zapo-js 0.3.0 → 1.0.0

package/dist/esm/client/coordinators/WaMessageDispatchCoordinator.js

@@ -1,70 +1,49 @@
 import { randomBytesAsync, sha256 } from '../../crypto/index.js';
 import { md5Bytes } from '../../crypto/core/primitives.js';
 import { PromiseDedup } from '../../infra/perf/PromiseDedup.js';
-import { ensureMessageSecret } from '../../message/index.js';
-import { needsSecretPersistence, resolveEditAttr, resolveEncMediaType, resolveMessageTypeAttr, resolveMetaAttrs } from '../../message/content.js';
-import { wrapDeviceSentMessage } from '../../message/device-sent.js';
-import { injectDeviceListMetadata, resolveIcdcMeta } from '../../message/icdc.js';
-import { writeRandomPadMax16 } from '../../message/padding.js';
-import { computePhashV2 } from '../../message/phash.js';
-import { buildReportingTokenArtifacts } from '../../message/reporting-token.js';
+import { assertMessageSecret, ensureMessageSecret } from '../../message/index.js';
+import { applyContextInfo, resolveSendContextInfo } from '../../message/context-info.js';
+import { injectDeviceListMetadata, resolveIcdcMeta } from '../../message/crypto/icdc.js';
+import { computePhashV2 } from '../../message/crypto/phash.js';
+import { buildReportingTokenArtifacts } from '../../message/crypto/reporting-token.js';
+import { isSendAddonCryptoMessage, isSendMediaMessage, isSendTextMessage, needsSecretPersistence, resolveButtonAddonKind, resolveDecryptFailAttr, resolveEditAttr, resolveEncMediaType, resolveMessageTypeAttr, resolveMetaAttrs, wrapAsViewOnce } from '../../message/encode/content.js';
+import { wrapDeviceSentMessage } from '../../message/encode/device-sent.js';
+import { writeRandomPadMax16 } from '../../message/encode/padding.js';
+import { buildBotInvokeProtoCopy, extractInvokedBotJid, genBotMsgSecret } from '../../message/kinds/bot.js';
 import { proto } from '../../proto.js';
 import { WA_DEFAULTS } from '../../protocol/constants.js';
-import { isGroupJid, isLidJid, normalizeDeviceJid, normalizeRecipientJid, parseJidFull, parseSignalAddressFromJid, signalAddressKey, toUserJid } from '../../protocol/jid.js';
+import { isBotJid, isGroupJid, isHostedDeviceJid, isLidJid, isNewsletterJid, normalizeDeviceJid, normalizeRecipientJid, parseJidFull, parseSignalAddressFromJid, signalAddressKey, toUserJid } from '../../protocol/jid.js';
 import { encodeBinaryNode } from '../../transport/binary/index.js';
-import { buildDirectMessageFanoutNode, buildGroupSenderKeyMessageNode, buildMetaNode } from '../../transport/node/builders/message.js';
-import { bytesToHex, concatBytes, TEXT_ENCODER } from '../../util/bytes.js';
+import { buildButtonAddonNode, buildDirectMessageFanoutNode, buildGroupSenderKeyMessageNode, buildMetaNode } from '../../transport/node/builders/message.js';
+import { bytesToHex, TEXT_ENCODER } from '../../util/bytes.js';
 import { toError } from '../../util/primitives.js';
 export class WaMessageDispatchCoordinator {
     constructor(options) {
         this.icdcDedup = new PromiseDedup();
         this.privacyTokenDedup = new PromiseDedup();
         this.distributionDedup = new PromiseDedup();
-        this.logger = options.logger;
-        this.messageClient = options.messageClient;
-        this.retryTracker = options.retryTracker;
-        this.sessionResolver = options.sessionResolver;
-        this.fanoutResolver = options.fanoutResolver;
-        this.participantsCache = options.participantsCache;
-        this.appStateSyncKeyProtocol = options.appStateSyncKeyProtocol;
-        this.buildMessageContent = options.buildMessageContent;
-        this.senderKeyManager = options.senderKeyManager;
-        this.signalProtocol = options.signalProtocol;
-        this.signalStore = options.signalStore;
-        this.sessionStore = options.sessionStore;
-        this.identityStore = options.identityStore;
-        this.deviceListStore = options.deviceListStore;
-        this.messageSecretStore = options.messageSecretStore;
-        this.getCurrentMeJid = options.getCurrentMeJid;
-        this.getCurrentMeLid = options.getCurrentMeLid;
-        this.getCurrentSignedIdentity = options.getCurrentSignedIdentity;
-        this.resolvePrivacyTokenNode = options.resolvePrivacyTokenNode;
-        this.onDirectMessageSent = options.onDirectMessageSent;
-        this.getIcdcHashLength = options.getIcdcHashLength;
+        this.deps = options;
         this.mobileMessageIdFormat = options.mobileMessageIdFormat ?? false;
+        this.serverClock = options.serverClock;
     }
     async publishMessageNode(node, options = {}) {
-        this.logger.debug('wa client publish message node', {
+        this.deps.logger.trace('wa client publish message node', {
             tag: node.tag,
             type: node.attrs.type,
             to: node.attrs.to
         });
-        const messageType = node.attrs.type ?? 'text';
         const replayPayload = {
             mode: 'opaque_node',
             node: encodeBinaryNode(node)
         };
-        return this.retryTracker.track({
+        return this.deps.retryTracker.track({
             messageIdHint: node.attrs.id,
             toJid: node.attrs.to,
-            type: messageType,
-            replayPayload,
-            participantJid: node.attrs.participant,
-            recipientJid: node.attrs.recipient
-        }, async () => this.messageClient.publishNode(node, options));
+            replayPayload
+        }, async () => this.deps.messageClient.publishNode(node, options));
     }
     async publishEncryptedMessage(input, options = {}) {
-        this.logger.debug('wa client publish encrypted message', {
+        this.deps.logger.trace('wa client publish encrypted message', {
             to: input.to,
             type: input.type,
             encType: input.encType
@@ -77,14 +56,12 @@ export class WaMessageDispatchCoordinator {
             ciphertext: input.ciphertext,
             participant: input.participant
         };
-        return this.retryTracker.track({
+        return this.deps.retryTracker.track({
             messageIdHint: input.id,
             toJid: input.to,
-            type: input.type ?? 'text',
             replayPayload,
-            participantJid: input.participant,
             eligibleRequesterDeviceJids: [input.to]
-        }, async () => this.messageClient.publishEncrypted(input, options));
+        }, async () => this.deps.messageClient.publishEncrypted(input, options));
     }
     async publishSignalMessage(input, options = {}) {
         this.requireCurrentMeJid('publishSignalMessage');
@@ -92,30 +69,29 @@ export class WaMessageDispatchCoordinator {
         if (address.server === WA_DEFAULTS.GROUP_SERVER) {
             throw new Error('publishSignalMessage currently supports only direct chats; use sender-key flow for groups');
         }
-        this.logger.debug('wa client publish signal message', {
+        this.deps.logger.trace('wa client publish signal message', {
             to: input.to,
             type: input.type
         });
         const [paddedPlaintext] = await Promise.all([
             writeRandomPadMax16(input.plaintext),
-            this.sessionResolver.ensureSession(address, input.to, input.expectedIdentity)
+            this.deps.sessionResolver.ensureSession(address, input.to, input.expectedIdentity)
         ]);
-        const encrypted = await this.signalProtocol.encryptMessage(address, paddedPlaintext, input.expectedIdentity);
+        const encrypted = await this.deps.signalProtocol.encryptMessage(address, paddedPlaintext, input.expectedIdentity);
         const messageType = input.type ?? 'text';
+        const deviceIdentity = encrypted.type === 'pkmsg' ? this.getEncodedSignedDeviceIdentity() : undefined;
         const replayPayload = {
             mode: 'plaintext',
             to: input.to,
             type: messageType,
             plaintext: paddedPlaintext
         };
-        return this.retryTracker.track({
+        return this.deps.retryTracker.track({
