Improve attachment download failure handling

Fixes #2116

.github/workflows/build.yml

@@ -0,0 +1,57 @@
+name: build
+
+on:
+  push:
+    branches:
+      - "**"
+  pull_request:
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  build:
+    strategy:
+      matrix:
+        # java="25" is the LTS Java version used in reproducible builds script (default in Containerfile).
+        # More Java versions can be added to test compatibility, eg. "26".
+        java: ["25", "26"]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - name: Build
+        run: |
+          if [ "${{ matrix.java }}" != "25" ]; then
+            export OVERRIDE_JAVA_VERSION="${{ matrix.java }}"
+          fi
+          ./reproducible-builds/build.sh
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: signal-cli-archive-${{ matrix.java }}
+          path: dist/*
+
+  build-client:
+    strategy:
+      matrix:
+        os:
+          - ubuntu
+          - macos
+          - windows
+    runs-on: ${{ matrix.os }}-latest
+    defaults:
+      run:
+        working-directory: ./client
+    steps:
+      - uses: actions/checkout@v6
+      - name: Install rust
+        run: rustup default stable
+      - name: Build client
+        run: cargo build --release --verbose
+      - name: Archive production artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: signal-cli-client-${{ matrix.os }}
+          path: |
+            client/target/release/signal-cli-client
+            client/target/release/signal-cli-client.exe

.github/workflows/ci.yml

@@ -1,96 +0,0 @@
-name: signal-cli CI
-
-on:
-  push:
-    branches:
-      - '**'
-  pull_request:
-  workflow_call:
-
-permissions:
-  contents: write # to fetch code (actions/checkout) and submit dependency graph (gradle/gradle-build-action)
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        java: [ '21', '25' ]
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up JDK
-        uses: actions/setup-java@v3
-        with:
-          distribution: 'zulu'
-          java-version: ${{ matrix.java }}
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
-        with:
-          dependency-graph: generate-and-submit
-      - name: Install asciidoc
-        run: sudo apt update && sudo apt --no-install-recommends install -y asciidoc-base
-      - name: Build with Gradle
-        run: ./gradlew --no-daemon build
-      - name: Build man page
-        run: |
-          cd man
-          make install
-      - name: Add man page to archive
-        run: |
-          version=$(tar tf build/distributions/signal-cli-*.tar | head -n1 | sed 's|signal-cli-\([^/]*\)/.*|\1|')
-          echo $version
-          tar --transform="flags=r;s|man|signal-cli-${version}/man|" -rf build/distributions/signal-cli-${version}.tar man/man{1,5}
-      - name: Compress archive
-        run: gzip -n -9 build/distributions/signal-cli-*.tar
-      - name: Archive production artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: signal-cli-archive-${{ matrix.java }}
-          path: build/distributions/signal-cli-*.tar.gz
-
-  build-graalvm:
-
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v4
-      - uses: graalvm/setup-graalvm@v1
-        with:
-          version: 'latest'
-          java-version: '21'
-          cache: 'gradle'
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build with Gradle
-        run: ./gradlew --no-daemon nativeCompile
-      - name: Archive production artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: signal-cli-native
-          path: build/native/nativeCompile/signal-cli
-
-  build-client:
-    strategy:
-      matrix:
-        os:
-          - ubuntu
-          - macos
-          - windows
-    runs-on: ${{ matrix.os }}-latest
-    defaults:
-      run:
-        working-directory: ./client
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install rust
-        run: rustup default stable
-      - name: Build client
-        run: cargo build --release --verbose
-      - name: Archive production artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: signal-cli-client-${{ matrix.os }}
-          path: |
-            client/target/release/signal-cli-client
-            client/target/release/signal-cli-client.exe

.github/workflows/codeql-analysis.yml

@@ -21,13 +21,13 @@ jobs:
     steps:
 
       - name: Setup Java JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v5
         with:
           distribution: 'zulu'
-          java-version: 21
+          java-version: 25
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           # We must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head.
@@ -35,7 +35,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         # Override language selection by uncommenting this and choosing your languages
         # with:
         #   languages: go, javascript, csharp, python, cpp, java
@@ -43,7 +43,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -57,4 +57,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4

.github/workflows/dependency-graph.yml

@@ -0,0 +1,27 @@
+name: dependency-graph
+
+on:
+  push:
+    branches:
+      - "**"
+
+permissions: {}
+
+jobs:
+  submit-dependency-graph:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v6
+      - name: Set up JDK
+        uses: actions/setup-java@v5
+        with:
+          distribution: 'zulu'
+          java-version: '25'
+      - name: Setup Gradle
+        uses: gradle/actions/setup-gradle@v5
+        with:
+          dependency-graph: generate-and-submit
+      - name: Generate dependency graph
+        run: ./gradlew --no-daemon dependencies

.github/workflows/release.yml

@@ -5,197 +5,78 @@ on:
     tags:
       - v*
 
-permissions:
-  contents: write # to fetch code (actions/checkout) and create release
+permissions: {}
 
 env:
   IMAGE_NAME: signal-cli
   IMAGE_REGISTRY: ghcr.io/asamk
   REGISTRY_USER: ${{ github.actor }}
   REGISTRY_PASSWORD: ${{ github.token }}
+  ARCHIVE_JAVA_VERSION: 25
 
 jobs:
+  build:
+    uses: ./.github/workflows/build.yml
 
-  ci_wf:
-    permissions:
-      contents: write
-    uses: AsamK/signal-cli/.github/workflows/ci.yml@master
-    # ${{ github.repository }} not accepted here
-
-  lib_to_jar:
-    needs: ci_wf
+  release:
+    needs: build
     runs-on: ubuntu-latest
     permissions:
       contents: write
-
     outputs:
-      signal_cli_version: ${{ steps.cli_ver.outputs.version }}
-      release_id: ${{ steps.create_release.outputs.id }}
-
+      version: ${{ steps.version.outputs.version }}
     steps:
-
       - name: Download signal-cli build from CI workflow
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
 
       - name: Get signal-cli version
-        id: cli_ver
+        id: version
         run: |
-          ver="${GITHUB_REF_NAME#v}"
-          echo "version=${ver}" >> $GITHUB_OUTPUT
+          mv ./signal-cli-archive-${{ env.ARCHIVE_JAVA_VERSION }}/* .
+          echo "version=$(cat VERSION)" >> $GITHUB_OUTPUT
 
-      - name: Extract archive
+      - name: Create draft release and upload assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          tree .
-          ARCHIVE_DIR=$(ls signal-cli-archive-*/ -d | tail -n1)
-          tar -xzf ./"${ARCHIVE_DIR}"/*.tar.gz
-          mv ./"${ARCHIVE_DIR}"/*.tar.gz signal-cli-${{ steps.cli_ver.outputs.version }}.tar.gz
-          rm -rf signal-cli-archive-*/
-
-#      - name: Get signal-client jar version
-#        id: lib_ver
-#        run: |
-#          JAR_PREFIX=libsignal-client-
-#          jar_file=$(find ./signal-cli-*/lib/ -name "$JAR_PREFIX*.jar")
-#          jar_version=$(echo "$jar_file" | xargs basename | sed "s/$JAR_PREFIX//; s/.jar//")
-#          echo "$jar_version"
-#          echo "signal_client_version=${jar_version}" >> $GITHUB_OUTPUT
-#
-#      - name: Download signal-client builds
-#        env:
-#          RELEASES_URL: https://github.com/signalapp/libsignal/releases/download/
-#          FILE_NAMES: signal_jni.dll libsignal_jni.dylib
-#          SIGNAL_CLIENT_VER: ${{ steps.lib_ver.outputs.signal_client_version }}
-#        run: |
-#          for file_name in $FILE_NAMES; do
-#            curl -sOL "${RELEASES_URL}/v${SIGNAL_CLIENT_VER}/${file_name}"  # note: added v
-#          done
-#          tree .
-
-      - name: Compress native app
-        env:
-          SIGNAL_CLI_VER: ${{ steps.cli_ver.outputs.version }}
-        run: |
-          chmod +x signal-cli-native/signal-cli
-          tar -czf signal-cli-${SIGNAL_CLI_VER}-Linux-native.tar.gz -C signal-cli-native signal-cli
-          rm -rf signal-cli-native/
-
-#      - name: Replace Windows lib
-#        env:
-#          SIGNAL_CLI_VER: ${{ steps.cli_ver.outputs.version }}
-#          SIGNAL_CLIENT_VER: ${{ steps.lib_ver.outputs.signal_client_version }}
-#        run: |
-#          mv signal_jni.dll libsignal_jni.so
-#          zip -u ./signal-cli-*/lib/libsignal-client-${SIGNAL_CLIENT_VER}.jar  ./libsignal_jni.so
-#          tar -czf signal-cli-${SIGNAL_CLI_VER}-Windows.tar.gz signal-cli-*/
-#
-#      - name: Replace macOS lib
-#        env:
-#          SIGNAL_CLI_VER: ${{ steps.cli_ver.outputs.version }}
-#          SIGNAL_CLIENT_VER: ${{ steps.lib_ver.outputs.signal_client_version }}
-#        run: |
-#          jar_file=./signal-cli-*/lib/libsignal-client-${SIGNAL_CLIENT_VER}.jar
-#          zip -d $jar_file libsignal_jni.so
-#          zip $jar_file libsignal_jni.dylib
-#          tar -czf signal-cli-${SIGNAL_CLI_VER}-macOS.tar.gz signal-cli-*/
-
-      - name: Create release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: v${{ steps.cli_ver.outputs.version }}  # note: added `v`
-          release_name: v${{ steps.cli_ver.outputs.version }}  # note: added `v`
-          draft: true
-
-      - name: Upload archive
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}.tar.gz
-          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}.tar.gz
-          asset_content_type: application/x-compressed-tar  # .tar.gz
-
-#      - name: Upload Linux archive
-#        uses: actions/upload-release-asset@v1
-#        env:
-#          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-#        with:
-#          upload_url: ${{ steps.create_release.outputs.upload_url }}
-#          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}-Linux.tar.gz
-#          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}-Linux.tar.gz
-#          asset_content_type: application/x-compressed-tar  # .tar.gz
-
-      - name: Upload Linux native archive
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}-Linux-native.tar.gz
-          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}-Linux-native.tar.gz
-          asset_content_type: application/x-compressed-tar  # .tar.gz
-
-#      - name: Upload windows archive
-#        uses: actions/upload-release-asset@v1
-#        env:
-#          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-#        with:
-#          upload_url: ${{ steps.create_release.outputs.upload_url }}
-#          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}-Windows.tar.gz
-#          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}-Windows.tar.gz
-#          asset_content_type: application/x-compressed-tar  # .tar.gz
-#
-#      - name: Upload macos archive
-#        uses: actions/upload-release-asset@v1
-#        env:
-#          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-#        with:
-#          upload_url: ${{ steps.create_release.outputs.upload_url }}
-#          asset_path: signal-cli-${{ steps.cli_ver.outputs.version }}-macOS.tar.gz
-#          asset_name: signal-cli-${{ steps.cli_ver.outputs.version }}-macOS.tar.gz
-#          asset_content_type: application/x-compressed-tar  # .tar.gz
+          gh release create "v${{ steps.version.outputs.version }}" \
+            --repo "${{ github.repository }}" \
+            --title "v${{ steps.version.outputs.version }}" \
+            --draft \
+            --verify-tag \
+            "signal-cli-${{ steps.version.outputs.version }}.tar.gz" \
+            "signal-cli-${{ steps.version.outputs.version }}-Linux-native.tar.gz" \
+            "signal-cli-${{ steps.version.outputs.version }}-Linux-client.tar.gz" \
+            "signal-cli-${{ steps.version.outputs.version }}-json-schemas.tar.gz"
 
   build-container:
-    needs: ci_wf
+    needs: release
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       packages: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Download signal-cli build from CI workflow
-        uses: actions/download-artifact@v4
-
-      - name: Get signal-cli version
-        id: cli_ver
-        run: |
-          ver="${GITHUB_REF_NAME#v}"
-          echo "version=${ver}" >> $GITHUB_OUTPUT
+        uses: actions/download-artifact@v8
 
       - name: Move archive file
         run: |
-          ARCHIVE_DIR=$(ls signal-cli-archive-*/ -d | tail -n1)
-          tar xf ./"${ARCHIVE_DIR}"/*.tar.gz
-          rm -r signal-cli-archive-* signal-cli-native
+          tar xf signal-cli-archive-${{ env.ARCHIVE_JAVA_VERSION }}/signal-cli-${{ needs.release.outputs.version }}.tar.gz
           mkdir -p build/install/
-          mv ./signal-cli-"${GITHUB_REF_NAME#v}"/ build/install/signal-cli
+          mv ./signal-cli-"${{ needs.release.outputs.version }}"/ build/install/signal-cli
 
       - name: Build Image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@v3
         with:
           image: ${{ env.IMAGE_NAME }}
-          tags: latest ${{ github.sha }} ${{ steps.cli_ver.outputs.version }}
-          containerfiles:
-            ./Containerfile
+          tags: latest ${{ github.sha }} ${{ needs.release.outputs.version }}
+          containerfiles: ./Containerfile
           oci: true
 
       - name: Push To GHCR
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@v3
         id: push
         with:
           image: ${{ steps.build_image.outputs.image }}
@@ -209,41 +90,75 @@ jobs:
           echo "${{ toJSON(steps.push.outputs) }}"
 
   build-container-native:
-    needs: ci_wf
+    needs: release
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       packages: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Download signal-cli build from CI workflow
-        uses: actions/download-artifact@v4
-
-      - name: Get signal-cli version
-        id: cli_ver
-        run: |
-          ver="${GITHUB_REF_NAME#v}"
-          echo "version=${ver}" >> $GITHUB_OUTPUT
+        uses: actions/download-artifact@v8
 
       - name: Move archive file
         run: |
+          tar xf signal-cli-archive-${{ env.ARCHIVE_JAVA_VERSION }}/signal-cli-${{ needs.release.outputs.version }}-Linux-native.tar.gz
           mkdir -p build/native/nativeCompile/
-          chmod +x ./signal-cli-native/signal-cli
-          mv ./signal-cli-native/signal-cli build/native/nativeCompile/
+          mv signal-cli build/native/nativeCompile/
+          chmod +x build/native/nativeCompile/signal-cli
 
       - name: Build Image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@v3
         with:
           image: ${{ env.IMAGE_NAME }}
-          tags: latest-native ${{ github.sha }}-native ${{ steps.cli_ver.outputs.version }}-native
-          containerfiles:
-            ./native.Containerfile
+          tags: latest-native ${{ github.sha }}-native ${{ needs.release.outputs.version }}-native
+          containerfiles: ./native.Containerfile
           oci: true
 
       - name: Push To GHCR
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@v3
+        id: push
+        with:
+          image: ${{ steps.build_image.outputs.image }}
+          tags: ${{ steps.build_image.outputs.tags }}
+          registry: ${{ env.IMAGE_REGISTRY }}
+          username: ${{ env.REGISTRY_USER }}
+          password: ${{ env.REGISTRY_PASSWORD }}
+
+      - name: Echo outputs
+        run: |
+          echo "${{ toJSON(steps.push.outputs) }}"
+
+  build-container-client:
+    needs: release
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v6
+      - name: Download signal-cli build from CI workflow
+        uses: actions/download-artifact@v8
+
+      - name: Move archive file
+        run: |
+          tar xf signal-cli-archive-${{ env.ARCHIVE_JAVA_VERSION }}/signal-cli-${{ needs.release.outputs.version }}-Linux-client.tar.gz
+          mkdir -p client/target/release/
+          mv signal-cli-client client/target/release/
+          chmod +x client/target/release/signal-cli-client
+
+      - name: Build Image
+        id: build_image
+        uses: redhat-actions/buildah-build@v3
+        with:
+          image: ${{ env.IMAGE_NAME }}
+          tags: latest-client ${{ github.sha }}-client ${{ needs.release.outputs.version }}-client
+          containerfiles: ./client.Containerfile
+          oci: true
+
+      - name: Push To GHCR
+        uses: redhat-actions/push-to-registry@v3
         id: push
         with:
           image: ${{ steps.build_image.outputs.image }}

.gitignore

@@ -1,4 +1,5 @@
 .gradle/
+.kotlin/
 .idea/*
 !.idea/codeStyles/
 build/
@@ -13,3 +14,10 @@ out/
 .DS_Store
 /bin/
 /test-config/
+/dist/
+/github/
+man/*.1
+man/*.5
+man/man1
+man/man5
+.superpowers/

CHANGELOG.md

@@ -1,5 +1,203 @@
 # Changelog
 
+## [Unreleased]
+
+### Added
+
+- `send --attachment-dimensions` and `--attachment-blurhash` to set the placeholder shown before an attachment is downloaded
+
+## [0.14.8] - 2026-09-10
+
+### Added
+
+- Add terminateGroup command to terminate a group for everyone
+- Include isVoiceNote in receive JSON and JSON-RPC attachment payloads
+
+### Improved
+
+- Prevent more storage sync loops
+
+### Fixed
+
+- Fix graalvm issue with image dimension probing
+- Fix issue with sticker storage sync
+
+## [0.14.7] - 2026-08-01
+
+### Added
+
+- Sync installed sticker packs via storage sync
+
+### Improved
+
+- Set width/height for outgoing image attachments (Thanks @mikesimone)
+- Update to new registration/provisioning API
+
+### Fixed
+
+- Removing self from pending group invite now works if invited via PNI
+- Correctly set needs PNI signature for recipients
+- Fix linking after previous unsuccessful link attempt
+
+## [0.14.6] - 2026-07-12
+
+### Added
+
+- New `sendStory` command to post file attachment stories to "My Story" or to a group via `--group-id`
+
+### Improved
+
+- The account parameter `-a` now supports ACI in addition to phone number
+- Disabling read receipts in configuration now prevents sending read receipts (only sync message to linked devices is still sent)
+
+### Fixed
+
+- Sending to large groups is no longer slowed down by members that are already known to be unregistered; they are skipped instead of being retried via the legacy 1:1 send path on every send.
+
+## [0.14.5] - 2026-06-11
+
+### Changed
+
+- Disable host validation when binding on 0.0.0.0
+- Use new SVR2 enclave for PINs
+
+### Fixed
+
+- Receiving unidentified sender messages after signal server change
+
+## [0.14.4] - 2026-05-23
+
+### Added
+
+- Support for a global configuration file to set system-wide defaults
+
+### Fixed
+
+- Group admins can now see profile information for users requesting to join groups.
+- Storage sync with unregistered contacts fixed
+- Incoming messages are validated more accurately, fixing receiving messages from new contacts
+
+### Improved
+
+- Some security and stability improvements, including HTTP HOST header validation and safer temporary file handling.
+
+## [0.14.3] - 2026-04-22
+
+### Fixed
+
+- Fix sender key re-distribution on every group message (Thanks @meinecke)
+
+### Improved
+
+- Performance improvement when assigning admin role to multiple group members
+- Increase disconnect timeout for websocket connections
+- Release builds are now reproducible
+
+### Changed
+
+- Send message results now surface server-advised retry time for plain rate-limit (HTTP 413) failures, not only for proof-required challenges. The `retryAfterSeconds` field in JSON-RPC `SendMessageResult` is populated whenever the server sends a `Retry-After` header. The canonical way to distinguish proof-required failures remains `token != null`. Text output includes "retry after N seconds" when known.
+- Add distinct JSON-RPC error code (6) for captcha rejection (Thanks @tonycpsu)
+- No longer sends busy call response to allow linked devices to accept call
+
+## [0.14.2] - 2026-04-04
+
+### Added
+
+- Add `--voice-note` parameter to `send` command (Thanks @Kevin)
+- Add experimental support for voice calling (Thanks @visigoth)
+
+### Fixed
+
+- Fix `updateGroup` command for adding admins and removing members (Thanks @joeykrim)
+
+## [0.14.1] - 2026-03-08
+
+### Added
+
+- Added isArchived to contact json output (Thanks @moppman)
+- Added support for group member labels
+
+### Fixed
+
+- Adapt registration to signal server changes
+
+## [0.14.0] - 2026-03-01
+
+**Attention**: Now requires Java 25
+
+Requires libsignal-client version 0.87.4.
+
+### Breaking changes
+
+- Remove isRegistered method without parameters from Signal dbus interface, which always returned `true`
+- Remove `sandbox` value for --service-environment parameter, use `staging` instead
+- The `daemon` command now requires at least one channel parameter (`--socket`, `--dbus`, ...) and no longer defaults to
+  dbus
+
+### Added
+
+- The `link` command now prints a QR code in the terminal. (Thanks @karel1980)
+- Add --ignore-avatars flag to prevent downloading avatars
+- Add --ignore-stickers flag to prevent downloading sticker packs
+- Add `--no-urgent` flag to `send` command to send messages that don't trigger a push notification. (Thanks @kaikozlov)
+- Add `sendPinMessage`/`sendUnpinMessage` commands for pinning messages
+
+### Improved
+
+- Improved behavior for unregistered contacts
+- Profiles are refreshed when using the listContacts command
+- For long text messages the text attachment is used instead of the truncated body
+
+### Fixed
+
+- Adapted to new binary aci/pni formats in the Signal protocol
+- Group invites should now work when the user was invited via phone number (PNI only)
+
+## [0.13.24] - 2026-02-05
+
+Requires libsignal-client version 0.87.0.
+
+### Improved
+
+- Improve performance of first send to large group
+- Improve envelope validation
+
+## [0.13.23] - 2026-01-24
+
+Requires libsignal-client version 0.86.12.
+
+### Added
+
+- Add sendPollCreate, sendPollVote, sendPollTerminate commands for polls
+- Add updateDevice command to set device name of linked devices
+
+### Changed
+
+- Allow updating contact names from linked devices
+
+### Fixed
+
+- Start multi account mode even if some accounts have authorization failures
+
+## [0.13.22] - 2025-11-14
+
+Requires libsignal-client version 0.86.1.
+
+### Fixed
+
+- Fix timeout handling for receive command
+- Fix device link URI parsing for unencoded trailing =
+- Adapt setPin command to server changes
+
+## [0.13.21] - 2025-10-25
+
+Requires libsignal-client version 0.84.0.
+
+### Changed
+
+- Add isExpirationUpdate to json message output
+- Improve error message when using verify without registering before
+
 ## [0.13.20] - 2025-09-23
 
 Requires libsignal-client version 0.81.0.
@@ -101,9 +299,11 @@ Requires libsignal-client version 0.68.1.
 Requires libsignal-client version 0.66.2.
 
 ### Added
+
 - Allow setting nickname and note with `updateContact` command
 
 ### Fixed
+
 - Fix syncing nickname, note and expiration timer
 - Fix check for registered users with a proxy
 - Improve handling of storage records not yet supported by signal-cli
@@ -129,6 +329,7 @@ Requires libsignal-client version 0.65.2.
 Requires libsignal-client version 0.64.0.
 
 ### Fixed
+
 - Fix issue with receiving messages that have an invalid destination
 
 ## [0.13.10] - 2024-11-30
@@ -141,6 +342,7 @@ Requires libsignal-client version 0.62.0.
 - Fix receiving expiration timer updates
 
 ### Improved
+
 - Add support for new storage encryption scheme
 
 ## [0.13.9] - 2024-10-28

CONTRIBUTING.md

@@ -10,7 +10,7 @@ If you have a question you can ask it in the [GitHub discussions page](https://g
     - Be sure to include a **title and clear description**, as much relevant information as possible.
     - Specify the versions of signal-cli, libsignal-client (if self-compiled), JDK and OS you're using
     - Specify if it's the normal java or the graalvm native version.
-    - Run the failing command with `--verbose` flag to get a more detailed log output and include that in the bug report
+    - Run the failing command with `-vv --scrub-log` flags to get a more detailed log output and include that in the bug report
 
 # Pull request
 

Containerfile

@@ -1,4 +1,4 @@
-FROM docker.io/azul/zulu-openjdk:21-jre-headless
+FROM docker.io/azul/zulu-openjdk:25-jre-headless
 
 LABEL org.opencontainers.image.source=https://github.com/AsamK/signal-cli
 LABEL org.opencontainers.image.description="signal-cli provides an unofficial commandline, dbus and JSON-RPC interface for the Signal messenger."

README.md

@@ -3,12 +3,13 @@
 signal-cli is a commandline interface for the [Signal messenger](https://signal.org/).
 It supports registering, verifying, sending and receiving messages.
 signal-cli uses a [patched libsignal-service-java](https://github.com/Turasa/libsignal-service-java),
-extracted from the [Signal-Android source code](https://github.com/signalapp/Signal-Android/tree/main/libsignal-service).
+extracted from the [Signal-Android source code](https://github.com/signalapp/Signal-Android/tree/main/lib/libsignal-service).
 For registering you need a phone number where you can receive SMS or incoming calls.
+Existing accounts without a phone number can be linked from a compatible Signal mobile app.
 
 signal-cli is primarily intended to be used on servers to notify admins of important events.
 For this use-case, it has a daemon mode with JSON-RPC interface ([man page](https://github.com/AsamK/signal-cli/blob/master/man/signal-cli-jsonrpc.5.adoc))
-and D-BUS interface ([man page](https://github.com/AsamK/signal-cli/blob/master/man/signal-cli-dbus.5.adoc)) .
+and D-BUS interface ([man page](https://github.com/AsamK/signal-cli/blob/master/man/signal-cli-dbus.5.adoc)).
 For the JSON-RPC interface there's also a simple [example client](https://github.com/AsamK/signal-cli/tree/master/client), written in Rust.
 
 signal-cli needs to be kept up-to-date to keep up with Signal-Server changes.
@@ -23,24 +24,33 @@ Windows. There's also a [docker image and some Linux packages](https://github.co
 
 System requirements:
 
-- at least Java Runtime Environment (JRE) 21
+- at least Java Runtime Environment (JRE) 25
 - native library: libsignal-client
 
   The native libs are bundled for x86_64 Linux (with recent enough glibc), Windows and MacOS. For other
   systems/architectures
   see: [Provide native lib for libsignal](https://github.com/AsamK/signal-cli/wiki/Provide-native-lib-for-libsignal)
 
-### Install system-wide on Linux
+### Install system-wide on Linux [ JVM build ]
 
 See [latest version](https://github.com/AsamK/signal-cli/releases).
 
 ```sh
-export VERSION=<latest version, format "x.y.z">
-wget https://github.com/AsamK/signal-cli/releases/download/v"${VERSION}"/signal-cli-"${VERSION}".tar.gz
+VERSION=$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/AsamK/signal-cli/releases/latest | sed -e 's/^.*\/v//')
+curl -L -O https://github.com/AsamK/signal-cli/releases/download/v"${VERSION}"/signal-cli-"${VERSION}".tar.gz
 sudo tar xf signal-cli-"${VERSION}".tar.gz -C /opt
 sudo ln -sf /opt/signal-cli-"${VERSION}"/bin/signal-cli /usr/local/bin/
 ```
 
+### Install system-wide on Linux [ GraalVM native build ]
+
+```sh
+VERSION=$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/AsamK/signal-cli/releases/latest | sed -e 's/^.*\/v//')
+curl -L -O https://github.com/AsamK/signal-cli/releases/download/v"${VERSION}"/signal-cli-"${VERSION}"-Linux-native.tar.gz
+sudo tar xf signal-cli-"${VERSION}"-Linux-native.tar.gz -C /opt
+sudo ln -sf /opt/signal-cli /usr/local/bin/
+```
+
 You can find further instructions on the Wiki:
 
 - [Quickstart](https://github.com/AsamK/signal-cli/wiki/Quickstart)
@@ -51,12 +61,26 @@ For a complete usage overview please read
 the [man page](https://github.com/AsamK/signal-cli/blob/master/man/signal-cli.1.adoc) and
 the [wiki](https://github.com/AsamK/signal-cli/wiki).
 
