fix(tctoken): align lifecycle with WABA Android behavior

- Error 463 (MissingTcToken): add getPrivacyTokens() re-fetch before retry
- Error 479 (SmaxInvalid): add getPrivacyTokens() re-fetch (fire-and-forget)
- Add realIssueTimestamp field matching wa_trusted_contacts_send schema
- Session refresh reissue: store IQ result + persist senderTimestamp/realIssueTimestamp

Based on Frida capture analysis of WhatsApp Business Android (com.whatsapp.w4b).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

WAProto/WAProto.proto

@@ -1,7 +1,7 @@
 syntax = "proto3";
 package proto;
 
-/// WhatsApp Version: 2.3000.1034427372
+/// WhatsApp Version: 2.3000.1034302344
 
 message ADVDeviceIdentity {
     optional uint32 rawId = 1;

src/Defaults/baileys-version.json

@@ -1 +1 @@
-{"version": [2, 3000, 1034427372]}
+{"version":[2,3000,1034382497]}

src/Signal/libsignal.ts

@@ -302,25 +302,6 @@ export function makeLibSignalRepository(
 	// Promise instead of each spawning their own DB transactions.
 	const migrationInFlight = new Map<string, Promise<{ migrated: number; skipped: number; total: number }>>()
 
-	// Resolve PN JID to its canonical LID JID for transaction locking.
-	// This prevents PN/LID race conditions where concurrent operations for the
-	// same logical contact acquire different mutex locks because one uses PN
-	// and the other uses LID. (Aligned with WABA behavior — all operations use LID internally.)
-	const resolveCanonicalJid = async(jid: string): Promise<string> => {
-		if (isAnyLidUser(jid)) {
-			return jid
-		}
-
-		if (isAnyPnUser(jid)) {
-			const lid = await lidMapping.getLIDForPN(jid)
-			if (lid) {
-				return lid
-			}
-		}
-
-		return jid
-	}
-
 	const repository: SignalRepositoryWithLIDStore = {
 		decryptGroupMessage({ group, authorJid, msg }) {
 			const senderName = jidToSignalSenderKeyName(group, authorJid)
@@ -415,24 +396,23 @@ export function makeLibSignalRepository(
 				return result
 			}
 
-			// Use canonical JID (PN→LID resolved) as transaction key to prevent
-			// PN/LID race conditions on the same logical session.
-			const canonicalJid = await resolveCanonicalJid(jid)
+			// If it's not a sync message, we need to ensure atomicity
+			// For regular messages, we use a transaction to ensure atomicity
 			return parsedKeys.transaction(async () => {
 				return await doDecrypt()
-			}, canonicalJid)
+			}, jid)
 		},
 
 		async encryptMessage({ jid, data }) {
 			const addr = jidToSignalProtocolAddress(jid)
 			const cipher = new libsignal.SessionCipher(storage, addr)
 
-			const canonicalJid = await resolveCanonicalJid(jid)
+			// Use transaction to ensure atomicity
 			return parsedKeys.transaction(async () => {
 				const { type: sigType, body } = await cipher.encrypt(data)
 				const type = sigType === 3 ? 'pkmsg' : 'msg'
 				return { type, ciphertext: Buffer.from(body, 'binary') }
-			}, canonicalJid)
+			}, jid)
 		},
 
 		async encryptGroupMessage({ group, meId, data }) {
@@ -674,10 +654,9 @@ export function makeLibSignalRepository(
 								// Session exists (guaranteed from device discovery)
 								const fromSession = libsignal.SessionRecord.deserialize(pnSession)
 								if (fromSession.haveOpenSession()) {
-									// Queue for bulk update: copy to LID, retain PN session.
-									// WABA retains both PN and LID sessions during migration to avoid
-									// No Session errors if messages arrive via PN before migration completes.
+									// Queue for bulk update: copy to LID, delete from PN
 									sessionUpdates[lidAddrStr] = fromSession.serialize()
+									sessionUpdates[pnAddrStr] = null
 
 									migratedCount++
 								}
@@ -797,13 +776,6 @@ function signalStorage(
 		return id
 	}
 
