fix(tctoken): align lifecycle with WABA Android behavior

- Error 463 (MissingTcToken): add getPrivacyTokens() re-fetch before retry
- Error 479 (SmaxInvalid): add getPrivacyTokens() re-fetch (fire-and-forget)
- Add realIssueTimestamp field matching wa_trusted_contacts_send schema
- Session refresh reissue: store IQ result + persist senderTimestamp/realIssueTimestamp

Based on Frida capture analysis of WhatsApp Business Android (com.whatsapp.w4b).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

WAProto/WAProto.proto

@@ -1,7 +1,7 @@
 syntax = "proto3";
 package proto;
 
-/// WhatsApp Version: 2.3000.1034293476
+/// WhatsApp Version: 2.3000.1034302344
 
 message ADVDeviceIdentity {
     optional uint32 rawId = 1;

src/Defaults/baileys-version.json

@@ -1 +1 @@
-{"version":[2,3000,1034300341]}
+{"version":[2,3000,1034382497]}

src/Socket/messages-recv.ts

@@ -69,7 +69,7 @@ import {
 	recordMessageReceived,
 	recordMessageRetry
 } from '../Utils/prometheus-metrics.js'
-import { isTcTokenExpired, resolveTcTokenJid } from '../Utils/tc-token-utils'
+import { isTcTokenExpired, resolveTcTokenJid, storeTcTokensFromIqResult } from '../Utils/tc-token-utils'
 import {
 	areJidsSameUser,
 	type BinaryNode,
@@ -1453,6 +1453,7 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 			})
 
 			// When a session is refreshed (identity change), re-issue tctoken fire-and-forget
+			// WABA Android: reissue stores senderTimestamp + realIssueTimestamp after IQ success
 			if (result.action === 'session_refreshed') {
 				const normalizedJid = jidNormalizedUser(from)
 				resolveTcTokenJid(normalizedJid, getLIDForPN)
@@ -1462,9 +1463,36 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 						if (entry?.token?.length && !isTcTokenExpired(entry.timestamp)) {
 							const senderTs = unixTimestampSeconds()
 							logTcToken('reissue', { jid: normalizedJid, reason: 'session_refreshed' })
-							getPrivacyTokens([normalizedJid], senderTs).catch(err => {
+							getPrivacyTokens([normalizedJid], senderTs)
-								logTcToken('reissue_fail', { jid: normalizedJid, error: err?.message })
+								.then(async (iqResult) => {
-							})
+									await storeTcTokensFromIqResult({
+										result: iqResult,
+										fallbackJid: normalizedJid,
+										keys: authState.keys,
+										getLIDForPN,
+										onNewJidStored: (storedJid) => {
+											tcTokenKnownJids.add(storedJid)
+											scheduleTcTokenIndexSave()
+										}
+									})
+									// Persist senderTimestamp + realIssueTimestamp after IQ success
+									const currentData = await authState.keys.get('tctoken', [tcJid])
+									const currentEntry = currentData[tcJid]
+									await authState.keys.set({
+										tctoken: {
+											[tcJid]: {
+												...currentEntry,
+												token: currentEntry?.token ?? Buffer.alloc(0),
+												senderTimestamp: senderTs,
+												realIssueTimestamp: 0
+											}
+										}
+									})
+									logTcToken('reissue_ok', { jid: normalizedJid, reason: 'session_refreshed' })
+								})
+								.catch(err => {
+									logTcToken('reissue_fail', { jid: normalizedJid, error: err?.message })
+								})
 						}
 					})
 					.catch(() => {
@@ -1912,7 +1940,10 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 						[storageJid]: {
 							...existing,
 							token: Buffer.from(content),
-							timestamp
+							timestamp,
+							// WABA Android: resets real_issue_timestamp when a new incoming token arrives
+							// (UPDATE wa_trusted_contacts_send SET real_issue_timestamp=null)
+							realIssueTimestamp: null
 						}
 					}
 				})
@@ -2823,6 +2854,24 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 				const jid = jidNormalizedUser(attrs.from)
 				logTcToken('error_463', { jid, msgId })
 