-Important: The ACCOUNT is your phone number in international format and must include the country calling code. Hence it
+For a numbered account, ACCOUNT is your phone number in international format and must include the country calling code. Hence it
 should start with a "+" sign. (See [Wikipedia](https://en.wikipedia.org/wiki/List_of_country_calling_codes) for a list
 of all country codes.)
+For a linked account without a phone number, use its ACI (Account ID) instead.
+See the [wiki](https://github.com/AsamK/signal-cli/wiki) for further documentation.
+
+* Link to an existing account
+
+  If you have an existing Signal account, with or without a phone number,
+  you can link signal-cli to it with:
+
+      signal-cli link
 
 * Register a number (with SMS verification)
 
+  Alternatively, if you don't have an existing Signal
+  account, you can register one from signal-cli. Note
+  that this will unregister any existing client
+  associated with the same number.
+
       signal-cli -a ACCOUNT register
 
   You can register Signal using a landline number. In this case, you need to follow the procedure below:
@@ -139,6 +163,16 @@ version installed, you can replace `./gradlew` with `gradle` in the following st
       ./gradlew run --args="--help"
       ```
 
+### JSON Schemas for the JSON-RPC mode
+
+1. Generate [JSON Schema](https://json-schema.org/) files for all the JSON-RPC data classes (`src/main/java/org/asamk/signal/json`):
+
+    ```sh
+    ./gradlew jsonSchemas
+    ```
+
+2. The generated files can be found in the `build/generated/META-INF/schemas` folder.
+
 ### Building a native binary with GraalVM (EXPERIMENTAL)
 
 It is possible to build a native binary with [GraalVM](https://www.graalvm.org). This is still experimental and will not

build.gradle.kts

@@ -1,19 +1,21 @@
+import groovy.json.JsonOutput
+
 plugins {
     java
     application
     eclipse
     `check-lib-versions`
-    id("org.graalvm.buildtools.native") version "0.11.0"
+    id("org.graalvm.buildtools.native") version "1.1.12"
 }
 
 allprojects {
     group = "org.asamk"
-    version = "0.13.20"
+    version = "0.14.9-SNAPSHOT"
 }
 
 java {
-    sourceCompatibility = JavaVersion.VERSION_21
-    targetCompatibility = JavaVersion.VERSION_21
+    sourceCompatibility = JavaVersion.VERSION_25
+    targetCompatibility = JavaVersion.VERSION_25
 
     if (!JavaVersion.current().isCompatibleWith(targetCompatibility)) {
         toolchain {
@@ -30,16 +32,15 @@ application {
 graalvmNative {
     binaries {
         this["main"].run {
-            buildArgs.add("--install-exit-handlers")
             buildArgs.add("-Dfile.encoding=UTF-8")
             buildArgs.add("-J-Dfile.encoding=UTF-8")
             buildArgs.add("-march=compatibility")
+            buildArgs.add("--enable-native-access=ALL-UNNAMED")
             resources.autodetect()
-            configurationFileDirectories.from(file("graalvm-config-dir"))
             if (System.getenv("GRAALVM_HOME") == null) {
                 toolchainDetection.set(true)
                 javaLauncher.set(javaToolchains.launcherFor {
-                    languageVersion.set(JavaLanguageVersion.of(21))
+                    languageVersion.set(JavaLanguageVersion.of(25))
                 })
             } else {
                 toolchainDetection.set(false)
@@ -73,6 +74,11 @@ val excludePatterns = mapOf(
     )
 )
 
+val schemaAnnotationProcessor = configurations.create("schemaAnnotationProcessor") {
+    isCanBeConsumed = false
+    isCanBeResolved = true
+}
+
 dependencies {
     registerTransform(JarFileExcluder::class) {
         from.attribute(minified, false).attribute(artifactType, "jar")
@@ -83,6 +89,8 @@ dependencies {
         }
     }
 
+    schemaAnnotationProcessor(libs.micronaut.json.schema.processor)
+    schemaAnnotationProcessor(libs.micronaut.inject.java)
     implementation(libs.bouncycastle)
     implementation(libs.jackson.databind)
     implementation(libs.argparse4j)
@@ -90,7 +98,20 @@ dependencies {
     implementation(libs.slf4j.api)
     implementation(libs.slf4j.jul)
     implementation(libs.logback)
+    implementation(libs.zxing)
+    implementation(libs.micronaut.json.schema.annotations)
+    if (gradle.startParameter.taskNames.any { it.contains("jsonSchemas") }) {
+        implementation(libs.micronaut.json.schema.generator)
+    }
     implementation(project(":libsignal-cli"))
+
+    testImplementation(libs.junit.jupiter)
+    testImplementation(platform(libs.junit.jupiter.bom))
+    testRuntimeOnly(libs.junit.launcher)
+}
+
+tasks.named<Test>("test") {
+    useJUnitPlatform()
 }
 
 configurations {
@@ -124,6 +145,7 @@ tasks.register("fatJar", type = Jar::class) {
     archiveBaseName.set("${project.name}-fat")
     exclude(
         "META-INF/*.SF",
+        "META-INF/**/*.MF",
         "META-INF/*.DSA",
         "META-INF/*.RSA",
         "META-INF/NOTICE*",
@@ -137,3 +159,44 @@ tasks.register("fatJar", type = Jar::class) {
     }
     with(tasks.jar.get())
 }
+
+tasks.register("writeLibsignalVersion") {
+    doLast {
+        val resolutionResult = configurations.runtimeClasspath.get().incoming.resolutionResult
+        val libsignalDep =
+            resolutionResult.allDependencies.find { dep -> dep.requested is ModuleComponentSelector && (dep.requested as ModuleComponentSelector).group == "org.signal" && (dep.requested as ModuleComponentSelector).moduleIdentifier.name == "libsignal-client" }
+        if (libsignalDep != null) {
+            val version = (libsignalDep.requested as ModuleComponentSelector).version
+            file("libsignal-version").writeText(version + "\n")
+        } else {
+            throw GradleException("Could not find libsignal-client dependency")
+        }
+    }
+}
+
+tasks.register<JavaCompile>("jsonSchemas") {
+    dependsOn(tasks.compileJava)
+    val schemaBaseUri = "http://localhost:8080/schemas/"
+    source = sourceSets.main.get().java
+    include("org/asamk/signal/json/**/*.java")
+    classpath = sourceSets.main.get().compileClasspath + files(sourceSets.main.get().java.destinationDirectory)
+    destinationDirectory.set(layout.buildDirectory.dir("generated"))
+    options.annotationProcessorPath = schemaAnnotationProcessor
+    options.compilerArgs.addAll(
+        listOf(
+            "-Amicronaut.processing.group=org.asamk",
+            "-Amicronaut.processing.module=signal-cli",
+            "-Amicronaut.processing.annotations=org.asamk.signal.json.*",
+            "-Amicronaut.jsonschema.baseUri=$schemaBaseUri",
+        )
+    )
+    doLast {
+        fileTree(destinationDirectory.get().dir("META-INF/schemas").asFile) {
+            include("*.schema.json")
+        }.forEach { schemaFile ->
+            val normalized = schemaFile.readText().replace("\"$schemaBaseUri/", "\"")
+            val prettyJson = JsonOutput.prettyPrint(normalized)
+            schemaFile.writeText("$prettyJson\n")
+        }
+    }
+}

buildSrc/build.gradle.kts

@@ -7,11 +7,11 @@ plugins {
 }
 
 tasks.named<KotlinCompilationTask<KotlinJvmCompilerOptions>>("compileKotlin").configure {
-    compilerOptions.jvmTarget.set(JvmTarget.JVM_17)
+    compilerOptions.jvmTarget.set(JvmTarget.JVM_25)
 }
 
 java {
-    targetCompatibility = JavaVersion.VERSION_17
+    targetCompatibility = JavaVersion.VERSION_25
 }
 
 repositories {

buildSrc/src/main/kotlin/CheckLibVersionsPlugin.kt

@@ -1,5 +1,3 @@
-@file:Suppress("DEPRECATION")
-
 import org.gradle.api.Plugin
 import org.gradle.api.Project
 import org.gradle.api.Task
@@ -8,7 +6,7 @@ import javax.xml.parsers.DocumentBuilderFactory
 
 class CheckLibVersionsPlugin : Plugin<Project> {
     override fun apply(project: Project) {
-        project.task("checkLibVersions") {
+        project.tasks.register("checkLibVersions") {
             description =
                 "Find any 3rd party libraries which have released new versions to the central Maven repo since we last upgraded."
             doLast {
@@ -28,7 +26,7 @@ class CheckLibVersionsPlugin : Plugin<Project> {
         try {
             val dbf = DocumentBuilderFactory.newInstance()
             val db = dbf.newDocumentBuilder()
-            val doc = db.parse(metaDataUrl);
+            val doc = db.parse(metaDataUrl)
             val newest = doc.getElementsByTagName("latest").item(0).textContent
             if (version != newest.toString()) {
                 println("UPGRADE {\"group\": \"$group\", \"name\": \"$name\", \"current\": \"$version\", \"latest\": \"$newest\"}")

client.Containerfile

@@ -0,0 +1,11 @@
+FROM docker.io/debian:testing-slim
+
+LABEL org.opencontainers.image.source=https://github.com/AsamK/signal-cli
+LABEL org.opencontainers.image.description="signal-cli provides an unofficial commandline, dbus and JSON-RPC interface for the Signal messenger."
+LABEL org.opencontainers.image.licenses=GPL-3.0-only
+
+RUN useradd signal-cli --system
+ADD client/target/release/signal-cli-client /usr/bin/signal-cli-client
+
+USER signal-cli
+ENTRYPOINT ["/usr/bin/signal-cli-client"]

client/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "signal-cli-client"
-version = "0.0.1"
+version = "0.14.8"
 edition = "2024"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

client/src/cli.rs

@@ -10,6 +10,9 @@ pub struct Cli {
     #[arg(short = 'a', long)]
     pub account: Option<String>,
 
+    #[arg(long)]
+    pub output: Option<String>,
+
     /// TCP host and port of signal-cli daemon
     #[arg(long, conflicts_with = "json_rpc_http")]
     pub json_rpc_tcp: Option<Option<SocketAddr>>,
@@ -94,7 +97,7 @@ pub enum CliCommands {
     },
     Link {
         #[arg(short = 'n', long)]
-        name: String,
+        name: Option<String>,
     },
     ListAccounts,
     ListContacts {
@@ -105,6 +108,10 @@ pub enum CliCommands {
         blocked: Option<bool>,
         #[arg(long)]
         name: Option<String>,
+        #[arg(long)]
+        detailed: bool,
+        #[arg(long)]
+        internal: bool,
     },
     ListDevices,
     ListGroups {
@@ -135,6 +142,8 @@ pub enum CliCommands {
         voice: bool,
         #[arg(long)]
         captcha: Option<String>,
+        #[arg(long)]
+        reregister: bool,
     },
     RemoveContact {
         recipient: String,
@@ -167,15 +176,24 @@ pub enum CliCommands {
         #[arg(short = 'g', long)]
         group_id: Vec<String>,
 
+        #[arg(short = 'u', long = "username")]
+        username: Vec<String>,
+
         #[arg(long)]
         note_to_self: bool,
 
+        #[arg(long)]
+        notify_self: bool,
+
         #[arg(short = 'e', long)]
         end_session: bool,
 
         #[arg(short = 'm', long)]
         message: Option<String>,
 
+        #[arg(long)]
+        message_from_stdin: bool,
+
         #[arg(short = 'a', long)]
         attachment: Vec<String>,
 
@@ -229,6 +247,25 @@ pub enum CliCommands {
 
         #[arg(long)]
         edit_timestamp: Option<u64>,
+
+        #[arg(long = "no-urgent")]
+        no_urgent: bool,
+    },
+    SendAdminDelete {
+        #[arg(short = 'g', long = "group-id")]
+        group_id: Vec<String>,
+
+        #[arg(short = 'a', long = "target-author")]
+        target_author: String,
+
+        #[arg(short = 't', long = "target-timestamp")]
+        target_timestamp: u64,
+
+        #[arg(long)]
+        story: bool,
+
+        #[arg(long)]
+        notify_self: bool,
     },
     SendContacts,
     SendPaymentNotification {
@@ -240,15 +277,117 @@ pub enum CliCommands {
         #[arg(long)]
         note: String,
     },
+    SendPinMessage {
+        recipient: Vec<String>,
+
+        #[arg(short = 'g', long = "group-id")]
+        group_id: Vec<String>,
+
+        #[arg(short = 'u', long = "username")]
+        username: Vec<String>,
+
+        #[arg(short = 'a', long = "target-author")]
+        target_author: String,
+
+        #[arg(short = 't', long = "target-timestamp")]
+        target_timestamp: u64,
+
+        #[arg(short = 'd', long = "pin-duration")]
+        pin_duration: Option<i32>,
+
+        #[arg(long = "note-to-self")]
+        note_to_self: bool,
+
+        #[arg(long)]
+        notify_self: bool,
+
+        #[arg(long)]
+        story: bool,
+    },
+    SendPollCreate {
+        recipient: Vec<String>,
+
+        #[arg(short = 'g', long = "group-id")]
+        group_id: Vec<String>,
+
+        #[arg(short = 'u', long = "username")]
+        username: Vec<String>,
+
+        #[arg(short = 'q', long = "question")]
+        question: String,
+
+        #[arg(short = 'o', long = "option")]
+        option: Vec<String>,
+
+        #[arg(long = "no-multi")]
+        no_multi: bool,
+
+        #[arg(long = "note-to-self")]
+        note_to_self: bool,
+
+        #[arg(long)]
+        notify_self: bool,
+    },
+    SendPollTerminate {
+        recipient: Vec<String>,
+
+        #[arg(short = 'g', long = "group-id")]
+        group_id: Vec<String>,
+
+        #[arg(short = 'u', long = "username")]
+        username: Vec<String>,
+
+        #[arg(long = "poll-timestamp")]
+        poll_timestamp: u64,
+
+        #[arg(long = "note-to-self")]
+        note_to_self: bool,
+
+        #[arg(long)]
+        notify_self: bool,
+    },
+    SendPollVote {
+        recipient: Vec<String>,
+
+        #[arg(short = 'g', long = "group-id")]
+        group_id: Vec<String>,
+
+        #[arg(short = 'u', long = "username")]
+        username: Vec<String>,
+
+        #[arg(long = "poll-author")]
+        poll_author: Option<String>,
+
+        #[arg(long = "poll-timestamp")]
+        poll_timestamp: u64,
+
+        #[arg(short = 'o', long = "option")]
+        option: Vec<i32>,
+
+        #[arg(long = "vote-count")]
+        vote_count: i32,
+
+        #[arg(long = "note-to-self")]
+        note_to_self: bool,
+
+        #[arg(long)]
+        notify_self: bool,
+    },
     SendReaction {
         recipient: Vec<String>,
 
         #[arg(short = 'g', long = "group-id")]
         group_id: Vec<String>,
 
+        #[arg(short = 'u', long = "username")]
+        username: Vec<String>,
+
         #[arg(long = "note-to-self")]
         note_to_self: bool,
 
+        #[arg(long)]
+        notify_self: bool,
+
         #[arg(short = 'e', long)]
         emoji: String,
 
@@ -267,6 +406,9 @@ pub enum CliCommands {
     SendReceipt {
         recipient: String,
 
+        #[arg(short = 'u', long = "username")]
+        username: Vec<String>,
+
         #[arg(short = 't', long = "target-timestamp")]
         target_timestamp: Vec<u64>,
 
@@ -283,12 +425,37 @@ pub enum CliCommands {
         #[arg(short = 's', long)]
         stop: bool,
     },
+    SendUnpinMessage {
+        recipient: Vec<String>,
+
+        #[arg(short = 'g', long = "group-id")]
+        group_id: Vec<String>,
+
+        #[arg(short = 'u', long = "username")]
+        username: Vec<String>,
+
+        #[arg(short = 'a', long = "target-author")]
+        target_author: String,
+
+        #[arg(short = 't', long = "target-timestamp")]
+        target_timestamp: u64,
+
+        #[arg(long = "note-to-self")]
+        note_to_self: bool,
+
+        #[arg(long)]
+        notify_self: bool,
+
+        #[arg(long)]
+        story: bool,
+    },
     SendMessageRequestResponse {
         recipient: Vec<String>,
 
         #[arg(short = 'g', long = "group-id")]
         group_id: Vec<String>,
 
+        #[arg(long)]
         r#type: MessageRequestResponseType,
     },
     SetPin {
@@ -334,6 +501,10 @@ pub enum CliCommands {
         discoverable_by_number: Option<bool>,
         #[arg(long = "number-sharing")]
         number_sharing: Option<bool>,
+        #[arg(short = 'u', long = "username")]
+        username: Option<String>,
+        #[arg(long = "delete-username")]
+        delete_username: bool,
     },
     UpdateConfiguration {
         #[arg(long = "read-receipts")]
@@ -356,6 +527,28 @@ pub enum CliCommands {
 
         #[arg(short = 'n', long)]
         name: Option<String>,
+
+        #[arg(long = "given-name")]
+        given_name: Option<String>,
+
+        #[arg(long = "family-name")]
+        family_name: Option<String>,
+
+        #[arg(long = "nick-given-name")]
+        nick_given_name: Option<String>,
+
+        #[arg(long = "nick-family-name")]
+        nick_family_name: Option<String>,
+
+        #[arg(long)]
+        note: Option<String>,
+    },
+    UpdateDevice {
+        #[arg(short = 'd', long = "device-id")]
+        device_id: u32,
+
+        #[arg(short = 'n', long = "device-name")]
+        device_name: String,
     },
     UpdateGroup {
         #[arg(short = 'g', long = "group-id")]
@@ -405,6 +598,12 @@ pub enum CliCommands {
 
         #[arg(short = 'e', long)]
         expiration: Option<u32>,
+
+        #[arg(long = "member-label-emoji")]
+        member_label_emoji: Option<String>,
+
+        #[arg(long = "member-label")]
+        member_label: Option<String>,
     },
     UpdateProfile {
         #[arg(long = "given-name")]

client/src/jsonrpc.rs

@@ -90,7 +90,7 @@ pub trait Rpc {
     fn finish_link(
         &self,
         #[allow(non_snake_case)] deviceLinkUri: String,
-        #[allow(non_snake_case)] deviceName: String,
+        #[allow(non_snake_case)] deviceName: Option<String>,
     ) -> Result<Value, ErrorObjectOwned>;
 
     #[method(name = "listAccounts", param_kind = map)]
@@ -104,6 +104,8 @@ pub trait Rpc {
         #[allow(non_snake_case)] allRecipients: bool,
         blocked: Option<bool>,
         name: Option<String>,
+        detailed: bool,
+        internal: bool,
     ) -> Result<Value, ErrorObjectOwned>;
 
     #[method(name = "listDevices", param_kind = map)]
@@ -141,6 +143,7 @@ pub trait Rpc {
         account: Option<String>,
         voice: bool,
         captcha: Option<String>,
+        reregister: bool,
     ) -> Result<Value, ErrorObjectOwned>;
 
     #[method(name = "removeContact", param_kind = map)]
@@ -179,32 +182,116 @@ pub trait Rpc {
         account: Option<String>,
         recipients: Vec<String>,
         groupIds: Vec<String>,
-        noteToSelf: bool,
-        endSession: bool,
+        usernames: Vec<String>,
+        #[allow(non_snake_case)] notifySelf: bool,
+        #[allow(non_snake_case)] noteToSelf: bool,
+        #[allow(non_snake_case)] endSession: bool,
         message: String,
         attachments: Vec<String>,
-        viewOnce: bool,
+        #[allow(non_snake_case)] viewOnce: bool,
         mentions: Vec<String>,
-        textStyle: Vec<String>,
-        quoteTimestamp: Option<u64>,
-        quoteAuthor: Option<String>,
-        quoteMessage: Option<String>,
-        quoteMention: Vec<String>,
-        quoteTextStyle: Vec<String>,
-        quoteAttachment: Vec<String>,
-        previewUrl: Option<String>,
-        previewTitle: Option<String>,
-        previewDescription: Option<String>,
-        previewImage: Option<String>,
+        #[allow(non_snake_case)] textStyle: Vec<String>,
+        #[allow(non_snake_case)] quoteTimestamp: Option<u64>,
+        #[allow(non_snake_case)] quoteAuthor: Option<String>,
+        #[allow(non_snake_case)] quoteMessage: Option<String>,
+        #[allow(non_snake_case)] quoteMention: Vec<String>,
+        #[allow(non_snake_case)] quoteTextStyle: Vec<String>,
+        #[allow(non_snake_case)] quoteAttachment: Vec<String>,
+        #[allow(non_snake_case)] previewUrl: Option<String>,
+        #[allow(non_snake_case)] previewTitle: Option<String>,
+        #[allow(non_snake_case)] previewDescription: Option<String>,
+        #[allow(non_snake_case)] previewImage: Option<String>,
         sticker: Option<String>,
-        storyTimestamp: Option<u64>,
-        storyAuthor: Option<String>,
-        editTimestamp: Option<u64>,
+        #[allow(non_snake_case)] storyTimestamp: Option<u64>,
+        #[allow(non_snake_case)] storyAuthor: Option<String>,
+        #[allow(non_snake_case)] editTimestamp: Option<u64>,
+        #[allow(non_snake_case)] noUrgent: bool,
     ) -> Result<Value, ErrorObjectOwned>;
 
     #[method(name = "sendContacts", param_kind = map)]
     fn send_contacts(&self, account: Option<String>) -> Result<Value, ErrorObjectOwned>;
 
+    #[method(name = "sendAdminDelete", param_kind = map)]
+    fn send_admin_delete(
+        &self,
+        account: Option<String>,
+        #[allow(non_snake_case)] groupIds: Vec<String>,
+        #[allow(non_snake_case)] targetAuthor: String,
+        #[allow(non_snake_case)] targetTimestamp: u64,
+        story: bool,
+        #[allow(non_snake_case)] notifySelf: bool,
+    ) -> Result<Value, ErrorObjectOwned>;
+
+    #[method(name = "sendPinMessage", param_kind = map)]
+    fn send_pin_message(
+        &self,
+        account: Option<String>,
+        recipients: Vec<String>,
+        #[allow(non_snake_case)] groupIds: Vec<String>,
+        usernames: Vec<String>,
+        #[allow(non_snake_case)] targetAuthor: String,
+        #[allow(non_snake_case)] targetTimestamp: u64,
+        #[allow(non_snake_case)] pinDuration: Option<i32>,
+        #[allow(non_snake_case)] noteToSelf: bool,
+        #[allow(non_snake_case)] notifySelf: bool,
+        story: bool,
+    ) -> Result<Value, ErrorObjectOwned>;
+
+    #[method(name = "sendPollCreate", param_kind = map)]
+    fn send_poll_create(
+        &self,
+        account: Option<String>,
+        recipients: Vec<String>,
+        #[allow(non_snake_case)] groupIds: Vec<String>,
+        usernames: Vec<String>,
+        question: String,
+        option: Vec<String>,
+        #[allow(non_snake_case)] noMulti: bool,
+        #[allow(non_snake_case)] noteToSelf: bool,
+        #[allow(non_snake_case)] notifySelf: bool,
+    ) -> Result<Value, ErrorObjectOwned>;
+
+    #[method(name = "sendPollVote", param_kind = map)]
+    fn send_poll_vote(
+        &self,
+        account: Option<String>,
+        recipients: Vec<String>,
+        #[allow(non_snake_case)] groupIds: Vec<String>,
+        usernames: Vec<String>,
+        #[allow(non_snake_case)] pollAuthor: Option<String>,
+        #[allow(non_snake_case)] pollTimestamp: u64,
+        option: Vec<i32>,
+        #[allow(non_snake_case)] voteCount: i32,
+        #[allow(non_snake_case)] noteToSelf: bool,
+        #[allow(non_snake_case)] notifySelf: bool,
+    ) -> Result<Value, ErrorObjectOwned>;
+
+    #[method(name = "sendPollTerminate", param_kind = map)]
+    fn send_poll_terminate(
+        &self,
+        account: Option<String>,
+        recipients: Vec<String>,
+        #[allow(non_snake_case)] groupIds: Vec<String>,
+        usernames: Vec<String>,
+        #[allow(non_snake_case)] pollTimestamp: u64,
+        #[allow(non_snake_case)] noteToSelf: bool,
+        #[allow(non_snake_case)] notifySelf: bool,
+    ) -> Result<Value, ErrorObjectOwned>;
+
+    #[method(name = "sendUnpinMessage", param_kind = map)]
+    fn send_unpin_message(
+        &self,
+        account: Option<String>,
+        recipients: Vec<String>,
+        #[allow(non_snake_case)] groupIds: Vec<String>,
+        usernames: Vec<String>,
+        #[allow(non_snake_case)] targetAuthor: String,
+        #[allow(non_snake_case)] targetTimestamp: u64,
+        #[allow(non_snake_case)] noteToSelf: bool,
+        #[allow(non_snake_case)] notifySelf: bool,
+        story: bool,
+    ) -> Result<Value, ErrorObjectOwned>;
+
     #[method(name = "sendPaymentNotification", param_kind = map)]
     fn send_payment_notification(
         &self,
@@ -220,7 +307,9 @@ pub trait Rpc {
         account: Option<String>,
         recipients: Vec<String>,
         #[allow(non_snake_case)] groupIds: Vec<String>,
+        usernames: Vec<String>,
         #[allow(non_snake_case)] noteToSelf: bool,
+        #[allow(non_snake_case)] notifySelf: bool,
         emoji: String,
         #[allow(non_snake_case)] targetAuthor: String,
         #[allow(non_snake_case)] targetTimestamp: u64,
@@ -233,6 +322,7 @@ pub trait Rpc {
         &self,
         account: Option<String>,
         recipient: String,
+        usernames: Vec<String>,
         #[allow(non_snake_case)] targetTimestamps: Vec<u64>,
         r#type: String,
     ) -> Result<Value, ErrorObjectOwned>;
@@ -314,6 +404,8 @@ pub trait Rpc {
         unrestrictedUnidentifiedSender: Option<bool>,
         discoverableByNumber: Option<bool>,
         numberSharing: Option<bool>,
+        username: Option<String>,
+        deleteUsername: bool,
     ) -> Result<Value, ErrorObjectOwned>;
 
     #[method(name = "updateConfiguration", param_kind = map)]
@@ -333,6 +425,19 @@ pub trait Rpc {
         recipient: String,
         name: Option<String>,
         expiration: Option<u32>,
+        #[allow(non_snake_case)] givenName: Option<String>,
+        #[allow(non_snake_case)] familyName: Option<String>,
+        #[allow(non_snake_case)] nickGivenName: Option<String>,
+        #[allow(non_snake_case)] nickFamilyName: Option<String>,
+        note: Option<String>,
+    ) -> Result<Value, ErrorObjectOwned>;
+
+    #[method(name = "updateDevice", param_kind = map)]
+    fn update_device(
+        &self,
+        account: Option<String>,
+        #[allow(non_snake_case)] deviceId: u32,
+        #[allow(non_snake_case)] deviceName: String,
     ) -> Result<Value, ErrorObjectOwned>;
 
     #[method(name = "updateGroup", param_kind = map)]
@@ -355,6 +460,8 @@ pub trait Rpc {
         #[allow(non_snake_case)] setPermissionEditDetails: Option<String>,
         #[allow(non_snake_case)] setPermissionSendMessages: Option<String>,
         expiration: Option<u32>,
+        #[allow(non_snake_case)] memberLabelEmoji: Option<String>,
+        #[allow(non_snake_case)] memberLabel: Option<String>,
     ) -> Result<Value, ErrorObjectOwned>;
 