             messageIdHint: input.id,
             toJid: input.to,
-            type: messageType,
             replayPayload,
-            participantJid: input.participant,
             eligibleRequesterDeviceJids: [input.to]
-        }, async () => this.messageClient.publishEncrypted({
+        }, async () => this.deps.messageClient.publishEncrypted({
             to: input.to,
             encType: encrypted.type,
             ciphertext: encrypted.ciphertext,
@@ -124,33 +100,130 @@ export class WaMessageDispatchCoordinator {
             category: input.category,
             pushPriority: input.pushPriority,
             participant: input.participant,
-            deviceFanout: input.deviceFanout
+            deviceFanout: input.deviceFanout,
+            deviceIdentity,
+            metaNode: input.metaNode
         }, options));
     }
     async sendMessage(to, content, options = {}) {
         const recipientJid = normalizeRecipientJid(to);
-        const [message, sendOptions] = await Promise.all([
-            this.buildMessageContent(content),
-            this.withResolvedMessageId(options)
-        ]);
-        const messageWithSecret = await ensureMessageSecret(message);
+        if (isNewsletterJid(recipientJid)) {
+            if (!this.deps.sendNewsletterMessage) {
+                throw new Error('newsletter sendMessage requires sendNewsletterMessage dependency');
+            }
+            const newsletterCtx = resolveSendContextInfo({
+                contentLevel: pickContentContextInfo(content),
+                optionsLevel: options.contextInfo,
+                quote: options.quote,
+                forward: options.forward,
+                mentions: options.mentions
+            });
+            assertNewsletterContextInfoCompatible(newsletterCtx);
+            const sendOptions = await this.withResolvedMessageId(options);
+            return this.deps.sendNewsletterMessage(recipientJid, content, sendOptions, newsletterCtx);
+        }
+        let built;
+        let sendOptions;
+        if (isSendAddonCryptoMessage(content)) {
+            sendOptions = await this.withResolvedMessageId(options);
+            const meJid = this.deps.getCurrentCredentials()?.meJid;
+            if (!meJid) {
+                throw new Error(`${content.type} sendMessage requires registered meJid`);
+            }
+            built = await this.deps.buildMessageContent(content, {
+                to: recipientJid,
+                outgoingStanzaId: sendOptions.id,
+                meJid: toUserJid(meJid)
+            });
+        }
+        else {
+            ;
+            [built, sendOptions] = await Promise.all([
+                this.deps.buildMessageContent(content, { to: recipientJid }),
+                this.withResolvedMessageId(options)
+            ]);
+        }
+        let optionsCtx = options.contextInfo;
+        if (options.expirationSeconds !== undefined) {
+            optionsCtx = { ...optionsCtx, expirationSeconds: options.expirationSeconds };
+        }
+        if (isGroupJid(recipientJid) &&
+            optionsCtx?.expirationSeconds === undefined &&
+            !options.disableGroupEphemeralAutoInject) {
+            const cachedEphemeral = await this.deps.groupMetadataCache.resolveEphemeral(recipientJid);
+            if (cachedEphemeral !== null && cachedEphemeral > 0) {
+                optionsCtx = { ...optionsCtx, expirationSeconds: cachedEphemeral };
+            }
+        }
+        const ctx = resolveSendContextInfo({
+            contentLevel: pickContentContextInfo(content),
+            optionsLevel: optionsCtx,
+            quote: options.quote,
+            forward: options.forward,
+            mentions: options.mentions,
+            meLid: this.deps.getCurrentCredentials()?.meLid
+        });
+        const withCtx = ctx ? applyContextInfo(built.message, ctx) : built.message;
+        const withViewOnce = options.viewOnce ? wrapAsViewOnce(withCtx) : withCtx;
+        const editKey = options.editKey;
+        let editId;
+        let editParticipant;
+        let editTimestamp;
+        if (editKey) {
+            if ('rawNode' in editKey) {
+                editId = editKey.key?.id ?? undefined;
+                editParticipant = editKey.key?.participant ?? undefined;
+            }
+            else {
+                editId = editKey.id;
+                editParticipant = editKey.participant;
+                editTimestamp = 'timestampMs' in editKey ? editKey.timestampMs : undefined;
+            }
+        }
+        const message = editKey
+            ? {
+                protocolMessage: {
+                    type: proto.Message.ProtocolMessage.Type.MESSAGE_EDIT,
+                    key: {
+                        remoteJid: recipientJid,
+                        fromMe: true,
+                        id: editId,
+                        ...(editParticipant ? { participant: editParticipant } : {})
+                    },
+                    editedMessage: withViewOnce,
+                    timestampMs: editTimestamp ?? this.serverClock.nowMs()
+                }
+            }
+            : withViewOnce;
+        const upload = built.upload;
+        const messageWithOverride = options.messageSecret
+            ? {
+                ...message,
+                messageContextInfo: {
+                    ...(message.messageContextInfo ?? {}),
+                    messageSecret: assertMessageSecret(options.messageSecret, 'options.messageSecret')
+                }
+            }
+            : message;
+        const messageWithSecret = await ensureMessageSecret(messageWithOverride);
         const rawSecret = messageWithSecret.messageContextInfo?.messageSecret;
         if (rawSecret &&
             rawSecret.length > 0 &&
             sendOptions.id &&
             needsSecretPersistence(messageWithSecret)) {
-            const meJid = this.getCurrentMeJid() ?? '';
-            void this.messageSecretStore
+            const meJid = this.deps.getCurrentCredentials()?.meJid ?? '';
+            void this.deps.messageSecretStore
                 .set(sendOptions.id, { secret: rawSecret, senderJid: meJid })
                 .catch((error) => {
-                this.logger.warn('failed to persist outgoing message secret', {
+                this.deps.logger.warn('failed to persist outgoing message secret', {
                     id: sendOptions.id,
+                    to: recipientJid,
                     message: toError(error).message
                 });
             });
         }
-        const meJid = this.getCurrentMeJid();
-        const regInfo = meJid ? await this.signalStore.getRegistrationInfo() : null;
+        const meJid = this.deps.getCurrentCredentials()?.meJid;
+        const regInfo = meJid ? await this.deps.signalStore.getRegistrationInfo() : null;
         const localPubKey = regInfo?.identityKeyPair.pubKey;
         const meParsed = meJid ? parseJidFull(meJid) : undefined;
         const meUserJid = meParsed?.userJid;
@@ -162,67 +235,343 @@ export class WaMessageDispatchCoordinator {
         ]);
         const messageWithIcdc = injectDeviceListMetadata(messageWithSecret, senderIcdc, recipientIcdc);
         const plaintext = await writeRandomPadMax16(proto.Message.encode(messageWithIcdc).finish());
-        const type = resolveMessageTypeAttr(messageWithIcdc);
-        const edit = resolveEditAttr(messageWithIcdc, sendOptions.subtype) ?? undefined;
-        const mediatype = resolveEncMediaType(messageWithIcdc) ?? undefined;
+        const buttonAddonKind = resolveButtonAddonKind(messageWithIcdc);
+        const buttonAddonNode = buttonAddonKind ? buildButtonAddonNode(buttonAddonKind) : undefined;
+        // when a <biz> companion is attached the stanza must advertise type=text and
+        // omit enc.mediatype; sending type=media + mediatype=list/button alongside the
+        // companion is rejected by the server as SMAX_INVALID (479).
