whalibmob 5.9.1 → 5.9.2

package/lib/Client.js

@@ -51,8 +51,8 @@ const CALL_VIDEO_PREFIX = 'https://call.whatsapp.com/video/';
 const INVITE_LINK_PREFIX = 'https://chat.whatsapp.com/';
 
 // The names privacy settings actually go by on the wire, and the friendly
-// aliases this library has always accepted for them. whatsmeow's
-// PrivacySettingType constants are the right-hand column.
+// aliases this library has always accepted for them. The wire names are the
+// right-hand column.
 const PRIVACY_NAME_ALIASES = {
   last_seen: 'last',            last: 'last',
   profile_picture: 'profile',   profile_pic: 'profile',    profile: 'profile',
@@ -80,8 +80,8 @@ const PRIVACY_WIRE_TO_KEY = {
   stickers:     'stickers'
 };
 
-// Reduce a JID to its bare user — whatsmeow's ToNonAD. Blocking, and anything
-// else that names an account rather than one of its devices, wants this form.
+// Reduce a JID to its bare user. Blocking, and anything else that names an
+// account rather than one of its devices, wants this form.
 function toNonAdJid(input) {
   const s      = String(input || '');
   const at     = s.indexOf('@');
@@ -246,14 +246,14 @@ class WhalibmobClient extends EventEmitter {
     this._tcTokenStore            = null; // TcTokenStore — loaded in init()
     this._inFlightTcTokenIssuance = new Set(); // dedupe concurrent proactive issuePrivacyTokens per JID
     this._inFlight463Recoveries   = new Set(); // dedupe concurrent 463-triggered token issuances per JID (separate from proactive)
-    // Blue-tick every message as it arrives. Set to false for whatsmeow's model,
-    // where read is only ever sent by an explicit markRead() call.
+    // Blue-tick every message as it arrives. Set to false to make read receipts
+    // explicit, sent only by a markRead() call.
     this.autoRead = opts.autoRead !== false;
     // Flipped by setOnline(). Delivery receipts sent while this is false carry
     // type="inactive", which the sender's app records but does not render.
     this._sendActiveReceipts = false;
-    // Cached privacy settings, as whatsmeow caches them. Warmed after connect
-    // and refreshed whenever the server reports a change; markRead reads it.
+    // Cached privacy settings. Warmed after connect and refreshed whenever the
+    // server reports a change; markRead reads it.
     this._privacySettings = null;
     if (opts.pino !== undefined) _whaConfigLogger(opts.pino);
   }
@@ -731,9 +731,9 @@ class WhalibmobClient extends EventEmitter {
       this._saveWebStore();
       _whaDbg('[DBG] COMPANION_FINISH adv_secret derived');
 
-      // Baileys awaits this one rather than firing and forgetting, so a server
-      // rejection surfaces as an error here instead of as a silent stall
-      // waiting for a pair-success that is never coming.
+      // Awaited rather than fired and forgotten, so a server rejection surfaces
+      // as an error here instead of as a silent stall waiting for a
+      // pair-success that is never coming.
       const finishResult = await this._sendIq(new BinaryNode('iq', {
         to:    's.whatsapp.net',
         type:  'set',
@@ -1810,10 +1810,9 @@ class WhalibmobClient extends EventEmitter {
     // Companion pairing — these arrive unsolicited, so they are checked before
     // the pending-IQ table rather than after it.
     //
-    // pair-device is matched on type=set; pair-success is matched on any type,
-    // the way Baileys distinguishes them ('CB:iq,type:set,pair-device' against
-    // a bare 'CB:iq,,pair-success'). Requiring type=set on pair-success would
-    // drop the stanza that completes the link.
+    // pair-device is matched on type=set; pair-success is matched on any type.
+    // Requiring type=set on pair-success would drop the stanza that completes
+    // the link.
     if (this._mode === 'web') {
       if (type === 'set' && findChild(node, 'pair-device')) { this._handlePairDevice(node);  return; }
       if (findChild(node, 'pair-success'))                  { this._handlePairSuccess(node); return; }
@@ -2001,8 +2000,8 @@ class WhalibmobClient extends EventEmitter {
         this._sendReadReceipt(id, fromRaw, partRaw);
 
         // ── pkmsg = peer opened a new Signal session (identity/device change) ──
-        // Re-issue our tcToken to them so the fresh session carries a valid token.
-        // Mirrors Baileys' reissueTcTokenAfterIdentityChange (messages-recv.js).
+        // Re-issue our tcToken to them so the fresh session carries a valid
+        // token.
         if (encType === 'pkmsg' && this._tcTokenStore) {
           this._reissueTcTokenAfterIdentityChange(sigJid);
         }
@@ -2250,10 +2249,10 @@ class WhalibmobClient extends EventEmitter {
   }
 
   // A read receipt only tells the sender we read it when read receipts are on.
-  // whatsmeow's MarkRead checks the same setting and downgrades "read" to
-  // "read-self", which marks the message read across our own devices without
-  // reporting it to the other side. Nothing here looked at the setting, so a
-  // user who had turned read receipts off still sent blue ticks.
+  // With them off, "read" is downgraded to "read-self", which marks the message
+  // read across our own devices without reporting it to the other side. Nothing
+  // here looked at the setting, so a user who had turned read receipts off
+  // still sent blue ticks.
   _readReceiptType(base) {
     const settings = this._privacySettings;
     if (settings && settings.readReceipts === 'none' && base === 'read') {
@@ -2264,9 +2263,8 @@ class WhalibmobClient extends EventEmitter {
 
   // The key a privacy token is stored and looked up under.
   //
-  // Both references resolve it to the contact's LID and fall back to the plain
-  // JID only when no LID is known — whatsmeow's resolveTCTokenStorageLID and
-  // Baileys' resolveTcTokenJid are the same three lines:
+  // It resolves to the contact's LID, falling back to the plain JID only when
+  // no LID is known:
   //
   //     if (isLidUser(jid)) return jid
   //     const lid = await getLIDForPN(jid)
@@ -2289,9 +2287,9 @@ class WhalibmobClient extends EventEmitter {
     // The in-memory map starts empty and is filled by usync and by incoming
     // messages, so a send early in a process — or one that hits a warm device
     // cache and never runs usync — could find nothing and fall back to the
-    // phone JID. The mapping is on disk in the Signal store either way, which
-    // is the same place whatsmeow reads it from, so consult that before giving
-    // up. The consequence of not doing so is not cosmetic: the lookup lands on
+    // phone JID. The mapping is on disk in the Signal store either way, so
+    // consult that before giving up. The consequence of not doing so is not
+    // cosmetic: the lookup lands on
     // a key with no token while a live one sits under the LID, and the message
     // goes out without one.
     if (!lidUser) {
@@ -2325,9 +2323,8 @@ class WhalibmobClient extends EventEmitter {
   //
   // Storage is always the LID. Issuance follows AB prop 14303
   // (lid_trusted_token_issue_to_lid), whose WA Web default is off — so the IQ
-  // names the phone JID. Baileys implements exactly this in resolveIssuanceJid
-  // and defaults the prop to false; whatsmeow issues to the LID instead. We
-  // follow WA Web, and more importantly we now follow it in one place: the
+  // names the phone JID. We follow WA Web, and more importantly we now follow
+  // it in one place: the
   // send path, the 463 recovery and the post-identity-change re-issue used to
   // each pick a different address family for the same contact.
   _resolveTcTokenIssuanceJid(jid) {
@@ -2340,9 +2337,9 @@ class WhalibmobClient extends EventEmitter {
 