     #[method(name = "updateProfile", param_kind = map)]

client/src/main.rs

@@ -84,9 +84,19 @@ async fn handle_command(
             all_recipients,
             blocked,
             name,
+            detailed,
+            internal,
         } => {
             client
-                .list_contacts(cli.account, recipient, all_recipients, blocked, name)
+                .list_contacts(
+                    cli.account,
+                    recipient,
+                    all_recipients,
+                    blocked,
+                    name,
+                    detailed,
+                    internal,
+                )
                 .await
         }
         CliCommands::ListDevices => client.list_devices(cli.account).await,
@@ -105,8 +115,14 @@ async fn handle_command(
                 .quit_group(cli.account, group_id, delete, admin)
                 .await
         }
-        CliCommands::Register { voice, captcha } => {
-            client.register(cli.account, voice, captcha).await
+        CliCommands::Register {
+            voice,
+            captcha,
+            reregister,
+        } => {
+            client
+                .register(cli.account, voice, captcha, reregister)
+                .await
         }
         CliCommands::RemoveContact {
             recipient,
@@ -140,9 +156,12 @@ async fn handle_command(
         CliCommands::Send {
             recipient,
             group_id,
+            username,
+            notify_self,
             note_to_self,
             end_session,
             message,
+            message_from_stdin,
             attachment,
             view_once,
             mention,
@@ -161,15 +180,22 @@ async fn handle_command(
             story_timestamp,
             story_author,
             edit_timestamp,
+            no_urgent,
         } => {
             client
                 .send(
                     cli.account,
                     recipient,
                     group_id,
+                    username,
+                    notify_self,
                     note_to_self,
                     end_session,
-                    message.unwrap_or_default(),
+                    if message_from_stdin {
+                        std::io::read_to_string(std::io::stdin()).unwrap()
+                    } else {
+                        message.unwrap_or_default()
+                    },
                     attachment,
                     view_once,
                     mention,
@@ -188,10 +214,29 @@ async fn handle_command(
                     story_timestamp,
                     story_author,
                     edit_timestamp,
+                    no_urgent,
                 )
                 .await
         }
         CliCommands::SendContacts => client.send_contacts(cli.account).await,
+        CliCommands::SendAdminDelete {
+            group_id,
+            target_author,
+            target_timestamp,
+            story,
+            notify_self,
+        } => {
+            client
+                .send_admin_delete(
+                    cli.account,
+                    group_id,
+                    target_author,
+                    target_timestamp,
+                    story,
+                    notify_self,
+                )
+                .await
+        }
         CliCommands::SendPaymentNotification {
             recipient,
             receipt,
@@ -201,10 +246,108 @@ async fn handle_command(
                 .send_payment_notification(cli.account, recipient, receipt, note)
                 .await
         }
+        CliCommands::SendPinMessage {
+            recipient,
+            group_id,
+            username,
+            target_author,
+            target_timestamp,
+            pin_duration,
+            note_to_self,
+            notify_self,
+            story,
+        } => {
+            client
+                .send_pin_message(
+                    cli.account,
+                    recipient,
+                    group_id,
+                    username,
+                    target_author,
+                    target_timestamp,
+                    pin_duration,
+                    note_to_self,
+                    notify_self,
+                    story,
+                )
+                .await
+        }
+        CliCommands::SendPollCreate {
+            recipient,
+            group_id,
+            username,
+            question,
+            option,
+            no_multi,
+            note_to_self,
+            notify_self,
+        } => {
+            client
+                .send_poll_create(
+                    cli.account,
+                    recipient,
+                    group_id,
+                    username,
+                    question,
+                    option,
+                    no_multi,
+                    note_to_self,
+                    notify_self,
+                )
+                .await
+        }
+        CliCommands::SendPollTerminate {
+            recipient,
+            group_id,
+            username,
+            poll_timestamp,
+            note_to_self,
+            notify_self,
+        } => {
+            client
+                .send_poll_terminate(
+                    cli.account,
+                    recipient,
+                    group_id,
+                    username,
+                    poll_timestamp,
+                    note_to_self,
+                    notify_self,
+                )
+                .await
+        }
+        CliCommands::SendPollVote {
+            recipient,
+            group_id,
+            username,
+            poll_author,
+            poll_timestamp,
+            option,
+            vote_count,
+            note_to_self,
+            notify_self,
+        } => {
+            client
+                .send_poll_vote(
+                    cli.account,
+                    recipient,
+                    group_id,
+                    username,
+                    poll_author,
+                    poll_timestamp,
+                    option,
+                    vote_count,
+                    note_to_self,
+                    notify_self,
+                )
+                .await
+        }
         CliCommands::SendReaction {
             recipient,
             group_id,
+            username,
             note_to_self,
+            notify_self,
             emoji,
             target_author,
             target_timestamp,
@@ -216,7 +359,9 @@ async fn handle_command(
                     cli.account,
                     recipient,
                     group_id,
+                    username,
                     note_to_self,
+                    notify_self,
                     emoji,
                     target_author,
                     target_timestamp,
@@ -227,6 +372,7 @@ async fn handle_command(
         }
         CliCommands::SendReceipt {
             recipient,
+            username,
             target_timestamp,
             r#type,
         } => {
@@ -234,6 +380,7 @@ async fn handle_command(
                 .send_receipt(
                     cli.account,
                     recipient,
+                    username,
                     target_timestamp,
                     match r#type {
                         cli::ReceiptType::Read => "read".to_owned(),
@@ -252,6 +399,30 @@ async fn handle_command(
                 .send_typing(cli.account, recipient, group_id, stop)
                 .await
         }
+        CliCommands::SendUnpinMessage {
+            recipient,
+            group_id,
+            username,
+            target_author,
+            target_timestamp,
+            note_to_self,
+            notify_self,
+            story,
+        } => {
+            client
+                .send_unpin_message(
+                    cli.account,
+                    recipient,
+                    group_id,
+                    username,
+                    target_author,
+                    target_timestamp,
+                    note_to_self,
+                    notify_self,
+                    story,
+                )
+                .await
+        }
         CliCommands::SetPin { pin } => client.set_pin(cli.account, pin).await,
         CliCommands::SubmitRateLimitChallenge { challenge, captcha } => {
             client
@@ -284,6 +455,8 @@ async fn handle_command(
             unrestricted_unidentified_sender,
             discoverable_by_number,
             number_sharing,
+            username,
+            delete_username,
         } => {
             client
                 .update_account(
@@ -292,6 +465,8 @@ async fn handle_command(
                     unrestricted_unidentified_sender,
                     discoverable_by_number,
                     number_sharing,
+                    username,
+                    delete_username,
                 )
                 .await
         }
@@ -315,9 +490,32 @@ async fn handle_command(
             recipient,
             expiration,
             name,
+            given_name,
+            family_name,
+            nick_given_name,
+            nick_family_name,
+            note,
         } => {
             client
-                .update_contact(cli.account, recipient, name, expiration)
+                .update_contact(
+                    cli.account,
+                    recipient,
+                    name,
+                    expiration,
+                    given_name,
+                    family_name,
+                    nick_given_name,
+                    nick_family_name,
+                    note,
+                )
+                .await
+        }
+        CliCommands::UpdateDevice {
+            device_id,
+            device_name,
+        } => {
+            client
+                .update_device(cli.account, device_id, device_name)
                 .await
         }
         CliCommands::UpdateGroup {
@@ -337,6 +535,8 @@ async fn handle_command(
             set_permission_edit_details,
             set_permission_send_messages,
             expiration,
+            member_label_emoji,
+            member_label,
         } => {
             client
                 .update_group(
@@ -370,6 +570,8 @@ async fn handle_command(
                         GroupPermission::OnlyAdmins => "onlyAdmins".to_owned(),
                     }),
                     expiration,
+                    member_label_emoji,
+                    member_label,
                 )
                 .await
         }

data/org.asamk.SignalCli.metainfo.xml

@@ -45,6 +45,45 @@
         <content_attribute id="social-chat">intense</content_attribute>
     </content_rating>
     <releases>
+        <release version="0.14.8" date="2026-09-10">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.14.8</url>
+        </release>
+        <release version="0.14.7" date="2026-08-01">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.14.7</url>
+        </release>
+        <release version="0.14.6" date="2026-07-12">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.14.6</url>
+        </release>
+        <release version="0.14.5" date="2026-06-11">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.14.5</url>
+        </release>
+        <release version="0.14.4" date="2026-05-23">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.14.4</url>
+        </release>
+        <release version="0.14.3" date="2026-04-22">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.14.3</url>
+        </release>
+        <release version="0.14.2" date="2026-04-04">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.14.2</url>
+        </release>
+        <release version="0.14.1" date="2026-03-08">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.14.1</url>
+        </release>
+        <release version="0.14.0" date="2026-03-01">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.14.0</url>
+        </release>
+        <release version="0.13.24" date="2026-02-05">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.13.24</url>
+        </release>
+        <release version="0.13.23" date="2026-01-24">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.13.23</url>
+        </release>
+        <release version="0.13.22" date="2025-11-14">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.13.22</url>
+        </release>
+        <release version="0.13.21" date="2025-10-25">
+            <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.13.21</url>
+        </release>
         <release version="0.13.20" date="2025-09-23">
             <url type="details">https://github.com/AsamK/signal-cli/releases/tag/v0.13.20</url>
         </release>

docs/CALL_TUNNEL.md

@@ -0,0 +1,359 @@
+# Voice Call Support
+
+## Overview
+
+signal-cli supports voice calls by spawning a subprocess called
+`signal-call-tunnel` for each call. The tunnel handles WebRTC negotiation and
+audio transport. signal-cli communicates with the tunnel over its stdin/stdout
+using newline-delimited JSON messages, relaying signaling between the tunnel
+and the Signal protocol.
+
+```
+signal-cli                        signal-call-tunnel
+    |                                     |
+    |-- spawn --------------------------->|
+    |-- config JSON on stdin ------------>|
+    |                                     |
+    |-- commands on stdin --------------->|
+    |<-- events on stdout ----------------|
+    |                                     |   WebRTC
+    |   signaling relay                   |   audio I/O
+    |                                     |
+    |   (stderr: tunnel logging) -------->| (captured by signal-cli)
+```
+
+Each call gets its own tunnel process. When the call ends, signal-cli closes
+stdin and destroys the process.
+
+Audio device names (`inputDeviceName`, `outputDeviceName`) are opaque strings
+returned by the tunnel in its `ready` message. signal-cli passes them through
+to JSON-RPC clients, which use them to connect audio via platform APIs.
+
+---
+
+## Spawning the Tunnel
+
+For each call, signal-cli:
+
+1. Spawns `signal-call-tunnel`
+2. Writes config JSON followed by a newline to stdin
+3. Keeps stdin open for subsequent control messages
+4. Reads control events from stdout
+5. Captures stderr for logging
+
+The `signal-call-tunnel` binary is located by searching (in order):
+
+1. `SIGNAL_CALL_TUNNEL_BIN` environment variable
+2. `<signal-cli install dir>/bin/signal-call-tunnel` (detected from jar location)
+3. `signal-call-tunnel` on `PATH`
+
+### Config JSON
+
+The first line written to the tunnel's stdin:
+
+```json
+{
+  "call_id": 12345,
+  "is_outgoing": true,
+  "local_device_id": 1,
+  "input_device_name": "signal_input",
+  "output_device_name": "signal_output"
+}
+```
+
+| Field                | Type                    | Description                                   |
+|----------------------|-------------------------|-----------------------------------------------|
+| `call_id`            | unsigned 64-bit integer | Call identifier (use unsigned representation) |
+| `is_outgoing`        | boolean                 | Whether this is an outgoing call              |
+| `local_device_id`    | integer                 | Signal device ID                              |
+| `input_device_name`  | string (optional)       | Requested input audio device name             |
+| `output_device_name` | string (optional)       | Requested output audio device name            |
+
+If `input_device_name` or `output_device_name` are omitted, the tunnel
+chooses default names. On Linux, these are per-call unique names (e.g.,
+`signal_input_<call_id>`). On macOS, these are the fixed names `signal_input`
+and `signal_output`, which must match the pre-installed BlackHole drivers.
+
+---
+
+## Control Protocol
+
+Newline-delimited JSON messages over stdin (signal-cli to tunnel) and stdout
+(tunnel to signal-cli). The first line on stdin is the config JSON. Subsequent
+lines are control messages.
+
+### signal-cli -> Tunnel (stdin)
+
+| Type                 | When                       | Fields                                                                                            |
+|----------------------|----------------------------|---------------------------------------------------------------------------------------------------|
+| `createOutgoingCall` | Outgoing call setup        | `callId`, `peerId`                                                                                |
+| `proceed`            | After offer/receivedOffer  | `callId`, `hideIp`, `iceServers`                                                                  |
+| `receivedOffer`      | Incoming call              | `callId`, `peerId`, `opaque`, `age`, `senderDeviceId`, `senderIdentityKey`, `receiverIdentityKey` |
+| `receivedAnswer`     | Outgoing call answered     | `opaque`, `senderDeviceId`, `senderIdentityKey`, `receiverIdentityKey`                            |
+| `receivedIce`        | ICE candidates arrive      | `candidates` (array of base64 opaque blobs)                                                       |
+| `accept`             | User accepts incoming call | *(none)*                                                                                          |
+| `hangup`             | End the call               | *(none)*                                                                                          |
+
+### Tunnel -> signal-cli (stdout)
+
+| Type          | When                                        | Fields                                               |
+|---------------|---------------------------------------------|------------------------------------------------------|
+| `ready`       | Control socket bound, audio devices created | `inputDeviceName`, `outputDeviceName`                |
+| `sendOffer`   | Tunnel generated an offer                   | `callId`, `opaque`, `callMediaType`                  |
+| `sendAnswer`  | Tunnel generated an answer                  | `callId`, `opaque`                                   |
+| `sendIce`     | ICE candidates gathered                     | `callId`, `candidates` (array of `{"opaque":"..."}`) |
+| `sendHangup`  | Tunnel wants to hang up                     | `callId`, `hangupType`                               |
+| `sendBusy`    | Line is busy                                | `callId`                                             |
+| `stateChange` | Call state transition                       | `state`, `reason` (optional)                         |
+| `error`       | Something went wrong                        | `message`                                            |
+
+Opaque blobs and identity keys are base64-encoded. ICE servers use the format:
+
+```json
+{
+  "urls": [
+    "turn:example.com"
+  ],
+  "username": "u",
+  "password": "p"
+}
+```
+
+---
+
+## Startup Sequence
+
+```
+signal-cli                          signal-call-tunnel
+    |                                       |
+    |-- spawn process ------------------>   |
+    |-- config JSON + newline on stdin ---->|
+    |                                       | parse config
+    |                                       | initialize audio
+    |                                       |
+    |<-------- ready (on stdout) -----------|
+    |   {"type":"ready",                    |
+    |    "inputDeviceName":"...",           |
+    |    "outputDeviceName":"..."}          |
+    |                                       |
+    |-- control messages on stdin --------->|
+    |<-- control events on stdout ----------|
+```
+
+---
+
+## Call Flows
+
+### Outgoing call
+
+```
+signal-cli            signal-call-tunnel           Remote Phone
+  |                          |                          |
+  |-- spawn + config ------->|                          |
+  |<-- ready ----------------|                          |
+  |-- createOutgoingCall --->|                          |
+  |-- proceed (TURN) ------->|                          |
+  |                          | create offer             |
+  |<-- sendOffer ------------|                          |
+  |-- offer via Signal -------------------------------->|
+  |<-- answer via Signal -------------------------------|
+  |-- receivedAnswer ------->| (+ identity keys)        |
+  |<-- sendIce --------------|                          |
+  |-- ICE via Signal ------------------------------->   |
+  |<-- ICE via Signal --------------------------------  |
+  |-- receivedIce ---------->|                          |
+  |                          | ICE connects             |
+  |<-- stateChange:Connected |                          |
+```
+
+### Incoming call
+
+```
+signal-cli            signal-call-tunnel           Remote Phone
+  |                          |                          |
+  |<-- offer via Signal --------------------------------|
+  |-- spawn + config ------->|                          |
+  |<-- ready ----------------|                          |
+  |-- receivedOffer -------->| (+ identity keys)        |
+  |-- proceed (TURN) ------->|                          |
+  |                          | process offer            |
+  |<-- sendAnswer -----------|                          |
+  |-- answer via Signal -------------------------------->|
+  |<-- sendIce --------------|                          |
+  |-- ICE via Signal ------------------------------>    |
+  |<-- ICE via Signal --------------------------------  |
+  |-- receivedIce ---------->|                          |
+  |                          | ICE connecting...         |
+  |                          |                          |
+  |   (user accepts call)    |                          |
+  |   Java defers accept     |                          |
+  |                          |                          |
+  |<-- stateChange:Ringing --|  (tunnel ready to accept)|
+  |-- accept --------------->|  (deferred accept sent)  |
+  |                          | accept                   |
+  |<-- stateChange:Connected |                          |
+```
+
+### JSON-RPC client perspective
+
+An external application (bot, UI, test script) interacts via JSON-RPC only.
+
+**Important:** Call event notifications are not sent by default. Clients must
+call `subscribeCallEvents` before initiating or receiving calls. Without this,
+incoming calls are silently ignored (no tunnel is spawned).
+
+```
+JSON-RPC Client                    signal-cli daemon
+  |                                      |
+  |-- subscribeCallEvents() ------------>|  (required: enables call support)
+  |                                      |
+  |-- startCall(recipient) ------------->|
+  |<-- {callId, state,                  -|
+  |     inputDeviceName,                 |
+  |     outputDeviceName}                |
+  |                                      |
+  |<-- callEvent: RINGING_OUTGOING ------|
+  |   ... remote answers ...             |
+  |<-- callEvent: CONNECTED -------------|
+  |                                      |
+  |   connect to audio devices           |
+  |   (via platform audio APIs)          |
+  |                                      |
+  |-- hangupCall(callId) --------------->|  (or: receive callEvent ENDED)
+  |<-- callEvent: ENDED -----------------|
+  |   disconnect from audio devices      |
+```
+
+For incoming calls:
+
+```
+JSON-RPC Client                    signal-cli daemon
+  |                                      |
+  |-- subscribeCallEvents() ------------>|  (if not already subscribed)
+  |                                      |
+  |<-- callEvent: RINGING_INCOMING ------|  (includes callId, device names)
+  |                                      |
+  |-- acceptCall(callId) --------------->|
+  |<-- {callId, state,                  -|
+  |     inputDeviceName,                 |
+  |     outputDeviceName}                |
+  |                                      |
+  |<-- callEvent: CONNECTING ------------|
+  |<-- callEvent: CONNECTED -------------|
+  |                                      |
+  |   connect to audio devices           |
+  |   (via platform audio APIs)          |
+```
+
+To stop receiving call events, call `unsubscribeCallEvents`.
+
+---
+
+## State Machine
+
+Call states as seen by JSON-RPC clients:
+
+```
+                 startCall()
+                     |
+                     v
+    +----- RINGING_OUTGOING ----+      RINGING_INCOMING -----+
+    |              |            |              |              |
+    | (timeout     | (answered) | (rejected)   | acceptCall() | (timeout
+    |  ~60s)       |            |              |              |  ~60s)
+    v              v            v              v              v
+  ENDED        CONNECTED      ENDED       CONNECTING        ENDED
+                 |                           |
+                 |                           v
+                 |                       CONNECTED
+                 |                           |
+                 | (hangup/error)            | (hangup/error)
+                 v                           v
+               ENDED                       ENDED
+```
+
+For outgoing calls, `CONNECTED` fires directly when the tunnel reports
+`Connected` state -- there is no intermediate `CONNECTING` event.
+
+For incoming calls, `CONNECTING` is set by Java when the user calls
+`acceptCall()`, before the tunnel completes ICE negotiation.
+
+Both directions have a 60-second ring timeout.
+
+Reconnection (ICE restart):
+
+```
+  CONNECTED --> RECONNECTING --> CONNECTED  (ICE restart succeeded)
+                     |
+                     v
+                   ENDED  (ICE restart failed)
+```
+
+`RECONNECTING` maps from the tunnel's `Connecting` state, which is emitted
+during ICE restarts (not during initial connection).
+
+---
+
+## CallManager.java
+
+`lib/src/main/java/org/asamk/signal/manager/helper/CallManager.java`
+
+Manages the call lifecycle from the Java side:
+
+1. Spawns `signal-call-tunnel` and writes config JSON to stdin
+2. Keeps stdin open as the control write channel; reads stdout for control events
+3. Captures stderr for tunnel logging
+4. Parses `inputDeviceName` and `outputDeviceName` from the tunnel's `ready`
+   message and includes them in `CallInfo`
+5. Translates tunnel state changes into `CallInfo.State` values and fires
+   `callEvent` JSON-RPC notifications to connected clients
+6. Defers the `accept` message for incoming calls until the tunnel reports
+   `Ringing` state (sending earlier causes the tunnel to drop it)
+7. Schedules a 60-second ring timeout for both incoming and outgoing calls
+8. On hangup: sends hangup message, closes stdin, and destroys the process
+
+---
+
+## Implementation Notes
+
+### Peer ID consistency
+
+The `peerId` field in `createOutgoingCall` and `receivedOffer` must be the actual
+remote peer UUID (e.g., `senderAddress.toString()`). The tunnel rejects ICE
+candidates if the peer ID doesn't match across calls, causing "Ignoring
+peer-reflexive ICE candidate because the ufrag is unknown."
+
+### sendHangup semantics
+
+`sendHangup` from the tunnel is a request to send a hangup message via Signal
+protocol. It is **not** a local state change -- local state transitions come
+exclusively from `stateChange` events. For single-device clients, ignore
+`AcceptedOnAnotherDevice`, `DeclinedOnAnotherDevice`, and
+`BusyOnAnotherDevice` hangup types in the `hangupType` field -- sending these to
+the remote peer causes it to terminate the call prematurely.
+
+### Call ID serialization
+
+Call IDs can exceed `Long.MAX_VALUE` in Java. Use `Long.toUnsignedString()` when
+serializing to JSON for the tunnel (which expects unsigned 64-bit integers). In
+the config JSON, `call_id` should also use unsigned representation.
+
+### Incoming hangup filtering
+
+When receiving hangup messages via Signal protocol, only honor `NORMAL` type
+hangups. `ACCEPTED`, `DECLINED`, and `BUSY` types are multi-device coordination
+messages and should be ignored by single-device clients.
+
+### JSON-RPC call ID types
+
+JSON-RPC clients may send call IDs as various numeric types (Long, BigInteger,
+Integer). Use `Number.longValue()` rather than direct casting when extracting
+call IDs from JSON-RPC parameters.
+
+### Identity key format
+
+Identity keys in `senderIdentityKey` and `receiverIdentityKey` must be **raw
+32-byte Curve25519 public keys** (without the 0x05 DJB type prefix). If the
+33-byte serialized form is used instead, SRTP key derivation produces different
+keys on each side, causing authentication failures.
+

graalvm-config-dir/jni-config.json

@@ -1,343 +0,0 @@
-[
-{
-  "name":"[B"
-},
-{
-  "name":"[Ljava.lang.String;"
-},
-{
-  "name":"[Z"
-},
-{
-  "name":"[[B"
-},
-{
-  "name":"com.sun.security.auth.module.UnixSystem",
-  "fields":[{"name":"gid"}, {"name":"groups"}, {"name":"uid"}, {"name":"username"}]
-},
-{
-  "name":"java.lang.Boolean",
-  "methods":[{"name":"getBoolean","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"java.lang.Class",
-  "methods":[{"name":"getCanonicalName","parameterTypes":[] }, {"name":"getClassLoader","parameterTypes":[] }]
-},
-{
-  "name":"java.lang.ClassLoader",
-  "methods":[{"name":"getPlatformClassLoader","parameterTypes":[] }, {"name":"loadClass","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"java.lang.ClassNotFoundException"
-},
-{
-  "name":"java.lang.Enum",
-  "methods":[{"name":"ordinal","parameterTypes":[] }]
-},
-{
-  "name":"java.lang.IllegalArgumentException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"java.lang.IllegalStateException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"java.lang.Long",
-  "methods":[{"name":"<init>","parameterTypes":["long"] }]
-},
-{
-  "name":"java.lang.NoClassDefFoundError"
-},
-{
-  "name":"java.lang.NoSuchMethodError"
-},
-{
-  "name":"java.lang.String"
-},
-{
-  "name":"java.lang.Thread",
-  "methods":[{"name":"currentThread","parameterTypes":[] }, {"name":"getStackTrace","parameterTypes":[] }]
-},
-{
-  "name":"java.lang.Throwable",
-  "methods":[{"name":"getMessage","parameterTypes":[] }, {"name":"setStackTrace","parameterTypes":["java.lang.StackTraceElement[]"] }, {"name":"toString","parameterTypes":[] }]
-},
-{
-  "name":"java.lang.UnsatisfiedLinkError",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"java.util.HashMap",
-  "methods":[{"name":"<init>","parameterTypes":[] }]
-},
-{
-  "name":"java.util.Map",
-  "methods":[{"name":"get","parameterTypes":["java.lang.Object"] }, {"name":"put","parameterTypes":["java.lang.Object","java.lang.Object"] }, {"name":"remove","parameterTypes":["java.lang.Object"] }]
-},
-{
-  "name":"java.util.UUID",
-  "methods":[{"name":"<init>","parameterTypes":["long","long"] }, {"name":"getLeastSignificantBits","parameterTypes":[] }, {"name":"getMostSignificantBits","parameterTypes":[] }]
-},
-{
-  "name":"java.util.concurrent.ForkJoinWorkerThread"
-},
-{
-  "name":"jdk.internal.loader.ClassLoaders$AppClassLoader"
-},
-{
-  "name":"jdk.internal.loader.ClassLoaders$PlatformClassLoader"
-},
-{
-  "name":"org.asamk.signal.manager.internal.SignalWebSocketHealthMonitor$KeepAliveSender"
-},
-{
-  "name":"org.asamk.signal.manager.storage.protocol.SignalProtocolStore",
-  "methods":[{"name":"getIdentity","parameterTypes":["org.signal.libsignal.protocol.SignalProtocolAddress"] }, {"name":"getIdentityKeyPair","parameterTypes":[] }, {"name":"getLocalRegistrationId","parameterTypes":[] }, {"name":"isTrustedIdentity","parameterTypes":["org.signal.libsignal.protocol.SignalProtocolAddress","org.signal.libsignal.protocol.IdentityKey","org.signal.libsignal.protocol.state.IdentityKeyStore$Direction"] }, {"name":"loadKyberPreKey","parameterTypes":["int"] }, {"name":"loadPreKey","parameterTypes":["int"] }, {"name":"loadSenderKey","parameterTypes":["org.signal.libsignal.protocol.SignalProtocolAddress","java.util.UUID"] }, {"name":"loadSession","parameterTypes":["org.signal.libsignal.protocol.SignalProtocolAddress"] }, {"name":"loadSignedPreKey","parameterTypes":["int"] }, {"name":"markKyberPreKeyUsed","parameterTypes":["int"] }, {"name":"markKyberPreKeyUsed","parameterTypes":["int","int","org.signal.libsignal.protocol.ecc.ECPublicKey"] }, {"name":"removePreKey","parameterTypes":["int"] }, {"name":"saveIdentity","parameterTypes":["org.signal.libsignal.protocol.SignalProtocolAddress","org.signal.libsignal.protocol.IdentityKey"] }, {"name":"storeSenderKey","parameterTypes":["org.signal.libsignal.protocol.SignalProtocolAddress","java.util.UUID","org.signal.libsignal.protocol.groups.state.SenderKeyRecord"] }, {"name":"storeSession","parameterTypes":["org.signal.libsignal.protocol.SignalProtocolAddress","org.signal.libsignal.protocol.state.SessionRecord"] }]
-},
-{
-  "name":"org.asamk.signal.manager.storage.senderKeys.SenderKeyStore",
-  "methods":[{"name":"loadSenderKey","parameterTypes":["org.signal.libsignal.protocol.SignalProtocolAddress","java.util.UUID"] }, {"name":"storeSenderKey","parameterTypes":["org.signal.libsignal.protocol.SignalProtocolAddress","java.util.UUID","org.signal.libsignal.protocol.groups.state.SenderKeyRecord"] }]
-},
-{
-  "name":"org.graalvm.jniutils.JNIExceptionWrapperEntryPoints",
-  "methods":[{"name":"getClassName","parameterTypes":["java.lang.Class"] }]
-},
-{
-  "name":"org.signal.libsignal.internal.CompletableFuture",
-  "methods":[{"name":"<init>","parameterTypes":[] }, {"name":"complete","parameterTypes":["java.lang.Object"] }, {"name":"completeExceptionally","parameterTypes":["java.lang.Throwable"] }, {"name":"setCancellationId","parameterTypes":["long"] }]
-},
-{
-  "name":"org.signal.libsignal.internal.NativeHandleGuard$SimpleOwner",
-  "methods":[{"name":"unsafeNativeHandleWithoutGuard","parameterTypes":[] }]
-},
-{
-  "name":"org.signal.libsignal.net.CdsiLookupResponse",
-  "methods":[{"name":"<init>","parameterTypes":["java.util.Map","int"] }]
-},
-{
-  "name":"org.signal.libsignal.net.CdsiLookupResponse$Entry",
-  "methods":[{"name":"<init>","parameterTypes":["byte[]","byte[]"] }]
-},
-{
-  "name":"org.signal.libsignal.net.ChatConnection$ListenerBridge",
-  "methods":[{"name":"onConnectionInterrupted","parameterTypes":["java.lang.Throwable"] }, {"name":"onIncomingMessage","parameterTypes":["byte[]","long","long"] }, {"name":"onQueueEmpty","parameterTypes":[] }, {"name":"onReceivedAlerts","parameterTypes":["java.lang.String[]"] }]
-},
-{
-  "name":"org.signal.libsignal.net.ChatConnection$Response",
-  "methods":[{"name":"<init>","parameterTypes":["int","java.lang.String","java.util.Map","byte[]"] }]
-},
-{
-  "name":"org.signal.libsignal.net.ChatService"
-},
-{
-  "name":"org.signal.libsignal.net.ChatService$DebugInfo"
-},
-{
-  "name":"org.signal.libsignal.net.ChatService$Response"
-},
-{
-  "name":"org.signal.libsignal.net.ChatService$ResponseAndDebugInfo"
-},
-{
-  "name":"org.signal.libsignal.net.DeviceDeregisteredException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.net.NetworkException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.net.RetryLaterException",
-  "methods":[{"name":"<init>","parameterTypes":["long"] }]
-},
-{
-  "name":"org.signal.libsignal.net.internal.BridgeChatListener"
-},
-{
-  "name":"org.signal.libsignal.protocol.DuplicateMessageException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.IdentityKey",
-  "methods":[{"name":"<init>","parameterTypes":["long"] }, {"name":"<init>","parameterTypes":["byte[]"] }, {"name":"serialize","parameterTypes":[] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.IdentityKeyPair",
-  "methods":[{"name":"serialize","parameterTypes":[] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.InvalidKeyException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.InvalidKeyIdException"
-},
-{
-  "name":"org.signal.libsignal.protocol.InvalidMessageException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.NoSessionException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.SignalProtocolAddress",
-  "methods":[{"name":"<init>","parameterTypes":["long"] }, {"name":"<init>","parameterTypes":["java.lang.String","int"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.UntrustedIdentityException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.ecc.ECPublicKey",
-  "methods":[{"name":"<init>","parameterTypes":["long"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.fingerprint.FingerprintParsingException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.groups.state.SenderKeyRecord",
-  "fields":[{"name":"unsafeHandle"}],
-  "methods":[{"name":"<init>","parameterTypes":["long"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.groups.state.SenderKeyStore"
-},
-{
-  "name":"org.signal.libsignal.protocol.logging.Log",
-  "methods":[{"name":"log","parameterTypes":["int","java.lang.String","java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.message.PlaintextContent",
-  "fields":[{"name":"unsafeHandle"}]
-},
-{
-  "name":"org.signal.libsignal.protocol.message.PreKeySignalMessage",
-  "fields":[{"name":"unsafeHandle"}],
-  "methods":[{"name":"<init>","parameterTypes":["long"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.message.SenderKeyMessage",
-  "fields":[{"name":"unsafeHandle"}],
-  "methods":[{"name":"<init>","parameterTypes":["long"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.message.SignalMessage",
-  "fields":[{"name":"unsafeHandle"}],
-  "methods":[{"name":"<init>","parameterTypes":["long"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.state.IdentityKeyStore"
-},
-{
-  "name":"org.signal.libsignal.protocol.state.IdentityKeyStore$Direction",
-  "fields":[{"name":"RECEIVING"}, {"name":"SENDING"}]
-},
-{
-  "name":"org.signal.libsignal.protocol.state.IdentityKeyStore$IdentityChange"
-},
-{
-  "name":"org.signal.libsignal.protocol.state.KyberPreKeyRecord",
-  "fields":[{"name":"unsafeHandle"}]
-},
-{
-  "name":"org.signal.libsignal.protocol.state.KyberPreKeyStore"
-},
-{
-  "name":"org.signal.libsignal.protocol.state.PreKeyRecord",
-  "fields":[{"name":"unsafeHandle"}]
-},
-{
-  "name":"org.signal.libsignal.protocol.state.PreKeyStore"
-},
-{
-  "name":"org.signal.libsignal.protocol.state.SessionRecord",
-  "fields":[{"name":"unsafeHandle"}],
-  "methods":[{"name":"<init>","parameterTypes":["long"] }, {"name":"<init>","parameterTypes":["byte[]"] }]
-},
-{
-  "name":"org.signal.libsignal.protocol.state.SessionStore"
-},
-{
-  "name":"org.signal.libsignal.protocol.state.SignedPreKeyRecord",
-  "fields":[{"name":"unsafeHandle"}]
-},
-{
-  "name":"org.signal.libsignal.protocol.state.SignedPreKeyStore"
-},
-{
-  "name":"org.signal.libsignal.usernames.BadDiscriminatorCharacterException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.usernames.BadNicknameCharacterException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.usernames.CannotBeEmptyException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.usernames.DiscriminatorCannotBeZeroException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.usernames.MissingSeparatorException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.usernames.NicknameTooLongException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.usernames.NicknameTooShortException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.signal.libsignal.zkgroup.InvalidInputException",
-  "methods":[{"name":"<init>","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.sqlite.BusyHandler",
-  "methods":[{"name":"callback","parameterTypes":["int"] }]
-},
-{
-  "name":"org.sqlite.Collation",
-  "methods":[{"name":"xCompare","parameterTypes":["java.lang.String","java.lang.String"] }]
-},
-{
-  "name":"org.sqlite.Function",
-  "fields":[{"name":"args"}, {"name":"context"}, {"name":"value"}],
-  "methods":[{"name":"xFunc","parameterTypes":[] }]
-},
-{
-  "name":"org.sqlite.Function$Aggregate",
-  "methods":[{"name":"clone","parameterTypes":[] }, {"name":"xFinal","parameterTypes":[] }, {"name":"xStep","parameterTypes":[] }]
-},
-{
-  "name":"org.sqlite.Function$Window",
-  "methods":[{"name":"xInverse","parameterTypes":[] }, {"name":"xValue","parameterTypes":[] }]
-},
-{
-  "name":"org.sqlite.ProgressHandler",
-  "methods":[{"name":"progress","parameterTypes":[] }]
-},
-{
-  "name":"org.sqlite.core.DB",
-  "methods":[{"name":"onCommit","parameterTypes":["boolean"] }, {"name":"onUpdate","parameterTypes":["int","java.lang.String","java.lang.String","long"] }, {"name":"throwex","parameterTypes":[] }, {"name":"throwex","parameterTypes":["int"] }]
-},
-{
-  "name":"org.sqlite.core.DB$ProgressObserver",
-  "methods":[{"name":"progress","parameterTypes":["int","int"] }]
-},
-{
-  "name":"org.sqlite.core.NativeDB",
-  "fields":[{"name":"busyHandler"}, {"name":"commitListener"}, {"name":"pointer"}, {"name":"progressHandler"}, {"name":"updateListener"}],
-  "methods":[{"name":"stringToUtf8ByteArray","parameterTypes":["java.lang.String"] }, {"name":"throwex","parameterTypes":["java.lang.String"] }]
-},
-{
-  "name":"org.whispersystems.signalservice.api.websocket.SignalWebSocket$DelayedDisconnectThread"
-}
-]