+        const type = buttonAddonKind ? 'text' : resolveMessageTypeAttr(messageWithIcdc);
+        const edit = resolveEditAttr(messageWithIcdc) ?? undefined;
+        const mediatype = buttonAddonKind
+            ? undefined
+            : (resolveEncMediaType(messageWithIcdc) ?? undefined);
         const metaAttrs = resolveMetaAttrs(messageWithIcdc);
         const metaNode = metaAttrs ? buildMetaNode(metaAttrs) : undefined;
-        if (isGroup) {
-            if (this.shouldUseGroupDirectPath(messageWithIcdc)) {
-                return this.publishGroupDirectMessage(recipientJid, messageWithIcdc, plaintext, type, sendOptions, {}, edit, mediatype, metaNode);
+        const customNodes = [];
+        if (metaNode)
+            customNodes.push(metaNode);
+        if (buttonAddonNode)
+            customNodes.push(buttonAddonNode);
+        if (options.customNodes) {
+            for (const node of options.customNodes) {
+                customNodes.push(node);
             }
-            return this.publishGroupSenderKeyMessage(recipientJid, messageWithIcdc, plaintext, type, sendOptions, {}, edit, mediatype, metaNode);
         }
-        const directRecipientJid = toUserJid(recipientJid);
-        return this.publishDirectSignalMessageWithFanout(directRecipientJid, messageWithIcdc, plaintext, type, sendOptions, edit, mediatype, metaNode);
+        const decryptFail = resolveDecryptFailAttr(messageWithIcdc);
+        const envelope = {
+            message: messageWithIcdc,
+            plaintext,
+            type,
+            edit,
+            mediatype,
+            decryptFail,
+            customNodes: customNodes.length > 0 ? customNodes : undefined,
+            sendOptions
+        };
+        const directRecipientJid = isGroup
+            ? recipientJid
+            : await this.resolveDirectRecipientLid(toUserJid(recipientJid));
+        const publishResult = isGroup
+            ? this.shouldUseGroupDirectPath(messageWithIcdc)
+                ? await this.publishGroupDirectMessage(recipientJid, envelope)
+                : await this.publishGroupSenderKeyMessage(recipientJid, envelope)
+            : await this.publishDirectSignalMessageWithFanout(directRecipientJid, envelope);
+        return upload ? { ...publishResult, upload } : publishResult;
+    }
+    /**
+     * For a 1:1 recipient passed in PN form, returns the LID-addressed user JID
+     * (cache-first; falls back to a one-shot `queryLidsByPhoneJids`). Switching
+     * to LID before fanout ensures the envelope, eligible-requester list, and
+     * retry-receipt addressing all agree, which keeps the retry tracker from
+     * rejecting receipts that arrive in LID form. Returns the original PN if
+     * no LID is known/resolvable. Inputs already in LID form pass through.
+     */
+    async resolveDirectRecipientLid(pnUserJid) {
+        if (isLidJid(pnUserJid))
+            return pnUserJid;
+        const cached = await this.deps.deviceListStore.findByAnyUserJid(pnUserJid);
+        if (cached) {
+            if (isLidJid(cached.userJid))
+                return cached.userJid;
+            if (cached.altUserJid && isLidJid(cached.altUserJid))
+                return cached.altUserJid;
+        }
+        try {
+            const results = await this.deps.signalDeviceSync.queryLidsByPhoneJids([pnUserJid]);
+            const match = results.find((entry) => entry.phoneJid === pnUserJid);
+            if (match?.lidJid)
+                return match.lidJid;
+        }
+        catch (error) {
+            this.deps.logger.debug('lid resolution failed for direct recipient', {
+                pnUserJid,
+                message: toError(error).message
+            });
+        }
+        return pnUserJid;
     }
     async syncSignalSession(jid, reasonIdentity = false) {
         const address = parseSignalAddressFromJid(jid);
         if (address.server === WA_DEFAULTS.GROUP_SERVER) {
             throw new Error('syncSignalSession supports only direct chats');
         }
-        await this.sessionResolver.ensureSession(address, jid, undefined, reasonIdentity);
+        await this.deps.sessionResolver.ensureSession(address, jid, undefined, reasonIdentity);
     }
     async sendReceipt(input) {
-        await this.messageClient.sendReceipt(input);
+        await this.deps.messageClient.sendReceipt(input);
+    }
+    async publishProtocolMessageToDevice(deviceJid, protocolMessage, options) {
+        const meJid = this.deps.getCurrentCredentials()?.meJid;
+        const meParsed = meJid ? parseJidFull(meJid) : undefined;
+        const meUserJid = meParsed?.userJid;
+        let senderIcdc = null;
+        if (meUserJid) {
+            const regInfo = await this.deps.signalStore.getRegistrationInfo();
+            const localPubKey = regInfo?.identityKeyPair.pubKey;
+            const localIdentity = meParsed && localPubKey
+                ? { address: meParsed.address, pubKey: localPubKey }
+                : undefined;
+            senderIcdc = await this.resolveUserIcdc(meUserJid, localIdentity);
+        }
+        const message = injectDeviceListMetadata({ protocolMessage }, senderIcdc, null);
+        return this.publishSignalMessage({
+            to: deviceJid,
+            plaintext: proto.Message.encode(message).finish(),
+            id: options?.id,
+            type: 'text',
+            category: 'peer',
+            pushPriority: options?.pushPriority ?? 'high',
+            metaNode: buildMetaNode({ appdata: 'default' })
+        });
+    }
+    async publishStatusMessage(input) {
+        if (input.recipients.length === 0) {
+            throw new Error('publishStatusMessage requires at least one recipient');
+        }
+        this.requireCurrentMeJid('publishStatusMessage');
+        const meLid = this.deps.getCurrentCredentials()?.meLid;
+        if (!meLid) {
+            throw new Error('publishStatusMessage requires current me lid');
+        }
+        const senderJid = normalizeDeviceJid(meLid);
+        const meUserLid = toUserJid(meLid);
+        const seen = new Set();
+        const recipientsWithSelf = [];
+        for (const jid of input.recipients) {
+            if (seen.has(jid))
+                continue;
+            seen.add(jid);
+            recipientsWithSelf.push(jid);
+        }
+        if (!seen.has(meUserLid)) {
+            recipientsWithSelf.push(meUserLid);
+        }
+        const statusSetting = input.statusSetting ?? 'contacts';
+        return this.publishSenderKeyFanout({
+            groupJid: WA_DEFAULTS.STATUS_BROADCAST_JID,
+            senderJid,
+            recipients: recipientsWithSelf,
+            message: input.message,
+            options: input.options ?? {},
+            logTag: 'status',
+            replayStatusSetting: statusSetting,
+            // Bare `<to jid=user>` ack hints route the skmsg through primary
+            // devices that already hold the sender key.
