'blacklist' ? privacy.list : []);
-      recipients = named.filter(jid => !blocked.has(jid));
+      recipients = pool.filter(jid => !blocked.has(jid));
     }
 
     if (!recipients.some(j => this._isOwnUser(j))) recipients.push(ownJid);
-    _whaDbg('[DBG] STATUS_RECIPIENTS type=' + privacy.type +
+    _whaDbg('[DBG] STATUS_RECIPIENTS type=' + privacy.type + ' source=' + source +
       ' count=' + recipients.length);
     return recipients;
   }
@@ -3509,27 +3593,71 @@ class WhalibmobClient extends EventEmitter {
     return this._updateBlocklist(jid, 'unblock');
   }
 
-  // The one IQ behind both, as whatsmeow's UpdateBlocklist sends it:
+  // Work out the LID a block list item has to be addressed with, and the phone
+  // JID that goes beside it.
+  //
+  // The server only accepts LID-addressed items on a LID account: a phone JID
+  // comes back as <error code="400" text="bad-request" addressing_mode="lid"/>,
+  // the attribute being the server saying which addressing it wanted. When the
+  // mapping is not known yet a contact usync fetches it.
+  async _resolveBlockTarget(jid) {
+    const norm = toNonAdJid(makeJid(jid));
+    const user = norm.split('@')[0];
+
+    if (norm.endsWith('@lid')) {
+      const pn = this._lidToPn.get(user);
+      return { lid: norm, pn: pn ? pn + '@s.whatsapp.net' : null };
+    }
+
+    let lidUser = this._pnToLid.get(user);
+    if (!lidUser && this._devMgr) {
+      _whaDbg('[DBG] BLOCK_LID_LOOKUP ' + user);
+      try { await this._devMgr._doContactUsync([user]); } catch (_) {}
+      lidUser = this._pnToLid.get(user);
+    }
+    return { lid: lidUser ? lidUser + '@lid' : null, pn: norm };
+  }
+
+  // The one IQ behind both:
   //
   //   <iq xmlns="blocklist" type="set" to="s.whatsapp.net">
-  //     <item jid="<JID>" action="block|unblock"/>
+  //     <item action="block" jid="<LID>" pn_jid="<phone JID>"/>
   //   </iq>
   //
-  // Three things were wrong with the pair this replaces. The jid went out as a
-  // raw string rather than a binary JID. It was not reduced to its bare user
-  // first, so blocking a contact you happened to name with a device suffix sent
-  // the server a device JID it has nothing to block. And the reply was thrown
-  // away without being looked at — including a type="error" reply — so a block
-  // the server refused came back looking exactly like one that worked.
+  // The item is addressed by LID, and a block carries the phone number beside
+  // it; an unblock carries only the LID. That is the shape Baileys'
+  // updateBlockStatus builds, and the one this server accepts — whatsmeow's
+  // UpdateBlocklist still sends the plain JID it was handed, which is what this
+  // used to do and what the server answered with 400 bad-request.
+  //
+  // Three other things were wrong with the pair this replaces. The jid went out
+  // as a raw string rather than a binary JID. It was not reduced to its bare
+  // user first, so naming a contact with a device suffix sent a device JID
+  // there is nothing to block. And the reply was thrown away without being
+  // looked at, so a refusal came back looking exactly like a success.
   async _updateBlocklist(jid, action) {
-    const target = toNonAdJid(makeJid(jid));
+    const { lid, pn } = await this._resolveBlockTarget(jid);
+    if (!lid) {
+      throw new Error(action + 'Contact: could not resolve a LID for ' + jid +
+        ' — the server only accepts LID-addressed block list items. ' +
+        'Check the number is on WhatsApp.');
+    }
+    const attrs = { action, jid: jidStrToObj(lid) };
+    if (action === 'block') {
+      if (!pn) {
+        throw new Error('blockContact: no phone number known for ' + lid +
+          ' — a block has to carry pn_jid beside the LID.');
+      }
+      attrs.pn_jid = jidStrToObj(pn);
+    }
+
     const node = new BinaryNode('iq', {
       id:    this._genMsgId(),
       xmlns: 'blocklist',
       to:    's.whatsapp.net',
       type:  'set'
     }, [
-      new BinaryNode('item', { jid: jidStrToObj(target), action }, null)
+      new BinaryNode('item', attrs, null)
     ]);
 