   // The one way to read a token that is safe to put on the wire.
   //
-  // whatsmeow funnels every attach site through ensureTCToken, which returns
-  // nothing for an expired token. whalibmob had the expiry check on the message
-  // path only; presence subscribe, group create, participant add and the
+  // Every attach site goes through here, and an expired token returns nothing.
+  // The expiry check used to be on the message path only; presence subscribe,
+  // group create, participant add and the
   // profile-picture query each tested `token.length` and nothing else, so once
   // a token aged past the 28-day window those four kept sending it. Same rule
   // everywhere now, and the dead token gets cleared on the way out.
@@ -2373,10 +2370,10 @@ class WhalibmobClient extends EventEmitter {
   // Delivery receipt — the sender's two grey ticks.
   //
   // Distinct from the <ack> above: the ack tells the server we took the stanza,
-  // the receipt tells the sender it reached a device. whatsmeow sends both for
-  // every incoming message (sendAck + sendMessageReceipt) and leaves the blue
-  // ticks to an explicit MarkRead. whalibmob only ever sent the ack and then
-  // jumped straight to type="read", so a sender never saw the grey stage.
+  // the receipt tells the sender it reached a device. Both go out for every
+  // incoming message, with the blue ticks left to markRead. Only the ack used
+  // to be sent, jumping straight to type="read", so a sender never saw the grey
+  // stage.
   //
   // A client that has not marked itself available sends this with
   // type="inactive": the sender's app records the delivery but does not render
@@ -2399,7 +2396,7 @@ class WhalibmobClient extends EventEmitter {
   //
   // Sent automatically after a message decodes unless autoRead is turned off, in
   // which case marking a chat read is up to the caller via markRead(). Turning
-  // it off gives whatsmeow's model, where read is always explicit.
+  // it off makes read receipts always explicit.
   // fromJid / partJid are raw JID objects (AD_JID encoding for correct routing).
   _sendReadReceipt(msgId, fromJid, partJid) {
     if (!this._socket || !this._connected) return;
@@ -2543,8 +2540,8 @@ class WhalibmobClient extends EventEmitter {
   }
 
   // <blocklist action="..." dhash="..." prev_dhash="..."><item jid=... action=.../></blocklist>
-  // Mirrors whatsmeow's handleBlocklist: the action on the node describes the
-  // whole change, each child names one JID and what happened to it.
+  // The action on the node describes the whole change; each child names one JID
+  // and what happened to it.
   _handleBlocklistNotification(node) {
     const attrs   = node.attrs || {};
     const changes = [];
@@ -2587,9 +2584,9 @@ class WhalibmobClient extends EventEmitter {
       // blocked only ever changed when it did the blocking itself.
       const blocklistNode = findChildDeep(node, 'blocklist');
       if (blocklistNode) this._handleBlocklistNotification(blocklistNode);
-      // ...and privacy setting changes, which arrive the same way. whatsmeow
-      // re-reads the settings on this and raises an event; nothing was watching
-      // the node, so a change made on the phone never reached the cache.
+      // ...and privacy setting changes, which arrive the same way. The settings
+      // are re-read on this and an event raised; nothing was watching the node,
+      // so a change made on the phone never reached the cache.
       const privacyNode = findChildDeep(node, 'privacy');
       if (privacyNode) this._handlePrivacySettingsNotification(privacyNode);
     }
@@ -2847,9 +2844,9 @@ class WhalibmobClient extends EventEmitter {
       return;
     }
 
-    // Not every failure kills the session. whatsmeow's IsLoggedOut() marks the
-    // ones that do — 401, 403, 405, 406, 409 — and treats the rest as worth
-    // another attempt. A 500 or a 503 is the server having a bad minute; giving
+    // Not every failure kills the session. These five do — 401, 403, 405, 406,
+    // 409 — and the rest are worth another attempt. A 500 or a 503 is the
+    // server having a bad minute; giving
     // up on the session for that would be throwing away a working registration.
     const LOGGED_OUT = ['401', '403', '405', '406', '409'];
     const spent = LOGGED_OUT.includes(reason);
@@ -3289,8 +3286,6 @@ class WhalibmobClient extends EventEmitter {
    * Send a `<iq type='set' xmlns='privacy'>` to issue a trusted-contact token
    * for `jid`. Returns the raw result node (or null on timeout).
    *
-   * Mirrors Baileys' `issuePrivacyTokens` in messages-send.js.
-   *
    * @param {string} jid          - Bare or full JID of the conversation partner
    * @param {number} timestamp    - Unix seconds to use as the token timestamp
    */
@@ -3378,13 +3373,12 @@ class WhalibmobClient extends EventEmitter {
                         : (typeof tokenNode.content === 'string' && tokenNode.content.length > 0)
                           ? Buffer.from(tokenNode.content, 'base64')
                           : null;
-          // Baileys tc-token-utils.js line 137-138:
-          // "In notifications tokenNode.attrs.jid is your own device JID, not the sender's"
-          // → always prefer fallbackJid; only fall back to a.jid when fallbackJid is absent
+          // In a notification, tokenNode.attrs.jid is our own device JID rather
+          // than the sender's, so fallbackJid wins whenever it is present.
           const jid = fallbackJid || String(a.jid);
           const t   = a.t   ? parseInt(String(a.t), 10) : issueTs;
-          // Baileys drops anything that is not a regular user here — the guard
-          // is against a malformed or spoofed notification filing a token under
+          // Anything that is not a regular user is dropped here, guarding
+          // against a malformed or spoofed notification filing a token under
           // the PSA account or a bot.
           if (!isRegularTcTokenUser(jid)) {
             _whaDbg('[DBG] STORE_TCTOKEN skipped non-user jid=' + jid);
@@ -3407,8 +3401,8 @@ class WhalibmobClient extends EventEmitter {
       }
     }
 
-    // ── CRITICAL: Baileys ALWAYS persists senderTimestamp after issuing, ─────
-    // ── regardless of whether server returned token bytes.               ─────
+    // ── CRITICAL: senderTimestamp is ALWAYS persisted after issuing,     ─────
+    // ── regardless of whether the server returned token bytes.           ─────
     // ── Without this, shouldSendNewTcToken() returns true every send and ─────
     // ── we flood the server with privacy IQs.                            ─────
     // ── For incoming privacy_token notifications saveSenderTs=false so  ─────
@@ -3427,14 +3421,14 @@ class WhalibmobClient extends EventEmitter {
   /**
    * Handle a server-pushed `<notification type='privacy_token'>`.
    *
-   * Wire format (mirrors Baileys' handlePrivacyTokenNotification):
+   * Wire format:
    *   <notification type='privacy_token' from='...' [sender_lid='...@lid']>
    *     <tokens>
    *       <token type='trusted_contact' jid='...' t='...'>…bytes…</token>
    *     </tokens>
    *   </notification>
    *
-   * Key rules (from Baileys messages-recv.js lines 996-1015):
+   * Key rules:
    *   1. Must find <tokens> wrapper inside notification; abort if absent.
    *   2. storage key = sender_lid (if present and @lid) else PN→LID lookup else from-JID.
    *   3. senderTimestamp is NOT updated here — only the peer-token bytes + timestamp.
@@ -3449,7 +3443,7 @@ class WhalibmobClient extends EventEmitter {
     _whaDbg('[DBG] PRIVACY_TOKEN_NOTIF_ENTER from=' + String(attrs.from || '') +
       ' sender_lid=' + String(attrs.sender_lid || ''));
 
-    // ── 1. Require <tokens> wrapper (matches Baileys' getBinaryNodeChild check) ──
+    // ── 1. Require the <tokens> wrapper ────────────────────────────────────────
     const content    = Array.isArray(node.content) ? node.content : [];
     const tokensNode = content.find(n => n && n.description === 'tokens');
     if (!tokensNode) {
@@ -3458,7 +3452,7 @@ class WhalibmobClient extends EventEmitter {
     }
 