+            customize: async ({ fanoutDeviceJids, distributionParticipants, messageWithSecret, sendOptions }) => {
+                const distributedAddressKeys = new Set();
+                for (let i = 0; i < distributionParticipants.length; i += 1) {
+                    distributedAddressKeys.add(signalAddressKey(distributionParticipants[i].address));
+                }
+                const ackHints = [];
+                const seenAck = new Set();
+                for (let i = 0; i < fanoutDeviceJids.length; i += 1) {
+                    const deviceJid = fanoutDeviceJids[i];
+                    const address = parseSignalAddressFromJid(deviceJid);
+                    if (distributedAddressKeys.has(signalAddressKey(address)))
+                        continue;
+                    if (address.device !== 0)
+                        continue;
+                    const userJid = toUserJid(deviceJid);
+                    if (seenAck.has(userJid))
+                        continue;
+                    seenAck.add(userJid);
+                    ackHints.push({ jid: userJid });
+                }
+                const reportingArtifacts = await this.tryBuildReportingTokenArtifacts({
+                    message: messageWithSecret,
+                    stanzaId: sendOptions.id,
+                    senderUserJid: toUserJid(senderJid),
+                    remoteJid: WA_DEFAULTS.STATUS_BROADCAST_JID,
+                    context: 'status'
+                });
+                const customNodes = [buildMetaNode({ status_setting: statusSetting })];
+                if (reportingArtifacts?.node)
+                    customNodes.push(reportingArtifacts.node);
+                return {
+                    extraParticipants: ackHints,
+                    customNodes
+                };
+            }
+        });
+    }
+    async publishBroadcastListMessage(input) {
+        if (input.recipients.length === 0) {
+            throw new Error('publishBroadcastListMessage requires at least one recipient');
+        }
+        const meJid = this.requireCurrentMeJid('publishBroadcastListMessage');
+        const senderJid = normalizeDeviceJid(meJid);
+        return this.publishSenderKeyFanout({
+            groupJid: input.listJid,
+            senderJid,
+            recipients: input.recipients,
+            message: input.message,
+            options: input.options ?? {},
+            logTag: 'broadcast list',
+            customize: ({ fanoutDeviceJids }) => {
+                const phashTargets = new Array(fanoutDeviceJids.length + 1);
+                let phashTargetCount = 0;
+                for (let i = 0; i < fanoutDeviceJids.length; i += 1) {
+                    const candidate = fanoutDeviceJids[i];
+                    if (isHostedDeviceJid(candidate))
+                        continue;
+                    phashTargets[phashTargetCount] = candidate;
+                    phashTargetCount += 1;
+                }
+                phashTargets[phashTargetCount] = senderJid;
+                phashTargets.length = phashTargetCount + 1;
+                return Promise.resolve({ phash: computePhashV2(phashTargets) });
+            }
+        });
+    }
+    async publishSenderKeyFanout(input) {
+        const sendOptions = await this.withResolvedMessageId(input.options);
+        const sender = parseSignalAddressFromJid(input.senderJid);
+        const messageWithSecret = await ensureMessageSecret(input.message);
+        const plaintext = await writeRandomPadMax16(proto.Message.encode(messageWithSecret).finish());
+        const { distributionMessage, ciphertext: groupCiphertext, keyId: senderKeyId } = await this.deps.senderKeyManager.prepareGroupEncryption(input.groupJid, sender, plaintext);
+        const { fanoutDeviceJids, distributionParticipants } = await this.encryptGroupDistributionParticipants(input.groupJid, senderKeyId, distributionMessage, input.recipients);
+        let shouldAttachDeviceIdentity = false;
+        for (let i = 0; i < distributionParticipants.length; i += 1) {
+            if (distributionParticipants[i].encType === 'pkmsg') {
+                shouldAttachDeviceIdentity = true;
+                break;
+            }
+        }
+        const extras = input.customize
+            ? await input.customize({
+                fanoutDeviceJids,
+                distributionParticipants,
+                messageWithSecret,
+                sendOptions
+            })
+            : {};
+        const participants = distributionParticipants.map((p) => ({
+            jid: p.jid,
+            encType: p.encType,
+            ciphertext: p.ciphertext
+        }));
+        if (extras.extraParticipants) {
+            for (const entry of extras.extraParticipants) {
+                participants.push(entry);
+            }
+        }
+        const messageNode = buildGroupSenderKeyMessageNode({
+            to: input.groupJid,
+            type: resolveMessageTypeAttr(messageWithSecret),
+            id: sendOptions.id,
+            phash: extras.phash,
+            edit: resolveEditAttr(messageWithSecret) ?? undefined,
+            mediatype: resolveEncMediaType(messageWithSecret) ?? undefined,
+            decryptFail: resolveDecryptFailAttr(messageWithSecret),
+            groupCiphertext: groupCiphertext.ciphertext,
+            participants,
+            deviceIdentity: shouldAttachDeviceIdentity
+                ? this.getEncodedSignedDeviceIdentity()
+                : undefined,
+            customNodes: extras.customNodes,
+            additionalAttributes: sendOptions.additionalAttributes
+        });
+        const replayPayload = {
+            mode: 'plaintext',
+            to: input.groupJid,
+            type: messageNode.attrs.type,
+            plaintext,
+            ...(input.replayStatusSetting ? { statusSetting: input.replayStatusSetting } : {})
+        };
+        const result = await this.deps.retryTracker.track({
+            messageIdHint: messageNode.attrs.id ?? sendOptions.id,
+            toJid: input.groupJid,
+            replayPayload,
+            eligibleRequesterDeviceJids: undefined
+        }, async () => this.deps.messageClient.publishNode(messageNode, sendOptions));
+        const distributedAddresses = new Array(distributionParticipants.length);
+        for (let i = 0; i < distributionParticipants.length; i += 1) {
+            distributedAddresses[i] = distributionParticipants[i].address;
+        }
+        try {
+            await this.deps.senderKeyManager.markSenderKeyDistributed(input.groupJid, senderKeyId, distributedAddresses);
+        }
+        catch (error) {
+            this.deps.logger.warn('failed to mark sender key distribution targets', {
+                logTag: input.logTag,
+                groupJid: input.groupJid,
+                participants: distributedAddresses.length,
+                message: toError(error).message
+            });
+        }
+        return result;
     }
     async requestAppStateSyncKeys(keyIds) {
-        return this.appStateSyncKeyProtocol.requestKeys(keyIds);
+        return this.deps.appStateSyncKeyProtocol.requestKeys(keyIds);
     }
     async sendAppStateSyncKeyShare(toDeviceJid, keys, missingKeyIds = []) {
-        await this.appStateSyncKeyProtocol.sendKeyShare(toDeviceJid, keys, missingKeyIds);
+        await this.deps.appStateSyncKeyProtocol.sendKeyShare(toDeviceJid, keys, missingKeyIds);
     }
-    async mutateParticipantsCacheFromGroupEvent(event) {
-        await this.participantsCache.mutateFromGroupEvent(event);
+    async mutateGroupMetadataCacheFromGroupEvent(event) {
+        await this.deps.groupMetadataCache.mutateFromGroupEvent(event);
     }
+    // noop for now
     shouldUseGroupDirectPath(message) {
-        const protocolType = message.protocolMessage?.type;
-        if (protocolType === proto.Message.ProtocolMessage.Type.REVOKE ||
-            protocolType === proto.Message.ProtocolMessage.Type.MESSAGE_EDIT) {
-            return true;
-        }
-        return message.keepInChatMessage?.keepType === proto.KeepType.UNDO_KEEP_FOR_ALL;
+        return false;
     }
-    async publishGroupDirectMessage(groupJid, message, plaintext, type, options, retryContext = {}, edit, mediatype, metaNode) {
-        const sendOptions = await this.withResolvedMessageId(options);
+    async publishGroupDirectMessage(groupJid, envelope, retryContext = {}) {
+        const { message, plaintext, type, edit, mediatype, sendOptions } = envelope;
         const meJid = this.requireCurrentMeJid('sendMessage');
         const participantUserJids = retryContext.forceRefreshParticipants
-            ? await this.participantsCache.refreshParticipantUsers(groupJid)
-            : await this.participantsCache.resolveParticipantUsers(groupJid);
+            ? await this.deps.groupMetadataCache.refreshParticipantUsers(groupJid)
+            : await this.deps.groupMetadataCache.resolveParticipantUsers(groupJid);
         const addressingMode = retryContext.forceAddressingMode ??