     const resp = await this._sendIq(node);
@@ -3712,7 +3840,6 @@ class WhalibmobClient extends EventEmitter {
   async createGroup(subject, participants, opts) {
     opts = opts || {};
     const id       = this._genMsgId();
-    const { normalizeJidForTcToken } = require('./messages/TcTokenStore');
     // participant nodes MUST use attr `jid`, not `value`
     const partNodes = (participants || []).map(p => {
       const jid   = makeJid(p);
@@ -3721,11 +3848,8 @@ class WhalibmobClient extends EventEmitter {
         const pn = this._lidToPn.get(jid.split('@')[0].split(':')[0]);
         if (pn) attrs.phone_number = jidStrToObj(pn + '@s.whatsapp.net');
       }
-      const entry = this._tcTokenStore &&
-        this._tcTokenStore.get(normalizeJidForTcToken(jid));
-      const children = (entry && entry.token && entry.token.length)
-        ? [new BinaryNode('privacy', {}, entry.token)]
-        : null;
+      const token    = this._tcTokenFor(jid);
+      const children = token ? [new BinaryNode('privacy', {}, token)] : null;
       return new BinaryNode('participant', attrs, children);
     });
 
@@ -3832,7 +3956,6 @@ class WhalibmobClient extends EventEmitter {
   async _groupParticipantAction(groupJid, action, jids) {
     const gJid = makeJid(groupJid);
     const arr  = Array.isArray(jids) ? jids : [jids];
-    const { normalizeJidForTcToken } = require('./messages/TcTokenStore');
     // Same shape whatsmeow's UpdateGroupParticipants builds: binary JIDs, and on
     // an add, the phone number behind a LID plus our privacy token for them.
     const participantNodes = arr.map(j => {
@@ -3844,11 +3967,8 @@ class WhalibmobClient extends EventEmitter {
           const pn = this._lidToPn.get(jid.split('@')[0].split(':')[0]);
           if (pn) attrs.phone_number = jidStrToObj(pn + '@s.whatsapp.net');
         }
-        const entry = this._tcTokenStore &&
-          this._tcTokenStore.get(normalizeJidForTcToken(jid));
-        if (entry && entry.token && entry.token.length) {
-          children = [new BinaryNode('privacy', {}, entry.token)];
-        }
+        const token = this._tcTokenFor(jid);
+        if (token) children = [new BinaryNode('privacy', {}, token)];
       }
       return new BinaryNode('participant', attrs, children);
     });

package/lib/messages/MessageSender.js

@@ -23,7 +23,8 @@ const {
 } = require('../proto/MessageProto');
 const { uploadMedia } = require('../MediaService');
 const { imageThumbnail, videoThumbnail, probeImageSize } = require('../MediaThumbnail');
-const { tcTokenExpired, shouldSendNewTcToken, normalizeJidForTcToken } = require('./TcTokenStore');
+const { tcTokenExpired, shouldSendNewTcToken, normalizeJidForTcToken,
+        isRegularTcTokenUser } = require('./TcTokenStore');
 
 // ─── Helpers ──────────────────────────────────────────────────────────────────
 