graalvm-config-dir/predefined-classes-config.json

@@ -1,8 +0,0 @@
-[
-  {
-    "type":"agent-extracted",
-    "classes":[
-    ]
-  }
-]
-

graalvm-config-dir/proxy-config.json

@@ -1,26 +0,0 @@
-[
-  {
-    "interfaces":["java.sql.Connection"]
-  },
-  {
-    "interfaces":["org.asamk.Signal"]
-  },
-  {
-    "interfaces":["org.asamk.Signal$Configuration"]
-  },
-  {
-    "interfaces":["org.asamk.Signal$Device"]
-  },
-  {
-    "interfaces":["org.asamk.Signal$Group"]
-  },
-  {
-    "interfaces":["org.asamk.Signal$Identity"]
-  },
-  {
-    "interfaces":["org.asamk.SignalControl"]
-  },
-  {
-    "interfaces":["org.freedesktop.dbus.interfaces.DBus"]
-  }
-]

graalvm-config-dir/resource-config.json

@@ -1,226 +0,0 @@
-{
-  "resources":{
-  "includes":[{
-    "pattern":"\\QMETA-INF/maven/org.xerial/sqlite-jdbc/pom.properties\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/ch.qos.logback.classic.spi.Configurator\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/com.sun.net.httpserver.spi.HttpServerProvider\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/java.lang.System$LoggerFinder\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/java.net.spi.InetAddressResolverProvider\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/java.net.spi.URLStreamHandlerProvider\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/java.nio.channels.spi.SelectorProvider\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/java.nio.file.spi.FileTypeDetector\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/java.sql.Driver\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/java.time.zone.ZoneRulesProvider\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/java.util.spi.ResourceBundleControlProvider\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/kotlin.reflect.jvm.internal.impl.builtins.BuiltInsLoader\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/kotlin.reflect.jvm.internal.impl.resolve.ExternalOverridabilityCondition\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/kotlin.reflect.jvm.internal.impl.util.ModuleVisibilityHelper\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/org.freedesktop.dbus.spi.message.ISocketProvider\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/org.freedesktop.dbus.spi.transport.ITransportProvider\\E"
-  }, {
-    "pattern":"\\QMETA-INF/services/org.slf4j.spi.SLF4JServiceProvider\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_AG\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_AI\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_AR\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_AS\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_AT\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_AU\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_AZ\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_BB\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_BD\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_BE\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_BM\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_BO\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_BR\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_BS\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_CA\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_CH\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_CI\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_CL\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_CN\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_CO\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_CR\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_CZ\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_DE\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_DK\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_EC\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_EE\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_ES\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_FI\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_FR\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_GB\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_GR\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_HK\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_HR\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_HU\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_ID\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_IL\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_IN\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_IR\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_IT\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_JP\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_LV\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_MM\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_MO\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_MX\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_MY\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_NG\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_NL\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_NZ\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_PA\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_PE\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_PH\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_PL\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_RO\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_RU\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_SA\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_SI\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_SK\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_TH\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_TR\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_UA\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_UG\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_US\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_VE\\E"
-  }, {
-    "pattern":"\\Qcom/google/i18n/phonenumbers/data/PhoneNumberMetadataProto_XK\\E"
-  }, {
-    "pattern":"\\Qjni/x86_64-Linux/libjffi-1.2.so\\E"
-  }, {
-    "pattern":"\\Qkotlin/annotation/annotation.kotlin_builtins\\E"
-  }, {
-    "pattern":"\\Qkotlin/collections/collections.kotlin_builtins\\E"
-  }, {
-    "pattern":"\\Qkotlin/coroutines/coroutines.kotlin_builtins\\E"
-  }, {
-    "pattern":"\\Qkotlin/internal/internal.kotlin_builtins\\E"
-  }, {
-    "pattern":"\\Qkotlin/jvm/jvm.kotlin_builtins\\E"
-  }, {
-    "pattern":"\\Qkotlin/kotlin.kotlin_builtins\\E"
-  }, {
-    "pattern":"\\Qkotlin/ranges/ranges.kotlin_builtins\\E"
-  }, {
-    "pattern":"\\Qkotlin/reflect/reflect.kotlin_builtins\\E"
-  }, {
-    "pattern":"\\Qlibsignal_jni.so\\E"
-  }, {
-    "pattern":"\\Qlibsignal_jni_aarch64.dylib\\E"
-  }, {
-    "pattern":"\\Qlibsignal_jni_amd64.dylib\\E"
-  }, {
-    "pattern":"\\Qlibsignal_jni_amd64.so\\E"
-  }, {
-    "pattern":"\\Qorg/asamk/signal/manager/config/ias.store\\E"
-  }, {
-    "pattern":"\\Qorg/asamk/signal/manager/config/whisper.store\\E"
-  }, {
-    "pattern":"\\Qorg/slf4j/impl/StaticLoggerBinder.class\\E"
-  }, {
-    "pattern":"\\Qorg/sqlite/native/Linux/x86_64/libsqlitejdbc.so\\E"
-  }, {
-    "pattern":"\\Qsignal_jni.dll\\E"
-  }, {
-    "pattern":"\\Qsignal_jni_amd64.dll\\E"
-  }, {
-    "pattern":"\\Qsqlite-jdbc.properties\\E"
-  }, {
-    "pattern":"com/google/i18n/phonenumbers/data/.*"
-  }, {
-    "pattern":"java.base:\\Qjdk/internal/icu/impl/data/icudt67b/nfc.nrm\\E"
-  }, {
-    "pattern":"java.base:\\Qjdk/internal/icu/impl/data/icudt67b/uprops.icu\\E"
-  }, {
-    "pattern":"java.base:\\Qjdk/internal/icu/impl/data/icudt72b/nfc.nrm\\E"
-  }, {
-    "pattern":"java.base:\\Qjdk/internal/icu/impl/data/icudt72b/uprops.icu\\E"
-  }, {
-    "pattern":"java.base:\\Qsun/net/idn/uidna.spp\\E"
-  }, {
-    "pattern":"java.base:\\Qsun/net/www/content-types.properties\\E"
-  }, {
-    "pattern":"java.base:\\Qsun/text/resources/LineBreakIteratorData\\E"
-  }]},
-  "bundles":[{
-    "name":"net.sourceforge.argparse4j.internal.ArgumentParserImpl",
-    "locales":["", "de", "en", "und"]
-  }]
-}

graalvm-config-dir/serialization-config.json

@@ -1,8 +0,0 @@
-{
-  "types":[
-  ],
-  "lambdaCapturingTypes":[
-  ],
-  "proxies":[
-  ]
-}

gradle/libs.versions.toml

@@ -1,17 +1,29 @@
 [versions]
-slf4j = "2.0.17"
+slf4j = "2.0.19"
+coroutines = "1.11.0"
+junit = "6.1.3"
+micronaut-json-schema = "2.2.0"
+micronaut-core = "5.2.0"
+signal-service = "2.15.3_unofficial_153"
 
 [libraries]
-bouncycastle = "org.bouncycastle:bcprov-jdk18on:1.81"
-jackson-databind = "com.fasterxml.jackson.core:jackson-databind:2.20.0"
+bouncycastle = "org.bouncycastle:bcprov-jdk18on:1.85.2"
+jackson-databind = "com.fasterxml.jackson.core:jackson-databind:2.22.2"
 argparse4j = "net.sourceforge.argparse4j:argparse4j:0.9.0"
 dbusjava = "com.github.hypfvieh:dbus-java-transport-native-unixsocket:5.0.0"
+zxing = "com.google.zxing:core:3.5.4"
+micronaut-json-schema-annotations = { module = "io.micronaut.jsonschema:micronaut-json-schema-annotations", version.ref = "micronaut-json-schema" }
+micronaut-json-schema-processor = { module = "io.micronaut.jsonschema:micronaut-json-schema-processor", version.ref = "micronaut-json-schema" }
+micronaut-json-schema-generator = { module = "io.micronaut.jsonschema:micronaut-json-schema-generator", version.ref = "micronaut-json-schema" }
+micronaut-inject-java = { module = "io.micronaut:micronaut-inject-java", version.ref = "micronaut-core" }
 slf4j-api = { module = "org.slf4j:slf4j-api", version.ref = "slf4j" }
 slf4j-jul = { module = "org.slf4j:jul-to-slf4j", version.ref = "slf4j" }
-logback = "ch.qos.logback:logback-classic:1.5.18"
+logback = "ch.qos.logback:logback-classic:1.6.3"
 
-signalservice = "com.github.turasa:signal-service-java:2.15.3_unofficial_130"
-sqlite = "org.xerial:sqlite-jdbc:3.50.3.0"
-hikari = "com.zaxxer:HikariCP:7.0.2"
-junit-jupiter = "org.junit.jupiter:junit-jupiter:5.13.4"
-junit-launcher = "org.junit.platform:junit-platform-launcher:1.13.4"
+kotlinx-coroutines-core = { module = "org.jetbrains.kotlinx:kotlinx-coroutines-core", version.ref = "coroutines" }
+signalnetwork = { module = "com.github.turasa:signal-network", version.ref = "signal-service" }
+sqlite = "org.xerial:sqlite-jdbc:3.53.4.0"
+hikari = "com.zaxxer:HikariCP:7.1.0"
+junit-jupiter-bom = { module = "org.junit:junit-bom", version.ref = "junit" }
+junit-jupiter = { module = "org.junit.jupiter:junit-jupiter", version.ref = "junit" }
+junit-launcher = { module = "org.junit.platform:junit-platform-launcher", version.ref = "junit" }

gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,9 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.1.0-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.1-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradlew

@@ -20,7 +20,7 @@
 
 ##############################################################################
 #
-#   Gradle start up script for POSIX generated by Gradle.
+#   gradlew start up script for POSIX generated by Gradle.
 #
 #   Important for running:
 #
@@ -29,7 +29,7 @@
 #       bash, then to run this script, type that shell name before the whole
 #       command line, like:
 #
-#           ksh Gradle
+#           ksh gradlew
 #
 #       Busybox and similar reduced shells will NOT work, because this script
 #       requires all of these POSIX shell features:
@@ -57,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/HEAD/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/<unknown>/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.

gradlew.bat

@@ -19,12 +19,12 @@
 @if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
-@rem  Gradle startup script for Windows
+@rem  gradlew startup script for Windows
 @rem
 @rem ##########################################################################
 
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
+@rem Set local scope for the variables, and ensure extensions are enabled
+setlocal EnableExtensions
 
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
@@ -51,7 +51,7 @@ echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :findJavaFromJavaHome
 set JAVA_HOME=%JAVA_HOME:"=%
@@ -65,29 +65,18 @@ echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :execute
 @rem Setup the command line
 
 
 
-@rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+@rem Execute gradlew
+@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
+@rem which allows us to clear the local environment before executing the java command
+endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
 
-:end
-@rem End local scope for the variables with windows NT shell
-if %ERRORLEVEL% equ 0 goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-set EXIT_CODE=%ERRORLEVEL%
-if %EXIT_CODE% equ 0 set EXIT_CODE=1
-if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
-exit /b %EXIT_CODE%
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega
+:exitWithErrorLevel
+@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
+"%COMSPEC%" /c exit %ERRORLEVEL%

lib/build.gradle.kts

@@ -4,11 +4,13 @@ plugins {
 }
 
 java {
-    sourceCompatibility = JavaVersion.VERSION_21
-    targetCompatibility = JavaVersion.VERSION_21
+    sourceCompatibility = JavaVersion.VERSION_25
+    targetCompatibility = JavaVersion.VERSION_25
 
-    toolchain {
-        languageVersion.set(JavaLanguageVersion.of(21))
+    if (!JavaVersion.current().isCompatibleWith(targetCompatibility)) {
+        toolchain {
+            languageVersion.set(JavaLanguageVersion.of(targetCompatibility.majorVersion))
+        }
     }
 }
 
@@ -16,9 +18,9 @@ val libsignalClientPath = project.findProperty("libsignal_client_path")?.toStrin
 
 dependencies {
     if (libsignalClientPath == null) {
-        implementation(libs.signalservice)
+        implementation(libs.signalnetwork)
     } else {
-        implementation(libs.signalservice) {
+        implementation(libs.signalnetwork) {
             exclude(group = "org.signal", module = "libsignal-client")
         }
         implementation(files(libsignalClientPath))
@@ -28,8 +30,10 @@ dependencies {
     implementation(libs.slf4j.api)
     implementation(libs.sqlite)
     implementation(libs.hikari)
+    compileOnly(libs.kotlinx.coroutines.core)
 
     testImplementation(libs.junit.jupiter)
+    testImplementation(platform(libs.junit.jupiter.bom))
     testRuntimeOnly(libs.junit.launcher)
 }
 

lib/src/main/java/org/asamk/signal/manager/Manager.java

@@ -4,6 +4,8 @@ import com.google.i18n.phonenumbers.PhoneNumberUtil;
 
 import org.asamk.signal.manager.api.AlreadyReceivingException;
 import org.asamk.signal.manager.api.AttachmentInvalidException;
+import org.asamk.signal.manager.api.CallInfo;
+import org.asamk.signal.manager.api.CallOffer;
 import org.asamk.signal.manager.api.CaptchaRejectedException;
 import org.asamk.signal.manager.api.CaptchaRequiredException;
 import org.asamk.signal.manager.api.Configuration;
@@ -37,11 +39,13 @@ import org.asamk.signal.manager.api.ReceiveConfig;
 import org.asamk.signal.manager.api.Recipient;
 import org.asamk.signal.manager.api.RecipientIdentifier;
 import org.asamk.signal.manager.api.SendGroupMessageResults;
+import org.asamk.signal.manager.api.SendMessageResult;
 import org.asamk.signal.manager.api.SendMessageResults;
 import org.asamk.signal.manager.api.StickerPack;
 import org.asamk.signal.manager.api.StickerPackId;
 import org.asamk.signal.manager.api.StickerPackInvalidException;
 import org.asamk.signal.manager.api.StickerPackUrl;
+import org.asamk.signal.manager.api.TurnServer;
 import org.asamk.signal.manager.api.TypingAction;
 import org.asamk.signal.manager.api.UnregisteredRecipientException;
 import org.asamk.signal.manager.api.UpdateGroup;
@@ -50,6 +54,7 @@ import org.asamk.signal.manager.api.UserStatus;
 import org.asamk.signal.manager.api.UsernameLinkUrl;
 import org.asamk.signal.manager.api.UsernameStatus;
 import org.asamk.signal.manager.api.VerificationMethodNotAvailableException;
+import org.signal.core.util.UuidUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -70,6 +75,10 @@ public interface Manager extends Closeable {
         return PhoneNumberUtil.getInstance().isPossibleNumber(e164Number, countryCode);
     }
 
+    static boolean isValidAci(final String aci) {
+        return UuidUtil.INSTANCE.isUuid(aci);
+    }
+
     static boolean isSignalClientAvailable() {
         final Logger logger = LoggerFactory.getLogger(Manager.class);
         try {
@@ -87,6 +96,16 @@ public interface Manager extends Closeable {
 
     String getSelfNumber();
 
+    String getSelfACI();
+
+    /**
+     * Returns the phone number for numbered accounts, or the ACI for numberless accounts.
+     */
+    default String getSelfIdentifier() {
+        final var number = getSelfNumber();
+        return number != null ? number : getSelfACI();
+    }
+
     /**
      * This is used for checking a set of phone numbers for registration on Signal
      *
@@ -154,6 +173,8 @@ public interface Manager extends Closeable {
 
     List<Device> getLinkedDevices() throws IOException;
 
+    void updateLinkedDevice(int deviceId, String name) throws IOException, NotPrimaryDeviceException;
+
     void removeLinkedDevices(int deviceId) throws IOException, NotPrimaryDeviceException;
 
     void addDeviceLink(DeviceLinkUrl linkUri) throws IOException, InvalidDeviceLinkException, NotPrimaryDeviceException, DeviceLimitExceededException;
@@ -171,6 +192,10 @@ public interface Manager extends Closeable {
 
     void deleteGroup(GroupId groupId) throws IOException;
 
+    SendGroupMessageResults terminateGroup(
+            GroupId groupId
+    ) throws IOException, GroupNotFoundException, NotAGroupMemberException;
+
     Pair<GroupId, SendGroupMessageResults> createGroup(
             String name,
             Set<RecipientIdentifier.Single> members,
@@ -207,6 +232,19 @@ public interface Manager extends Closeable {
             long editTargetTimestamp
     ) throws IOException, AttachmentInvalidException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException, InvalidStickerException;
 
+    /**
+     * Post a file attachment story to "My Story" or to a group.
+     *
+     * @param attachment    path to the file to upload and post as a story
+     * @param allowsReplies whether other users are allowed to reply to this story
+     * @param groupId       if present, post the story to this group instead of "My Story"
+     */
+    SendMessageResults sendStory(
+            String attachment,
+            boolean allowsReplies,
+            Optional<GroupId> groupId
+    ) throws IOException, AttachmentInvalidException, GroupNotFoundException, NotAGroupMemberException;
+
     SendMessageResults sendRemoteDeleteMessage(
             long targetSentTimestamp,
             Set<RecipientIdentifier> recipients
@@ -218,22 +256,71 @@ public interface Manager extends Closeable {
             RecipientIdentifier.Single targetAuthor,
             long targetSentTimestamp,
             Set<RecipientIdentifier> recipients,
+            final boolean notifySelf,
             final boolean isStory
     ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException;
 
+    SendMessageResults sendAdminDelete(
+            RecipientIdentifier.Single targetAuthor,
+            long targetSentTimestamp,
+            Set<RecipientIdentifier.Group> recipients,
+            boolean notifySelf,
+            boolean isStory
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException;
+
+    SendMessageResults sendPinMessage(
+            int pinDuration,
+            RecipientIdentifier.Single targetAuthor,
+            long targetSentTimestamp,
+            Set<RecipientIdentifier> recipients,
+            boolean notifySelf,
+            boolean isStory
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException;
+
+    SendMessageResults sendUnpinMessage(
+            RecipientIdentifier.Single targetAuthor,
+            long targetSentTimestamp,
+            Set<RecipientIdentifier> recipients,
+            boolean notifySelf,
+            boolean isStory
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException;
+
     SendMessageResults sendPaymentNotificationMessage(
             byte[] receipt,
             String note,
             RecipientIdentifier.Single recipient
     ) throws IOException;
 
-    SendMessageResults sendEndSessionMessage(Set<RecipientIdentifier.Single> recipients) throws IOException;
+    void sendEndSessionMessage(Set<RecipientIdentifier.Single> recipients) throws IOException;
 
     SendMessageResults sendMessageRequestResponse(
             MessageEnvelope.Sync.MessageRequestResponse.Type type,
             Set<RecipientIdentifier> recipientIdentifiers
     );
 
+    SendMessageResults sendPollCreateMessage(
+            final String question,
+            final boolean allowMultiple,
+            final List<String> options,
+            final Set<RecipientIdentifier> recipients,
+            final boolean notifySelf
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException;
+
+    SendMessageResults sendPollVoteMessage(
+            final RecipientIdentifier.Single targetAuthor,
+            final long targetSentTimestamp,
+            final List<Integer> optionIndexes,
+            final int voteCount,
+            final Set<RecipientIdentifier> recipients,
+            final boolean notifySelf
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException;
+
+    SendMessageResults sendPollTerminateMessage(
+            final long targetSentTimestamp,
+            final Set<RecipientIdentifier> recipients,
+            final boolean notifySelf
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException;
+
     void hideRecipient(RecipientIdentifier.Single recipient);
 
     void deleteRecipient(RecipientIdentifier.Single recipient);
@@ -247,7 +334,7 @@ public interface Manager extends Closeable {
             final String nickGivenName,
             final String nickFamilyName,
             final String note
-    ) throws NotPrimaryDeviceException, UnregisteredRecipientException;
+    ) throws UnregisteredRecipientException;
 
     void setContactsBlocked(
             Collection<RecipientIdentifier.Single> recipient,
@@ -362,9 +449,52 @@ public interface Manager extends Closeable {
 
     InputStream retrieveSticker(final StickerPackId stickerPackId, final int stickerId) throws IOException;
 
+    // --- Voice call methods ---
+
+    CallInfo startCall(RecipientIdentifier.Single recipient) throws IOException, UnregisteredRecipientException;
+
+    CallInfo acceptCall(long callId) throws IOException;
+
+    void hangupCall(long callId) throws IOException;
+
+    SendMessageResult rejectCall(long callId) throws IOException;
+
+    List<CallInfo> listActiveCalls();
+
+    void sendCallOffer(
+            RecipientIdentifier.Single recipient,
+            CallOffer offer
+    ) throws IOException, UnregisteredRecipientException;
+
+    void sendCallAnswer(
+            RecipientIdentifier.Single recipient,
+            long callId,
+            byte[] answerOpaque
+    ) throws IOException, UnregisteredRecipientException;
+
+    void sendIceUpdate(
+            RecipientIdentifier.Single recipient,
+            long callId,
+            List<byte[]> iceCandidates
+    ) throws IOException, UnregisteredRecipientException;
+
+    void sendHangup(
+            RecipientIdentifier.Single recipient,
+            long callId,
+            MessageEnvelope.Call.Hangup.Type type
+    ) throws IOException, UnregisteredRecipientException;
+
+    void sendBusy(RecipientIdentifier.Single recipient, long callId) throws IOException, UnregisteredRecipientException;
+
+    List<TurnServer> getTurnServerInfo() throws IOException;
+
     @Override
     void close();
 
+    void addCallEventListener(CallEventListener listener);
+
+    void removeCallEventListener(CallEventListener listener);
+
     interface ReceiveMessageHandler {
 
         ReceiveMessageHandler EMPTY = (envelope, e) -> {
@@ -372,4 +502,9 @@ public interface Manager extends Closeable {
 
         void handleMessage(MessageEnvelope envelope, Throwable e);
     }
+
+    interface CallEventListener {
+
+        void handleCallEvent(CallInfo callInfo, String reason);
+    }
 }

lib/src/main/java/org/asamk/signal/manager/ManagerLogger.java

@@ -1,10 +1,12 @@
 package org.asamk.signal.manager;
 
 import org.asamk.signal.manager.internal.LibSignalLogger;
+import org.asamk.signal.manager.internal.SignalLogger;
 
 public class ManagerLogger {
 
     public static void initLogger() {
         LibSignalLogger.initLogger();
+        SignalLogger.initLogger();
     }
 }

lib/src/main/java/org/asamk/signal/manager/MultiAccountManager.java

@@ -8,8 +8,6 @@ import java.util.function.Consumer;
 
 public interface MultiAccountManager extends AutoCloseable {
 
-    List<String> getAccountNumbers();
-
     List<Manager> getManagers();
 
     void addOnManagerAddedHandler(Consumer<Manager> handler);

lib/src/main/java/org/asamk/signal/manager/ProvisioningManager.java

@@ -10,5 +10,8 @@ public interface ProvisioningManager {
 
     URI getDeviceLinkUri() throws TimeoutException, IOException;
 
+    /**
+     * Completes linking and returns the account's phone number, or ACI if it has no number.
+     */
     String finishDeviceLink(String deviceName) throws IOException, TimeoutException, UserAlreadyExistsException;
 }

lib/src/main/java/org/asamk/signal/manager/RegistrationManager.java

@@ -6,6 +6,7 @@ import org.asamk.signal.manager.api.NonNormalizedPhoneNumberException;
 import org.asamk.signal.manager.api.PinLockMissingException;
 import org.asamk.signal.manager.api.PinLockedException;
 import org.asamk.signal.manager.api.RateLimitException;
+import org.asamk.signal.manager.api.TotpRequiredException;
 import org.asamk.signal.manager.api.VerificationMethodNotAvailableException;
 
 import java.io.Closeable;
@@ -17,13 +18,19 @@ public interface RegistrationManager extends Closeable {
             boolean voiceVerification,
             String captcha,
             final boolean forceRegister
-    ) throws IOException, CaptchaRequiredException, NonNormalizedPhoneNumberException, RateLimitException, VerificationMethodNotAvailableException;
+    ) throws IOException, CaptchaRequiredException, NonNormalizedPhoneNumberException, RateLimitException, TotpRequiredException, VerificationMethodNotAvailableException;
 
     void verifyAccount(
             String verificationCode,
             String pin
     ) throws IOException, PinLockedException, IncorrectPinException, PinLockMissingException;
 
+    void registerWithRecoveryKey(
+            String recoveryKey,
+            boolean forceRegister,
+            Integer totp
+    ) throws IOException, RateLimitException, TotpRequiredException;
+
     void deleteLocalAccountData() throws IOException;
 
     boolean isRegistered();

lib/src/main/java/org/asamk/signal/manager/SignalAccountFiles.java

@@ -15,6 +15,7 @@ import org.asamk.signal.manager.internal.RegistrationManagerImpl;
 import org.asamk.signal.manager.storage.SignalAccount;
 import org.asamk.signal.manager.storage.accounts.AccountsStore;
 import org.asamk.signal.manager.util.KeyUtils;
+import org.signal.core.models.ServiceId.ACI;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.push.exceptions.DeprecatedVersionException;
@@ -24,6 +25,7 @@ import java.io.IOException;
 import java.util.Objects;
 import java.util.Set;
 import java.util.function.Consumer;
+import java.util.stream.Collectors;
 
 public class SignalAccountFiles {
 
@@ -64,15 +66,26 @@ public class SignalAccountFiles {
         return accountsStore.getAllNumbers();
     }
 