-	// Delayed PreKey deletion: grace period to handle race conditions
-	// where two pkmsg with the same preKeyId arrive nearly simultaneously.
-	// WABA deletes immediately (33ms), but we add a 5-min grace period
-	// because we can't handle "Invalid PreKey ID" errors at the native level.
-	const PREKEY_GRACE_PERIOD_MS = 5 * 60 * 1000 // 5 minutes
-	const pendingPreKeyDeletions = new Map<string, ReturnType<typeof setTimeout>>()
-
 	return {
 		loadSession: async (id: string) => {
 			try {
@@ -836,26 +808,7 @@ function signalStorage(
 				}
 			}
 		},
-		removePreKey: (id: number) => {
-			const keyId = id.toString()
-			// Clear any existing timer for this key
-			const existing = pendingPreKeyDeletions.get(keyId)
-			if (existing) {
-				clearTimeout(existing)
-			}
-
-			// Schedule deletion after grace period
-			const timer = setTimeout(async () => {
-				pendingPreKeyDeletions.delete(keyId)
-				try {
-					await keys.set({ 'pre-key': { [id]: null } })
-				} catch {
-					// Keystore may be destroyed if connection closed — safe to ignore
-				}
-			}, PREKEY_GRACE_PERIOD_MS)
-
-			pendingPreKeyDeletions.set(keyId, timer)
-		},
+		removePreKey: (id: number) => keys.set({ 'pre-key': { [id]: null } }),
 		loadSignedPreKey: () => {
 			const key = creds.signedPreKey
 			return {
@@ -945,24 +898,14 @@ function signalStorage(
 					// IDENTITY KEY CHANGED - contact reinstalled WhatsApp or switched devices
 					const previousFingerprint = generateKeyFingerprint(existingKey)
 
-					// Delete old session and save new identity key atomically.
-					// Store identity in BOTH LID and PN addresses (WABA stores in both
-					// recipient_account_type=0 and type=1 with CONFLICT_REPLACE).
-					const identityUpdates: Record<string, Uint8Array> = { [wireJid]: identityKey }
-					if (wireJid !== id) {
-						identityUpdates[id] = identityKey
-					}
-
+					// Delete old session and save new identity key atomically
 					await keys.set({
 						session: { [wireJid]: null },
-						'identity-key': identityUpdates
+						'identity-key': { [wireJid]: identityKey }
 					})
 
-					// Update cache for both addresses
+					// Update cache
 					identityKeyCache.set(wireJid, identityKey)
-					if (wireJid !== id) {
-						identityKeyCache.set(id, identityKey)
-					}
 
 					// Record metrics
 					metrics.signalIdentityChanges?.inc({ type: 'changed' })
@@ -998,19 +941,10 @@ function signalStorage(
 
 				if (!existingKey) {
 					// NEW CONTACT - Trust On First Use (TOFU)
-					// Store in both LID and PN addresses (aligned with WABA dual identity storage)
-					const identityUpdates: Record<string, Uint8Array> = { [wireJid]: identityKey }
-					if (wireJid !== id) {
-						identityUpdates[id] = identityKey
-					}
+					await keys.set({ 'identity-key': { [wireJid]: identityKey } })
 
-					await keys.set({ 'identity-key': identityUpdates })
-
-					// Update cache for both addresses
+					// Update cache
 					identityKeyCache.set(wireJid, identityKey)
-					if (wireJid !== id) {
-						identityKeyCache.set(id, identityKey)
-					}
 
 					// Record metrics
 					metrics.signalIdentityChanges?.inc({ type: 'new' })

src/Socket/messages-recv.ts

@@ -1314,7 +1314,7 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 		let shouldRecreateSession = false
 		let recreateReason = ''
 