             this.resolveGroupAddressingMode(participantUserJids, groupJid);
         const senderForPhash = this.resolveSenderForAddressingMode(addressingMode, meJid);
-        const fanoutDeviceJids = await this.fanoutResolver.resolveGroupParticipantDeviceJids(participantUserJids);
+        const fanoutDeviceJids = await this.deps.fanoutResolver.resolveGroupParticipantDeviceJids(participantUserJids);
         if (fanoutDeviceJids.length === 0) {
             throw new Error('group direct send resolved no target devices');
         }
-        const resolvedFanoutTargets = await this.sessionResolver.ensureSessionsBatch(fanoutDeviceJids);
+        const resolvedFanoutTargets = await this.deps.sessionResolver.ensureSessionsBatch(fanoutDeviceJids);
+        const resolvedNormalizedJids = new Set();
+        for (let index = 0; index < resolvedFanoutTargets.length; index += 1) {
+            resolvedNormalizedJids.add(resolvedFanoutTargets[index].jid);
+        }
         const uniqueNormalizedFanoutJids = new Set();
         for (let index = 0; index < fanoutDeviceJids.length; index += 1) {
             uniqueNormalizedFanoutJids.add(normalizeDeviceJid(fanoutDeviceJids[index]));
         }
-        if (resolvedFanoutTargets.length !== uniqueNormalizedFanoutJids.size) {
-            throw new Error('group direct send resolved incomplete signal sessions');
+        const droppedDevices = [];
+        for (const expected of uniqueNormalizedFanoutJids) {
+            if (!resolvedNormalizedJids.has(expected)) {
+                droppedDevices.push(expected);
+            }
+        }
+        if (droppedDevices.length > 0) {
+            this.deps.logger.warn('group direct fanout dropping devices without signal session', {
+                groupJid,
+                droppedCount: droppedDevices.length,
+                totalExpected: uniqueNormalizedFanoutJids.size,
+                sample: droppedDevices.slice(0, 3)
+            });
+        }
+        if (resolvedFanoutTargets.length === 0) {
+            throw new Error('group direct send resolved no signal sessions');
         }
         const participantEncryptRequests = new Array(resolvedFanoutTargets.length);
         for (let index = 0; index < resolvedFanoutTargets.length; index += 1) {
@@ -232,7 +581,7 @@ export class WaMessageDispatchCoordinator {
                 plaintext
             };
         }
-        const encryptedParticipants = await this.signalProtocol.encryptMessagesBatch(participantEncryptRequests, resolvedFanoutTargets);
+        const encryptedParticipants = await this.deps.signalProtocol.encryptMessagesBatch(participantEncryptRequests, resolvedFanoutTargets);
         const participants = new Array(resolvedFanoutTargets.length);
         for (let index = 0; index < resolvedFanoutTargets.length; index += 1) {
             const target = resolvedFanoutTargets[index];
@@ -250,20 +599,27 @@ export class WaMessageDispatchCoordinator {
             }
         }
         const phashTargets = new Array(resolvedFanoutTargets.length + 1);
+        let phashTargetCount = 0;
         for (let index = 0; index < resolvedFanoutTargets.length; index += 1) {
-            phashTargets[index] = resolvedFanoutTargets[index].jid;
-        }
-        phashTargets[resolvedFanoutTargets.length] = senderForPhash;
-        const [localPhash, reportingArtifacts] = await Promise.all([
-            computePhashV2(phashTargets),
-            this.tryBuildReportingTokenArtifacts({
-                message,
-                stanzaId: sendOptions.id,
-                senderUserJid: toUserJid(senderForPhash),
-                remoteJid: groupJid,
-                context: 'group_direct'
-            })
-        ]);
+            const candidate = resolvedFanoutTargets[index].jid;
+            if (isHostedDeviceJid(candidate))
+                continue;
+            phashTargets[phashTargetCount] = candidate;
+            phashTargetCount += 1;
+        }
+        phashTargets[phashTargetCount] = senderForPhash;
+        phashTargets.length = phashTargetCount + 1;
+        const localPhash = computePhashV2(phashTargets);
+        const reportingArtifacts = await this.tryBuildReportingTokenArtifacts({
+            message,
+            stanzaId: sendOptions.id,
+            senderUserJid: toUserJid(senderForPhash),
+            remoteJid: groupJid,
+            context: 'group_direct'
+        });
+        const customNodes = envelope.customNodes ? [...envelope.customNodes] : [];
+        if (reportingArtifacts?.node)
+            customNodes.push(reportingArtifacts.node);
         const messageNode = buildDirectMessageFanoutNode({
             to: groupJid,
             type,
@@ -275,9 +631,10 @@ export class WaMessageDispatchCoordinator {
             deviceIdentity: shouldAttachDeviceIdentity
                 ? this.getEncodedSignedDeviceIdentity()
                 : undefined,
-            reportingNode: reportingArtifacts?.node ?? undefined,
-            metaNode,
-            mediatype
+            customNodes: customNodes.length > 0 ? customNodes : undefined,
+            mediatype,
+            decryptFail: envelope.decryptFail,
+            additionalAttributes: sendOptions.additionalAttributes
         });
         const replayPayload = {
             mode: 'plaintext',
@@ -285,13 +642,12 @@ export class WaMessageDispatchCoordinator {
             type,
             plaintext
         };
-        const result = await this.retryTracker.track({
-            messageIdHint: sendOptions.id ?? messageNode.attrs.id,
+        const result = await this.deps.retryTracker.track({
+            messageIdHint: messageNode.attrs.id ?? sendOptions.id,
             toJid: groupJid,
-            type,
             replayPayload,
             eligibleRequesterDeviceJids: undefined
-        }, async () => this.messageClient.publishNode(messageNode, sendOptions));
+        }, async () => this.deps.messageClient.publishNode(messageNode, sendOptions));
         const ackError = result.ack.error;
         const serverPhash = result.ack.phash;
         const serverAddressingMode = result.ack.addressingMode;
@@ -300,7 +656,7 @@ export class WaMessageDispatchCoordinator {
         const hasAddressingError = ackError === 421;
         if (!retryContext.retried &&
             (hasPhashMismatch || hasAddressingMismatch || hasAddressingError)) {
-            this.logger.warn('group direct publish acknowledged with mismatch metadata', {
+            this.deps.logger.warn('group direct publish acknowledged with mismatch metadata', {
                 id: result.id,
                 groupJid,
                 localPhash,
@@ -309,28 +665,88 @@ export class WaMessageDispatchCoordinator {
                 serverAddressingMode,
                 ackError
             });
-            return this.publishGroupDirectMessage(groupJid, message, plaintext, type, {
-                ...sendOptions,
-                id: result.id
+            return this.publishGroupDirectMessage(groupJid, {
+                ...envelope,
+                sendOptions: { ...sendOptions, id: result.id }
             }, {
                 retried: true,
                 forceRefreshParticipants: true,
                 forceAddressingMode: serverAddressingMode
-            }, edit, mediatype, metaNode);
+            });
         }
         return result;
     }
-    async publishGroupSenderKeyMessage(groupJid, message, plaintext, type, options, retryContext = {}, edit, mediatype, metaNode) {
-        const sendOptions = await this.withResolvedMessageId(options);
+    // Returns null on any failure so the group send still goes out unchanged.
+    async buildBotSidecarParticipant(message) {
+        const botJid = extractInvokedBotJid(message);
+        if (!botJid)
+            return null;
+        let address;
+        try {
+            address = parseSignalAddressFromJid(botJid);
+        }
+        catch (error) {
+            this.deps.logger.debug('bot sidecar: failed to parse bot jid', {
+                botJid,
+                message: toError(error).message
+            });
+            return null;
+        }
+        let resolvedTargets;
+        try {
+            resolvedTargets = await this.deps.sessionResolver.ensureSessionsBatch([botJid]);
+        }
+        catch (error) {
+            this.deps.logger.debug('bot sidecar: signal session sync failed', {
+                botJid,
+                message: toError(error).message
+            });
+            return null;
+        }
+        if (resolvedTargets.length === 0) {
+            this.deps.logger.debug('bot sidecar: signal session not established', { botJid });
+            return null;
+        }
+        // The bot seeds its streaming-response keys from this HKDF derivation.
+        const parentMessageSecret = message.messageContextInfo?.messageSecret;
+        const botMessageSecret = parentMessageSecret && parentMessageSecret.byteLength > 0
+            ? genBotMsgSecret(parentMessageSecret)
+            : undefined;
+        const botCopy = buildBotInvokeProtoCopy(message, botMessageSecret);
+        const botPlaintext = await writeRandomPadMax16(proto.Message.encode(botCopy).finish());
+        try {
+            const [encrypted] = await this.deps.signalProtocol.encryptMessagesBatch([{ address, plaintext: botPlaintext }], resolvedTargets.map((target) => ({
+                address: target.address,
+                session: target.session
+            })));
+            if (!encrypted)
+                return null;
+            this.deps.logger.trace('bot sidecar encrypted', { botJid, encType: encrypted.type });
+            return {
+                jid: botJid,
+                encType: encrypted.type,
+                ciphertext: encrypted.ciphertext
+            };
+        }
+        catch (error) {
+            this.deps.logger.debug('bot sidecar: encryption failed', {
+                botJid,
+                message: toError(error).message
+            });
+            return null;
+        }
+    }
+    async publishGroupSenderKeyMessage(groupJid, envelope, retryContext = {}) {
+        const { message, plaintext, type, edit, mediatype, sendOptions } = envelope;
         const meJid = this.requireCurrentMeJid('sendMessage');
         const participantUserJids = retryContext.forceRefreshParticipants
-            ? await this.participantsCache.refreshParticipantUsers(groupJid)
-            : await this.participantsCache.resolveParticipantUsers(groupJid);
+            ? await this.deps.groupMetadataCache.refreshParticipantUsers(groupJid)
+            : await this.deps.groupMetadataCache.resolveParticipantUsers(groupJid);
         const addressingMode = retryContext.forceAddressingMode ??