@@ -1014,7 +1015,10 @@ class MessageSender {
     // event. Once enough accumulate the server returns error 463 (timelock).
     // We attach the stored trusted-contact token when one exists and is valid.
     const tcStore = this._client._tcTokenStore;
-    const tcJid   = normalizeJidForTcToken(routingToJid);
+    // Keyed by the contact's LID, which is where a token they issued us was
+    // filed when it arrived. Looking it up by the phone JID — which is what
+    // this did — never found one, so nothing was ever attached.
+    const tcJid   = this._client._resolveTcTokenJid(routingToJid);
     if (tcStore) {
       const tcEntry = tcStore.get(tcJid);
       if (tcEntry && tcEntry.token && tcEntry.token.length) {
@@ -1078,11 +1082,23 @@ class MessageSender {
     // for this JID (one issuance per 7-day bucket is enough).  The token is
     // stored and attached on future sends so the server does not count them
     // as anonymous "reaching out" events (which would trigger error 463).
-    if (tcStore && tcStore.shouldIssue(tcJid) &&
+    //
+    // Two targets never get one. WhatsApp's own announcement account
+    // (0@s.whatsapp.net) and the bot numbers, including Meta AI, are not
+    // contacts you can be "timelocked" against, and no real client issues to
+    // them — whatsmeow gates on shouldSendTCTokenInChatAction, Baileys on
+    // isBotOrPSA. Protocol messages (a revoke, an ephemeral-timer change) are
+    // out too: Baileys skips issuance for them because they are bookkeeping,
+    // not a reach-out. Attaching an existing token to them is still correct
+    // and still happens above — this only governs asking for a new one.
+    const isProtocolMsg = !!(options && options._protocol);
+    if (tcStore && isRegularTcTokenUser(tcJid) && !isProtocolMsg &&
+        tcStore.shouldIssue(tcJid) &&
         !this._client._inFlightTcTokenIssuance.has(tcJid)) {
       this._client._inFlightTcTokenIssuance.add(tcJid);
-      const issueTs = Math.floor(Date.now() / 1000);
-      this._client._issuePrivacyTokens(routingToJid, issueTs)
+      const issueTs  = Math.floor(Date.now() / 1000);
+      const issueJid = this._client._resolveTcTokenIssuanceJid(routingToJid);
+      this._client._issuePrivacyTokens(issueJid, issueTs)
         .then(result => this._client._storeTcTokenFromIqResult(result, tcJid, issueTs))
         .catch(() => {})
         .finally(() => this._client._inFlightTcTokenIssuance.delete(tcJid));
@@ -1110,10 +1126,17 @@ class MessageSender {
         (typeof this._client._getStatusRecipients === 'function'
           ? await this._client._getStatusRecipients()
           : []);
-      if (!members.length) {
+      // Our own JID is always in the list so the post reaches our own devices,
+      // so a list of length one means there is nobody else on it. Counting the
+      // raw list let that through: the walk below then dropped us as the
+      // sender, left no targets, and the stanza went out as a bare skmsg with
+      // no <participants> — a SenderKey message nobody holds the key for, which
+      // the server answers with ack 479.
+      const others = members.filter(jid => !this._client._isOwnUser(jid));
+      if (others.length === 0) {
         throw new Error(
-          'Cannot post a Status: no recipients. Sync history so the contact ' +
-          'list is known, or pass { recipients: [...] }.'
+          'Cannot post a Status: it would reach nobody. The contact list is ' +
+          'empty — sync history first, or pass { recipients: [...] }.'
         );
       }
     }
@@ -1258,6 +1281,16 @@ class MessageSender {
     if (myLidUser) selfAddrs.add(adString(`${myLidUser}@lid`));
     const allTargets = enumeratedDevices.filter(jid => !selfAddrs.has(adString(jid)));
 
+    // Whatever the member list said, if nothing came back with a session there
+    // is no one to hand the SenderKey to and the skmsg below is undeliverable.
+    // Better to say so than to emit it and read the 479 back.
+    if (isStatus && allTargets.length === 0) {
+      throw new Error(
+        'Cannot post a Status: no Signal session could be opened with any ' +
+        'recipient, so the post would reach nobody.'
+      );
+    }
+
     const skStore        = this._signal.senderKeyStore;
     const existingSkdmMap = skStore.getSKDMMap(groupJid);
     // Same exclusions Baileys applies when choosing SenderKey recipients:
@@ -1411,7 +1444,7 @@ class MessageSender {
           // concurrent 463 recoveries and proactive issuances don't clash.
           if (error === '463' && !_isRetry) {
             const ackFrom = ackAttrs.from ? String(ackAttrs.from) : '';
-            const tcJid   = normalizeJidForTcToken(
+            const tcJid   = client._resolveTcTokenJid(
               ackFrom || String(node.attrs && node.attrs.to || '')
             );
             _whaDbg('[DBG] ACK_463 from=' + ackFrom + ' id=' + id +
@@ -1439,7 +1472,13 @@ class MessageSender {
             client._inFlight463Recoveries.add(tcJid);
             const issueTs = Math.floor(Date.now() / 1000);
 