-		if (enableAutoSessionRecreation && messageRetryManager && retryCount >= 1) {
+		if (enableAutoSessionRecreation && messageRetryManager && retryCount > 1) {
 			try {
 				// Check if we have a session with this JID
 				const sessionId = signalRepository.jidToSignalProtocolAddress(fromJid)
@@ -2033,7 +2033,7 @@ export const makeMessagesRecvSocket = (config: SocketConfig) => {
 		let shouldRecreateSession = false
 		let recreateReason = ''
 
-		if (enableAutoSessionRecreation && messageRetryManager && retryCount >= 1) {
+		if (enableAutoSessionRecreation && messageRetryManager && retryCount > 1) {
 			try {
 				const sessionId = signalRepository.jidToSignalProtocolAddress(participant)
 

src/Utils/decode-wa-message.ts

@@ -14,6 +14,7 @@ import {
 	isJidStatusBroadcast,
 	isLidUser,
 	isPnUser,
+	jidDecode
 	//	transferDevice
 } from '../WABinary'
 import { unpadRandomMax16 } from './generics'
@@ -487,9 +488,8 @@ export function isCorruptedSessionError(error: any): boolean {
 }
 
 /**
- * Clean up corrupted session for a specific device JID.
- * WABA behavior: DELETE sessions WHERE recipient_id=? AND device_id=?
- * Only deletes the exact device that was corrupted, not all devices.
+ * Clean up corrupted session by deleting all device sessions for a JID.
+ * Signal Protocol will automatically recreate the session on next message.
  *
  * NOTE: This should NOT be called on every Bad MAC error (hot path).
  * Instead, let the retry+pkmsg flow handle recovery naturally (like WhatsApp does).
@@ -500,7 +500,45 @@ export async function cleanupCorruptedSession(
 	repository: SignalRepositoryWithLIDStore,
 	logger: ILogger
 ): Promise<number> {
-	await repository.deleteSession([jid])
-	logger.info({ jid }, 'Cleaned up corrupted session for specific device')
-	return 1
+	const { user, device } = jidDecode(jid) || {}
+	if (!user) {
+		logger.warn({ jid }, 'Cannot cleanup session - invalid JID')
+		return 0
+	}
+
+	// Build list of JIDs to delete (primary + secondary devices)
+	const jidsToDelete: string[] = []
+
+	// Determine domain type correctly (handle hosted JIDs)
+	// JID formats:
+	//   - PN: user@s.whatsapp.net
+	//   - LID: user@lid
+	//   - Hosted PN: user@hosted
+	//   - Hosted LID: user@hosted.lid
+	const isLID = jid.endsWith('@lid') || jid.endsWith('@hosted.lid')
+	const isHosted = jid.includes('@hosted')
+
+	let domain: string
+	if (isLID) {
+		domain = isHosted ? 'hosted.lid' : 'lid'
+	} else {
+		domain = isHosted ? 'hosted' : 's.whatsapp.net'
+	}
+
+	// Primary device (0)
+	jidsToDelete.push(`${user}@${domain}`)
+
+	// Secondary devices (1-5 common range for Web/Desktop/etc)
+	for (let i = 1; i <= 5; i++) {
+		jidsToDelete.push(`${user}:${i}@${domain}`)
+	}
+
+	// If specific device was identified and > 5, ensure it's included
+	if (device !== undefined && device > 5) {
+		jidsToDelete.push(`${user}:${device}@${domain}`)
+	}
+
+	await repository.deleteSession(jidsToDelete)
+
+	return jidsToDelete.length
 }

src/Utils/message-retry-manager.ts

@@ -218,7 +218,7 @@ export class MessageRetryManager {
 		if (errorCode !== undefined && MAC_ERROR_CODES.has(errorCode)) {
 			const now = Date.now()
 			const prevTime = this.sessionRecreateHistory.get(jid)
-			const MAC_ERROR_COOLDOWN_MS = 1_000 // 1 second — WABA recovers faster
+			const MAC_ERROR_COOLDOWN_MS = 10_000 // 10 seconds
 
 			if (prevTime && now - prevTime < MAC_ERROR_COOLDOWN_MS) {
 				const reasonName = RetryReason[errorCode] || `code_${errorCode}`