             this.resolveGroupAddressingMode(participantUserJids, groupJid);
         const senderJid = this.resolveSenderForAddressingMode(addressingMode, meJid);
         const sender = parseSignalAddressFromJid(senderJid);
-        const { distributionMessage: senderKeyDistributionMessage, ciphertext: groupCiphertext, keyId: senderKeyId } = await this.senderKeyManager.prepareGroupEncryption(groupJid, sender, plaintext);
+        const { distributionMessage: senderKeyDistributionMessage, ciphertext: groupCiphertext, keyId: senderKeyId } = await this.deps.senderKeyManager.prepareGroupEncryption(groupJid, sender, plaintext);
         const distributionData = await this.distributionDedup.run(`dist:${groupJid}:${senderKeyId}`, () => this.encryptGroupDistributionParticipants(groupJid, senderKeyId, senderKeyDistributionMessage, participantUserJids));
         const { fanoutDeviceJids, distributionParticipants } = distributionData;
         let shouldAttachDeviceIdentity = false;
@@ -341,20 +757,28 @@ export class WaMessageDispatchCoordinator {
             }
         }
         const phashTargets = new Array(fanoutDeviceJids.length + 1);
+        let phashTargetCount = 0;
         for (let index = 0; index < fanoutDeviceJids.length; index += 1) {
-            phashTargets[index] = fanoutDeviceJids[index];
-        }
-        phashTargets[fanoutDeviceJids.length] = senderJid;
-        const [localPhash, reportingArtifacts] = await Promise.all([
-            computePhashV2(phashTargets),
-            this.tryBuildReportingTokenArtifacts({
-                message,
-                stanzaId: sendOptions.id,
-                senderUserJid: toUserJid(senderJid),
-                remoteJid: groupJid,
-                context: 'group_sender_key'
-            })
-        ]);
+            const candidate = fanoutDeviceJids[index];
+            if (isHostedDeviceJid(candidate))
+                continue;
+            phashTargets[phashTargetCount] = candidate;
+            phashTargetCount += 1;
+        }
+        phashTargets[phashTargetCount] = senderJid;
+        phashTargets.length = phashTargetCount + 1;
+        const localPhash = computePhashV2(phashTargets);
+        const reportingArtifacts = await this.tryBuildReportingTokenArtifacts({
+            message,
+            stanzaId: sendOptions.id,
+            senderUserJid: toUserJid(senderJid),
+            remoteJid: groupJid,
+            context: 'group_sender_key'
+        });
+        const botSidecar = await this.buildBotSidecarParticipant(message);
+        const customNodes = envelope.customNodes ? [...envelope.customNodes] : [];
+        if (reportingArtifacts?.node)
+            customNodes.push(reportingArtifacts.node);
         const messageNode = buildGroupSenderKeyMessageNode({
             to: groupJid,
             type,
@@ -364,12 +788,14 @@ export class WaMessageDispatchCoordinator {
             addressingMode,
             groupCiphertext: groupCiphertext.ciphertext,
             participants: distributionParticipants,
-            deviceIdentity: shouldAttachDeviceIdentity
+            deviceIdentity: shouldAttachDeviceIdentity || botSidecar?.encType === 'pkmsg'
                 ? this.getEncodedSignedDeviceIdentity()
                 : undefined,
-            reportingNode: reportingArtifacts?.node ?? undefined,
-            metaNode,
-            mediatype
+            customNodes: customNodes.length > 0 ? customNodes : undefined,
+            mediatype,
+            decryptFail: envelope.decryptFail,
+            botParticipants: botSidecar ? [botSidecar] : undefined,
+            additionalAttributes: sendOptions.additionalAttributes
         });
         const replayPayload = {
             mode: 'plaintext',
@@ -377,22 +803,21 @@ export class WaMessageDispatchCoordinator {
             type,
             plaintext
         };
-        const result = await this.retryTracker.track({
-            messageIdHint: sendOptions.id ?? messageNode.attrs.id,
+        const result = await this.deps.retryTracker.track({
+            messageIdHint: messageNode.attrs.id ?? sendOptions.id,
             toJid: groupJid,
-            type,
             replayPayload,
             eligibleRequesterDeviceJids: undefined
-        }, async () => this.messageClient.publishNode(messageNode, sendOptions));
+        }, async () => this.deps.messageClient.publishNode(messageNode, sendOptions));
         const distributedAddresses = new Array(distributionParticipants.length);
         for (let index = 0; index < distributionParticipants.length; index += 1) {
             distributedAddresses[index] = distributionParticipants[index].address;
         }
         try {
-            await this.senderKeyManager.markSenderKeyDistributed(groupJid, senderKeyId, distributedAddresses);
+            await this.deps.senderKeyManager.markSenderKeyDistributed(groupJid, senderKeyId, distributedAddresses);
         }
         catch (error) {
-            this.logger.warn('failed to mark sender key distribution targets', {
+            this.deps.logger.warn('failed to mark sender key distribution targets', {
                 groupJid,
                 participants: distributedAddresses.length,
                 message: toError(error).message
@@ -406,7 +831,7 @@ export class WaMessageDispatchCoordinator {
         const hasAddressingError = ackError === 421;
         if (!retryContext.retried &&
             (hasPhashMismatch || hasAddressingMismatch || hasAddressingError)) {
-            this.logger.warn('group message publish acknowledged with mismatch metadata', {
+            this.deps.logger.warn('group message publish acknowledged with mismatch metadata', {
                 id: result.id,
                 groupJid,
                 localPhash,
@@ -415,14 +840,14 @@ export class WaMessageDispatchCoordinator {
                 serverAddressingMode,
                 ackError
             });
-            return this.publishGroupSenderKeyMessage(groupJid, message, plaintext, type, {
-                ...sendOptions,
-                id: result.id
+            return this.publishGroupSenderKeyMessage(groupJid, {
+                ...envelope,
+                sendOptions: { ...sendOptions, id: result.id }
             }, {
                 retried: true,
                 forceRefreshParticipants: true,
                 forceAddressingMode: serverAddressingMode
-            }, edit, mediatype, metaNode);
+            });
         }
         return result;
     }
@@ -432,7 +857,7 @@ export class WaMessageDispatchCoordinator {
                 return 'lid';
             }
         }
-        this.logger.trace('group addressing mode resolved to pn (default)', {
+        this.deps.logger.trace('group addressing mode resolved to pn (default)', {
             groupJid,
             participants: participantUserJids.length
         });
@@ -440,13 +865,13 @@ export class WaMessageDispatchCoordinator {
     }
     resolveSenderForAddressingMode(addressingMode, meJid) {
         if (addressingMode === 'lid') {
-            const meLid = this.getCurrentMeLid();
+            const meLid = this.deps.getCurrentCredentials()?.meLid;
             if (meLid && meLid.includes('@')) {
                 try {
                     return normalizeDeviceJid(meLid);
                 }
                 catch (error) {
-                    this.logger.trace('ignoring malformed me lid jid', {
+                    this.deps.logger.trace('ignoring malformed me lid jid', {
                         meLid,
                         message: toError(error).message
                     });
@@ -459,7 +884,7 @@ export class WaMessageDispatchCoordinator {
         const distributionPayload = await writeRandomPadMax16(proto.Message.encode({
             senderKeyDistributionMessage
         }).finish());
-        const fanoutDeviceJids = await this.fanoutResolver.resolveGroupParticipantDeviceJids(participantUserJids);
+        const fanoutDeviceJids = await this.deps.fanoutResolver.resolveGroupParticipantDeviceJids(participantUserJids);
         if (fanoutDeviceJids.length === 0) {
             return {
                 fanoutDeviceJids,
@@ -474,7 +899,7 @@ export class WaMessageDispatchCoordinator {
             fanoutAddresses[index] = address;
             fanoutTargetsByAddressKey.set(signalAddressKey(address), { jid, address });
         }
-        const pendingAddresses = await this.senderKeyManager.filterParticipantsNeedingDistribution(groupJid, senderKeyId, fanoutAddresses);
+        const pendingAddresses = await this.deps.senderKeyManager.filterParticipantsNeedingDistribution(groupJid, senderKeyId, fanoutAddresses);
         if (pendingAddresses.length === 0) {
             return {
                 fanoutDeviceJids,