     // ── 2. Resolve storage JID ─────────────────────────────────────────────────
-    // Priority (mirrors Baileys lines 1001-1006):
+    // Priority:
     //   1. sender_lid attr if it is a @lid JID
     //   2. from user is a known LID user (LID comes as @s.whatsapp.net in notification)
     //   3. from is a PN → look up LID in _pnToLid
@@ -3494,7 +3488,7 @@ class WhalibmobClient extends EventEmitter {
    * Called when we successfully decrypt a pkmsg — the peer opened a fresh Signal
    * session (reset or new device), so we re-issue a privacy token so they can
    * reach us.  Only fires if we've previously issued a token (senderTimestamp
-   * present and not expired), mirroring Baileys' reissueTcTokenAfterIdentityChange.
+   * present and not expired).
    *
    * @param {string} from  - Signal-session JID (PN or LID JID of the sender)
    */
@@ -3516,8 +3510,8 @@ class WhalibmobClient extends EventEmitter {
         _whaDbg('[DBG] REISSUE_TC_TOKEN_AFTER_IDENTITY_CHANGE jid=' + tcJid +
           ' prevSenderTs=' + senderTs);
 
-        // Baileys re-issues with the *previous* senderTimestamp, not a fresh
-        // one, and stores the result without touching the dedupe state. That
+        // The re-issue carries the *previous* senderTimestamp, not a fresh one,
+        // and the result is stored without touching the dedupe state. That
         // matters: this is a repair of an existing grant after the peer's
         // device changed, not a new grant, so it must not move the 7-day
         // bucket that governs regular issuance. We were stamping it with
@@ -3614,7 +3608,7 @@ class WhalibmobClient extends EventEmitter {
    *  - Skips expired tokens (no point loading a token we'd immediately discard).
    *  - Storage key follows TcTokenStore convention: normalized bare JID.
    *    For LID chats (jid ends in @lid) we use the lid JID directly.
-   *    For PN chats we try to look up the LID first (Baileys always stores under LID).
+   *    For PN chats we try to look up the LID first, since storage is by LID.
    *
    * @param {object|null} merged  - Return value of mergeHistoryToStore()
    */
@@ -3642,7 +3636,7 @@ class WhalibmobClient extends EventEmitter {
         continue;
       }
 
-      // Resolve storage JID: Baileys always stores under LID.
+      // Resolve storage JID — storage is always by LID.
       // If this chat is a @lid jid, use it directly.
       // If it's a PN jid, try to find its LID counterpart.
       let storageJid;
@@ -3801,9 +3795,9 @@ class WhalibmobClient extends EventEmitter {
   //            required in a group; type may be 'read' (default) or 'played'
   //            to mark a voice note as listened to.
   //
-  // Shaped the way whatsmeow's MarkRead builds it: the FIRST id on the receipt
-  // and the rest as <item> children of a <list> node. whalibmob used the last id
-  // and put the items straight into <receipt>, which is not a shape the server
+  // The FIRST id goes on the receipt and the rest as <item> children of a
+  // <list> node. The last id used to be used instead, with the items straight
+  // inside <receipt>, which is not a shape the server
   // reads back — the extra ids were silently ignored, so only one message per
   // call was ever marked. The participant was missing entirely, so a group read
   // never told the server whose message had been read.
@@ -3890,8 +3884,8 @@ class WhalibmobClient extends EventEmitter {
 
   // Set global online/offline status.
   //
-  // whatsmeow refuses to send this without a push name (ErrNoPushName): the
-  // server takes the display name from this node, and sending it empty makes
+  // This is refused without a push name: the server takes the display name from
+  // this node, and sending it empty makes
   // every other user see "-" instead of a name. Going available also flips the
   // client into sending active delivery receipts — see _sendDeliveryReceipt.
   //
@@ -3914,9 +3908,9 @@ class WhalibmobClient extends EventEmitter {
   // Set typing/recording presence in a specific chat.
   // presence: 'composing' | 'paused' | 'recording'
   //
-  // whatsmeow's SendChatPresence puts both `from` (our own JID) and `to` on the
-  // chatstate node and expresses recording as composing with media="audio" —
-  // there is no separate recording state in the protocol. The `from` was missing
+  // Both `from` (our own JID) and `to` go on the chatstate node, and recording
+  // is expressed as composing with media="audio" — there is no separate
+  // recording state in the protocol. The `from` was missing
   // here, and both JIDs were raw strings, which the server ignores for @lid
   // chats, so the indicator never showed for a LID-addressed contact.
   setChatPresence(chatJid, presence) {
@@ -3940,18 +3934,17 @@ class WhalibmobClient extends EventEmitter {
 
   // Subscribe to presence updates for contacts.
   //
-  // whatsmeow attaches the contact's privacy token when it has one; without it
-  // the server may decline to send their presence. It also notes that the server
-  // only forwards presence to clients that have marked themselves available, so
-  // call setOnline(true) first.
+  // The contact's privacy token is attached when there is one; without it the
+  // server may decline to send their presence. The server also only forwards
+  // presence to clients that have marked themselves available, so call
+  // setOnline(true) first.
   subscribeToPresence(jids) {
     if (!this._socket || !this._connected) return;
     const arr = Array.isArray(jids) ? jids : [jids];
     const { isRegularTcTokenUser } = require('./messages/TcTokenStore');
     for (const raw of arr) {
       const jid   = makeJid(raw);
-      // Groups and newsletters have no privacy token; Baileys guards the same
-      // way before building the node.
+      // Groups and newsletters have no privacy token.
       const token = isRegularTcTokenUser(jid) ? this._tcTokenFor(jid) : null;
       const children = token ? [new BinaryNode('tctoken', {}, token)] : null;
       this._socket.sendNode(new BinaryNode('presence', {
@@ -4058,8 +4051,8 @@ class WhalibmobClient extends EventEmitter {
     return (info && info.url) || null;
   }
 
-  // Full profile picture info, the way whatsmeow's GetProfilePictureInfo returns
-  // it: { id, url, type, directPath, hash }, or null when the user has no
+  // Full profile picture info: { id, url, type, directPath, hash }, or null
+  // when the user has no
   // picture or it has not changed since opts.existingId.
   //
   // opts: { preview, existingId, isCommunity }
@@ -4185,8 +4178,8 @@ class WhalibmobClient extends EventEmitter {
 
   // Parse the <list> a blocklist query or update comes back with.
   //
-  // whatsmeow's parseBlocklist walks every child and takes its jid, without
-  // caring what the tag is called, and keeps the dhash off the list itself.
+  // Every child is walked and its jid taken, whatever the tag is called, with
+  // the dhash kept off the list itself.
   // The JIDs are stringified here: the binary decoder hands them back as JID
   // objects, and while those print correctly they are not strings, so the array
   // this used to return failed any includes() or === against a JID string —
@@ -4319,9 +4312,9 @@ class WhalibmobClient extends EventEmitter {
   //        'none' | 'match_last_seen' | 'known' | 'on_standard' | 'off'
   // excluded: JIDs to exclude — see the note below
   //
-  // The names above are friendly aliases. What goes on the wire is what
-  // whatsmeow sends: last, profile, status, online, readreceipts, groupadd,
-  // calladd, messages, defense, stickers. Four of the six names this used to
+  // The names above are friendly aliases. What goes on the wire is: last,
+  // profile, status, online, readreceipts, groupadd, calladd, messages,
+  // defense, stickers. Four of the six names this used to
   // put on the wire — last_seen, profile_picture, read_receipts, groups_add —
   // are not names the server knows, so those settings never changed and the
   // discarded reply meant it never said so either.
@@ -4332,8 +4325,8 @@ class WhalibmobClient extends EventEmitter {
         Object.keys(PRIVACY_NAME_ALIASES).join(', '));
     }
 
-    // Neither whatsmeow nor WhatsApp Web puts <user> children on this IQ; the
-    // exclusion list is maintained separately. Kept for callers that pass it,
+    // WhatsApp Web does not put <user> children on this IQ; the exclusion list
+    // is maintained separately. Kept for callers that pass it,
     // and only emitted when they do.
     const children = [];
     if (excluded && excluded.length > 0) {
@@ -4364,8 +4357,8 @@ class WhalibmobClient extends EventEmitter {
         (code ? ' (' + code + (text ? ' ' + text : '') + ')' : ''));
     }
 