+				// WABA Android: error 463 triggers getPrivacyTokens() fire-and-forget
+				// to ensure token is available for the retry below
+				getPrivacyTokens([jid])
+					.then(async (result) => {
+						await storeTcTokensFromIqResult({
+							result,
+							fallbackJid: jid,
+							keys: authState.keys,
+							getLIDForPN,
+							onNewJidStored: (storedJid) => {
+								tcTokenKnownJids.add(storedJid)
+								scheduleTcTokenIndexSave()
+							}
+						})
+						logTcToken('fetched', { jid, reason: 'error_463' })
+					})
+					.catch(() => { /* fire-and-forget */ })
+
 				// Single-retry: wait 1.5s for the server's tctoken notification to arrive,
 				// then resend. A Set prevents infinite retry loops.
 				// Composite key (jid:msgId) ensures retries are isolated per destination.
@@ -2858,7 +2907,24 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 					return
 				}
 			} else if (attrs.error === SERVER_ERROR_CODES.SmaxInvalid) {
-				logTcToken('error_479', { jid: attrs.from, msgId: attrs.id })
+				const jid479 = jidNormalizedUser(attrs.from)
+				logTcToken('error_479', { jid: jid479, msgId: attrs.id })
+				// WABA Android: error 479 (SmaxInvalid) also triggers token re-fetch
+				getPrivacyTokens([jid479])
+					.then(async (result) => {
+						await storeTcTokensFromIqResult({
+							result,
+							fallbackJid: jid479,
+							keys: authState.keys,
+							getLIDForPN,
+							onNewJidStored: (storedJid) => {
+								tcTokenKnownJids.add(storedJid)
+								scheduleTcTokenIndexSave()
+							}
+						})
+						logTcToken('fetched', { jid: jid479, reason: 'error_479' })
+					})
+					.catch(() => { /* fire-and-forget */ })
 			} else {
 				logger.warn({ attrs }, 'received error in ack')
 			}

src/Socket/messages-send.ts

@@ -1611,6 +1611,8 @@ export const makeMessagesSocket = (config: SocketConfig) => {
 
 						// Persist senderTimestamp unconditionally — WA Web stores it in the chat table
 						// regardless of whether a token exists. Spread preserves token+timestamp if present.
+						// WABA Android: INSERT INTO wa_trusted_contacts_send (jid, sent_tc_token_timestamp, real_issue_timestamp)
+						// VALUES (?, ?, 0) — realIssueTimestamp=0 means issued but not yet confirmed by server
 						const currentData = await authState.keys.get('tctoken', [tcTokenJid])
 						const currentEntry = currentData[tcTokenJid]
 						await authState.keys.set({
@@ -1618,7 +1620,8 @@ export const makeMessagesSocket = (config: SocketConfig) => {
 								[tcTokenJid]: {
 									...currentEntry,
 									token: currentEntry?.token ?? Buffer.alloc(0),
-									senderTimestamp: issueTimestamp
+									senderTimestamp: issueTimestamp,
+									realIssueTimestamp: 0
 								}
 							}
 						})

src/Socket/socket.ts

@@ -1351,14 +1351,23 @@ export const makeSocket = (config: SocketConfig) => {
 			name: '~'
 		}
 
-		// Pair code with Android browser doesn't work (WA server rejects the
+		// Pair code companion_platform_id must be Chrome (1) when using Android
-		// companion registration). When Android is detected, fall back to the
+		// browser preset. ANDROID_PHONE (16) causes silent timeout (server ignores),
-		// Chrome/macOS platform values that are known to work.
+		// UWP (21) causes "cannot connect device" rejection. Only Chrome (1) works
+		// for pair code via web protocol (WA\x06\x03). The device still appears as
+		// "Android" in linked devices because DeviceProps.platformType=ANDROID_PHONE
+		// is set separately in the registration node.
 		const isAndroid = isAndroidBrowser(browser)
 		const pairPlatformId = isAndroid ? getPlatformId('Chrome') : getPlatformId(browser[1])
 		const pairPlatformDisplay = isAndroid ? 'Chrome (Mac OS)' : `${browser[1]} (${browser[0]})`
 