@@ -507,7 +932,7 @@ export class WaMessageDispatchCoordinator {
         let availableTargets = [];
         let prefetchedAvailableTargets;
         try {
-            const resolvedTargets = await this.sessionResolver.ensureSessionsBatch(pendingTargetJids);
+            const resolvedTargets = await this.deps.sessionResolver.ensureSessionsBatch(pendingTargetJids);
             availableTargets = resolvedTargets;
             prefetchedAvailableTargets = resolvedTargets;
         }
@@ -516,7 +941,7 @@ export class WaMessageDispatchCoordinator {
             if (normalized.message === 'identity mismatch') {
                 throw normalized;
             }
-            this.logger.warn('group sender-key distribution session sync failed, continuing with available sessions', {
+            this.deps.logger.warn('group sender-key distribution session sync failed, continuing with available sessions', {
                 groupJid,
                 requested: pendingTargetJids.length,
                 message: normalized.message
@@ -525,7 +950,7 @@ export class WaMessageDispatchCoordinator {
             for (let index = 0; index < pendingTargets.length; index += 1) {
                 pendingTargetAddresses[index] = pendingTargets[index].address;
             }
-            const hasPendingSessions = await this.sessionStore.hasSessions(pendingTargetAddresses);
+            const hasPendingSessions = await this.deps.sessionStore.hasSessions(pendingTargetAddresses);
             const nextAvailableTargets = [];
             for (let index = 0; index < pendingTargets.length; index += 1) {
                 if (hasPendingSessions[index]) {
@@ -548,7 +973,7 @@ export class WaMessageDispatchCoordinator {
                 plaintext: distributionPayload
             };
         }
-        const encryptedDistributionParticipants = await this.signalProtocol.encryptMessagesBatch(distributionEncryptRequests, prefetchedAvailableTargets);
+        const encryptedDistributionParticipants = await this.deps.signalProtocol.encryptMessagesBatch(distributionEncryptRequests, prefetchedAvailableTargets);
         const distributionParticipants = new Array(availableTargets.length);
         for (let index = 0; index < availableTargets.length; index += 1) {
             const target = availableTargets[index];
@@ -564,12 +989,12 @@ export class WaMessageDispatchCoordinator {
             distributionParticipants
         };
     }
-    async publishDirectSignalMessageWithFanout(recipientJid, message, plaintext, type, options, edit, mediatype, metaNode) {
-        const sendOptions = await this.withResolvedMessageId(options);
+    async publishDirectSignalMessageWithFanout(recipientJid, envelope) {
+        const { message, plaintext, type, edit, mediatype, sendOptions } = envelope;
         const meJid = this.requireCurrentMeJid('sendMessage');
-        const meLid = this.getCurrentMeLid();
-        const selfDeviceJidForRecipient = this.fanoutResolver.resolveSelfDeviceJidForRecipient(recipientJid, meJid, meLid);
-        const deviceJids = await this.fanoutResolver.resolveDirectFanoutDeviceJids(recipientJid, selfDeviceJidForRecipient);
+        const meLid = this.deps.getCurrentCredentials()?.meLid;
+        const selfDeviceJidForRecipient = this.deps.fanoutResolver.resolveSelfDeviceJidForRecipient(recipientJid, meJid, meLid);
+        const deviceJids = await this.deps.fanoutResolver.resolveDirectFanoutDeviceJids(recipientJid, selfDeviceJidForRecipient);
         const targets = new Array(deviceJids.length);
         for (let index = 0; index < deviceJids.length; index += 1) {
             const jid = deviceJids[index];
@@ -582,7 +1007,7 @@ export class WaMessageDispatchCoordinator {
         }
         const recipientUserJid = toUserJid(recipientJid);
         const meUserJid = toUserJid(selfDeviceJidForRecipient);
-        this.logger.debug('wa client publish signal fanout', {
+        this.deps.logger.trace('wa client publish signal fanout', {
             to: recipientJid,
             devices: deviceJids.length,
             type
@@ -596,20 +1021,42 @@ export class WaMessageDispatchCoordinator {
                 }
             }
         }
-        const resolvedFanoutTargets = await this.sessionResolver.ensureSessionsBatch(deviceJids, expectedIdentityByJid);
+        const resolvedFanoutTargets = await this.deps.sessionResolver.ensureSessionsBatch(deviceJids, expectedIdentityByJid);
         const resolvedFanoutTargetsByJid = new Map();
         for (let index = 0; index < resolvedFanoutTargets.length; index += 1) {
             const target = resolvedFanoutTargets[index];
             resolvedFanoutTargetsByJid.set(normalizeDeviceJid(target.jid), target);
         }
+        const liveTargets = [];
+        const droppedSecondaryDevices = [];
         for (let index = 0; index < targets.length; index += 1) {
-            if (!resolvedFanoutTargetsByJid.has(targets[index].normalizedJid)) {
-                throw new Error('direct fanout missing signal sessions for one or more targets');
+            const target = targets[index];
+            if (resolvedFanoutTargetsByJid.has(target.normalizedJid)) {
+                liveTargets.push(target);
+                continue;
             }
+            const isPrimaryRecipient = target.userJid === recipientUserJid && target.normalizedJid === target.userJid;
+            if (isPrimaryRecipient) {
+                this.deps.logger.error('direct fanout dropping primary recipient device without signal session', { to: recipientJid, device: target.jid });
+            }
+            else {
+                droppedSecondaryDevices.push(target.jid);
+            }
+        }
+        if (droppedSecondaryDevices.length > 0) {
+            this.deps.logger.warn('direct fanout dropping secondary devices without signal session', {
+                to: recipientJid,
+                droppedCount: droppedSecondaryDevices.length,
+                totalExpected: targets.length,
+                sample: droppedSecondaryDevices.slice(0, 3)
+            });
+        }
+        if (liveTargets.length === 0) {
+            throw new Error('direct fanout missing signal sessions for all targets');
         }
         let hasSelfDeviceFanout = false;
-        for (let index = 0; index < targets.length; index += 1) {
-            if (targets[index].userJid === meUserJid) {
+        for (let index = 0; index < liveTargets.length; index += 1) {
+            if (liveTargets[index].userJid === meUserJid) {
                 hasSelfDeviceFanout = true;
                 break;
             }
@@ -617,13 +1064,10 @@ export class WaMessageDispatchCoordinator {
         const selfDevicePlaintext = hasSelfDeviceFanout
             ? await writeRandomPadMax16(proto.Message.encode(wrapDeviceSentMessage(message, recipientUserJid)).finish())
             : null;
-        const participantRequests = new Array(targets.length);
-        for (let index = 0; index < targets.length; index += 1) {
-            const target = targets[index];
+        const participantRequests = new Array(liveTargets.length);
+        for (let index = 0; index < liveTargets.length; index += 1) {
+            const target = liveTargets[index];
             const resolvedTarget = resolvedFanoutTargetsByJid.get(target.normalizedJid);
-            if (!resolvedTarget) {
-                throw new Error('direct fanout missing signal session for target');
-            }
             participantRequests[index] = {
                 target,
                 address: resolvedTarget.address,
@@ -648,15 +1092,20 @@ export class WaMessageDispatchCoordinator {
                 session: request.session
             };
         }
-        const encryptedParticipants = await this.signalProtocol.encryptMessagesBatch(encryptRequests, prefetchedSessions);
-        const participants = new Array(participantRequests.length);
+        const encryptedParticipants = await this.deps.signalProtocol.encryptMessagesBatch(encryptRequests, prefetchedSessions);
+        const isBotRecipient = isBotJid(recipientJid);
+        const participants = [];
         for (let index = 0; index < participantRequests.length; index += 1) {
             const request = participantRequests[index];
-            participants[index] = {
+            const entry = {
                 jid: request.target.jid,
                 encType: encryptedParticipants[index].type,
                 ciphertext: encryptedParticipants[index].ciphertext
             };
+            // wa-web direct 1:1 to bot puts the bot device alongside self devices
+            // inside `<participants>`; the `<bot>` envelope is only used for group
+            // mentions (the sidecar copy) or for bot feedback / revoke flows.