-    // whatsmeow folds the change into its cached copy and hands the whole thing
-    // back rather than making the caller re-query.
+    // The change is folded into the cached copy and the whole thing handed back
+    // rather than making the caller re-query.
     const key = PRIVACY_WIRE_TO_KEY[name];
     this._privacySettings = Object.assign({}, this._privacySettings || {},
       { [key]: String(value) });
@@ -4394,8 +4387,8 @@ class WhalibmobClient extends EventEmitter {
 
   // Who your Status posts go to.
   //
-  // Returns [{ type, isDefault, list }] with the default first, as whatsmeow's
-  // GetStatusPrivacy does. type is 'contacts', 'blacklist' or 'whitelist'; list
+  // Returns [{ type, isDefault, list }] with the default first. type is
+  // 'contacts', 'blacklist' or 'whitelist'; list
   // holds the JIDs the last two are built from. A server that has never been
   // told otherwise answers nothing, which means the default: all contacts.
   async queryStatusPrivacy() {
@@ -4436,8 +4429,8 @@ class WhalibmobClient extends EventEmitter {
   }
 
   // Resolve the status privacy settings into the JIDs a post actually goes to,
-  // the way whatsmeow's getStatusBroadcastRecipients does: a whitelist is the
-  // list itself, anything else is every known contact minus the blacklist, and
+  // a whitelist is the list itself, anything else is every known contact minus
+  // the blacklist, and
   // our own JID is added so the post lands on our own devices too.
   //
   // Contacts come from the synced history store — this client has no separate
@@ -4998,10 +4991,9 @@ class WhalibmobClient extends EventEmitter {
   //   </iq>
   //
   // The item is addressed by LID, and a block carries the phone number beside
-  // it; an unblock carries only the LID. That is the shape Baileys'
-  // updateBlockStatus builds, and the one this server accepts — whatsmeow's
-  // UpdateBlocklist still sends the plain JID it was handed, which is what this
-  // used to do and what the server answered with 400 bad-request.
+  // it; an unblock carries only the LID. That is the shape this server accepts
+  // — sending the plain JID it was handed, which is what this used to do, got a
+  // 400 bad-request back.
   //
   // Three other things were wrong with the pair this replaces. The jid went out
   // as a raw string rather than a binary JID. It was not reduced to its bare

package/lib/DeviceManager.js

@@ -45,8 +45,8 @@ function jidStrToObj(jidStr) {
     return { user, agent: 0, device, server, toString() { return self; } };
   }
   // @lid multi-device (e.g. "112713111982325:2@lid"): AD_JID with the domain in
-  // the agent byte — 1 for lid, matching Baileys' writeJid, which emits AD_JID
-  // with domainType whenever a device is present.
+  // the agent byte — 1 for lid. AD_JID with a domain type is the shape whenever
+  // a device is present.
   //
   // This previously packed the device into the user string as a JID_PAIR
   // ("112713111982325:2"), a workaround from when the encoder could not express
@@ -204,7 +204,7 @@ class DeviceManager {
   // It loads the on-disk device cache so the very first send after a process
   // restart is instant — no cold-start usync round-trip needed.
   //
-  // Files saved in session dir (baileys-compatible naming):
+  // Files saved in session dir:
   //   <phone>.device-cache.json                          ← combined cache (internal)
   //   device-list-447911234567@s.whatsapp.net.json       ← per-phone device IDs
   //   device-list-139471160877194@lid.json               ← per-LID device IDs
@@ -268,7 +268,7 @@ class DeviceManager {
         'utf8'
       );
 
-      // ── Individual device-list files (baileys-compatible) ──────────────────
+      // ── Individual device-list files ───────────────────────────────────────
       for (const [key, ids] of Object.entries(entries)) {
         let fileName;
         if (key.startsWith('lid:')) {
@@ -411,13 +411,12 @@ class DeviceManager {
     return jids.length > 0 ? jids : phones.map(p => makeDeviceJid(p, 0));
   }
 
-  // ─── USync executor (Baileys WAUSync, mobile-API transport) ─────────────────
+  // ─── USync executor (mobile-API transport) ──────────────────────────────────
   //
-  // Mirrors Baileys' socket.js `executeUSyncQuery`: it builds the <query> and
-  // <list> nodes from the USyncQuery protocols/users, sends the IQ, and parses
-  // the response through `usyncQuery.parseUSyncQueryResult`.  The difference is
-  // purely the transport — whalibmob talks the WhatsApp *mobile* protocol, not
-  // the web protocol — so three adaptations are applied:
+  // Builds the <query> and <list> nodes from the USyncQuery protocols/users,
+  // sends the IQ, and parses the response through
+  // `usyncQuery.parseUSyncQueryResult`. Talking the WhatsApp *mobile* protocol
+  // rather than the web one calls for three adaptations:
   //
   //   1. Nodes use whalibmob's BinaryNode (`description` field) instead of the
   //      web `{ tag }` object literals.
@@ -431,7 +430,7 @@ class DeviceManager {
   //     protocol → <user><contact>+phone</contact></user>.  The mobile server
   //     ignores the <user jid="..."> form for phone-based device discovery.
   //   • Discovery for an already-known routing JID (a LID) uses
-  //     USyncUser().withId(jid) → <user jid="..."> exactly like Baileys.
+  //     USyncUser().withId(jid) → <user jid="...">.
   async executeUSyncQuery(usyncQuery) {
     if (!usyncQuery || usyncQuery.protocols.length === 0) {
       throw new Error('USyncQuery must have at least one protocol');
@@ -464,9 +463,9 @@ class DeviceManager {
       return { user: (server === 'lid' && device > 0) ? raw : user, server, toString() { return str; } };
     };
 
-    // <user> nodes — jid attr is set only when the user has no phone (Baileys:
-    // `jid: !user.phone ? user.id : undefined`); phone users carry a <contact>
-    // child instead, produced by the contact protocol's getUserElement.
+    // <user> nodes — the jid attr is set only when the user has no phone; phone
+    // users carry a <contact> child instead, produced by the contact protocol's
+    // getUserElement.
     const userNodes = usyncQuery.users.map(user => {
       const children = usyncQuery.protocols
         .map(p => p.getUserElement(user))
@@ -535,9 +534,9 @@ class DeviceManager {
   //  Fix C — context and side_list must match _doContactUsync (the working format):
   //    context="interactive" + <side_list/> is REQUIRED. context="message" → server ignores IQ.
   async _doUsyncIq(phones) {
-    // Build the device-discovery query exactly as Baileys does — via USyncQuery
-    // and the device / LID / contact protocols — then run it through the
-    // mobile-API executor and parse it with the shared parseUSyncQueryResult.
+    // Build the device-discovery query via USyncQuery and the device / LID /
+    // contact protocols, then run it through the mobile-API executor and parse
+    // it with the shared parseUSyncQueryResult.
     //
     // Users are addressed by PHONE (USyncUser().withPhone → <contact>+phone</>)
     // because the WA *mobile* server silently drops usync IQs that address
@@ -626,9 +625,9 @@ class DeviceManager {
           for (const dev of deviceList) {
             const devId  = Number.isFinite(dev.id)       ? dev.id       : 0;
             const keyIdx = Number.isFinite(dev.keyIndex) ? dev.keyIndex : -1;
-            // Mirror Baileys extractDeviceJids: keep device 0 or non-zero
-            // devices that carry a valid key-index (otherwise the encrypt IQ
-            // returns a bad-request / empty bundle for that device).
+            // Keep device 0, and non-zero devices that carry a valid
+            // key-index — otherwise the encrypt IQ returns a bad-request or an
+            // empty bundle for that device.
             if (devId === 0 || keyIdx > 0) {
               this._dcAdd(cachePhone, devId);
             }
@@ -883,8 +882,8 @@ class DeviceManager {
   // expressed as <ourLid>:<device>@lid.
   //
   // Device 0 is excluded exactly as it is on the phone path: it is the device
-  // doing the sending, and both Baileys and whatsmeow skip the exact sender
-  // device when building participants.
+  // doing the sending, and the sender device is never one of its own
+  // participants.
   async ensureOwnLidDeviceSessions(lidUser, ownPhone, signalProto, allowPkmsg = true) {
     if (!lidUser) return [];
     const cacheKey = 'lid:' + lidUser;
@@ -977,7 +976,7 @@ class DeviceManager {
   async _doContactUsync(phones) {
     // Contact-only fallback (device/lid protocols omitted): the plain contact
     // query is the form the mobile server reliably answers when the richer
-    // device query times out.  Built via the shared Baileys USyncQuery builder.
+    // device query times out.  Built via the shared USyncQuery builder.
     const query = new USyncQuery()
       .withContext('interactive')
       .withContactProtocol();
@@ -1031,9 +1030,9 @@ class DeviceManager {
     const jidStr = typeof jid === 'string' ? jid : String(jid);
 