-    public MultiAccountManager initMultiAccountManager() throws IOException, AccountCheckException {
+    public Set<String> getAllLocalAccountIdentifiers() throws IOException {
+        return accountsStore.getAllAccounts()
+                .stream()
+                .map(a -> a.number() != null ? a.number() : a.uuid())
+                .collect(Collectors.toSet());
+    }
+
+    public MultiAccountManager initMultiAccountManager() throws IOException {
         final var managerPairs = accountsStore.getAllAccounts().parallelStream().map(a -> {
+            final var identifier = a.number() != null ? a.number() : a.uuid();
             try {
-                return new Pair<Manager, Throwable>(initManager(a.number(), a.path()), null);
+                final var manager = a.number() != null
+                        ? initManagerByNumber(a.number(), a.path())
+                        : initManagerByAci(ACI.parseOrThrow(a.uuid()), a.path());
+                return new Pair<Manager, Throwable>(manager, null);
             } catch (NotRegisteredException e) {
-                logger.warn("Ignoring {}: {} ({})", a.number(), e.getMessage(), e.getClass().getSimpleName());
+                logger.warn("Ignoring {}: {} ({})", identifier, e.getMessage(), e.getClass().getSimpleName());
                 return null;
             } catch (AccountCheckException | IOException e) {
-                logger.error("Failed to load {}: {} ({})", a.number(), e.getMessage(), e.getClass().getSimpleName());
+                logger.error("Failed to load {}: {} ({})", identifier, e.getMessage(), e.getClass().getSimpleName());
                 return new Pair<Manager, Throwable>(null, e);
             }
         }).filter(Objects::nonNull).toList();
@@ -80,24 +93,41 @@ public class SignalAccountFiles {
         for (final var pair : managerPairs) {
             if (pair.second() instanceof IOException e) {
                 throw e;
-            } else if (pair.second() instanceof AccountCheckException e) {
-                throw e;
             }
         }
 
-        final var managers = managerPairs.stream().map(Pair::first).toList();
+        final var managers = managerPairs.stream()
+                .filter(p -> p != null && p.first() != null)
+                .map(Pair::first)
+                .toList();
         return new MultiAccountManagerImpl(managers, this);
     }
 
-    public Manager initManager(String number) throws IOException, NotRegisteredException, AccountCheckException {
+    public Manager initManagerByNumber(String number) throws IOException, NotRegisteredException, AccountCheckException {
         final var accountPath = accountsStore.getPathByNumber(number);
-        return this.initManager(number, accountPath);
+        return this.initManagerByNumber(number, accountPath);
     }
 
-    private Manager initManager(
+    public Manager initManagerByAci(String aciStr) throws IOException, NotRegisteredException, AccountCheckException {
+        final var aci = ACI.parseOrThrow(aciStr);
+        final var accountPath = accountsStore.getPathByAci(aci);
+        return this.initManagerByAci(aci, accountPath);
+    }
+
+    private Manager initManagerByNumber(
             String number,
             String accountPath
     ) throws IOException, NotRegisteredException, AccountCheckException {
+        final var account = loadAccount(accountPath);
+        if (!number.equals(account.getNumber())) {
+            account.close();
+            throw new IOException("Number in account file doesn't match expected number: " + account.getNumber());
+        }
+
+        return initManagerFromAccount(number, accountPath, account);
+    }
+
+    private SignalAccount loadAccount(final String accountPath) throws NotRegisteredException, IOException {
         if (accountPath == null) {
             throw new NotRegisteredException();
         }
@@ -105,12 +135,27 @@ public class SignalAccountFiles {
             throw new NotRegisteredException();
         }
 
-        var account = SignalAccount.load(pathConfig.dataPath(), accountPath, true, settings);
-        if (!number.equals(account.getNumber())) {
+        return SignalAccount.load(pathConfig.dataPath(), accountPath, true, settings);
+    }
+
+    private Manager initManagerByAci(
+            ACI aci,
+            String accountPath
+    ) throws IOException, NotRegisteredException, AccountCheckException {
+        final var account = loadAccount(accountPath);
+        if (!aci.equals(account.getAci())) {
             account.close();
-            throw new IOException("Number in account file doesn't match expected number: " + account.getNumber());
+            throw new IOException("ACI in account file doesn't match expected ACI: " + account.getAci());
         }
 
+        return initManagerFromAccount(aci.toString(), accountPath, account);
+    }
+
+    private ManagerImpl initManagerFromAccount(
+            final String identifier,
+            final String accountPath,
+            final SignalAccount account
+    ) throws NotRegisteredException, IOException, AccountCheckException {
         if (!account.isRegistered()) {
             account.close();
             throw new NotRegisteredException();
@@ -132,10 +177,10 @@ public class SignalAccountFiles {
             manager.checkAccountState();
         } catch (DeprecatedVersionException e) {
             manager.close();
-            throw new AccountCheckException("signal-cli version is too old for the Signal-Server, please update.");
+            throw new IOException("signal-cli version is too old for the Signal-Server, please update.");
         } catch (IOException e) {
             manager.close();
-            throw new AccountCheckException("Error while checking account " + number + ": " + e.getMessage(), e);
+            throw new AccountCheckException("Error while checking account " + identifier + ": " + e.getMessage(), e);
         }
 
         if (account.getServiceEnvironment() == null) {
@@ -166,6 +211,11 @@ public class SignalAccountFiles {
             String number,
             Consumer<Manager> newManagerListener
     ) throws IOException {
+        final var aci = ACI.parseOrNull(number);
+        if (aci != null) {
+            return initRegistrationManager(aci, newManagerListener);
+        }
+
         final var accountPath = accountsStore.getPathByNumber(number);
         if (accountPath == null || !SignalAccount.accountFileExists(pathConfig.dataPath(), accountPath)) {
             final var newAccountPath = accountPath == null ? accountsStore.addAccount(number, null) : accountPath;
@@ -205,4 +255,43 @@ public class SignalAccountFiles {
                 newManagerListener,
                 new AccountFileUpdaterImpl(accountsStore, accountPath));
     }
+
+    private RegistrationManager initRegistrationManager(
+            final ACI aci,
+            final Consumer<Manager> newManagerListener
+    ) throws IOException {
+        final var accountPath = accountsStore.getPathByAci(aci);
+        if (accountPath == null || !SignalAccount.accountFileExists(pathConfig.dataPath(), accountPath)) {
+            final var newAccountPath = accountPath == null ? accountsStore.addAccount(null, aci) : accountPath;
+            final var account = SignalAccount.create(pathConfig.dataPath(),
+                    newAccountPath,
+                    null,
+                    aci,
+                    serviceEnvironment,
+                    KeyUtils.generateIdentityKeyPair(),
+                    KeyUtils.generateIdentityKeyPair(),
+                    KeyUtils.createProfileKey(),
+                    settings);
+            account.initDatabase();
+            return new RegistrationManagerImpl(account,
+                    pathConfig,
+                    serviceEnvironmentConfig,
+                    userAgent,
+                    newManagerListener,
+                    new AccountFileUpdaterImpl(accountsStore, newAccountPath));
+        }
+
+        final var account = SignalAccount.load(pathConfig.dataPath(), accountPath, true, settings);
+        if (!aci.equals(account.getAci())) {
+            account.close();
+            throw new IOException("ACI in account file doesn't match expected ACI: " + account.getAci());
+        }
+        account.initDatabase();
+        return new RegistrationManagerImpl(account,
+                pathConfig,
+                serviceEnvironmentConfig,
+                userAgent,
+                newManagerListener,
+                new AccountFileUpdaterImpl(accountsStore, accountPath));
+    }
 }

lib/src/main/java/org/asamk/signal/manager/actions/RenewSessionAction.java

@@ -2,7 +2,7 @@ package org.asamk.signal.manager.actions;
 
 import org.asamk.signal.manager.helper.Context;
 import org.asamk.signal.manager.storage.recipients.RecipientId;
-import org.whispersystems.signalservice.api.push.ServiceId;
+import org.signal.core.models.ServiceId;
 
 public class RenewSessionAction implements HandleAction {
 

lib/src/main/java/org/asamk/signal/manager/actions/RetrieveDeviceNameAction.java

@@ -0,0 +1,20 @@
+package org.asamk.signal.manager.actions;
+
+import org.asamk.signal.manager.helper.Context;
+
+public class RetrieveDeviceNameAction implements HandleAction {
+
+    private static final RetrieveDeviceNameAction INSTANCE = new RetrieveDeviceNameAction();
+
+    public static RetrieveDeviceNameAction create() {
+        return INSTANCE;
+    }
+
+    private RetrieveDeviceNameAction() {
+    }
+
+    @Override
+    public void execute(Context context) throws Throwable {
+        context.getAccountHelper().refreshDeviceName();
+    }
+}

lib/src/main/java/org/asamk/signal/manager/actions/SendRetryMessageRequestAction.java

@@ -60,7 +60,7 @@ public class SendRetryMessageRequestAction implements HandleAction {
             return CiphertextMessage.WHISPER_TYPE;
         }
         return switch (type) {
-            case PREKEY_BUNDLE -> CiphertextMessage.PREKEY_TYPE;
+            case PREKEY_MESSAGE -> CiphertextMessage.PREKEY_TYPE;
             case UNIDENTIFIED_SENDER -> CiphertextMessage.SENDERKEY_TYPE;
             case PLAINTEXT_CONTENT -> CiphertextMessage.PLAINTEXT_CONTENT_TYPE;
             default -> CiphertextMessage.WHISPER_TYPE;

lib/src/main/java/org/asamk/signal/manager/api/BadRequestException.java

@@ -0,0 +1,19 @@
+package org.asamk.signal.manager.api;
+
+import org.signal.libsignal.net.BadRequestError;
+
+import java.io.IOException;
+
+public class BadRequestException extends IOException {
+
+    private final BadRequestError error;
+
+    public BadRequestException(final BadRequestError error) {
+        super(error.toString());
+        this.error = error;
+    }
+
+    public BadRequestError getError() {
+        return error;
+    }
+}

lib/src/main/java/org/asamk/signal/manager/api/CallInfo.java

@@ -0,0 +1,21 @@
+package org.asamk.signal.manager.api;
+
+public record CallInfo(
+        long callId,
+        State state,
+        RecipientAddress recipient,
+        String inputDeviceName,
+        String outputDeviceName,
+        boolean isOutgoing
+) {
+
+    public enum State {
+        IDLE,
+        RINGING_INCOMING,
+        RINGING_OUTGOING,
+        CONNECTING,
+        CONNECTED,
+        RECONNECTING,
+        ENDED
+    }
+}

lib/src/main/java/org/asamk/signal/manager/api/CallOffer.java

@@ -0,0 +1,11 @@
+package org.asamk.signal.manager.api;
+
+public record CallOffer(
+        long callId, Type type, byte[] opaque
+) {
+
+    public enum Type {
+        AUDIO,
+        VIDEO
+    }
+}

lib/src/main/java/org/asamk/signal/manager/api/CaptchaRequiredException.java

@@ -2,11 +2,11 @@ package org.asamk.signal.manager.api;
 
 public class CaptchaRequiredException extends Exception {
 
-    private long nextAttemptTimestamp;
+    private long nextVerificationAttemptMilliseconds;
 
-    public CaptchaRequiredException(final long nextAttemptTimestamp) {
+    public CaptchaRequiredException(final long nextVerificationAttemptMilliseconds) {
         super("Captcha required");
-        this.nextAttemptTimestamp = nextAttemptTimestamp;
+        this.nextVerificationAttemptMilliseconds = nextVerificationAttemptMilliseconds;
     }
 
     public CaptchaRequiredException(final String message) {
@@ -17,7 +17,7 @@ public class CaptchaRequiredException extends Exception {
         super(message, cause);
     }
 
-    public long getNextAttemptTimestamp() {
-        return nextAttemptTimestamp;
+    public long getNextVerificationAttemptMilliseconds() {
+        return nextVerificationAttemptMilliseconds;
     }
 }

lib/src/main/java/org/asamk/signal/manager/api/Contact.java

@@ -15,6 +15,7 @@ public record Contact(
         long muteUntil,
         boolean hideStory,
         boolean isBlocked,
+        long blockedAt,
         boolean isArchived,
         boolean isProfileSharingEnabled,
         boolean isHidden,
@@ -34,6 +35,7 @@ public record Contact(
                 builder.muteUntil,
                 builder.hideStory,
                 builder.isBlocked,
+                builder.blockedAt,
                 builder.isArchived,
                 builder.isProfileSharingEnabled,
                 builder.isHidden,
@@ -58,6 +60,7 @@ public record Contact(
         builder.muteUntil = copy.muteUntil();
         builder.hideStory = copy.hideStory();
         builder.isBlocked = copy.isBlocked();
+        builder.blockedAt = copy.blockedAt();
         builder.isArchived = copy.isArchived();
         builder.isProfileSharingEnabled = copy.isProfileSharingEnabled();
         builder.isHidden = copy.isHidden();
@@ -80,6 +83,21 @@ public record Contact(
         return givenName + " " + familyName;
     }
 
+    public String getDisplayNickname() {
+        final var noNickGivenName = Util.isEmpty(nickNameGivenName);
+        final var noNickFamilyName = Util.isEmpty(nickNameFamilyName);
+
+        if (noNickGivenName && noNickFamilyName) {
+            return null;
+        } else if (noNickGivenName) {
+            return nickNameFamilyName;
+        } else if (noNickFamilyName) {
+            return nickNameGivenName;
+        }
+
+        return nickNameGivenName + " " + nickNameFamilyName;
+    }
+
     public static final class Builder {
 
         private String givenName;
@@ -94,6 +112,7 @@ public record Contact(
         private long muteUntil;
         private boolean hideStory;
         private boolean isBlocked;
+        private long blockedAt;
         private boolean isArchived;
         private boolean isProfileSharingEnabled;
         private boolean isHidden;
@@ -162,10 +181,20 @@ public record Contact(
         }
 
         public Builder withIsBlocked(final boolean val) {
+            if (val && !isBlocked) {
+                blockedAt = System.currentTimeMillis();
+            } else if (!val) {
+                blockedAt = 0;
+            }
             isBlocked = val;
             return this;
         }
 
+        public Builder withBlockedAt(final long val) {
+            blockedAt = val;
+            return this;
+        }
+
         public Builder withIsArchived(final boolean val) {
             isArchived = val;
             return this;

lib/src/main/java/org/asamk/signal/manager/api/Group.java

@@ -12,10 +12,9 @@ public record Group(
         String title,
         String description,
         GroupInviteLinkUrl groupInviteLinkUrl,
-        Set<RecipientAddress> members,
+        Set<GroupMember> members,
         Set<RecipientAddress> pendingMembers,
         Set<RecipientAddress> requestingMembers,
-        Set<RecipientAddress> adminMembers,
         Set<RecipientAddress> bannedMembers,
         boolean isBlocked,
         int messageExpirationTimer,
@@ -23,7 +22,8 @@ public record Group(
         GroupPermission permissionEditDetails,
         GroupPermission permissionSendMessage,
         boolean isMember,
-        boolean isAdmin
+        boolean isAdmin,
+        boolean isTerminated
 ) {
 
     public static Group from(
@@ -37,8 +37,7 @@ public record Group(
                 groupInfo.getGroupInviteLink(),
                 groupInfo.getMembers()
                         .stream()
-                        .map(recipientStore::resolveRecipientAddress)
-                        .map(org.asamk.signal.manager.storage.recipients.RecipientAddress::toApiRecipientAddress)
+                        .map(m -> org.asamk.signal.manager.api.GroupMember.from(m, recipientStore))
                         .collect(Collectors.toSet()),
                 groupInfo.getPendingMembers()
                         .stream()
@@ -50,11 +49,6 @@ public record Group(
                         .map(recipientStore::resolveRecipientAddress)
                         .map(org.asamk.signal.manager.storage.recipients.RecipientAddress::toApiRecipientAddress)
                         .collect(Collectors.toSet()),
-                groupInfo.getAdminMembers()
-                        .stream()
-                        .map(recipientStore::resolveRecipientAddress)
-                        .map(org.asamk.signal.manager.storage.recipients.RecipientAddress::toApiRecipientAddress)
-                        .collect(Collectors.toSet()),
                 groupInfo.getBannedMembers()
                         .stream()
                         .map(recipientStore::resolveRecipientAddress)
@@ -66,6 +60,7 @@ public record Group(
                 groupInfo.getPermissionEditDetails(),
                 groupInfo.getPermissionSendMessage(),
                 groupInfo.isMember(selfRecipientId),
-                groupInfo.isAdmin(selfRecipientId));
+                groupInfo.isAdmin(selfRecipientId),
+                groupInfo.isTerminated());
     }
 }

lib/src/main/java/org/asamk/signal/manager/api/GroupInviteLinkUrl.java

@@ -4,8 +4,8 @@ import org.asamk.signal.manager.groups.GroupLinkPassword;
 import org.signal.core.util.Base64;
 import org.signal.libsignal.zkgroup.InvalidInputException;
 import org.signal.libsignal.zkgroup.groups.GroupMasterKey;
-import org.signal.storageservice.protos.groups.GroupInviteLink;
-import org.signal.storageservice.protos.groups.local.DecryptedGroup;
+import org.signal.storageservice.storage.protos.groups.GroupInviteLink;
+import org.signal.storageservice.storage.protos.groups.local.DecryptedGroup;
 
 import java.io.IOException;
 import java.net.URI;
@@ -52,8 +52,8 @@ public final class GroupInviteLinkUrl {
             var bytes = Base64.decode(encoding);
             GroupInviteLink groupInviteLink = GroupInviteLink.ADAPTER.decode(bytes);
 
-            if (groupInviteLink.v1Contents != null) {
-                var groupInviteLinkContentsV1 = groupInviteLink.v1Contents;
+            if (groupInviteLink.contentsV1 != null) {
+                var groupInviteLinkContentsV1 = groupInviteLink.contentsV1;
                 var groupMasterKey = new GroupMasterKey(groupInviteLinkContentsV1.groupMasterKey.toByteArray());
                 var password = GroupLinkPassword.fromBytes(groupInviteLinkContentsV1.inviteLinkPassword.toByteArray());
 
@@ -90,7 +90,7 @@ public final class GroupInviteLinkUrl {
     }
 
     private static String createUrl(GroupMasterKey groupMasterKey, GroupLinkPassword password) {
-        var groupInviteLink = new GroupInviteLink.Builder().v1Contents(new GroupInviteLink.GroupInviteLinkContentsV1.Builder().groupMasterKey(
+        var groupInviteLink = new GroupInviteLink.Builder().contentsV1(new GroupInviteLink.GroupInviteLinkContentsV1.Builder().groupMasterKey(
                         ByteString.of(groupMasterKey.serialize()))
                 .inviteLinkPassword(ByteString.of(password.serialize()))
                 .build()).build();

lib/src/main/java/org/asamk/signal/manager/api/GroupMember.java

@@ -0,0 +1,14 @@
+package org.asamk.signal.manager.api;
+
+import org.asamk.signal.manager.helper.RecipientAddressResolver;
+import org.asamk.signal.manager.storage.groups.GroupMemberInfo;
+
+public record GroupMember(
+        RecipientAddress recipientAddress, boolean isAdmin, String labelEmoji, String label
+) {
+
+    public static GroupMember from(final GroupMemberInfo memberInfo, final RecipientAddressResolver recipientStore) {
+        return new GroupMember(recipientStore.resolveRecipientAddress(memberInfo.getRecipientId())
+                .toApiRecipientAddress(), memberInfo.isAdmin(), memberInfo.labelEmoji(), memberInfo.labelString());
+    }
+}

lib/src/main/java/org/asamk/signal/manager/api/Message.java

@@ -6,15 +6,21 @@ import java.util.Optional;
 public record Message(
         String messageText,
         List<String> attachments,
+        List<AttachmentDimensions> attachmentDimensions,
+        List<String> attachmentBlurHashes,
         boolean viewOnce,
+        boolean voiceNote,
         List<Mention> mentions,
         Optional<Quote> quote,
         Optional<Sticker> sticker,
         List<Preview> previews,
         Optional<StoryReply> storyReply,
-        List<TextStyle> textStyles
+        List<TextStyle> textStyles,
+        boolean urgent
 ) {
 
+    public record AttachmentDimensions(int width, int height) {}
+
     public record Mention(RecipientIdentifier.Single recipient, int start, int length) {}
 
     public record Quote(

lib/src/main/java/org/asamk/signal/manager/api/MessageEnvelope.java

@@ -3,6 +3,7 @@ package org.asamk.signal.manager.api;
 import org.asamk.signal.manager.groups.GroupUtils;
 import org.asamk.signal.manager.helper.RecipientAddressResolver;
 import org.asamk.signal.manager.storage.recipients.RecipientResolver;
+import org.asamk.signal.manager.util.MimeUtils;
 import org.signal.libsignal.metadata.ProtocolException;
 import org.whispersystems.signalservice.api.messages.SignalServiceAttachment;
 import org.whispersystems.signalservice.api.messages.SignalServiceAttachmentPointer;
@@ -32,11 +33,11 @@ import org.whispersystems.signalservice.api.messages.multidevice.SentTranscriptM
 import org.whispersystems.signalservice.api.messages.multidevice.SignalServiceSyncMessage;
 import org.whispersystems.signalservice.api.messages.multidevice.ViewOnceOpenMessage;
 import org.whispersystems.signalservice.api.messages.multidevice.ViewedMessage;
-import org.whispersystems.signalservice.api.push.ServiceId;
 
 import java.io.File;
 import java.io.IOException;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Collectors;
@@ -115,17 +116,35 @@ public record MessageEnvelope(
             Optional<Long> remoteDeleteId,
             Optional<Sticker> sticker,
             List<SharedContact> sharedContacts,
+            Optional<PollCreate> pollCreate,
+            Optional<PollVote> pollVote,
+            Optional<PollTerminate> pollTerminate,
             List<Mention> mentions,
             List<Preview> previews,
-            List<TextStyle> textStyles
+            List<TextStyle> textStyles,
+            Optional<PinMessage> pinMessage,
+            Optional<UnpinMessage> unpinMessage,
+            Optional<AdminDelete> adminDelete
     ) {
 
         static Data from(
                 final SignalServiceDataMessage dataMessage,
+                Map<String, String> longTexts,
                 RecipientResolver recipientResolver,
                 RecipientAddressResolver addressResolver,
                 final AttachmentFileProvider fileProvider
         ) {
+            var body = dataMessage.getBody();
+            if (dataMessage.getAttachments().isPresent()) {
+                for (final var attachment : dataMessage.getAttachments().get()) {
+                    if (MimeUtils.LONG_TEXT.equals(attachment.getContentType()) && attachment.isPointer()) {
+                        final var longBody = longTexts.get(attachment.asPointer().getRemoteId().toString());
+                        if (longBody != null) {
+                            body = Optional.of(longBody);
+                        }
+                    }
+                }
+            }
             return new Data(dataMessage.getTimestamp(),
                     dataMessage.getGroupContext().map(GroupContext::from),
                     dataMessage.getStoryContext()
@@ -133,11 +152,11 @@ public record MessageEnvelope(
                                     recipientResolver,
                                     addressResolver)),
                     dataMessage.getGroupCallUpdate().map(GroupCallUpdate::from),
-                    dataMessage.getBody(),
+                    body,
                     dataMessage.getExpiresInSeconds(),
                     dataMessage.isExpirationUpdate(),
                     dataMessage.isViewOnce(),
-                    dataMessage.isEndSession(),
+                    false,
                     dataMessage.isProfileKeyUpdate(),
                     dataMessage.getProfileKey().isPresent(),
                     dataMessage.getReaction().map(r -> Reaction.from(r, recipientResolver, addressResolver)),
@@ -155,6 +174,9 @@ public record MessageEnvelope(
                                     .map(sharedContact -> SharedContact.from(sharedContact, fileProvider))
                                     .toList())
                             .orElse(List.of()),
+                    dataMessage.getPollCreate().map(PollCreate::from),
+                    dataMessage.getPollVote().map(p -> PollVote.from(p, recipientResolver, addressResolver)),
+                    dataMessage.getPollTerminate().map(PollTerminate::from),
                     dataMessage.getMentions()
                             .map(a -> a.stream().map(m -> Mention.from(m, recipientResolver, addressResolver)).toList())
                             .orElse(List.of()),
@@ -163,7 +185,10 @@ public record MessageEnvelope(
                             .orElse(List.of()),
                     dataMessage.getBodyRanges()
                             .map(a -> a.stream().filter(r -> r.style != null).map(TextStyle::from).toList())
-                            .orElse(List.of()));
+                            .orElse(List.of()),
+                    dataMessage.getPinnedMessage().map(p -> PinMessage.from(p, recipientResolver, addressResolver)),
+                    dataMessage.getUnpinnedMessage().map(p -> UnpinMessage.from(p, recipientResolver, addressResolver)),
+                    dataMessage.getAdminDelete().map(p -> AdminDelete.from(p, recipientResolver, addressResolver)));
         }
 
         public record GroupContext(GroupId groupId, boolean isGroupUpdate, int revision) {
@@ -509,6 +534,44 @@ public record MessageEnvelope(
             }
         }
 
+        public record PollCreate(
+                String question, boolean allowMultiple, List<String> options
+        ) {
+
+            static PollCreate from(
+                    SignalServiceDataMessage.PollCreate pollCreate
+            ) {
+                return new PollCreate(pollCreate.getQuestion(), pollCreate.getAllowMultiple(), pollCreate.getOptions());
+            }
+
+        }
+
+        public record PollVote(
+                RecipientAddress targetAuthor, long targetSentTimestamp, List<Integer> optionIndexes, int voteCount
+        ) {
+
+            static PollVote from(
+                    SignalServiceDataMessage.PollVote pollVote,
+                    RecipientResolver recipientResolver,
+                    RecipientAddressResolver addressResolver
+            ) {
+                return new PollVote(addressResolver.resolveRecipientAddress(recipientResolver.resolveRecipient(pollVote.getTargetAuthor()))
+                        .toApiRecipientAddress(),
+                        pollVote.getTargetSentTimestamp(),
+                        pollVote.getOptionIndexes(),
+                        pollVote.getVoteCount());
+            }
+
+        }
+
+        public record PollTerminate(long targetSentTimestamp) {
+
+            static PollTerminate from(SignalServiceDataMessage.PollTerminate pollTerminate) {
+                return new PollTerminate(pollTerminate.getTargetSentTimestamp());
+            }
+
+        }
+
         public record Preview(String title, String description, long date, String url, Optional<Attachment> image) {
 
             static Preview from(SignalServicePreview preview, final AttachmentFileProvider fileProvider) {
@@ -520,18 +583,68 @@ public record MessageEnvelope(
             }
         }
 
+        public record PinMessage(
+                RecipientAddress targetAuthor, long targetSentTimestamp, long pinDurationSeconds
+        ) {
+
+            static PinMessage from(
+                    SignalServiceDataMessage.PinnedMessage pinnedMessage,
+                    RecipientResolver recipientResolver,
+                    RecipientAddressResolver addressResolver
+            ) {
+                return new PinMessage(addressResolver.resolveRecipientAddress(recipientResolver.resolveRecipient(
+                        pinnedMessage.getTargetAuthor())).toApiRecipientAddress(),
+                        pinnedMessage.getTargetSentTimestamp(),
+                        Boolean.TRUE.equals(pinnedMessage.getForever())
+                                ? -1
+                                : pinnedMessage.getPinDurationInSeconds() == null
+                                        ? 0
+                                        : pinnedMessage.getPinDurationInSeconds());
+            }
+        }
+
+        public record UnpinMessage(RecipientAddress targetAuthor, long targetSentTimestamp) {
+
+            static UnpinMessage from(
+                    SignalServiceDataMessage.UnpinnedMessage unpinnedMessage,
+                    RecipientResolver recipientResolver,
+                    RecipientAddressResolver addressResolver
+            ) {
+                return new UnpinMessage(addressResolver.resolveRecipientAddress(recipientResolver.resolveRecipient(
+                        unpinnedMessage.getTargetAuthor())).toApiRecipientAddress(),
+                        unpinnedMessage.getTargetSentTimestamp());
+            }
+        }
+
+        public record AdminDelete(RecipientAddress targetAuthor, long targetSentTimestamp) {
+
+            static AdminDelete from(
+                    SignalServiceDataMessage.AdminDelete adminDelete,
+                    RecipientResolver recipientResolver,
+                    RecipientAddressResolver addressResolver
+            ) {
+                return new AdminDelete(addressResolver.resolveRecipientAddress(recipientResolver.resolveRecipient(
+                        adminDelete.getTargetAuthor())).toApiRecipientAddress(), adminDelete.getTargetSentTimestamp());
+            }
+        }
+
     }
 
     public record Edit(long targetSentTimestamp, Data dataMessage) {
 
         public static Edit from(
                 final SignalServiceEditMessage editMessage,
+                Map<String, String> longTexts,
                 RecipientResolver recipientResolver,
                 RecipientAddressResolver addressResolver,
                 final AttachmentFileProvider fileProvider
         ) {
             return new Edit(editMessage.getTargetSentTimestamp(),
-                    Data.from(editMessage.getDataMessage(), recipientResolver, addressResolver, fileProvider));
+                    Data.from(editMessage.getDataMessage(),
+                            longTexts,
+                            recipientResolver,
+                            addressResolver,
+                            fileProvider));
         }
     }
 