-            client._issuePrivacyTokens(ackFrom || tcJid, issueTs)
+            // Same address family as every other issuance path — see
+            // Client._resolveTcTokenIssuanceJid. This used to hand the server
+            // whatever the ack happened to carry.
+            const issueJid = client._resolveTcTokenIssuanceJid(
+              ackFrom || String(node.attrs && node.attrs.to || '')
+            );
+            client._issuePrivacyTokens(issueJid, issueTs)
               .then(result => client._storeTcTokenFromIqResult(result, tcJid, issueTs))
               .then(() => {
                 // Verify that real token bytes were received from the server.
@@ -1540,7 +1579,9 @@ class MessageSender {
     const msgBuf = encodeMessage('protocol', revokePayload);
     // ProtocolMessage is one of the explicit "text" cases in whatsmeow's
     // getTypeFromMessage; there is no "protocol" stanza type.
-    return this._sendMessage(toJid, msgId, msgBuf, 'text', { ...opts, edit: editBit });
+    // _protocol marks it for the tcToken issuance gate — see _sendDMMessage.
+    return this._sendMessage(toJid, msgId, msgBuf, 'text',
+      { ...opts, edit: editBit, _protocol: true });
   }
 
   // ─── Ephemeral timer DM ───────────────────────────────────────────────────
@@ -1555,7 +1596,7 @@ class MessageSender {
       ephemeralExpiration:  seconds
     });
     const msgBuf = encodeMessage('protocol', payload);
-    return this._sendMessage(toJid, msgId, msgBuf, 'text', opts);
+    return this._sendMessage(toJid, msgId, msgBuf, 'text', { ...opts, _protocol: true });
   }
 
   // ─── Utility: mark read, presence, receipt, ping ─────────────────────────

package/lib/messages/TcTokenStore.js

@@ -6,6 +6,14 @@ const path = require('path');
 // 7-day buckets, 4 buckets = ~28-day rolling window (matches Baileys tc-token-utils)
 const TC_BUCKET_DURATION = 604800;
 const TC_NUM_BUCKETS     = 4;
+// whatsmeow prunes expired rows out of the token table at most once a day
+// (tcTokenDBPruneInterval). Ours is a JSON file, so the same cadence applies.
+const TC_PRUNE_INTERVAL_MS = 24 * 60 * 60 * 1000;
+
+// The two phone-number ranges WhatsApp uses for bots, including Meta AI.
+// Byte-for-byte the same expression in whatsmeow (botUserRegex) and in
+// Baileys (BOT_PHONE_REGEX).
+const BOT_USER_RE = /^1313555\d{4}$|^131655500\d{2}$/;
 
 function tcTokenExpired(timestamp) {
   if (timestamp == null) return true;
@@ -25,6 +33,26 @@ function shouldSendNewTcToken(senderTimestamp) {
   return curBucket > senderBucket;
 }
 