     // Discovery for an already-known routing JID (a LID) — addressed via
-    // USyncUser().withId(jid) → <user jid="...">, exactly as Baileys'
-    // getUSyncDevices does.  executeUSyncQuery encodes the jid attr as a
-    // JID object so the mobile binary encoder emits proper JID_PAIR bytes.
+    // USyncUser().withId(jid) → <user jid="...">.  executeUSyncQuery encodes
+    // the jid attr as a JID object so the mobile binary encoder emits proper
+    // JID_PAIR bytes.
     const query = new USyncQuery()
       .withContext('interactive')
       .withDeviceProtocol()

package/lib/MediaService.js

@@ -119,8 +119,8 @@ function decryptMedia(encryptedWithMac, mediaKey, keyName) {
 
 // Upload encrypted media, trying every CDN host in turn.
 //
-// refreshAuth (optional) mirrors Baileys' refreshMediaConn(true): when a host
-// answers but the upload yields no usable URL — the signature of an expired or
+// refreshAuth (optional): when a host answers but the upload yields no usable
+// URL — the signature of an expired or
 // rejected auth token — the auth is force-refreshed once and the hosts are
 // retried with the fresh credentials. Without this a token that expires between
 // the TTL check and the upload burns through every host and fails permanently

package/lib/MediaThumbnail.js

@@ -8,9 +8,8 @@
 // drawn, so the recipient gets the grey placeholder with a download arrow and
 // has to tap it before seeing anything.
 //
-// Baileys builds that preview by resizing the source to 32 pixels wide at JPEG
-// quality 50, and takes the original dimensions from the same decode. This does
-// the same, with the difference that none of it is mandatory:
+// The preview is the source resized to 32 pixels wide at JPEG quality 50, with
+// the original dimensions read from the same decode. None of it is mandatory:
 //
 //   • Dimensions are read straight out of the file header — JPEG, PNG, WebP,
 //     GIF and BMP — with no library at all.
@@ -31,8 +30,8 @@ const path = require('path');
 const crypto = require('crypto');
 const { execFile } = require('child_process');
 
-// Baileys' numbers — the preview is deliberately tiny, it is only ever shown
-// blurred behind the real image while that downloads.
+// The preview is deliberately tiny; it is only ever shown blurred behind the
+// real image while that downloads.
 const THUMB_WIDTH   = 32;
 const THUMB_QUALITY = 50;
 
@@ -358,8 +357,7 @@ async function videoThumbnail(input, opts) {
       } catch (_) {}
     }
 
-    // Same frame grab Baileys runs: first frame, scaled to the preview width
-    // with the aspect ratio kept.
+    // First frame, scaled to the preview width with the aspect ratio kept.
     const dest = tmpFile('.jpg');
     try {
       const ok = await run('ffmpeg', [

package/lib/auth-utils.js

@@ -2,8 +2,8 @@
 
 // ─── auth-utils.js ────────────────────────────────────────────────────────────
 //
-// Provides four utilities that mirror Baileys' auth-utils, adapted to
-// whalibmob's architecture (method-based SignalStore, Buffer key pairs, etc.):
+// Four utilities built around whalibmob's architecture (method-based
+// SignalStore, Buffer key pairs, etc.):
 //
 //  1. makeCacheableSignalKeyStore  — wraps SignalStore with NodeCache (5-min TTL)
 //                                   and a Mutex for all read/write operations
@@ -591,7 +591,6 @@ function addTransactionCapability(state, logger, opts) {
  * Returns the authenticated user's JID (phone@s.whatsapp.net) or throws
  * a descriptive error if the store is not yet fully authenticated.
  *
- * Equivalent to Baileys' assertMeId(creds) but for whalibmob's store format.
  * Use this anywhere we'd otherwise reach for `store.phoneNumber` directly,
  * to fail fast with a clear error instead of a silent null-reference crash.
  *
@@ -623,12 +622,12 @@ function assertMeId(store) {
  * Creates a fresh set of whalibmob auth credentials (key pairs, registration ID,
  * device identifiers) for a given phone number.
  *
- * Equivalent to Baileys' initAuthCreds() but returns whalibmob's store format
- * (Buffer key pairs, signedPreKey as { id, public, private, signature }).
+ * Returns whalibmob's store format (Buffer key pairs, signedPreKey as
+ * { id, public, private, signature }).
  *
- * Additional Baileys-compatible fields (nextPreKeyId, firstUnuploadedPreKeyId,
- * accountSyncCounter, accountSettings, advSecretKey, etc.) are appended so
- * code that was written against Baileys' credential shape works unchanged.
+ * A few extra fields (nextPreKeyId, firstUnuploadedPreKeyId, accountSyncCounter,
+ * accountSettings, advSecretKey, etc.) are appended for account sync and for
+ * application code that expects them.
  *
  * @param {string|number} phoneNumber — full international number (e.g. "40712345678")
  * @param {object}        options     — optional overrides:
@@ -643,9 +642,8 @@ function initAuthCreds(phoneNumber, options) {
   // Use whalibmob's own key-generation machinery (curve25519-js, proper prefixes)
   const store = createNewStore(phoneNumber);
 
-  // ── Extra Baileys-compatible fields ──────────────────────────────────────────
-  // These are not required by whalibmob internally but are commonly expected by
-  // application code that was originally written against Baileys.
+  // ── Extra credential fields ──────────────────────────────────────────────────
+  // Not required internally, but commonly expected by application code.
 
   /** Next pre-key ID to generate (monotonically increasing). */
   store.nextPreKeyId             = 1;
@@ -656,7 +654,7 @@ function initAuthCreds(phoneNumber, options) {
   /** Sync counter used in account-sync IQ stanzas. */
   store.accountSyncCounter       = 0;
 
-  /** Account-level settings mirroring Baileys' IAccountSettings shape. */
+  /** Account-level settings. */
   store.accountSettings          = { unarchiveChats: false };
 
   /** Processed history messages — used to avoid duplicate handling on reconnect. */
@@ -664,7 +662,7 @@ function initAuthCreds(phoneNumber, options) {
 
   /**
    * 32-byte random secret used for ADV (multi-device) poll encryption.
-   * Stored as a base64 string, consistent with Baileys' advSecretKey.
+   * Stored as a base64 string.
    */
   store.advSecretKey             = crypto.randomBytes(32).toString('base64');
 

package/lib/messages/MessageSender.js

@@ -43,8 +43,7 @@ function isGroupJid(jid) {
 
 // A Status/Story is posted as a message to status@broadcast, and it travels the
 // SenderKey path a group message does — one skmsg plus a distribution to every
-// recipient — not the 1:1 path. Baileys calls the pair isGroupOrStatus;
-// whatsmeow routes BroadcastServer into sendGroup for the same reason.
+// recipient — not the 1:1 path. A Status and a group are the same case here.
 const STATUS_BROADCAST_JID = 'status@broadcast';
 
 function isStatusBroadcast(jid) {
@@ -196,18 +195,14 @@ function adString(jid) {
   return `${user}.0:${device}@${server}`;
 }
 