+            participants.push(entry);
         }
         let shouldAttachDeviceIdentity = false;
         for (let index = 0; index < participants.length; index += 1) {
@@ -676,16 +1125,23 @@ export class WaMessageDispatchCoordinator {
             context: 'direct_fanout'
         });
         let privacyTokenNode;
-        try {
-            privacyTokenNode =
-                (await this.privacyTokenDedup.run(`pt:${recipientUserJid}`, () => this.resolvePrivacyTokenNode(recipientUserJid))) ?? undefined;
-        }
-        catch (error) {
-            this.logger.warn('privacy token resolution failed', {
-                to: recipientUserJid,
-                message: toError(error).message
-            });
+        if (!isBotRecipient) {
+            try {
+                privacyTokenNode =
+                    (await this.privacyTokenDedup.run(`pt:${recipientUserJid}`, () => this.deps.resolvePrivacyTokenNode(recipientUserJid))) ?? undefined;
+            }
+            catch (error) {
+                this.deps.logger.warn('privacy token resolution failed', {
+                    to: recipientUserJid,
+                    message: toError(error).message
+                });
+            }
         }
+        const customNodes = envelope.customNodes ? [...envelope.customNodes] : [];
+        if (reportingArtifacts?.node)
+            customNodes.push(reportingArtifacts.node);
+        if (privacyTokenNode)
+            customNodes.push(privacyTokenNode);
         const messageNode = buildDirectMessageFanoutNode({
             to: recipientJid,
             type,
@@ -693,10 +1149,10 @@ export class WaMessageDispatchCoordinator {
             edit,
             participants,
             deviceIdentity,
-            reportingNode: reportingArtifacts?.node ?? undefined,
-            privacyTokenNode,
-            metaNode,
-            mediatype
+            customNodes: customNodes.length > 0 ? customNodes : undefined,
+            mediatype,
+            decryptFail: envelope.decryptFail,
+            additionalAttributes: sendOptions.additionalAttributes
         });
         const replayPayload = {
             mode: 'plaintext',
@@ -704,14 +1160,13 @@ export class WaMessageDispatchCoordinator {
             type,
             plaintext
         };
-        const result = await this.retryTracker.track({
-            messageIdHint: sendOptions.id ?? messageNode.attrs.id,
+        const result = await this.deps.retryTracker.track({
+            messageIdHint: messageNode.attrs.id ?? sendOptions.id,
             toJid: recipientJid,
-            type,
             replayPayload,
             eligibleRequesterDeviceJids: deviceJids
-        }, async () => this.messageClient.publishNode(messageNode, sendOptions));
-        this.onDirectMessageSent(recipientUserJid);
+        }, async () => this.deps.messageClient.publishNode(messageNode, sendOptions));
+        this.deps.onDirectMessageSent(recipientUserJid);
         return result;
     }
     async withResolvedMessageId(options) {
@@ -737,26 +1192,24 @@ export class WaMessageDispatchCoordinator {
             const dv = new DataView(timestampBytes.buffer, timestampBytes.byteOffset, timestampBytes.byteLength);
             if (this.mobileMessageIdFormat) {
                 dv.setBigUint64(0, BigInt(Date.now()), false);
-                const entropy = concatBytes([
+                const digest = md5Bytes([
                     timestampBytes,
                     TEXT_ENCODER.encode(meUserJid),
                     await randomBytesAsync(16)
                 ]);
-                const digest = md5Bytes(entropy);
                 digest[0] = 0xac;
                 return bytesToHex(digest).toUpperCase();
             }
             dv.setBigUint64(0, BigInt(Math.floor(Date.now() / 1000)), false);
-            const entropy = concatBytes([
+            const digest = sha256([
                 timestampBytes,
                 TEXT_ENCODER.encode(meUserJid),
                 await randomBytesAsync(8)
             ]);
-            const digest = await sha256(entropy);
             return `3EB0${bytesToHex(digest.subarray(0, 9)).toUpperCase()}`;
         }
         catch (error) {
-            this.logger.warn('failed to generate message id, falling back to random', {
+            this.deps.logger.warn('failed to generate message id, falling back to random', {
                 message: toError(error).message
             });
             if (this.mobileMessageIdFormat) {
@@ -780,7 +1233,7 @@ export class WaMessageDispatchCoordinator {
             });
         }
         catch (error) {
-            this.logger.warn('failed to generate reporting token', {
+            this.deps.logger.warn('failed to generate reporting token', {
                 context: input.context,
                 id: input.stanzaId,
                 remoteJid: input.remoteJid,
@@ -790,7 +1243,7 @@ export class WaMessageDispatchCoordinator {
         }
     }
     getEncodedSignedDeviceIdentity() {
-        const signedIdentity = this.getCurrentSignedIdentity();
+        const signedIdentity = this.deps.getCurrentCredentials()?.signedIdentity;
         if (!signedIdentity) {
             return undefined;
         }
@@ -799,15 +1252,15 @@ export class WaMessageDispatchCoordinator {
     resolveUserIcdc(userJid, localIdentity) {
         return this.icdcDedup.run(`icdc:${userJid}:${localIdentity ? '1' : '0'}`, async () => {
             try {
-                const snapshots = await this.deviceListStore.getUserDevicesBatch([userJid]);
+                const snapshots = await this.deps.deviceListStore.getUserDevicesBatch([userJid]);
                 const snapshot = snapshots[0];
                 if (!snapshot || snapshot.deviceJids.length === 0) {
                     return null;
                 }
-                return resolveIcdcMeta(snapshot.deviceJids, this.identityStore, snapshot.updatedAtMs, localIdentity, this.getIcdcHashLength?.());
+                return resolveIcdcMeta(snapshot.deviceJids, this.deps.identityStore, snapshot.updatedAtMs, localIdentity, this.deps.getIcdcHashLength?.());
             }
             catch (error) {
-                this.logger.trace('icdc resolution failed', {
+                this.deps.logger.trace('icdc resolution failed', {
                     userJid,
                     message: toError(error).message
                 });
@@ -816,10 +1269,35 @@ export class WaMessageDispatchCoordinator {
         });
     }
     requireCurrentMeJid(context) {
-        const meJid = this.getCurrentMeJid();
+        const meJid = this.deps.getCurrentCredentials()?.meJid;
         if (meJid) {
             return meJid;
         }
         throw new Error(`${context} requires registered meJid`);
     }
 }
+function pickContentContextInfo(content) {
+    if (typeof content !== 'object' || content === null)
+        return undefined;
+    if (isSendTextMessage(content) || isSendMediaMessage(content)) {
+        return content.contextInfo;
+    }
+    return undefined;
+}
+function assertNewsletterContextInfoCompatible(ctx) {
+    if (!ctx)
+        return;
+    const unsupported = [];
+    if (ctx.quotedMessageId !== undefined)
+        unsupported.push('quote');
+    if (ctx.mentionedJids?.length)
+        unsupported.push('mentions');
+    if (ctx.isSpoiler === true)
+        unsupported.push('isSpoiler');
+    if (ctx.groupSubject !== undefined || ctx.parentGroupJid !== undefined) {
+        unsupported.push('group invite reply (groupSubject/parentGroupJid)');
+    }
+    if (unsupported.length > 0) {
+        throw new Error(`newsletter sends do not support: ${unsupported.join(', ')}`);
+    }
+}