+// Whether a JID is a real person we may hold a trusted-contact token for.
+//
+// whatsmeow gates issuance with shouldSendTCTokenInChatAction and Baileys gates
+// both issuance and storage with isRegularUser; the two agree on the rule:
+// a user address (phone or LID), not the PSA pseudo-contact 0@…, not a bot.
+// Without it we issue a privacy IQ to WhatsApp's own announcement account and
+// to Meta AI, which no real client ever does.
+function isRegularTcTokenUser(jid) {
+  if (!jid) return false;
+  const norm   = normalizeJidForTcToken(jid);
+  const atIdx  = norm.indexOf('@');
+  if (atIdx < 0) return false;
+  const user   = norm.slice(0, atIdx);
+  const server = norm.slice(atIdx + 1);
+  if (server !== 's.whatsapp.net' && server !== 'c.us' && server !== 'lid') return false;
+  if (user === '0') return false;              // PSA
+  if (BOT_USER_RE.test(user)) return false;    // bots, Meta AI
+  return true;
+}
+
 // Strip device part and normalize to bare JID
 function normalizeJidForTcToken(jid) {
   if (!jid) return String(jid || '');
@@ -43,7 +71,36 @@ class TcTokenStore {
     this._path = filePath;
     // jid → { token: Buffer|null, timestamp: number|null, senderTimestamp: number|null }
     this._map  = new Map();
+    this._lastPrune = 0;
     this._load();
+    this.pruneExpired();
+  }
+
+  // Drop entries that are past the 28-day window on both counts.
+  //
+  // whatsmeow runs DeleteExpiredPrivacyTokens against the same cutoff and lets
+  // its in-memory sender-timestamp map age out on the same boundary. An entry
+  // whose token has expired but whose senderTimestamp is still inside the
+  // window has to stay: that timestamp is what keeps us from re-issuing on
+  // every single send.
+  pruneExpired() {
+    let removed = 0;
+    for (const [jid, entry] of this._map) {
+      const tokenDead  = !entry.token || !entry.token.length || tcTokenExpired(entry.timestamp);
+      const senderDead = tcTokenExpired(entry.senderTimestamp);
+      if (tokenDead && senderDead) {
+        this._map.delete(jid);
+        removed++;
+      }
+    }
+    this._lastPrune = Date.now();
+    if (removed) this._save();
+    return removed;
+  }
+
+  _maybePrune() {
+    if (Date.now() - this._lastPrune < TC_PRUNE_INTERVAL_MS) return;
+    this.pruneExpired();
   }
 
   _load() {
@@ -77,14 +134,36 @@ class TcTokenStore {
   }
 
   get(jid) {
+    // whatsmeow prunes from ensureTCToken, i.e. on the read path, rate-limited
+    // to once a day. Same here.
+    this._maybePrune();
     return this._map.get(normalizeJidForTcToken(jid)) || null;
   }
 
+  // Returns true when the token was accepted.
+  //
+  // Two rejections, both taken from Baileys' storeTcTokensFromIqResult:
+  //  - a token with no timestamp is already expired by definition, so storing
+  //    it only wastes a slot and guarantees a miss on the next send;
+  //  - a token older than the one on file must never overwrite it. Token
+  //    deliveries are not ordered — an issuance result and a privacy_token
+  //    notification for the same contact can land in either order — so without
+  //    this a stale copy can replace a fresh one.
   setToken(jid, tokenBuf, timestamp) {
     const key      = normalizeJidForTcToken(jid);
-    const existing = this._map.get(key) || {};
-    this._map.set(key, { ...existing, token: tokenBuf, timestamp });
+    const incoming = timestamp != null ? Number(timestamp) : 0;
+    if (!incoming || isNaN(incoming)) return false;
+
+    const existing   = this._map.get(key) || {};
+    const existingTs = existing.timestamp != null ? Number(existing.timestamp) : 0;
+    if (existingTs > 0 && existingTs > incoming &&
+        existing.token && existing.token.length) {
+      return false;
+    }
+
+    this._map.set(key, { ...existing, token: tokenBuf, timestamp: incoming });
     this._save();
+    return true;
   }
 
   clearToken(jid) {
@@ -113,4 +192,12 @@ class TcTokenStore {
   }
 }
 
-module.exports = { TcTokenStore, tcTokenExpired, shouldSendNewTcToken, normalizeJidForTcToken };
+module.exports = {
+  TcTokenStore,
+  tcTokenExpired,
+  shouldSendNewTcToken,
+  normalizeJidForTcToken,
+  isRegularTcTokenUser,
+  TC_BUCKET_DURATION,
+  TC_NUM_BUCKETS
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.5.89",
+  "version": "5.5.93",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",