-// Participant-list hash v2, as whatsmeow's participantListHashV2 computes it:
-// sort the AD strings, sha256 the concatenation, then base64 the FIRST SIX
-// BYTES of the digest — eight characters, prefixed "2:".
+// Participant-list hash v2: sort the AD strings, sha256 the concatenation, then
+// base64 the FIRST SIX BYTES of the digest — eight characters, prefixed "2:".
 //
-// This previously mirrored Baileys' generateParticipantHashV2, which hashes
-// plain JID strings and then takes the first six CHARACTERS of the base64 of
-// the whole digest. That produces a different, six-character value from
-// different input. Baileys never puts the result on the wire — it assigns it to
-// extraAttrs after the participant nodes are built, so nothing ever reads it —
-// which is why the discrepancy has gone unnoticed there. whalibmob did put it
-// on the wire, so every multi-device send carried a hash the server could not
-// match against its own view of the participant list.
+// This previously hashed plain JID strings and took the first six CHARACTERS of
+// the base64 of the whole digest, which is a different, six-character value over
+// different input. It goes on the wire, so every multi-device send carried a
+// hash the server could not match against its own view of the participant
+// list.
 function computePhash(jids) {
   const sorted = [...new Set(jids.map(adString))].sort();
   const hash   = crypto.createHash('sha256').update(sorted.join('')).digest();
@@ -341,7 +336,7 @@ class MessageSender {
       gifPlayback:       options.gifPlayback || false,
       contextInfo:       options.contextInfo
     }));
-    // whatsmeow labels a video with gifPlayback as mediatype "gif", not "video".
+    // A video with gifPlayback is labelled mediatype "gif", not "video".
     return this._sendMessage(toJid, msgId, vidBuf, 'media',
       { ...options, _mediaSubtype: options.gifPlayback ? 'gif' : 'video' });
   }
@@ -459,8 +454,8 @@ class MessageSender {
       selectableOptionsCount: selectableCount != null ? selectableCount : 0,
       messageSecret: opts.messageSecret || opts.encKey || null
     });
-    // whatsmeow's BuildPollCreation pairs the poll with a messageContextInfo
-    // holding the secret. It is a sibling field of the poll inside Message, not
+    // The poll has to be paired with a messageContextInfo holding the secret.
+    // It is a sibling field of the poll inside Message, not
     // part of the poll — a voter derives their vote key from this copy, so a
     // poll sent without it cannot be voted on.
     const pollBuf = Buffer.concat([
@@ -497,9 +492,9 @@ class MessageSender {
       contextInfo:   opts.contextInfo
     }));
     // A location is a plain message as far as the envelope is concerned.
-    // whatsmeow's getTypeFromMessage has only text, media, reaction and poll —
-    // LocationMessage is in none of the media cases, so it falls through to
-    // text. Sending type="location" hands the server a type it has no case for.
+    // The stanza types are text, media, reaction and poll — LocationMessage is
+    // in none of the media cases, so it is text. Sending type="location" hands
+    // the server a type it has no case for.
     return this._sendMessage(toJid, msgId, locBuf, 'text', opts);
   }
 
@@ -922,9 +917,8 @@ class MessageSender {
     const allowPkmsg = true;
 
     // ── Addressing family ─────────────────────────────────────────────────────
-    // Baileys 7.0.0-rc13 — the release that fixed ack 479 on LID addressing —
-    // derives the whole address family from the JID the caller passed, and
-    // never converts between the two:
+    // The whole address family comes from the JID the caller passed, and the
+    // two are never converted between:
     //
     //     const targetUserServer = isLid ? 'lid' : 's.whatsapp.net'
     //     const senderIdentity   = isLid && meLid ? <ourLid> : <ourPn>
@@ -939,9 +933,9 @@ class MessageSender {
     // The recipient's devices followed the caller's JID but ours were always
     // enumerated by phone, so a DM to an @lid went out with @lid recipient
     // entries and @s.whatsapp.net entries for our own linked devices in the same
-    // <participants> list. whatsmeow builds the pair as [to, ownID] with ownID
-    // switched to our LID for @lid destinations precisely to avoid that, and a
-    // participant list the server cannot reconcile is what comes back as 479.
+    // <participants> list. The pair has to be [to, ownID] with ownID switched to
+    // our LID for @lid destinations; a participant list the server cannot
+    // reconcile is what comes back as 479.
     const isLidTarget  = toJid.endsWith('@lid');
     const routingToJid = toJid;
     const ownLidUser   = this._client._myLid ? phoneFromJid(this._client._myLid) : null;
@@ -955,8 +949,7 @@ class MessageSender {
     }
 
     // Enumerate the recipient's devices and our own in parallel, both in the
-    // address family the destination JID dictates — Baileys does the same in one
-    // getUSyncDevices([senderIdentity, jid]) call.
+    // address family the destination JID dictates.
     let otherJids, ownLinkedJids, ownPrimaryJid;
     if (isLidTarget) {
       const lidUser = phoneFromJid(toJid);
@@ -981,8 +974,7 @@ class MessageSender {
       ownPrimaryJid = this._client._ownDeviceJid();
     }
 
-    // The device doing the sending is never one of its own recipients. Both
-    // Baileys ("Skipping exact sender device") and whatsmeow drop it explicitly.
+    // The device doing the sending is never one of its own recipients.
     const ownPrimaryAddr = adString(ownPrimaryJid);
     otherJids     = otherJids.filter(j => adString(j) !== ownPrimaryAddr);
     ownLinkedJids = ownLinkedJids.filter(j => adString(j) !== ownPrimaryAddr);
@@ -999,12 +991,12 @@ class MessageSender {
     // ─────────────────────────────────────────────────────────────────────────
 
     // The hash covers every device the server enumerates for this pair of users,
-    // our own primary included — whatsmeow hashes GetUserDevices([to, ownID]) in
-    // full and only skips the sending device when it encrypts. Excluding it here
-    // produced a hash over a different set than the server's.
+    // our own primary included — the sending device is skipped only when it
+    // comes to encrypting. Excluding it here produced a hash over a different
+    // set than the server's.
     //
-    // It is not put on the stanza: neither whatsmeow nor Baileys sends phash on a
-    // 1:1 message, only on a group one. It is carried inside the (encrypted)
+    // It is not put on the stanza: phash belongs on a group message, not a 1:1
+    // one. It is carried inside the (encrypted)
     // DeviceSentMessage for our own devices, and compared against the phash the
     // server echoes back on the ack so a drifted device cache gets flushed.
     const phash = computePhash([...otherJids, ownPrimaryJid, ...ownLinkedJids]);
@@ -1115,8 +1107,7 @@ class MessageSender {
 
     // The server echoes its own participant hash on the ack. A difference means
     // its device list for this chat is not the one we just fanned out to, so the
-    // cached list is stale — drop it and let the next send re-run usync, exactly
-    // as whatsmeow does when the hashes disagree.
+    // cached list is stale — drop it and let the next send re-run usync.
     if (dispatchResult && dispatchResult.phash && dispatchResult.phash !== phash) {
       _whaDbg('[DBG] PHASH_MISMATCH ours=' + phash + ' server=' + dispatchResult.phash +
         ' to=' + toJid + ' — flushing device cache');
@@ -1136,10 +1127,9 @@ class MessageSender {
     // Two targets never get one. WhatsApp's own announcement account
     // (0@s.whatsapp.net) and the bot numbers, including Meta AI, are not
     // contacts you can be "timelocked" against, and no real client issues to
-    // them — whatsmeow gates on shouldSendTCTokenInChatAction, Baileys on
-    // isBotOrPSA. Protocol messages (a revoke, an ephemeral-timer change) are
-    // out too: Baileys skips issuance for them because they are bookkeeping,
-    // not a reach-out. Attaching an existing token to them is still correct
+    // them. Protocol messages (a revoke, an ephemeral-timer change) are out
+    // too — they are bookkeeping, not a reach-out. Attaching an existing token
+    // to them is still correct
     // and still happens above — this only governs asking for a new one.
     const isProtocolMsg = !!(options && options._protocol);
     if (tcStore && isRegularTcTokenUser(tcJid) && !isProtocolMsg &&
@@ -1219,9 +1209,9 @@ class MessageSender {
     }
 