@@ -548,12 +661,13 @@ public record MessageEnvelope(
 
         public static Sync from(
                 final SignalServiceSyncMessage syncMessage,
+                Map<String, String> longTexts,
                 RecipientResolver recipientResolver,
                 RecipientAddressResolver addressResolver,
                 final AttachmentFileProvider fileProvider
         ) {
             return new Sync(syncMessage.getSent()
-                    .map(s -> Sent.from(s, recipientResolver, addressResolver, fileProvider)),
+                    .map(s -> Sent.from(s, longTexts, recipientResolver, addressResolver, fileProvider)),
                     syncMessage.getBlockedList().map(b -> Blocked.from(b, recipientResolver, addressResolver)),
                     syncMessage.getRead()
                             .map(r -> r.stream().map(rm -> Read.from(rm, recipientResolver, addressResolver)).toList())
@@ -582,6 +696,7 @@ public record MessageEnvelope(
 
             static Sent from(
                     SentTranscriptMessage sentMessage,
+                    Map<String, String> longTexts,
                     RecipientResolver recipientResolver,
                     RecipientAddressResolver addressResolver,
                     final AttachmentFileProvider fileProvider
@@ -597,9 +712,17 @@ public record MessageEnvelope(
                                         .toApiRecipientAddress())
                                 .collect(Collectors.toSet()),
                         sentMessage.getDataMessage()
-                                .map(message -> Data.from(message, recipientResolver, addressResolver, fileProvider)),
+                                .map(message -> Data.from(message,
+                                        longTexts,
+                                        recipientResolver,
+                                        addressResolver,
+                                        fileProvider)),
                         sentMessage.getEditMessage()
-                                .map(message -> Edit.from(message, recipientResolver, addressResolver, fileProvider)),
+                                .map(message -> Edit.from(message,
+                                        longTexts,
+                                        recipientResolver,
+                                        addressResolver,
+                                        fileProvider)),
                         sentMessage.getStoryMessage().map(s -> Story.from(s, fileProvider)));
             }
         }
@@ -616,7 +739,10 @@ public record MessageEnvelope(
                                 null,
                                 d.getE164(),
                                 null))
-                        .toList(), blockedListMessage.groupIds.stream().map(GroupId::unknownVersion).toList());
+                        .toList(),
+                        blockedListMessage.groups.stream()
+                                .map(group -> GroupId.unknownVersion(group.getGroupId()))
+                                .toList());
             }
         }
 
@@ -627,7 +753,7 @@ public record MessageEnvelope(
                     RecipientResolver recipientResolver,
                     RecipientAddressResolver addressResolver
             ) {
-                return new Read(addressResolver.resolveRecipientAddress(recipientResolver.resolveRecipient(readMessage.getSender()))
+                return new Read(addressResolver.resolveRecipientAddress(recipientResolver.resolveRecipient(readMessage.getSenderAci()))
                         .toApiRecipientAddress(), readMessage.getTimestamp());
             }
         }
@@ -898,12 +1024,13 @@ public record MessageEnvelope(
     public static MessageEnvelope from(
             SignalServiceEnvelope envelope,
             SignalServiceContent content,
+            Map<String, String> longTexts,
             RecipientResolver recipientResolver,
             RecipientAddressResolver addressResolver,
             final AttachmentFileProvider fileProvider,
             Exception exception
     ) {
-        final var serviceId = envelope.getSourceServiceId().map(ServiceId::parseOrNull).orElse(null);
+        final var serviceId = envelope.getSourceServiceId();
         final var source = !envelope.isUnidentifiedSender() && serviceId != null
                 ? recipientResolver.resolveRecipient(serviceId)
                 : envelope.isUnidentifiedSender() && content != null
@@ -928,9 +1055,15 @@ public record MessageEnvelope(
             receipt = content.getReceiptMessage().map(Receipt::from);
             typing = content.getTypingMessage().map(Typing::from);
             data = content.getDataMessage()
-                    .map(dataMessage -> Data.from(dataMessage, recipientResolver, addressResolver, fileProvider));
-            edit = content.getEditMessage().map(s -> Edit.from(s, recipientResolver, addressResolver, fileProvider));
-            sync = content.getSyncMessage().map(s -> Sync.from(s, recipientResolver, addressResolver, fileProvider));
+                    .map(dataMessage -> Data.from(dataMessage,
+                            longTexts,
+                            recipientResolver,
+                            addressResolver,
+                            fileProvider));
+            edit = content.getEditMessage()
+                    .map(s -> Edit.from(s, longTexts, recipientResolver, addressResolver, fileProvider));
+            sync = content.getSyncMessage()
+                    .map(s -> Sync.from(s, longTexts, recipientResolver, addressResolver, fileProvider));
             call = content.getCallMessage().map(Call::from);
             story = content.getStoryMessage().map(s -> Story.from(s, fileProvider));
         } else {

lib/src/main/java/org/asamk/signal/manager/api/ProofRequiredException.java

@@ -10,12 +10,19 @@ public class ProofRequiredException extends Exception {
 
     private final String token;
     private final Set<Option> options;
-    private final long retryAfterSeconds;
+    private final long retryAfterMilliseconds;
 
-    public ProofRequiredException(org.whispersystems.signalservice.api.push.exceptions.ProofRequiredException e) {
-        this.token = e.getToken();
-        this.options = e.getOptions().stream().map(Option::from).collect(Collectors.toSet());
-        this.retryAfterSeconds = e.getRetryAfterSeconds();
+    public ProofRequiredException(final String token, final Set<Option> options, final long retryAfterMilliseconds) {
+        super("Rate limit");
+        this.token = token;
+        this.options = options;
+        this.retryAfterMilliseconds = retryAfterMilliseconds;
+    }
+
+    public static ProofRequiredException from(org.whispersystems.signalservice.api.push.exceptions.ProofRequiredException e) {
+        return new ProofRequiredException(e.getToken(),
+                e.getOptions().stream().map(Option::from).collect(Collectors.toSet()),
+                e.getRetryAfterSeconds() * 1000L);
     }
 
     public String getToken() {
@@ -26,8 +33,8 @@ public class ProofRequiredException extends Exception {
         return options;
     }
 
-    public long getRetryAfterSeconds() {
-        return retryAfterSeconds;
+    public long getRetryAfterMilliseconds() {
+        return retryAfterMilliseconds;
     }
 
     public enum Option {

lib/src/main/java/org/asamk/signal/manager/api/RateLimitException.java

@@ -2,14 +2,18 @@ package org.asamk.signal.manager.api;
 
 public class RateLimitException extends Exception {
 
-    private final long nextAttemptTimestamp;
+    private final Long retryAfterMilliseconds;
 
-    public RateLimitException(final long nextAttemptTimestamp) {
+    public RateLimitException(final Long retryAfterMilliseconds) {
         super("Rate limit");
-        this.nextAttemptTimestamp = nextAttemptTimestamp;
+        this.retryAfterMilliseconds = retryAfterMilliseconds;
     }
 
-    public long getNextAttemptTimestamp() {
-        return nextAttemptTimestamp;
+    public static RateLimitException from(org.whispersystems.signalservice.api.push.exceptions.RateLimitException e) {
+        return new RateLimitException(e.getRetryAfterMilliseconds().orElse(null));
+    }
+
+    public Long getRetryAfterMilliseconds() {
+        return retryAfterMilliseconds;
     }
 }

lib/src/main/java/org/asamk/signal/manager/api/ReceiveConfig.java

@@ -1,3 +1,9 @@
 package org.asamk.signal.manager.api;
 
-public record ReceiveConfig(boolean ignoreAttachments, boolean ignoreStories, boolean sendReadReceipts) {}
+public record ReceiveConfig(
+        boolean ignoreAttachments,
+        boolean ignoreStories,
+        boolean ignoreAvatars,
+        boolean ignoreStickers,
+        boolean sendReadReceipts
+) {}

lib/src/main/java/org/asamk/signal/manager/api/RecipientAddress.java

@@ -1,6 +1,6 @@
 package org.asamk.signal.manager.api;
 
-import org.whispersystems.signalservice.api.util.UuidUtil;
+import org.signal.core.util.UuidUtil;
 
 import java.util.Optional;
 import java.util.UUID;

lib/src/main/java/org/asamk/signal/manager/api/RecipientIdentifier.java

@@ -1,9 +1,9 @@
 package org.asamk.signal.manager.api;
 
 import org.asamk.signal.manager.util.PhoneNumberFormatter;
+import org.signal.core.util.UuidUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.whispersystems.signalservice.api.util.UuidUtil;
 
 import java.util.UUID;
 
@@ -24,13 +24,13 @@ public sealed interface RecipientIdentifier {
     sealed interface Single extends RecipientIdentifier {
 
         static Single fromString(String identifier, String localNumber) throws InvalidNumberException {
-            if (UuidUtil.isUuid(identifier)) {
+            if (UuidUtil.INSTANCE.isUuid(identifier)) {
                 return new Uuid(UUID.fromString(identifier));
             }
 
             if (identifier.startsWith("PNI:")) {
                 final var pni = identifier.substring(4);
-                if (!UuidUtil.isUuid(pni)) {
+                if (!UuidUtil.INSTANCE.isUuid(pni)) {
                     throw new InvalidNumberException("Invalid PNI");
                 }
                 return new Pni(UUID.fromString(pni));

lib/src/main/java/org/asamk/signal/manager/api/SendMessageResult.java

@@ -9,13 +9,13 @@ public record SendMessageResult(
         boolean isNetworkFailure,
         boolean isUnregisteredFailure,
         boolean isIdentityFailure,
-        boolean isRateLimitFailure,
+        RateLimitException rateLimitException,
         ProofRequiredException proofRequiredFailure,
         boolean isInvalidPreKeyFailure
 ) {
 
     public static SendMessageResult unregisteredFailure(RecipientAddress address) {
-        return new SendMessageResult(address, false, false, true, false, false, null, false);
+        return new SendMessageResult(address, false, false, true, false, null, null, false);
     }
 
     public static SendMessageResult from(
@@ -23,16 +23,30 @@ public record SendMessageResult(
             RecipientResolver recipientResolver,
             RecipientAddressResolver addressResolver
     ) {
+        final var rateLimitFailure = sendMessageResult.getRateLimitFailure();
+        final var proofRequiredFailure = sendMessageResult.getProofRequiredFailure();
         return new SendMessageResult(addressResolver.resolveRecipientAddress(recipientResolver.resolveRecipient(
                 sendMessageResult.getAddress())).toApiRecipientAddress(),
                 sendMessageResult.isSuccess(),
                 sendMessageResult.isNetworkFailure(),
                 sendMessageResult.isUnregisteredFailure(),
                 sendMessageResult.getIdentityFailure() != null,
-                sendMessageResult.getRateLimitFailure() != null || sendMessageResult.getProofRequiredFailure() != null,
-                sendMessageResult.getProofRequiredFailure() == null
-                        ? null
-                        : new ProofRequiredException(sendMessageResult.getProofRequiredFailure()),
+                rateLimitFailure == null ? null : RateLimitException.from(rateLimitFailure),
+                proofRequiredFailure == null ? null : ProofRequiredException.from(proofRequiredFailure),
                 sendMessageResult.isInvalidPreKeyFailure());
     }
+
+    public boolean isRateLimitFailure() {
+        return this.rateLimitException != null || this.proofRequiredFailure != null;
+    }
+
+    public Long rateLimitRetryAfterMilliseconds() {
+        if (proofRequiredFailure != null) {
+            return proofRequiredFailure.getRetryAfterMilliseconds();
+        } else if (rateLimitException != null) {
+            return rateLimitException.getRetryAfterMilliseconds();
+        } else {
+            return null;
+        }
+    }
 }

lib/src/main/java/org/asamk/signal/manager/api/SendMessageResults.java

@@ -2,6 +2,7 @@ package org.asamk.signal.manager.api;
 
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 
 public record SendMessageResults(long timestamp, Map<RecipientIdentifier, List<SendMessageResult>> results) {
 
@@ -26,4 +27,18 @@ public record SendMessageResults(long timestamp, Map<RecipientIdentifier, List<S
                 .flatMap(res -> res.stream().map(SendMessageResult::isRateLimitFailure))
                 .allMatch(r -> r) && results.values().stream().mapToInt(List::size).sum() > 0;
     }
+
+    /**
+     * Longest rate-limit retry-after window across all rate-limited recipients, in milliseconds.
+     * Null when no recipient reported one (server omitted Retry-After, or no rate-limit failures).
+     */
+    public Long maxRateLimitRetryAfterMilliseconds() {
+        return results.values()
+                .stream()
+                .flatMap(List::stream)
+                .map(SendMessageResult::rateLimitRetryAfterMilliseconds)
+                .filter(Objects::nonNull)
+                .max(Long::compareTo)
+                .orElse(null);
+    }
 }

lib/src/main/java/org/asamk/signal/manager/api/StickerPackId.java

@@ -1,6 +1,6 @@
 package org.asamk.signal.manager.api;
 
-import org.whispersystems.signalservice.internal.util.Hex;
+import org.signal.core.util.Hex;
 
 import java.util.Arrays;
 

lib/src/main/java/org/asamk/signal/manager/api/StickerPackUrl.java

@@ -1,7 +1,7 @@
 package org.asamk.signal.manager.api;
 
 import org.asamk.signal.manager.util.Utils;
-import org.whispersystems.signalservice.internal.util.Hex;
+import org.signal.core.util.Hex;
 
 import java.io.IOException;
 import java.net.URI;

lib/src/main/java/org/asamk/signal/manager/api/TotpRequiredException.java

@@ -0,0 +1,10 @@
+package org.asamk.signal.manager.api;
+
+import java.io.IOException;
+
+public class TotpRequiredException extends IOException {
+
+    public TotpRequiredException() {
+        super("A TOTP token is required or the supplied token is incorrect");
+    }
+}

lib/src/main/java/org/asamk/signal/manager/api/TurnServer.java

@@ -0,0 +1,7 @@
+package org.asamk.signal.manager.api;
+
+import java.util.List;
+
+public record TurnServer(
+        String username, String password, List<String> urls
+) {}

lib/src/main/java/org/asamk/signal/manager/api/UpdateGroup.java

@@ -19,6 +19,8 @@ public class UpdateGroup {
     private final String avatarFile;
     private final Integer expirationTimer;
     private final Boolean isAnnouncementGroup;
+    private final String labelEmoji;
+    private final String labelString;
 
     private UpdateGroup(final Builder builder) {
         name = builder.name;
@@ -36,6 +38,8 @@ public class UpdateGroup {
         avatarFile = builder.avatarFile;
         expirationTimer = builder.expirationTimer;
         isAnnouncementGroup = builder.isAnnouncementGroup;
+        labelEmoji = builder.labelEmoji;
+        labelString = builder.labelString;
     }
 
     public static Builder newBuilder() {
@@ -57,7 +61,9 @@ public class UpdateGroup {
                 copy.editDetailsPermission,
                 copy.avatarFile,
                 copy.expirationTimer,
-                copy.isAnnouncementGroup);
+                copy.isAnnouncementGroup,
+                copy.labelEmoji,
+                copy.labelString);
     }
 
     public static Builder newBuilder(
@@ -75,7 +81,9 @@ public class UpdateGroup {
             final GroupPermission editDetailsPermission,
             final String avatarFile,
             final Integer expirationTimer,
-            final Boolean isAnnouncementGroup
+            final Boolean isAnnouncementGroup,
+            final String labelEmoji,
+            final String labelString
     ) {
         return new Builder(name,
                 description,
@@ -91,7 +99,9 @@ public class UpdateGroup {
                 editDetailsPermission,
                 avatarFile,
                 expirationTimer,
-                isAnnouncementGroup);
+                isAnnouncementGroup,
+                labelEmoji,
+                labelString);
     }
 
     public String getName() {
@@ -154,6 +164,14 @@ public class UpdateGroup {
         return isAnnouncementGroup;
     }
 
+    public String getLabelEmoji() {
+        return labelEmoji;
+    }
+
+    public String getLabelString() {
+        return labelString;
+    }
+
     public static final class Builder {
 
         private String name;
@@ -171,6 +189,8 @@ public class UpdateGroup {
         private String avatarFile;
         private Integer expirationTimer;
         private Boolean isAnnouncementGroup;
+        private String labelEmoji;
+        private String labelString;
 
         private Builder() {
         }
@@ -190,7 +210,9 @@ public class UpdateGroup {
                 final GroupPermission editDetailsPermission,
                 final String avatarFile,
                 final Integer expirationTimer,
-                final Boolean isAnnouncementGroup
+                final Boolean isAnnouncementGroup,
+                final String labelEmoji,
+                final String labelString
         ) {
             this.name = name;
             this.description = description;
@@ -207,6 +229,8 @@ public class UpdateGroup {
             this.avatarFile = avatarFile;
             this.expirationTimer = expirationTimer;
             this.isAnnouncementGroup = isAnnouncementGroup;
+            this.labelEmoji = labelEmoji;
+            this.labelString = labelString;
         }
 
         public Builder withName(final String val) {
@@ -284,6 +308,16 @@ public class UpdateGroup {
             return this;
         }
 
+        public Builder withLabelEmoji(final String val) {
+            labelEmoji = val;
+            return this;
+        }
+
+        public Builder withLabelString(final String val) {
+            labelString = val;
+            return this;
+        }
+
         public UpdateGroup build() {
             return new UpdateGroup(this);
         }

lib/src/main/java/org/asamk/signal/manager/api/UsernameLinkUrl.java

@@ -1,8 +1,8 @@
 package org.asamk.signal.manager.api;
 
 import org.signal.core.util.Base64;
+import org.signal.core.util.UuidUtil;
 import org.whispersystems.signalservice.api.push.UsernameLinkComponents;
-import org.whispersystems.signalservice.api.util.UuidUtil;
 
 import java.io.IOException;
 import java.util.Arrays;
@@ -36,7 +36,7 @@ public final class UsernameLinkUrl {
 
         final var entropy = Arrays.copyOfRange(allBytes, 0, 32);
         final var serverId = Arrays.copyOfRange(allBytes, 32, allBytes.length);
-        final var serverIdUuid = UuidUtil.parseOrNull(serverId);
+        final var serverIdUuid = UuidUtil.INSTANCE.parseOrNull(serverId);
         if (serverIdUuid == null) {
             throw new InvalidUsernameLinkException("Invalid serverId");
         }

lib/src/main/java/org/asamk/signal/manager/config/LiveConfig.java

@@ -3,15 +3,15 @@ package org.asamk.signal.manager.config;
 import org.signal.libsignal.net.Network.Environment;
 import org.signal.libsignal.protocol.InvalidKeyException;
 import org.signal.libsignal.protocol.ecc.ECPublicKey;
-import org.whispersystems.signalservice.api.push.TrustStore;
-import org.whispersystems.signalservice.internal.configuration.HttpProxy;
-import org.whispersystems.signalservice.internal.configuration.SignalCdnUrl;
-import org.whispersystems.signalservice.internal.configuration.SignalCdsiUrl;
-import org.whispersystems.signalservice.internal.configuration.SignalProxy;
-import org.whispersystems.signalservice.internal.configuration.SignalServiceConfiguration;
-import org.whispersystems.signalservice.internal.configuration.SignalServiceUrl;
-import org.whispersystems.signalservice.internal.configuration.SignalStorageUrl;
-import org.whispersystems.signalservice.internal.configuration.SignalSvr2Url;
+import org.signal.network.config.HttpProxy;
+import org.signal.network.config.SignalCdnUrl;
+import org.signal.network.config.SignalCdsiUrl;
+import org.signal.network.config.SignalProxy;
+import org.signal.network.config.SignalServiceConfiguration;
+import org.signal.network.config.SignalServiceUrl;
+import org.signal.network.config.SignalStorageUrl;
+import org.signal.network.config.SignalSvr2Url;
+import org.signal.network.config.TrustStore;
 
 import java.util.Base64;
 import java.util.List;
@@ -30,8 +30,8 @@ class LiveConfig {
     private static final byte[] UNIDENTIFIED_SENDER_TRUST_ROOT2 = Base64.getDecoder()
             .decode("BUkY0I+9+oPgDCn4+Ac6Iu813yvqkDr/ga8DzLxFxuk6");
     private static final String CDSI_MRENCLAVE = "0f6fd79cdfdaa5b2e6337f534d3baf999318b0c462a7ac1f41297a3e4b424a57";
-    private static final String SVR2_MRENCLAVE_LEGACY = "093be9ea32405e85ae28dbb48eb668aebeb7dbe29517b9b86ad4bec4dfe0e6a6";
-    private static final String SVR2_MRENCLAVE = "29cd63c87bea751e3bfd0fbd401279192e2e5c99948b4ee9437eafc4968355fb";
+    private static final String SVR2_MRENCLAVE = "fdbbacdc0c043d0d53fe1440f62728de0386f45ab0a275bd8f99e03a02af355e";
+    private static final String SVR2_MRENCLAVE_LEGACY = "ced8217b26228e4b210c985786999d095c4958a94faf37b14acaf25c4cbb02a4";
 
     private static final String URL = "https://chat.signal.org";
     private static final String CDN_URL = "https://cdn.signal.org";
@@ -49,10 +49,10 @@ class LiveConfig {
     private static final byte[] zkGroupServerPublicParams = Base64.getDecoder()
             .decode("AMhf5ywVwITZMsff/eCyudZx9JDmkkkbV6PInzG4p8x3VqVJSFiMvnvlEKWuRob/1eaIetR31IYeAbm0NdOuHH8Qi+Rexi1wLlpzIo1gstHWBfZzy1+qHRV5A4TqPp15YzBPm0WSggW6PbSn+F4lf57VCnHF7p8SvzAA2ZZJPYJURt8X7bbg+H3i+PEjH9DXItNEqs2sNcug37xZQDLm7X36nOoGPs54XsEGzPdEV+itQNGUFEjY6X9Uv+Acuks7NpyGvCoKxGwgKgE5XyJ+nNKlyHHOLb6N1NuHyBrZrgtY/JYJHRooo5CEqYKBqdFnmbTVGEkCvJKxLnjwKWf+fEPoWeQFj5ObDjcKMZf2Jm2Ae69x+ikU5gBXsRmoF94GXTLfN0/vLt98KDPnxwAQL9j5V1jGOY8jQl6MLxEs56cwXN0dqCnImzVH3TZT1cJ8SW1BRX6qIVxEzjsSGx3yxF3suAilPMqGRp4ffyopjMD1JXiKR2RwLKzizUe5e8XyGOy9fplzhw3jVzTRyUZTRSZKkMLWcQ/gv0E4aONNqs4P+NameAZYOD12qRkxosQQP5uux6B2nRyZ7sAV54DgFyLiRcq1FvwKw2EPQdk4HDoePrO/RNUbyNddnM/mMgj4FW65xCoT1LmjrIjsv/Ggdlx46ueczhMgtBunx1/w8k8V+l8LVZ8gAT6wkU5J+DPQalQguMg12Jzug3q4TbdHiGCmD9EunCwOmsLuLJkz6EcSYXtrlDEnAM+hicw7iergYLLlMXpfTdGxJCWJmP4zqUFeTTmsmhsjGBt7NiEB/9pFFEB3pSbf4iiUukw63Eo8Aqnf4iwob6X1QviCWuc8t0LUlT9vALgh/f2DPVOOmR0RW6bgRvc7DSF20V/omg+YBw==");
     private static final byte[] genericServerPublicParams = Base64.getDecoder()
-            .decode("AByD873dTilmOSG0TjKrvpeaKEsUmIO8Vx9BeMmftwUs9v7ikPwM8P3OHyT0+X3EUMZrSe9VUp26Wai51Q9I8mdk0hX/yo7CeFGJyzoOqn8e/i4Ygbn5HoAyXJx5eXfIbqpc0bIxzju4H/HOQeOpt6h742qii5u/cbwOhFZCsMIbElZTaeU+BWMBQiZHIGHT5IE0qCordQKZ5iPZom0HeFa8Yq0ShuEyAl0WINBiY6xE3H/9WnvzXBbMuuk//eRxXgzO8ieCeK8FwQNxbfXqZm6Ro1cMhCOF3u7xoX83QhpN");
+            .decode("AeCO67P9mIv1yUHkdeZ9JF789GDbox61GvTqq3S4kYc1ADUWxWHQygU390tv1oRWt9WjkdZlU7mKkifF59ftjE+2ZlMmxns6I+ySiLpR8FEmfu+TGpVp3zYTjNV93obJJTyBCCsSHVETCyQRbKdCyb5TMa6LGrvcZaX0Q/VAavhuNA/m4kSiRMgSnYrUjGhVekdDnF+7xioo4wvFnxjIDh7uJQrYOWD6MloNGX7St5gbysTuQQ7i/HI38b9V8x8mKazuDSXxB//BKGZx/XHkK8cHX+QK1MPxYUVM1/CBI5oW");
 
     private static final byte[] backupServerPublicParams = Base64.getDecoder()
-            .decode("AJwNSU55fsFCbgaxGRD11wO1juAs8Yr5GF8FPlGzzvdJJIKH5/4CC7ZJSOe3yL2vturVaRU2Cx0n751Vt8wkj1bozK3CBV1UokxV09GWf+hdVImLGjXGYLLhnI1J2TWEe7iWHyb553EEnRb5oxr9n3lUbNAJuRmFM7hrr0Al0F0wrDD4S8lo2mGaXe0MJCOM166F8oYRQqpFeEHfiLnxA1O8ZLh7vMdv4g9jI5phpRBTsJ5IjiJrWeP0zdIGHEssUeprDZ9OUJ14m0v61eYJMKsf59Bn+mAT2a7YfB+Don9O");
+            .decode("AZwNSU55fsFCbgaxGRD11wO1juAs8Yr5GF8FPlGzzvdJJIKH5/4CC7ZJSOe3yL2vturVaRU2Cx0n751Vt8wkj1Y4pyiScu0/S10n647ipo+iq97JZQv+UOlwH8ThyNlGT5DfxXCwTqivxHuXvZpuezPgHk5Gxl5aC6xuNxOnwmFlmu4CeSgdhW8+Pp0vAJOQ1MsU2D0+/kzI+tU94nB3tybY/Ao1AcGW2q41uKQbnOJUWwmQaFT6s+xTISgzsg7CPox6oORGX8rnyk/9lic3DbGsUHctIVpMAl/ogJBb4aYC");
 
     private static final Environment LIBSIGNAL_NET_ENV = Environment.PRODUCTION;
 

lib/src/main/java/org/asamk/signal/manager/config/ServiceConfig.java

@@ -20,6 +20,7 @@ public class ServiceConfig {
 
     public static final int MAX_ATTACHMENT_SIZE = 150 * 1024 * 1024;
     public static final long MAX_ENVELOPE_SIZE = 0;
+    public static final int MAX_INCREMENTAL_MACS_PER_ENVELOPE = 10;
     public static final int MAX_MESSAGE_SIZE_BYTES = 2000;
     public static final long AVATAR_DOWNLOAD_FAILSAFE_MAX_SIZE = 10 * 1024 * 1024;
     public static final boolean AUTOMATIC_NETWORK_RETRY = true;
@@ -27,10 +28,20 @@ public class ServiceConfig {
     public static final int MAXIMUM_ONE_OFF_REQUEST_SIZE = 3;
     public static final long UNREGISTERED_LIFESPAN = TimeUnit.DAYS.toMillis(30);
 