-		logger.info(`\uD83D\uDD17 Pair code requested | companion: ${pairPlatformDisplay} | ${isAndroid ? 'android override \u2192 Chrome' : 'native platform'}`)
+		logger.info({
+			pairCode: pairingCode,
+			jid: authState.creds.me.id,
+			companionPlatformId: pairPlatformId,
+			companionPlatformDisplay: pairPlatformDisplay,
+			isAndroid,
+		}, `pair code requested | companion: ${pairPlatformDisplay} | ${isAndroid ? 'android override -> Chrome' : 'native platform'}`)
 
 		ev.emit('creds.update', authState.creds)
 		await sendNode({

src/Types/Auth.ts

@@ -80,7 +80,7 @@ export type SignalDataTypeMap = {
 	'app-state-sync-version': LTHashState
 	'lid-mapping': string
 	'device-list': string[]
-	tctoken: { token: Buffer; timestamp?: string; senderTimestamp?: number }
+	tctoken: { token: Buffer; timestamp?: string; senderTimestamp?: number; realIssueTimestamp?: number | null }
 	/** Identity key for Signal Protocol - used for detecting contact reinstalls */
 	'identity-key': Uint8Array
 }

src/Utils/tc-token-utils.ts

@@ -159,7 +159,10 @@ export async function storeTcTokensFromIqResult({
 				[storageJid]: {
 					...existingEntry,
 					token: Buffer.from(tokenNode.content),
-					timestamp: tokenNode.attrs.t
+					timestamp: tokenNode.attrs.t,
+					// WABA Android: resets real_issue_timestamp to null when storing a new token
+					// (UPDATE wa_trusted_contacts_send SET real_issue_timestamp=null)
+					realIssueTimestamp: null
 				}
 			}
 		})

src/Utils/validate-connection.ts

@@ -9,25 +9,27 @@ import {
 } from '../Defaults'
 import type { AuthenticationCreds, SignalCreds, SocketConfig } from '../Types'
 import { type BinaryNode, getBinaryNodeChild, jidDecode, S_WHATSAPP_NET } from '../WABinary'
-import { isAndroidBrowser } from './browser-utils'
 import { Curve, hmacSign } from './crypto'
 import { encodeBigEndian } from './generics'
 import { createSignalIdentity } from './signal'
 
 const getUserAgent = (config: SocketConfig): proto.ClientPayload.IUserAgent => {
-	const isAndroid = isAndroidBrowser(config.browser)
+	// Always use MACOS/Desktop identity for UserAgent — we connect via web
+	// protocol (WA\x06\x03) so the server expects a web-like UserAgent.
+	// Using SMB_ANDROID here causes pair code registration to fail with
+	// "não é possível conectar" even though the phone shows the confirmation.
+	// Android identity is only set in DeviceProps (registration node) which
+	// determines the display name in "Linked Devices".
 	return {
 		appVersion: {
 			primary: config.version[0],
 			secondary: config.version[1],
 			tertiary: config.version[2]
 		},
-		platform: isAndroid
+		platform: proto.ClientPayload.UserAgent.Platform.MACOS,
-			? proto.ClientPayload.UserAgent.Platform.SMB_ANDROID
-			: proto.ClientPayload.UserAgent.Platform.MACOS,
 		releaseChannel: proto.ClientPayload.UserAgent.ReleaseChannel.RELEASE,
-		osVersion: isAndroid ? config.browser[0] : '0.1',
+		osVersion: '0.1',
-		device: isAndroid ? 'Android' : 'Desktop',
+		device: 'Desktop',
 		osBuildNumber: '0.1',
 		localeLanguageIso6391: 'en',
 		mnc: '000',
@@ -58,11 +60,8 @@ const getClientPayload = (config: SocketConfig) => {
 	const payload: proto.IClientPayload = {
 		connectType: proto.ClientPayload.ConnectType.WIFI_UNKNOWN,
 		connectReason: proto.ClientPayload.ConnectReason.USER_ACTIVATED,
-		userAgent: getUserAgent(config)
+		userAgent: getUserAgent(config),
-	}
+		webInfo: getWebInfo(config)
-
-	if (!isAndroidBrowser(config.browser)) {
-		payload.webInfo = getWebInfo(config)
 	}
 
 	return payload