     // Determine addressing mode for this group (lid = modern groups, pn = legacy).
-    // A Status carries none: whatsmeow sets addressing_mode only for the group
-    // server, and its recipients are ordinary contacts, so everything below
-    // stays in phone space.
+    // A Status carries none: addressing_mode is set only for the group server,
+    // and a Status goes to ordinary contacts, so everything below stays in
+    // phone space.
     const groupAddressingMode = isStatus
       ? null
       : (this._client._groupAddressingMode.get(groupJid) || 'lid');
@@ -1258,9 +1248,8 @@ class MessageSender {
     // out of the member walk and put back through the own-device path below.
     // Left in, the walk enumerates our devices starting at device 0 — the very
     // device doing the sending — and it lands in <participants> as a recipient
-    // of our own SenderKey. Baileys skips the exact sender device explicitly
-    // ("Skipping exact sender device"), whatsmeow does the same with
-    // `jid == ownJID || jid == ownLID`.
+    // of our own SenderKey. The exact sender device has to be skipped, matched
+    // against both our phone JID and our LID.
     //
     // The phone branch already dropped us via `p !== ownPhone`; the LID branch
     // never did, so this only ever misfired on LID-addressed groups.
@@ -1313,10 +1302,10 @@ class MessageSender {
     ]);
 
     // Every device this group resolves to, our own primary included, deduped so
-    // a device reached through more than one path is counted once. whatsmeow
-    // hashes GetUserDevices(groupParticipants) in exactly this shape — the whole
-    // enumeration, sending device and all — and drops hosted endpoints first,
-    // since those are bot-side and never real participants.
+    // a device reached through more than one path is counted once. The hash
+    // covers the whole enumeration, sending device and all, with hosted
+    // endpoints dropped first since those are bot-side and never real
+    // participants.
     const isHostedJid = (jid) => {
       const s = String(jid);
       return s.endsWith('@hosted') || s.endsWith('@hosted.lid');
@@ -1334,14 +1323,14 @@ class MessageSender {
       [...memberDevices, ...lidDevices, ...ownTargets, ownSelfJid]
     )].filter(jid => !isHostedJid(jid));
 
-    // The participant hash the server checks the fan-out against. whatsmeow puts
-    // it on group stanzas (sendGroup sets node.Attrs["phash"]) and nowhere else;
-    // it is computed over the enumeration above, not over the encryption targets,
+    // The participant hash the server checks the fan-out against. It goes on
+    // group stanzas and nowhere else, and is computed over the enumeration
+    // above rather than over the encryption targets,
     // so the sending device counts here even though it is not a recipient.
     const phash = computePhash(enumeratedDevices);
 
-    // Targets to actually encrypt for: everything but the sending device. Both
-    // Baileys and whatsmeow skip it explicitly at this point and not before.
+    // Targets to actually encrypt for: everything but the sending device, and
+    // it is skipped at this point rather than earlier.
     // Only the device actually sending. On a companion link that is not the
     // account's phone — the phone is a peer that has to receive the SenderKey
     // like everyone else, so excluding the bare number here would leave the
@@ -1364,8 +1353,8 @@ class MessageSender {
 
     const skStore        = this._signal.senderKeyStore;
     const existingSkdmMap = skStore.getSKDMMap(groupJid);
-    // Same exclusions Baileys applies when choosing SenderKey recipients:
-    // hosted (bot-side) users and device 99, which is a server placeholder
+    // Exclusions when choosing SenderKey recipients: hosted (bot-side) users
+    // and device 99, which is a server placeholder
     // rather than a real endpoint, must never receive a distribution.
     const isSkdmEligible = (jid) => {
       const s = String(jid);
@@ -1408,10 +1397,10 @@ class MessageSender {
       msgContent.push(new BinaryNode('device-identity', {}, advBytes));
     }
     if (skdmEncrypted.length > 0) {
-      // Baileys applies the same extra attrs — mediatype included — to the
-      // SenderKey participant nodes as to the skmsg, so an image sent to a
-      // group carries mediatype on both. Passing null here left the SKDM
-      // <enc> nodes unlabelled.
+      // The same extra attrs — mediatype included — belong on the SenderKey
+      // participant nodes as on the skmsg, so an image sent to a group carries
+      // mediatype on both. Passing null here left the SKDM <enc> nodes
+      // unlabelled.
       msgContent.push(DeviceManager.buildParticipantsNode(skdmEncrypted, mediaSubtype));
     }
     const skmsgAttrs = { type: 'skmsg', v: '2' };
@@ -1429,10 +1418,9 @@ class MessageSender {
       _whaDbg('[DBG] REPORTING_TOKEN attached to=' + groupJid + ' id=' + msgId);
     }
 
-    // phash belongs on a group stanza and only on a group stanza — whatsmeow's
-    // sendGroup sets it, sendDM does not. It tells the server which device set we
-    // fanned out to; the server compares it against its own and echoes its hash
-    // back on the ack when they differ.
+    // phash belongs on a group stanza and only on a group stanza. It tells the
+    // server which device set we fanned out to; the server compares it against
+    // its own and echoes its hash back on the ack when they differ.
     const stanzaAttrs = {
       to: jidStrToObj(groupJid),
       id: msgId,
@@ -1464,9 +1452,9 @@ class MessageSender {
 
     // A hash on the ack that differs from ours means the server's participant
     // list for this group is not the one we just fanned out to, so some members
-    // did not get the message. whatsmeow drops its group cache on exactly this
-    // signal; the device lists behind the members are dropped too, so the next
-    // send re-runs group metadata and usync rather than repeating the miss.
+    // did not get the message. The group cache is dropped on exactly this
+    // signal, and the device lists behind the members with it, so the next send
+    // re-runs group metadata and usync rather than repeating the miss.
     if (dispatchResult && dispatchResult.phash && dispatchResult.phash !== phash) {
       _whaDbg('[DBG] GROUP_PHASH_MISMATCH ours=' + phash +
         ' server=' + dispatchResult.phash + ' group=' + groupJid +
@@ -1485,7 +1473,7 @@ class MessageSender {
 
   // ─── Dispatch and wait for ack ────────────────────────────────────────────
   //
-  // Error 463 recovery (mirrors Baileys messages-recv.js inFlight463Recoveries):
+  // Error 463 recovery:
   //   1. 463 ack arrives → issue privacy token via _issuePrivacyTokens
   //   2. Wait for token to be stored in _tcTokenStore
   //   3. Re-send the SAME message node with a new msgId — the tctoken node
@@ -1496,7 +1484,7 @@ class MessageSender {
   //
   // Uses a SEPARATE _inFlight463Recoveries Set (not shared with the proactive
   // _inFlightTcTokenIssuance) so 463 recovery and proactive issuance never
-  // block each other. Matches Baileys pattern exactly.
+  // block each other.
 