-    public static AccountAttributes.Capabilities getCapabilities(boolean isPrimaryDevice) {
+    public static AccountAttributes.Capabilities getCapabilities(
+            final boolean isPrimaryDevice,
+            final boolean hasPhoneNumber
+    ) {
         final var attachmentBackfill = !isPrimaryDevice;
-        final var spqr = !isPrimaryDevice;
-        return new AccountAttributes.Capabilities(true, true, attachmentBackfill, spqr);
+        final var spqr = true;
+        final var usernameSyncChangeMessage = !isPrimaryDevice;
+        final var optionalPhoneNumber = !isPrimaryDevice || !hasPhoneNumber;
+        return new AccountAttributes.Capabilities(true,
+                true,
+                attachmentBackfill,
+                spqr,
+                usernameSyncChangeMessage,
+                optionalPhoneNumber);
     }
 
     public static ServiceEnvironmentConfig getServiceEnvironmentConfig(

lib/src/main/java/org/asamk/signal/manager/config/ServiceEnvironmentConfig.java

@@ -3,7 +3,7 @@ package org.asamk.signal.manager.config;
 import org.asamk.signal.manager.api.ServiceEnvironment;
 import org.signal.libsignal.net.Network;
 import org.signal.libsignal.protocol.ecc.ECPublicKey;
-import org.whispersystems.signalservice.internal.configuration.SignalServiceConfiguration;
+import org.signal.network.config.SignalServiceConfiguration;
 
 import java.util.List;
 

lib/src/main/java/org/asamk/signal/manager/config/StagingConfig.java

@@ -3,15 +3,15 @@ package org.asamk.signal.manager.config;
 import org.signal.libsignal.net.Network;
 import org.signal.libsignal.protocol.InvalidKeyException;
 import org.signal.libsignal.protocol.ecc.ECPublicKey;
-import org.whispersystems.signalservice.api.push.TrustStore;
-import org.whispersystems.signalservice.internal.configuration.HttpProxy;
-import org.whispersystems.signalservice.internal.configuration.SignalCdnUrl;
-import org.whispersystems.signalservice.internal.configuration.SignalCdsiUrl;
-import org.whispersystems.signalservice.internal.configuration.SignalProxy;
-import org.whispersystems.signalservice.internal.configuration.SignalServiceConfiguration;
-import org.whispersystems.signalservice.internal.configuration.SignalServiceUrl;
-import org.whispersystems.signalservice.internal.configuration.SignalStorageUrl;
-import org.whispersystems.signalservice.internal.configuration.SignalSvr2Url;
+import org.signal.network.config.HttpProxy;
+import org.signal.network.config.SignalCdnUrl;
+import org.signal.network.config.SignalCdsiUrl;
+import org.signal.network.config.SignalProxy;
+import org.signal.network.config.SignalServiceConfiguration;
+import org.signal.network.config.SignalServiceUrl;
+import org.signal.network.config.SignalStorageUrl;
+import org.signal.network.config.SignalSvr2Url;
+import org.signal.network.config.TrustStore;
 
 import java.util.Base64;
 import java.util.List;
@@ -30,8 +30,8 @@ class StagingConfig {
     private static final byte[] UNIDENTIFIED_SENDER_TRUST_ROOT2 = Base64.getDecoder()
             .decode("BYhU6tPjqP46KGZEzRs1OL4U39V5dlPJ/X09ha4rErkm");
     private static final String CDSI_MRENCLAVE = "0f6fd79cdfdaa5b2e6337f534d3baf999318b0c462a7ac1f41297a3e4b424a57";
-    private static final String SVR2_MRENCLAVE_LEGACY = "2e8cefe6e3f389d8426adb24e9b7fb7adf10902c96f06f7bbcee36277711ed91";
-    private static final String SVR2_MRENCLAVE = "a75542d82da9f6914a1e31f8a7407053b99cc99a0e7291d8fbd394253e19b036";
+    private static final String SVR2_MRENCLAVE = "0ff2d7d4efbe7cfc24ac069a16fba898928dbe6c40d500c8b6da55733c727d6e";
+    private static final String SVR2_MRENCLAVE_LEGACY = "3c699f4975aaa3d172c0aad042f94f031b2b03e10b9c19a45116a01693d83302";
 
     private static final String URL = "https://chat.staging.signal.org";
     private static final String CDN_URL = "https://cdn-staging.signal.org";
@@ -49,10 +49,10 @@ class StagingConfig {
     private static final byte[] zkGroupServerPublicParams = Base64.getDecoder()
             .decode("ABSY21VckQcbSXVNCGRYJcfWHiAMZmpTtTELcDmxgdFbtp/bWsSxZdMKzfCp8rvIs8ocCU3B37fT3r4Mi5qAemeGeR2X+/YmOGR5ofui7tD5mDQfstAI9i+4WpMtIe8KC3wU5w3Inq3uNWVmoGtpKndsNfwJrCg0Hd9zmObhypUnSkfYn2ooMOOnBpfdanRtrvetZUayDMSC5iSRcXKpdlukrpzzsCIvEwjwQlJYVPOQPj4V0F4UXXBdHSLK05uoPBCQG8G9rYIGedYsClJXnbrgGYG3eMTG5hnx4X4ntARBgELuMWWUEEfSK0mjXg+/2lPmWcTZWR9nkqgQQP0tbzuiPm74H2wMO4u1Wafe+UwyIlIT9L7KLS19Aw8r4sPrXZSSsOZ6s7M1+rTJN0bI5CKY2PX29y5Ok3jSWufIKcgKOnWoP67d5b2du2ZVJjpjfibNIHbT/cegy/sBLoFwtHogVYUewANUAXIaMPyCLRArsKhfJ5wBtTminG/PAvuBdJ70Z/bXVPf8TVsR292zQ65xwvWTejROW6AZX6aqucUjlENAErBme1YHmOSpU6tr6doJ66dPzVAWIanmO/5mgjNEDeK7DDqQdB1xd03HT2Qs2TxY3kCK8aAb/0iM0HQiXjxZ9HIgYhbtvGEnDKW5ILSUydqH/KBhW4Pb0jZWnqN/YgbWDKeJxnDbYcUob5ZY5Lt5ZCMKuaGUvCJRrCtuugSMaqjowCGRempsDdJEt+cMaalhZ6gczklJB/IbdwENW9KeVFPoFNFzhxWUIS5ML9riVYhAtE6JE5jX0xiHNVIIPthb458cfA8daR0nYfYAUKogQArm0iBezOO+mPk5vCNWI+wwkyFCqNDXz/qxl1gAntuCJtSfq9OC3NkdhQlgYQ==");
     private static final byte[] genericServerPublicParams = Base64.getDecoder()
-            .decode("AHILOIrFPXX9laLbalbA9+L1CXpSbM/bTJXZGZiuyK1JaI6dK5FHHWL6tWxmHKYAZTSYmElmJ5z2A5YcirjO/yfoemE03FItyaf8W1fE4p14hzb5qnrmfXUSiAIVrhaXVwIwSzH6RL/+EO8jFIjJ/YfExfJ8aBl48CKHgu1+A6kWynhttonvWWx6h7924mIzW0Czj2ROuh4LwQyZypex4GuOPW8sgIT21KNZaafgg+KbV7XM1x1tF3XA17B4uGUaDbDw2O+nR1+U5p6qHPzmJ7ggFjSN6Utu+35dS1sS0P9N");
+            .decode("AYhaw+NbxtNLo/RlGFEsHd904hW38LpPJ59jYJlNmT4wwtyOq4xzCs/MyXsfRbIsAYhQjDnpE0rhFtWkMcn/kV740SISwFfpPHunrtZ9h0YWz5QNNbI5I3DRGUjhKXgMU7J7s7qOr0fdms+g0e+L9FMSjJLobDkOngp/m0B5TsxTyqLscJ5VyU69Cj8txImTfHMCKrYphYfRHO78RwPoz2g2tGUAzEbKHm12OgDna2qutkE5TvYqwZczvgZyLVHdHXpvdyOlEdv4afVyWkI7u/S0XYDonIJoHlxqJoTSepZR");
 
     private static final byte[] backupServerPublicParams = Base64.getDecoder()
-            .decode("AHYrGb9IfugAAJiPKp+mdXUx+OL9zBolPYHYQz6GI1gWjpEu5me3zVNSvmYY4zWboZHif+HG1sDHSuvwFd0QszSwuSF4X4kRP3fJREdTZ5MCR0n55zUppTwfHRW2S4sdQ0JGz7YDQIJCufYSKh0pGNEHL6hv79Agrdnr4momr3oXdnkpVBIp3HWAQ6IbXQVSG18X36GaicI1vdT0UFmTwU2KTneluC2eyL9c5ff8PcmiS+YcLzh0OKYQXB5ZfQ06d6DiINvDQLy75zcfUOniLAj0lGJiHxGczin/RXisKSR8");
+            .decode("AXYrGb9IfugAAJiPKp+mdXUx+OL9zBolPYHYQz6GI1gWjpEu5me3zVNSvmYY4zWboZHif+HG1sDHSuvwFd0QszS6h3nZ6vRdM/IYGK+cLynw3ucWo7idf3zjOG3b6JnGT/z7XYCr6HuOGkWH4DQWCH98hxVZMGOgmT8DCQoqebQb3oK1yrwEglRWmtI01KhRg9RGUKoQiwuej1JZEY8uaG4Uz9n1cVODJ1iuByhNqGHo+KfI4iWhjtx2AnhYqHViQ3CMd4ASGBJtic9UTFVk/4vegVIy0wfYsAmViftzK6t4");
 
     private static final Network.Environment LIBSIGNAL_NET_ENV = Network.Environment.STAGING;
 

lib/src/main/java/org/asamk/signal/manager/config/WhisperTrustStore.java

@@ -1,6 +1,6 @@
 package org.asamk.signal.manager.config;
 
-import org.whispersystems.signalservice.api.push.TrustStore;
+import org.signal.network.config.TrustStore;
 
 import java.io.InputStream;
 

lib/src/main/java/org/asamk/signal/manager/helper/AccountFileUpdater.java

@@ -1,6 +1,6 @@
 package org.asamk.signal.manager.helper;
 
-import org.whispersystems.signalservice.api.push.ServiceId.ACI;
+import org.signal.core.models.ServiceId.ACI;
 
 public interface AccountFileUpdater {
 

lib/src/main/java/org/asamk/signal/manager/helper/AccountHelper.java

@@ -1,5 +1,6 @@
 package org.asamk.signal.manager.helper;
 
+import org.asamk.signal.manager.api.BadRequestException;
 import org.asamk.signal.manager.api.CaptchaRequiredException;
 import org.asamk.signal.manager.api.DeviceLinkUrl;
 import org.asamk.signal.manager.api.IncorrectPinException;
@@ -14,22 +15,27 @@ import org.asamk.signal.manager.storage.SignalAccount;
 import org.asamk.signal.manager.util.KeyUtils;
 import org.asamk.signal.manager.util.NumberVerificationUtils;
 import org.asamk.signal.manager.util.Utils;
+import org.signal.core.models.ServiceId.ACI;
+import org.signal.core.models.ServiceId.PNI;
 import org.signal.core.util.Base64;
+import org.signal.core.util.crypto.DeviceNameCipher;
 import org.signal.libsignal.protocol.IdentityKeyPair;
 import org.signal.libsignal.protocol.InvalidKeyException;
+import org.signal.libsignal.protocol.NoSessionException;
 import org.signal.libsignal.protocol.SignalProtocolAddress;
 import org.signal.libsignal.protocol.state.KyberPreKeyRecord;
 import org.signal.libsignal.protocol.state.SignedPreKeyRecord;
 import org.signal.libsignal.protocol.util.KeyHelper;
 import org.signal.libsignal.usernames.BaseUsernameException;
 import org.signal.libsignal.usernames.Username;
+import org.signal.network.api.AccountApiV2.SetAccountAttributesError;
+import org.signal.network.exceptions.NonSuccessfulResponseCodeException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.account.ChangePhoneNumberRequest;
 import org.whispersystems.signalservice.api.crypto.UntrustedIdentityException;
 import org.whispersystems.signalservice.api.link.LinkedDeviceVerificationCodeResponse;
-import org.whispersystems.signalservice.api.push.ServiceId.ACI;
-import org.whispersystems.signalservice.api.push.ServiceId.PNI;
+import org.whispersystems.signalservice.api.messages.multidevice.DeviceInfo;
 import org.whispersystems.signalservice.api.push.ServiceIdType;
 import org.whispersystems.signalservice.api.push.SignalServiceAddress;
 import org.whispersystems.signalservice.api.push.SignedPreKeyEntity;
@@ -37,10 +43,6 @@ import org.whispersystems.signalservice.api.push.UsernameLinkComponents;
 import org.whispersystems.signalservice.api.push.exceptions.AlreadyVerifiedException;
 import org.whispersystems.signalservice.api.push.exceptions.AuthorizationFailedException;
 import org.whispersystems.signalservice.api.push.exceptions.DeprecatedVersionException;
-import org.whispersystems.signalservice.api.push.exceptions.UsernameIsNotReservedException;
-import org.whispersystems.signalservice.api.push.exceptions.UsernameMalformedException;
-import org.whispersystems.signalservice.api.push.exceptions.UsernameTakenException;
-import org.whispersystems.signalservice.api.util.DeviceNameUtil;
 import org.whispersystems.signalservice.internal.push.DeviceLimitExceededException;
 import org.whispersystems.signalservice.internal.push.KyberPreKeyEntity;
 import org.whispersystems.signalservice.internal.push.OutgoingPushMessage;
@@ -48,7 +50,9 @@ import org.whispersystems.signalservice.internal.push.SyncMessage;
 import org.whispersystems.signalservice.internal.push.exceptions.MismatchedDevicesException;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Objects;
@@ -59,6 +63,7 @@ import okio.ByteString;
 
 import static org.asamk.signal.manager.config.ServiceConfig.PREKEY_MAXIMUM_ID;
 import static org.asamk.signal.manager.util.Utils.handleResponseException;
+import static org.asamk.signal.manager.util.Utils.handleResponseExceptionSuspend;
 import static org.whispersystems.signalservice.internal.util.Util.isEmpty;
 
 public class AccountHelper {
@@ -82,16 +87,9 @@ public class AccountHelper {
     }
 
     public void checkAccountState() throws IOException {
-        if (account.getLastReceiveTimestamp() == 0) {
-            logger.info("The Signal protocol expects that incoming messages are regularly received.");
-        } else {
-            var diffInMilliseconds = System.currentTimeMillis() - account.getLastReceiveTimestamp();
-            long days = TimeUnit.DAYS.convert(diffInMilliseconds, TimeUnit.MILLISECONDS);
-            if (days > 7) {
-                logger.warn(
-                        "Messages have been last received {} days ago. The Signal protocol expects that incoming messages are regularly received.",
-                        days);
-            }
+        if (account.getAci() == null) {
+            account.setRegistered(false);
+            throw new IOException("Account without ACI");
         }
         try {
             updateAccountAttributes();
@@ -100,10 +98,10 @@ public class AccountHelper {
             } else {
                 context.getPreKeyHelper().refreshPreKeysIfNecessary();
             }
-            if (account.getAci() == null || account.getPni() == null) {
+            if (account.getPni() == null && account.getNumber() != null) {
                 checkWhoAmiI();
             }
-            if (!account.isPrimaryDevice() && account.getPniIdentityKeyPair() == null) {
+            if (!account.isPrimaryDevice() && account.getPni() != null && account.getPniIdentityKeyPair() == null) {
                 throw new IOException("Missing PNI identity key, relinking required");
             }
             if (account.getPreviousStorageVersion() < 10
@@ -125,14 +123,26 @@ public class AccountHelper {
             account.setRegistered(false);
             throw e;
         }
+        if (account.getLastReceiveTimestamp() == 0) {
+            logger.info("The Signal protocol expects that incoming messages are regularly received.");
+        } else {
+            var diffInMilliseconds = System.currentTimeMillis() - account.getLastReceiveTimestamp();
+            long days = TimeUnit.DAYS.convert(diffInMilliseconds, TimeUnit.MILLISECONDS);
+            if (days > 7) {
+                logger.warn(
+                        "Messages have been last received {} days ago. The Signal protocol expects that incoming messages are regularly received.",
+                        days);
+            }
+        }
     }
 
     public void checkWhoAmiI() throws IOException {
         final var whoAmI = dependencies.getAccountManager().getWhoAmI();
         final var number = whoAmI.getNumber();
         final var aci = ACI.parseOrThrow(whoAmI.getAci());
-        final var pni = PNI.parseOrThrow(whoAmI.getPni());
-        if (number.equals(account.getNumber()) && aci.equals(account.getAci()) && pni.equals(account.getPni())) {
+        final var pni = whoAmI.getPni() == null ? null : PNI.parseOrThrow(whoAmI.getPni());
+        if (Objects.equals(number, account.getNumber()) && aci.equals(account.getAci()) && Objects.equals(pni,
+                account.getPni())) {
             return;
         }
 
@@ -143,7 +153,7 @@ public class AccountHelper {
         account.setNumber(number);
         account.setAci(aci);
         account.setPni(pni);
-        if (account.isPrimaryDevice() && account.getPniIdentityKeyPair() == null) {
+        if (pni != null && account.isPrimaryDevice() && account.getPniIdentityKeyPair() == null) {
             account.setPniIdentityKeyPair(KeyUtils.generateIdentityKeyPair());
         }
         account.getRecipientTrustedResolver().resolveSelfRecipientTrusted(account.getSelfRecipientAddress());
@@ -278,13 +288,16 @@ public class AccountHelper {
                     final var message = messageSender.getEncryptedSyncPniInitializeDeviceMessage(deviceId,
                             pniChangeNumber);
                     encryptedDeviceMessages.add(message);
-                } catch (UntrustedIdentityException | IOException | InvalidKeyException e) {
+                } catch (UntrustedIdentityException | IOException | InvalidKeyException | NoSessionException e) {
                     throw new RuntimeException(e);
                 }
             }
         }
 
         final var sessionId = account.getSessionId(newNumber);
+        if (sessionId == null) {
+            throw new IOException("No change number verification session active");
+        }
         final var result = NumberVerificationUtils.verifyNumber(sessionId,
                 verificationCode,
                 pin,
@@ -308,16 +321,21 @@ public class AccountHelper {
                             Utils.mapKeys(pniRegistrationIds, Object::toString))));
                 });
 
+        account.clearSessionId();
         final var updatePni = PNI.parseOrThrow(result.first().getPni());
         if (updatePni.equals(account.getPni())) {
             logger.debug("PNI is unchanged after change number");
             return;
         }
 
-        handlePniChangeNumberMessage(selfChangeNumber, updatePni);
+        handlePniChangeNumberMessage(selfChangeNumber, updatePni, false);
     }
 
-    public void handlePniChangeNumberMessage(final SyncMessage.PniChangeNumber pniChangeNumber, final PNI updatedPni) {
+    public boolean handlePniChangeNumberMessage(
+            final SyncMessage.PniChangeNumber pniChangeNumber,
+            final PNI updatedPni,
+            final boolean forcePniPreKeyRotation
+    ) {
         if (pniChangeNumber.identityKeyPair != null
                 && pniChangeNumber.registrationId != null
                 && pniChangeNumber.signedPreKey != null) {
@@ -331,10 +349,19 @@ public class AccountHelper {
                         pniChangeNumber.lastResortKyberPreKey != null
                                 ? new KyberPreKeyRecord(pniChangeNumber.lastResortKyberPreKey.toByteArray())
                                 : null);
+                if (forcePniPreKeyRotation) {
+                    try {
+                        context.getPreKeyHelper().forceRefreshPreKeys(ServiceIdType.PNI);
+                    } catch (IOException e) {
+                        logger.warn("Failed to force refresh PNI pre keys after PNI change sync", e);
+                    }
+                }
+                return true;
             } catch (Exception e) {
                 logger.warn("Failed to handle change number message", e);
             }
         }
+        return false;
     }
 
     public static final int USERNAME_MIN_LENGTH = 3;
@@ -376,13 +403,17 @@ public class AccountHelper {
     }
 
     private void reserveUsername(final List<Username> candidates) throws IOException {
-        final var candidateHashes = new ArrayList<String>();
+        final var candidateHashes = new ArrayList<byte[]>();
         for (final var candidate : candidates) {
-            candidateHashes.add(Base64.encodeUrlSafeWithoutPadding(candidate.getHash()));
+            candidateHashes.add(candidate.getHash());
         }
 
-        final var response = handleResponseException(dependencies.getAccountApi().reserveUsername(candidateHashes));
-        final var hashIndex = candidateHashes.indexOf(response.getUsernameHash());
+        final var usernameHash = handleResponseException(dependencies.getAccountApi().reserveUsername(candidateHashes));
+        final var hashIndex = candidateHashes.stream()
+                .filter(candidateHash -> Arrays.equals(candidateHash, usernameHash))
+                .findFirst()
+                .map(candidateHashes::indexOf)
+                .orElse(-1);
         if (hashIndex == -1) {
             logger.warn("[reserveUsername] The response hash could not be found in our set of candidateHashes.");
             throw new IOException("Unexpected username response");
@@ -457,7 +488,7 @@ public class AccountHelper {
             logger.debug("Attempting to resynchronize username.");
             try {
                 tryReserveConfirmUsername(username);
-            } catch (UsernameMalformedException | UsernameTakenException | UsernameIsNotReservedException e) {
+            } catch (NonSuccessfulResponseCodeException e) {
                 logger.debug("[confirmUsername] Failed to reserve confirm username: {} ({})",
                         e.getMessage(),
                         e.getClass().getSimpleName());
@@ -475,8 +506,7 @@ public class AccountHelper {
         final var usernameLink = account.getUsernameLink();
 
         if (usernameLink == null) {
-            handleResponseException(dependencies.getAccountApi()
-                    .reserveUsername(List.of(Base64.encodeUrlSafeWithoutPadding(username.getHash()))));
+            handleResponseException(dependencies.getAccountApi().reserveUsername(List.of(username.getHash())));
             logger.debug("[reserveUsername] Successfully reserved existing username.");
             final var linkComponents = confirmUsernameAndCreateNewLink(username);
             account.setUsernameLink(linkComponents);
@@ -501,21 +531,56 @@ public class AccountHelper {
         }
     }
 
+    @SuppressWarnings("unchecked")
     public void deleteUsername() throws IOException {
-        handleResponseException(dependencies.getAccountApi().deleteUsername());
+        handleResponseException(dependencies.getAccountApi().deleteUsernameHash());
         account.setUsernameLink(null);
         account.setUsername(null);
         logger.debug("[deleteUsername] Successfully deleted the username.");
     }
 
     public void setDeviceName(String deviceName) {
-        final var privateKey = account.getAciIdentityKeyPair().getPrivateKey();
-        final var encryptedDeviceName = DeviceNameUtil.encryptDeviceName(deviceName, privateKey);
-        account.setEncryptedDeviceName(encryptedDeviceName);
+        final var encryptedDeviceName = getEncryptedDeviceName(deviceName);
+        account.setEncryptedDeviceName(Base64.encodeWithoutPadding(encryptedDeviceName));
+    }
+
+    public void setDeviceName(int deviceId, String deviceName) throws IOException {
+        final var encryptedDeviceName = getEncryptedDeviceName(deviceName);
+        handleResponseExceptionSuspend(cont -> dependencies.getLinkDeviceApi()
+                .setDeviceName(encryptedDeviceName, deviceId, cont));
+        context.getSyncHelper().sendDeviceNameChange(deviceId);
+    }
+
+    private byte[] getEncryptedDeviceName(final String deviceName) {
+        final var identityKey = account.getAciIdentityKeyPair();
+        return DeviceNameCipher.encryptDeviceName(deviceName.getBytes(StandardCharsets.UTF_8), identityKey);
+    }
+
+    public void refreshDeviceName() throws IOException {
+        final List<DeviceInfo> devices = handleResponseExceptionSuspend(cont -> dependencies.getLinkDeviceApi()
+                .getDevices(cont));
+        final var deviceId = account.getDeviceId();
+        final var device = devices.stream().filter(d -> d.id == deviceId).findFirst();
+        if (device.isPresent()) {
+            account.setEncryptedDeviceName(device.get().name);
+        }
     }
 
     public void updateAccountAttributes() throws IOException {
-        handleResponseException(dependencies.getAccountApi().setAccountAttributes(account.getAccountAttributes(null)));
+        if (account.getNumber() != null) {
+            handleResponseException(dependencies.getAccountApi()
+                    .setAccountAttributes(account.getAccountAttributes(null)));
+            return;
+        }
+        try {
+            handleResponseExceptionSuspend(cont -> dependencies.getAccountApiV2()
+                    .setAccountAttributes(account.getAccountAttributesV2(), cont));
+        } catch (BadRequestException e) {
+            if (e.getError() instanceof SetAccountAttributesError.Unauthorized) {
+                throw new AuthorizationFailedException(401, "Authorization failed!");
+            }
+            throw new IOException("Account attribute update rate limited; try again later");
+        }
     }
 
     public void addDevice(DeviceLinkUrl deviceLinkInfo) throws IOException, org.asamk.signal.manager.api.DeviceLimitExceededException {
@@ -540,36 +605,39 @@ public class AccountHelper {
                         account.getOrCreatePinMasterKey(),
                         account.getOrCreateMediaRootBackupKey(),
                         verificationCode.getVerificationCode(),
-                        null));
+                        null,
+                        account.getAuthCredentialSalt()));
         account.setMultiDevice(true);
         context.getJobExecutor().enqueueJob(new SyncStorageJob());
     }
 
     public void removeLinkedDevices(int deviceId) throws IOException {
-        handleResponseException(dependencies.getLinkDeviceApi().removeDevice(deviceId));
-        var devices = handleResponseException(dependencies.getLinkDeviceApi().getDevices());
+        handleResponseExceptionSuspend(cont -> dependencies.getLinkDeviceApi().removeDevice(deviceId, cont));
+        final List<DeviceInfo> devices = handleResponseExceptionSuspend(cont -> dependencies.getLinkDeviceApi()
+                .getDevices(cont));
         account.setMultiDevice(devices.size() > 1);
     }
 
+    @SuppressWarnings("unchecked")
     public void migrateRegistrationPin() throws IOException {
         var masterKey = account.getOrCreatePinMasterKey();
 
         context.getPinHelper().migrateRegistrationLockPin(account.getRegistrationLockPin(), masterKey);
-        handleResponseException(dependencies.getAccountApi()
-                .enableRegistrationLock(masterKey.deriveRegistrationLock()));
+        handleResponseException(dependencies.getAccountApi().enableRegistrationLock(masterKey));
     }
 
+    @SuppressWarnings("unchecked")
     public void setRegistrationPin(String pin) throws IOException {
         var masterKey = account.getOrCreatePinMasterKey();
 
         context.getPinHelper().setRegistrationLockPin(pin, masterKey);
-        handleResponseException(dependencies.getAccountApi()
-                .enableRegistrationLock(masterKey.deriveRegistrationLock()));
+        handleResponseException(dependencies.getAccountApi().enableRegistrationLock(masterKey));
 
         account.setRegistrationLockPin(pin);
         updateAccountAttributes();
     }
 
+    @SuppressWarnings("unchecked")
     public void removeRegistrationPin() throws IOException {
         // Remove KBS Pin
         context.getPinHelper().removeRegistrationLockPin();
@@ -582,7 +650,7 @@ public class AccountHelper {
         // When setting an empty GCM id, the Signal-Server also sets the fetchesMessages property to false.
         // If this is the primary device, other users can't send messages to this number anymore.
         // If this is a linked device, other users can still send messages, but this device doesn't receive them anymore.
-        handleResponseException(dependencies.getAccountApi().clearFcmToken());
+        handleResponseExceptionSuspend(cont -> dependencies.getAccountApi().clearFcmToken(cont));
 
         account.setRegistered(false);
         unregisteredListener.call();

lib/src/main/java/org/asamk/signal/manager/helper/AttachmentHelper.java

@@ -1,20 +1,25 @@
 package org.asamk.signal.manager.helper;
 
 import org.asamk.signal.manager.api.AttachmentInvalidException;
+import org.asamk.signal.manager.api.Message.AttachmentDimensions;
 import org.asamk.signal.manager.config.ServiceConfig;
 import org.asamk.signal.manager.internal.SignalDependencies;
 import org.asamk.signal.manager.storage.AttachmentStore;
 import org.asamk.signal.manager.util.AttachmentUtils;
 import org.asamk.signal.manager.util.IOUtils;
+import org.asamk.signal.manager.util.Utils;
 import org.signal.libsignal.protocol.InvalidMessageException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.crypto.AttachmentCipherInputStream;
+import org.whispersystems.signalservice.api.crypto.AttachmentCipherStreamUtil;
 import org.whispersystems.signalservice.api.messages.SignalServiceAttachment;
 import org.whispersystems.signalservice.api.messages.SignalServiceAttachmentPointer;
 import org.whispersystems.signalservice.api.messages.SignalServiceAttachmentStream;
 import org.whispersystems.signalservice.api.push.exceptions.MissingConfigurationException;
 import org.whispersystems.signalservice.api.util.StreamDetails;
+import org.whispersystems.signalservice.internal.crypto.PaddingInputStream;
+import org.whispersystems.signalservice.internal.push.http.ResumableUploadSpec;
 
 import java.io.File;
 import java.io.IOException;
@@ -30,8 +35,10 @@ public class AttachmentHelper {
 
     private final SignalDependencies dependencies;
     private final AttachmentStore attachmentStore;
+    private final Context context;
 
     public AttachmentHelper(final Context context) {
+        this.context = context;
         this.dependencies = context.getDependencies();
         this.attachmentStore = context.getAttachmentStore();
     }
@@ -44,8 +51,13 @@ public class AttachmentHelper {
         return attachmentStore.retrieveAttachment(id);
     }
 
-    public List<SignalServiceAttachment> uploadAttachments(final List<String> attachments) throws AttachmentInvalidException, IOException {
-        final var attachmentStreams = createAttachmentStreams(attachments);
+    public List<SignalServiceAttachment> uploadAttachments(
+            final List<String> attachments,
+            final List<AttachmentDimensions> dimensions,
+            final List<String> blurHashes,
+            boolean voiceNote
+    ) throws AttachmentInvalidException, IOException {
+        final var attachmentStreams = createAttachmentStreams(attachments, dimensions, blurHashes, voiceNote);
 
         try {
             // Upload attachments here, so we only upload once even for multiple recipients
@@ -61,21 +73,74 @@ public class AttachmentHelper {
         }
     }
 
-    private List<SignalServiceAttachmentStream> createAttachmentStreams(List<String> attachments) throws AttachmentInvalidException, IOException {
+    public List<SignalServiceAttachment> uploadAttachments(final List<String> attachments) throws AttachmentInvalidException, IOException {
+        return uploadAttachments(attachments, List.of(), List.of(), false);
+    }
+
+    private List<SignalServiceAttachmentStream> createAttachmentStreams(
+            List<String> attachments,
+            List<AttachmentDimensions> dimensions,
+            List<String> blurHashes,
+            boolean voiceNote
+    ) throws AttachmentInvalidException, IOException {
         if (attachments == null) {
             return null;
         }
         final var signalServiceAttachments = new ArrayList<SignalServiceAttachmentStream>(attachments.size());
-        for (var attachment : attachments) {
-            final var uploadSpec = dependencies.getMessageSender().getResumableUploadSpec();
-            signalServiceAttachments.add(AttachmentUtils.createAttachmentStream(attachment, uploadSpec));
+        for (var i = 0; i < attachments.size(); i++) {
+            final var size = i < dimensions.size() ? dimensions.get(i) : null;
+            final var blurHash = i < blurHashes.size() && !blurHashes.get(i).isEmpty() ? blurHashes.get(i) : null;
+            signalServiceAttachments.add(getAttachmentStream(attachments.get(i), size, blurHash, voiceNote));
         }
         return signalServiceAttachments;
     }
 