   _dispatchAndAck(node, msgId, _isRetry) {
     const self   = this;
@@ -1659,8 +1647,8 @@ class MessageSender {
       key:  { remoteJid: toJid, fromMe: !!fromMe, id: origMsgId }
     });
     const msgBuf = encodeMessage('protocol', revokePayload);
-    // ProtocolMessage is one of the explicit "text" cases in whatsmeow's
-    // getTypeFromMessage; there is no "protocol" stanza type.
+    // A ProtocolMessage travels as stanza type "text"; there is no "protocol"
+    // stanza type.
     // _protocol marks it for the tcToken issuance gate — see _sendDMMessage.
     return this._sendMessage(toJid, msgId, msgBuf, 'text',
       { ...opts, edit: editBit, _protocol: true });

package/lib/messages/ReportingToken.js

@@ -16,10 +16,9 @@
 // not change the token. REPORTING_FIELDS below is that subset, and it is the
 // part that has to match byte for byte or the token is worthless.
 //
-// Ported field-for-field from Baileys' reporting-utils. whatsmeow derives the
-// key from (ownID, to) where Baileys uses the destination JID for both halves;
-// the reference followed here is Baileys, and since the server only checks the
-// token when a report is actually filed, neither choice is observable on send.
+// The key is derived using the destination JID for both halves. Since the
+// server only checks the token when a report is actually filed, the choice is
+// not observable on send.
 
 const crypto     = require('crypto');
 const { hkdf }   = require('@noble/hashes/hkdf');
@@ -121,8 +120,7 @@ function encodeVarint(value) {
 // The result is sorted by field number, which is what makes the token
 // independent of the order the encoder happened to write the fields in.
 //
-// Returns null on malformed input — the caller then attaches no token, which is
-// the same thing Baileys does.
+// Returns null on malformed input — the caller then attaches no token.
 function extractReportingTokenContent(data, cfg) {
   const out = [];
   let i = 0;

package/lib/messages/TcTokenStore.js

@@ -3,16 +3,14 @@
 const fs   = require('fs');
 const path = require('path');
 
-// 7-day buckets, 4 buckets = ~28-day rolling window (matches Baileys tc-token-utils)
+// 7-day buckets, 4 buckets = ~28-day rolling window
 const TC_BUCKET_DURATION = 604800;
 const TC_NUM_BUCKETS     = 4;
-// whatsmeow prunes expired rows out of the token table at most once a day
-// (tcTokenDBPruneInterval). Ours is a JSON file, so the same cadence applies.
+// Expired rows are pruned out of the token store at most once a day; it is a
+// JSON file, so there is nothing to gain from doing it more often.
 const TC_PRUNE_INTERVAL_MS = 24 * 60 * 60 * 1000;
 
 // The two phone-number ranges WhatsApp uses for bots, including Meta AI.
-// Byte-for-byte the same expression in whatsmeow (botUserRegex) and in
-// Baileys (BOT_PHONE_REGEX).
 const BOT_USER_RE = /^1313555\d{4}$|^131655500\d{2}$/;
 
 function tcTokenExpired(timestamp) {
@@ -35,9 +33,8 @@ function shouldSendNewTcToken(senderTimestamp) {
 
 // Whether a JID is a real person we may hold a trusted-contact token for.
 //
-// whatsmeow gates issuance with shouldSendTCTokenInChatAction and Baileys gates
-// both issuance and storage with isRegularUser; the two agree on the rule:
-// a user address (phone or LID), not the PSA pseudo-contact 0@…, not a bot.
+// The rule is: a user address (phone or LID), not the PSA pseudo-contact 0@…,
+// and not a bot.
 // Without it we issue a privacy IQ to WhatsApp's own announcement account and
 // to Meta AI, which no real client ever does.
 function isRegularTcTokenUser(jid) {
@@ -78,10 +75,8 @@ class TcTokenStore {
 
   // Drop entries that are past the 28-day window on both counts.
   //
-  // whatsmeow runs DeleteExpiredPrivacyTokens against the same cutoff and lets
-  // its in-memory sender-timestamp map age out on the same boundary. An entry
-  // whose token has expired but whose senderTimestamp is still inside the
-  // window has to stay: that timestamp is what keeps us from re-issuing on
+  // An entry whose token has expired but whose senderTimestamp is still inside
+  // the window has to stay: that timestamp is what keeps us from re-issuing on
   // every single send.
   pruneExpired() {
     let removed = 0;
@@ -134,15 +129,14 @@ class TcTokenStore {
   }
 
   get(jid) {
-    // whatsmeow prunes from ensureTCToken, i.e. on the read path, rate-limited
-    // to once a day. Same here.
+    // Pruning happens on the read path, rate-limited to once a day.
     this._maybePrune();
     return this._map.get(normalizeJidForTcToken(jid)) || null;
   }
 
   // Returns true when the token was accepted.
   //
-  // Two rejections, both taken from Baileys' storeTcTokensFromIqResult:
+  // Two rejections:
   //  - a token with no timestamp is already expired by definition, so storing
   //    it only wastes a slot and guarantees a miss on the next send;
   //  - a token older than the one on file must never overwrite it. Token

package/lib/noise.js

@@ -449,10 +449,9 @@ class NoiseSocket extends EventEmitter {
           // for a bug in the client; the credentials were rejected by the
           // server, which is a different thing and has different remedies.
           //
-          // The names and numbers are whatsmeow's ConnectFailureReason, which
-          // is the only place they are written down — WhatsApp publishes none
-          // of this. Codes marked "wipe" are the ones its IsLoggedOut() covers:
-          // the session is finished and retrying with it is pointless.
+          // WhatsApp publishes none of this, so the meanings below come from
+          // observing the server. Codes marked "wipe" mean the session is
+          // finished and retrying with it is pointless.
           const FAILURE = {
             '400': { wipe: false, text: 'generic failure.' },
             '401': { wipe: true,  text: 'logged out. The session was unpaired ' +

package/lib/proto/MessageProto.js

@@ -226,10 +226,10 @@ function encodePollOption(name) {
 // PollCreationMessage { encKey=1, name=2, options=3, selectableOptionsCount=4 }
 //
 // The 32-byte secret was being written to encKey, inside the poll itself.
-// whatsmeow's BuildPollCreation leaves encKey unset and puts the secret in
-// Message.messageContextInfo.messageSecret instead — which is the copy a voter
-// derives their vote key from. In the wrong place it reached nobody, so the
-// poll could not be voted on.
+// encKey has to stay unset; the secret belongs in
+// Message.messageContextInfo.messageSecret, which is the copy a voter derives
+// their vote key from. In the wrong place it reached nobody, so the poll could
+// not be voted on.
 function encodePollCreationMessage(opts) {
   const messageSecret = opts.messageSecret || opts.encKey ||
     require('crypto').randomBytes(32);

package/lib/signal/SignalProtocol.js

@@ -278,15 +278,15 @@ class SignalProtocol {
 
   // ─── SenderKey group encrypt / decrypt ────────────────────────────────────
   //
-  // Uses WaSignalGroup GroupCipher/GroupSessionBuilder (Baileys-compatible).
+  // Uses WaSignalGroup GroupCipher/GroupSessionBuilder.
   // SenderKeyName format: groupId::senderId::0 (device 0 for group identity).
 
   _senderKeyName(groupId, senderId) {
     // A SenderKey belongs to a device, not to an account. Every device that
     // posts to a group distributes its own key, so the name has to carry the
-    // device index the way Baileys and whatsmeow do — otherwise two devices of
-    // the same person share one slot and the second one to speak overwrites
-    // the first, leaving its messages undecryptable.
+    // device index — otherwise two devices of the same person share one slot
+    // and the second one to speak overwrites the first, leaving its messages
+    // undecryptable.
     //
     // Bare JIDs still resolve to device 0, so everything already on disk keeps
     // the exact same key string.

package/lib/signal/SignalStore.js

@@ -209,8 +209,8 @@ class SignalStore {
   // SessionCipher.encrypt — which throws "No open session". bulkEncryptForDevices
   // drops whatever it cannot encrypt, so the stanza went out with a <to> entry
   // missing for that device and the server nacked the whole send with ack 479.
-  // Baileys hit the same class of bug with its peerSessionsCache and fixed it by
-  // validating through haveOpenSession() on every check.
+  // The fix is to validate the record itself on every check rather than
+  // trusting that a cached entry still holds an open session.
   hasSession(encodedAddress) {
     if (!this._openSessionMemo) this._openSessionMemo = new Map();
     const data = this._sessions[encodedAddress];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.9.1",
+  "version": "5.9.2",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto50",
   "main": "index.js",