+    private SignalServiceAttachmentStream getAttachmentStream(
+            final String attachment,
+            final AttachmentDimensions dimensions,
+            final String blurHash,
+            final boolean voiceNote
+    ) throws AttachmentInvalidException {
+        try {
+            // Reject local files that point into the signal-cli data directory
+            if (attachment != null && !attachment.startsWith("data:")) {
+                try {
+                    final var file = new File(attachment);
+                    final var canonical = file.getCanonicalFile();
+                    final var dataPath = context.getAccount().getDataPath().getCanonicalFile();
+                    if (canonical.toPath().startsWith(dataPath.toPath())) {
+                        throw new AttachmentInvalidException(attachment,
+                                new IOException("Attaching files from the signal-cli data directory is not allowed"));
+                    }
+                } catch (IOException e) {
+                    throw new AttachmentInvalidException(attachment, e);
+                }
+            }
+
+            final var streamDetailsAndFileName = Utils.createStreamDetails(attachment);
+            final var streamDetails = streamDetailsAndFileName.first();
+            final var uploadSpec = getResumableUploadSpec(streamDetails);
+
+            return AttachmentUtils.createAttachmentStream(streamDetails,
+                    streamDetailsAndFileName.second(),
+                    voiceNote,
+                    dimensions,
+                    blurHash,
+                    uploadSpec);
+        } catch (IOException e) {
+            throw new AttachmentInvalidException(attachment, e);
+        }
+    }
+
+    public ResumableUploadSpec getResumableUploadSpec(final StreamDetails streamDetails) throws IOException {
+        final var streamLength = streamDetails.getLength();
+        final var ciphertextLength = AttachmentCipherStreamUtil.getCiphertextLength(PaddingInputStream.getPaddedSize(
+                streamLength));
+        return dependencies.getCdnService().getResumableUploadSpecBlocking(ciphertextLength);
+    }
+
     public SignalServiceAttachmentPointer uploadAttachment(String attachment) throws IOException, AttachmentInvalidException {
-        final var uploadSpec = dependencies.getMessageSender().getResumableUploadSpec();
-        var attachmentStream = AttachmentUtils.createAttachmentStream(attachment, uploadSpec);
+        final var attachmentStream = getAttachmentStream(attachment, null, null, false);
         return uploadAttachment(attachmentStream);
     }
 
@@ -103,7 +168,7 @@ public class AttachmentHelper {
         try {
             attachmentStore.storeAttachment(pointer, outputStream -> this.retrieveAttachment(pointer, outputStream));
         } catch (IOException e) {
-            logger.warn("Failed to download attachment ({}), ignoring: {}", pointer.getRemoteId(), e.getMessage());
+            logger.warn("Failed to download attachment ({}), ignoring", pointer.getRemoteId(), e);
         }
     }
 

lib/src/main/java/org/asamk/signal/manager/helper/CallManager.java

@@ -0,0 +1,809 @@
+package org.asamk.signal.manager.helper;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+
+import org.asamk.signal.manager.Manager;
+import org.asamk.signal.manager.api.CallInfo;
+import org.asamk.signal.manager.api.MessageEnvelope;
+import org.asamk.signal.manager.api.TurnServer;
+import org.asamk.signal.manager.internal.SignalDependencies;
+import org.asamk.signal.manager.storage.SignalAccount;
+import org.asamk.signal.manager.storage.recipients.RecipientId;
+import org.asamk.signal.manager.util.Utils;
+import org.signal.libsignal.protocol.IdentityKey;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.whispersystems.signalservice.api.messages.SendMessageResult;
+import org.whispersystems.signalservice.api.messages.calls.AnswerMessage;
+import org.whispersystems.signalservice.api.messages.calls.BusyMessage;
+import org.whispersystems.signalservice.api.messages.calls.HangupMessage;
+import org.whispersystems.signalservice.api.messages.calls.IceUpdateMessage;
+import org.whispersystems.signalservice.api.messages.calls.OfferMessage;
+import org.whispersystems.signalservice.api.messages.calls.SignalServiceCallMessage;
+import org.whispersystems.signalservice.api.push.exceptions.ProofRequiredException;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.io.OutputStreamWriter;
+import java.io.PrintWriter;
+import java.math.BigInteger;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+
+import static org.asamk.signal.manager.util.Utils.callIdUnsigned;
+import static org.asamk.signal.manager.util.Utils.handleResponseException;
+
+/**
+ * Manages active voice calls: tracks state, spawns/monitors the signal-call-tunnel
+ * subprocess, routes incoming call messages, and handles timeouts.
+ */
+public class CallManager implements AutoCloseable {
+
+    private static final Logger logger = LoggerFactory.getLogger(CallManager.class);
+    private static final long RING_TIMEOUT_MS = 60_000;
+    private static final ObjectMapper mapper = new ObjectMapper();
+
+    private final Context context;
+    private final SignalAccount account;
+    private final SignalDependencies dependencies;
+    private final Map<Long, CallState> activeCalls = new ConcurrentHashMap<>();
+    private final List<Manager.CallEventListener> callEventListeners = new CopyOnWriteArrayList<>();
+    private final ScheduledExecutorService scheduler = Executors.newSingleThreadScheduledExecutor(r -> {
+        var t = new Thread(r, "call-timeout-scheduler");
+        t.setDaemon(true);
+        return t;
+    });
+
+    public CallManager(final Context context) {
+        this.context = context;
+        this.account = context.getAccount();
+        this.dependencies = context.getDependencies();
+    }
+
+    public void addCallEventListener(Manager.CallEventListener listener) {
+        callEventListeners.add(listener);
+    }
+
+    public void removeCallEventListener(Manager.CallEventListener listener) {
+        callEventListeners.remove(listener);
+    }
+
+    private void fireCallEvent(CallState state, String reason) {
+        var callInfo = state.toCallInfo(account.getRecipientAddressResolver());
+        for (var listener : callEventListeners) {
+            try {
+                listener.handleCallEvent(callInfo, reason);
+            } catch (Throwable e) {
+                logger.warn("Call event listener failed, ignoring", e);
+            }
+        }
+    }
+
+    public CallInfo startOutgoingCall(
+            final RecipientId recipientId
+    ) throws IOException {
+        var callId = generateCallId();
+        var recipientAddress = account.getRecipientAddressResolver().resolveRecipientAddress(recipientId);
+
+        var state = new CallState(callId, CallInfo.State.RINGING_OUTGOING, recipientId, null, true);
+        logger.debug("Starting outgoing call {} to {} (recipientId: {})",
+                callIdUnsigned(callId),
+                recipientAddress,
+                recipientId);
+        activeCalls.put(callId, state);
+        dependencies.getAuthenticatedSignalWebSocket().registerKeepAliveToken("call" + callId);
+        dependencies.getUnauthenticatedSignalWebSocket().registerKeepAliveToken("call" + callId);
+        fireCallEvent(state, null);
+
+        // Spawn call tunnel binary and connect control channel
+        spawnMediaTunnel(state);
+
+        // Fetch TURN servers
+        var turnServers = getTurnServers();
+
+        // Send createOutgoingCall + proceed via control channel
+        var createMsg = mapper.createObjectNode();
+        createMsg.put("type", "createOutgoingCall");
+        createMsg.put("callId", Utils.callIdUnsigned(callId));
+        createMsg.put("peerId", recipientAddress.toString());
+        sendControlMessage(state, writeJson(createMsg));
+        sendProceed(state, callId, turnServers);
+
+        // Schedule ring timeout
+        scheduler.schedule(() -> handleRingTimeout(callId), RING_TIMEOUT_MS, TimeUnit.MILLISECONDS);
+
+        logger.debug("Started outgoing call {} to {}", callIdUnsigned(callId), recipientAddress);
+        return state.toCallInfo(account.getRecipientAddressResolver());
+    }
+
+    public CallInfo acceptIncomingCall(final long callId) throws IOException {
+        final var state = getActiveCall(callId);
+        if (state.state != CallInfo.State.RINGING_INCOMING) {
+            throw new IOException("Call "
+                    + callId
+                    + " is not in RINGING_INCOMING state (current: "
+                    + state.state
+                    + ")");
+        }
+
+        // Defer the accept until the tunnel reports Ringing state.
+        // Sending accept too early (while RingRTC is in ConnectingBeforeAccepted)
+        // causes it to be silently dropped.
+        state.acceptPending = true;
+        // If the tunnel is already in Ringing state, send immediately
+        sendAcceptIfReady(state);
+
+        state.state = CallInfo.State.CONNECTING;
+        fireCallEvent(state, null);
+
+        logger.debug("Accepted incoming call {}", callIdUnsigned(callId));
+        return state.toCallInfo(account.getRecipientAddressResolver());
+    }
+
+    public void hangupCall(final long callId) throws IOException {
+        getActiveCall(callId);
+        endCall(callId, "local_hangup");
+    }
+
+    public SendMessageResult rejectCall(final long callId) throws IOException {
+        final var callState = getActiveCall(callId);
+
+        final var result = sendBusyMessage(callState.callId, callState.recipientId, callState.deviceId);
+
+        endCall(callId, "rejected");
+        return result;
+    }
+
+    public List<CallInfo> listActiveCalls() {
+        return activeCalls.values()
+                .stream()
+                .map((CallState callState) -> callState.toCallInfo(account.getRecipientAddressResolver()))
+                .toList();
+    }
+
+    public List<TurnServer> getTurnServers() throws IOException {
+        try {
+            var turnServerList = handleResponseException(dependencies.getCallingApi().getTurnServerInfo());
+            return turnServerList.stream()
+                    .map(info -> new TurnServer(info.getUsername(), info.getPassword(), info.getUrls()))
+                    .toList();
+        } catch (Throwable e) {
+            logger.warn("Failed to get TURN server info, returning empty list", e);
+            return List.of();
+        }
+    }
+
+    // --- Incoming call message handling ---
+
+    public void handleIncomingOffer(
+            final RecipientId recipientId,
+            final int deviceId,
+            final long callId,
+            final MessageEnvelope.Call.Offer.Type type,
+            final byte[] opaque
+    ) {
+        if (callEventListeners.isEmpty()) {
+            logger.debug("Ignoring incoming offer for call {}: no call event listeners registered",
+                    callIdUnsigned(callId));
+            return;
+        }
+
+        var senderAddress = account.getRecipientAddressResolver()
+                .resolveRecipientAddress(recipientId)
+                .toApiRecipientAddress();
+
+        logger.debug("Incoming offer opaque ({} bytes)", opaque == null ? 0 : opaque.length);
+
+        var state = new CallState(callId, CallInfo.State.RINGING_INCOMING, recipientId, deviceId, false);
+        logger.debug("Starting incoming call {} from {} (recipientId: {})",
+                callIdUnsigned(callId),
+                senderAddress,
+                recipientId);
+        activeCalls.put(callId, state);
+
+        // Spawn call tunnel binary immediately
+        spawnMediaTunnel(state);
+
+        // Get identity keys for the receivedOffer message
+        // Use raw 32-byte Curve25519 public key (without 0x05 DJB prefix) to match Signal Android
+        byte[] localIdentityKey = getRawIdentityKeyBytes(account.getAciIdentityKeyPair().getPublicKey());
+        byte[] remoteIdentityKey = getRemoteIdentityKey(state);
+
+        // Fetch TURN servers
+        List<TurnServer> turnServers;
+        try {
+            turnServers = getTurnServers();
+        } catch (IOException e) {
+            logger.warn("Failed to get TURN servers for incoming call {}", callIdUnsigned(callId), e);
+            turnServers = List.of();
+        }
+
+        // Send receivedOffer to subprocess
+        var offerMsg = mapper.createObjectNode();
+        offerMsg.put("type", "receivedOffer");
+        offerMsg.put("callId", Utils.callIdUnsigned(callId));
+        offerMsg.put("peerId", senderAddress.toString());
+        offerMsg.put("senderDeviceId", deviceId);
+        offerMsg.put("opaque", java.util.Base64.getEncoder().encodeToString(opaque));
+        offerMsg.put("age", 0);
+        offerMsg.put("senderIdentityKey", java.util.Base64.getEncoder().encodeToString(remoteIdentityKey));
+        offerMsg.put("receiverIdentityKey", java.util.Base64.getEncoder().encodeToString(localIdentityKey));
+        sendControlMessage(state, writeJson(offerMsg));
+
+        // Send proceed with TURN servers
+        sendProceed(state, callId, turnServers);
+
+        fireCallEvent(state, null);
+
+        // Schedule ring timeout
+        scheduler.schedule(() -> handleRingTimeout(callId), RING_TIMEOUT_MS, TimeUnit.MILLISECONDS);
+
+        logger.debug("Incoming call {} from {}", callIdUnsigned(callId), senderAddress);
+    }
+
+    public void handleIncomingAnswer(final long callId, final int deviceId, final byte[] opaque) {
+        var state = activeCalls.get(callId);
+        if (state == null) {
+            logger.warn("Received answer for unknown call {}", callIdUnsigned(callId));
+            return;
+        }
+
+        // Get identity keys
+        // Use raw 32-byte Curve25519 public key (without 0x05 DJB prefix) to match Signal Android
+        byte[] localIdentityKey = getRawIdentityKeyBytes(account.getAciIdentityKeyPair().getPublicKey());
+        byte[] remoteIdentityKey = getRemoteIdentityKey(state);
+
+        // Forward raw opaque to subprocess
+        var answerMsg = mapper.createObjectNode();
+        answerMsg.put("type", "receivedAnswer");
+        answerMsg.put("opaque", java.util.Base64.getEncoder().encodeToString(opaque));
+        answerMsg.put("senderDeviceId", deviceId);
+        answerMsg.put("senderIdentityKey", java.util.Base64.getEncoder().encodeToString(remoteIdentityKey));
+        answerMsg.put("receiverIdentityKey", java.util.Base64.getEncoder().encodeToString(localIdentityKey));
+        sendControlMessage(state, writeJson(answerMsg));
+
+        state.deviceId = deviceId;
+        state.state = CallInfo.State.CONNECTING;
+        fireCallEvent(state, null);
+
+        logger.debug("Received answer for call {}", callIdUnsigned(callId));
+    }
+
+    public void handleIncomingIceCandidate(final long callId, final byte[] opaque, final int deviceId) {
+        var state = activeCalls.get(callId);
+        if (state == null) {
+            logger.debug("Received ICE candidate for unknown call {}", callIdUnsigned(callId));
+            return;
+        }
+
+        // Forward to subprocess as receivedIce
+        var iceMsg = mapper.createObjectNode();
+        iceMsg.put("type", "receivedIce");
+        iceMsg.put("senderDeviceId", deviceId);
+        var candidates = iceMsg.putArray("candidates");
+        candidates.add(java.util.Base64.getEncoder().encodeToString(opaque));
+        sendControlMessage(state, writeJson(iceMsg));
+        logger.debug("Forwarded ICE candidate to tunnel for call {}", callIdUnsigned(callId));
+    }
+
+    public void handleIncomingHangup(final long callId) {
+        if (callEventListeners.isEmpty() && !activeCalls.containsKey(callId)) {
+            return;
+        }
+        endCall(callId, "remote_hangup");
+    }
+
+    public void handleIncomingBusy(final long callId) {
+        if (callEventListeners.isEmpty() && !activeCalls.containsKey(callId)) {
+            return;
+        }
+        endCall(callId, "remote_busy");
+    }
+
+    // --- Internal helpers ---
+
+    private CallState getActiveCall(final long callId) throws IOException {
+        var state = activeCalls.get(callId);
+        if (state == null) {
+            throw new IOException("No active call with id " + callIdUnsigned(callId));
+        }
+        return state;
+    }
+
+    private SendMessageResult sendBusyMessage(final long callId, final RecipientId recipientId, final int deviceId) {
+        var busyMessage = new BusyMessage(callId);
+        var callMessage = SignalServiceCallMessage.forBusy(busyMessage, deviceId);
+        return context.getSendHelper().sendCallMessage(callMessage, recipientId);
+    }
+
+    private void sendControlMessage(CallState state, String json) {
+        if (state.controlWriter == null) {
+            logger.debug("Queueing control message for call {} (not yet connected): {}",
+                    callIdUnsigned(state.callId),
+                    json);
+            state.pendingControlMessages.add(json);
+            return;
+        }
+        state.controlWriter.println(json);
+    }
+
+    private void sendProceed(CallState state, long callId, List<TurnServer> turnServers) {
+        var proceedMsg = mapper.createObjectNode();
+        proceedMsg.put("type", "proceed");
+        proceedMsg.put("callId", Utils.callIdUnsigned(callId));
+        proceedMsg.put("hideIp", false);
+        var iceServers = proceedMsg.putArray("iceServers");
+        for (var ts : turnServers) {
+            var server = iceServers.addObject();
+            server.put("username", ts.username());
+            server.put("password", ts.password());
+            var urls = server.putArray("urls");
+            for (var url : ts.urls()) {
+                urls.add(url);
+            }
+        }
+        sendControlMessage(state, writeJson(proceedMsg));
+    }
+
+    private void spawnMediaTunnel(CallState state) {
+        try {
+            var command = new ArrayList<>(List.of(findTunnelBinary()));
+
+            var processBuilder = new ProcessBuilder(command);
+            // Keep stdout and stderr separate: stdout = control protocol, stderr = logging
+            processBuilder.redirectErrorStream(false);
+            var process = processBuilder.start();
+
+            state.tunnelProcess = process;
+
+            // Write config JSON to stdin, then keep stdin open for control messages
+            var config = buildConfig(state);
+            var stdinStream = process.getOutputStream();
+            stdinStream.write(config.getBytes(StandardCharsets.UTF_8));
+            stdinStream.write('\n');
+            stdinStream.flush();
+
+            // stdin is the control write channel
+            state.controlWriter = new PrintWriter(new OutputStreamWriter(stdinStream, StandardCharsets.UTF_8), true);
+
+            // Flush any pending control messages
+            for (var msg : state.pendingControlMessages) {
+                state.controlWriter.println(msg);
+            }
+            state.pendingControlMessages.clear();
+
+            // If accept was deferred, send it now
+            sendAcceptIfReady(state);
+
+            // Read control events from subprocess stdout
+            Thread.ofVirtual()
+                    .name("control-read-" + callIdUnsigned(state.callId))
+                    .start(() -> readControlEvents(state, process.getInputStream()));
+
+            // Drain subprocess stderr to prevent pipe buffer deadlock
+            Thread.ofVirtual().name("tunnel-stderr-" + callIdUnsigned(state.callId)).start(() -> {
+                try (var reader = new BufferedReader(new InputStreamReader(process.getErrorStream(),
+                        StandardCharsets.UTF_8))) {
+                    String line;
+                    while ((line = reader.readLine()) != null) {
+                        logger.debug("[tunnel-{}] {}", callIdUnsigned(state.callId), line);
+                    }
+                } catch (IOException ignored) {
+                }
+            });
+
+            // Monitor process exit
+            process.onExit().thenAcceptAsync(p -> {
+                logger.debug("Tunnel for call {} exited with code {}", callIdUnsigned(state.callId), p.exitValue());
+                if (activeCalls.containsKey(state.callId)) {
+                    endCall(state.callId, "tunnel_exit");
+                }
+            });
+
+            logger.debug("Spawned signal-call-tunnel for call {}", callIdUnsigned(state.callId));
+        } catch (Exception e) {
+            logger.error("Failed to spawn tunnel for call {}", callIdUnsigned(state.callId), e);
+            endCall(state.callId, "tunnel_spawn_error");
+        }
+    }
+
+    private String findTunnelBinary() {
+        // Check environment variable first
+        var envPath = System.getenv("SIGNAL_CALL_TUNNEL_BIN");
+        if (envPath != null && !envPath.isEmpty()) {
+            return envPath;
+        }
+
+        // Check relative to the signal-cli installation directory
+        try {
+            var codeSource = CallManager.class.getProtectionDomain().getCodeSource();
+            if (codeSource != null) {
+                var jarPath = Path.of(codeSource.getLocation().toURI());
+                var binPath = tunnelBinaryFromCodeSourcePath(jarPath);
+                if (Files.isExecutable(binPath)) {
+                    return binPath.toString();
+                }
+            }
+        } catch (Exception e) {
+            logger.debug("Failed to determine install dir from code source", e);
+        }
+
+        // Fall back to PATH
+        return "signal-call-tunnel";
+    }
+
+    /**
+     * Resolves the expected tunnel binary path from a code source path.
+     * The code source (jar or class dir) is expected to be in {@code <install>/lib/},
+     * so we go up two levels to reach the install root, then look for
+     * {@code bin/signal-call-tunnel}.
+     */
+    static Path tunnelBinaryFromCodeSourcePath(Path codeSourcePath) {
+        var installDir = codeSourcePath.getParent().getParent();
+        return installDir.resolve("bin").resolve("signal-call-tunnel");
+    }
+
+    private String buildConfig(CallState state) {
+        var config = mapper.createObjectNode();
+        config.put("call_id", Utils.callIdUnsigned(state.callId));
+        config.put("is_outgoing", state.isOutgoing);
+        config.put("local_device_id", 1);
+        return writeJson(config);
+    }
+
+    private void readControlEvents(CallState state, java.io.InputStream inputStream) {
+        try (var reader = new BufferedReader(new InputStreamReader(inputStream, StandardCharsets.UTF_8))) {
+            String line;
+            while ((line = reader.readLine()) != null) {
+                line = line.trim();
+                if (line.isEmpty()) continue;
+                logger.debug("Control event for call {}: {}", callIdUnsigned(state.callId), line);
+
+                try {
+                    var json = mapper.readTree(line);
+                    var type = json.has("type") ? json.get("type").asText() : "";
+
+                    switch (type) {
+                        case "ready" -> {
+                            if (json.has("inputDeviceName")) {
+                                state.inputDeviceName = json.get("inputDeviceName").asText();
+                            }
+                            if (json.has("outputDeviceName")) {
+                                state.outputDeviceName = json.get("outputDeviceName").asText();
+                            }
+                            logger.debug("Tunnel ready for call {}: input={}, output={}",
+                                    callIdUnsigned(state.callId),
+                                    state.inputDeviceName,
+                                    state.outputDeviceName);
+                        }
+                        case "sendOffer" -> {
+                            var opaqueB64 = json.get("opaque").asText();
+                            var opaque = java.util.Base64.getDecoder().decode(opaqueB64);
+                            logSendMessageResult(sendOfferViaSignal(state, opaque));
+                        }
+                        case "sendAnswer" -> {
+                            var opaqueB64 = json.get("opaque").asText();
+                            var opaque = java.util.Base64.getDecoder().decode(opaqueB64);
+                            logSendMessageResult(sendAnswerViaSignal(state, opaque));
+                        }
+                        case "sendIce" -> {
+                            var candidatesArr = json.get("candidates");
+                            var opaqueList = new ArrayList<byte[]>();
+                            for (var c : candidatesArr) {
+                                opaqueList.add(java.util.Base64.getDecoder().decode(c.get("opaque").asText()));
+                            }
+                            logSendMessageResult(sendIceViaSignal(state, opaqueList));
+                        }
+                        case "sendHangup" -> {
+                            // RingRTC wants us to send a hangup message via Signal protocol.
+                            // This is NOT a local state change — local state is handled by stateChange events.
+                            var hangupType = json.has("hangupType")
+                                    ? json.get("hangupType").asText("normal")
+                                    : "normal";
+                            // Skip multi-device hangup types — signal-cli is single-device,
+                            // and sending these to the remote peer causes it to terminate the call.
+                            if (hangupType.contains("onanotherdevice")) {
+                                logger.debug("Ignoring multi-device hangup type: {}", hangupType);
+                            } else {
+                                logSendMessageResult(sendHangupViaSignal(state, hangupType));
+                            }
+                        }
+                        case "sendBusy" -> {
+                            logSendMessageResult(sendBusyViaSignal(state));
+                        }
+                        case "stateChange" -> {
+                            var ringrtcState = json.get("state").asText();
+                            var reason = json.has("reason") ? json.get("reason").asText(null) : null;
+                            handleStateChange(state, ringrtcState, reason);
+                        }
+                        case "error" -> {
+                            var message = json.has("message") ? json.get("message").asText("unknown") : "unknown";
+                            logger.error("Tunnel error for call {}: {}", callIdUnsigned(state.callId), message);
+                            endCall(state.callId, "tunnel_error");
+                        }
+                        default -> {
+                            logger.debug("Unknown control event type '{}' for call {}",
+                                    type,
+                                    callIdUnsigned(state.callId));
+                        }
+                    }
+                } catch (Exception e) {
+                    logger.warn("Failed to parse control event JSON for call {}: {}",
+                            callIdUnsigned(state.callId),
+                            e.getMessage());
+                }
+            }
+        } catch (IOException e) {
+            logger.debug("Control read ended for call {}: {}", callIdUnsigned(state.callId), e.getMessage());
+        }
+    }
+
+    private void handleStateChange(CallState state, String ringrtcState, String reason) {
+        if (ringrtcState.startsWith("Incoming")) {
+            // Don't downgrade if we've already accepted
+            if (state.state == CallInfo.State.CONNECTING) return;
+            state.state = CallInfo.State.RINGING_INCOMING;
+        } else if (ringrtcState.startsWith("Outgoing")) {
+            state.state = CallInfo.State.RINGING_OUTGOING;
+        } else if ("Ringing".equals(ringrtcState)) {
+            // Tunnel is now ready to accept — flush deferred accept if pending
+            state.tunnelRinging = true;
+            sendAcceptIfReady(state);
+            return;
+        } else if ("Connected".equals(ringrtcState)) {
+            state.state = CallInfo.State.CONNECTED;
+        } else if ("Connecting".equals(ringrtcState)) {
+            state.state = CallInfo.State.RECONNECTING;
+        } else if ("Ended".equals(ringrtcState) || "Rejected".equals(ringrtcState)) {
+            endCall(state.callId, reason != null ? reason : ringrtcState.toLowerCase());
+            return;
+        } else if ("Concluded".equals(ringrtcState)) {
+            // Cleanup, no-op
+            return;
+        }
+        fireCallEvent(state, reason);
+    }
+
+    public static void logSendMessageResult(SendMessageResult result) {
+        var identifier = result.getAddress().getIdentifier();
+        if (result.getProofRequiredFailure() != null) {
+            final var failure = result.getProofRequiredFailure();
+            logger.warn(
+                    "CAPTCHA proof required for sending to \"{}\", available options \"{}\" with challenge token \"{}\", or wait \"{}\" seconds.\n",
+                    identifier,
+                    failure.getOptions()
+                            .stream()
+                            .map(ProofRequiredException.Option::toString)
+                            .collect(Collectors.joining(", ")),
+                    failure.getToken(),
+                    failure.getRetryAfterSeconds());
+        } else if (result.isNetworkFailure()) {
+            logger.warn("Network failure for \"{}\"", identifier);
+        } else if (result.getRateLimitFailure() != null) {
+            logger.warn("Rate limit failure for \"{}\"", identifier);
+        } else if (result.isUnregisteredFailure()) {
+            logger.warn("Unregistered user \"{}\"", identifier);
+        } else if (result.getIdentityFailure() != null) {
+            logger.warn("Untrusted Identity for \"{}\"", identifier);
+        }
+    }
+
+    private void sendAcceptIfReady(CallState state) {
+        if (state.acceptPending && state.tunnelRinging && state.controlWriter != null) {
+            state.acceptPending = false;
+            logger.debug("Sending deferred accept for call {}", callIdUnsigned(state.callId));
+            var acceptMsg = mapper.createObjectNode();
+            acceptMsg.put("type", "accept");
+            state.controlWriter.println(writeJson(acceptMsg));
+        }
+    }
+
+    private SendMessageResult sendOfferViaSignal(CallState state, byte[] opaque) {
+        var offerMessage = new OfferMessage(state.callId, OfferMessage.Type.AUDIO_CALL, opaque);
+        var callMessage = SignalServiceCallMessage.forOffer(offerMessage, state.deviceId);
+        final var result = context.getSendHelper().sendCallMessage(callMessage, state.recipientId);
+        logger.debug("Sent offer via Signal for call {}", callIdUnsigned(state.callId));
+        return result;
+    }
+
+    private SendMessageResult sendAnswerViaSignal(CallState state, byte[] opaque) {
+        var answerMessage = new AnswerMessage(state.callId, opaque);
+        var callMessage = SignalServiceCallMessage.forAnswer(answerMessage, state.deviceId);
+        final var result = context.getSendHelper().sendCallMessage(callMessage, state.recipientId);
+        logger.debug("Sent answer via Signal for call {}", callIdUnsigned(state.callId));
+        return result;
+    }
+
+    private SendMessageResult sendIceViaSignal(CallState state, List<byte[]> opaqueList) {
+        var iceUpdates = opaqueList.stream().map(opaque -> new IceUpdateMessage(state.callId, opaque)).toList();
+        var callMessage = SignalServiceCallMessage.forIceUpdates(iceUpdates, state.deviceId);
+        final var result = context.getSendHelper().sendCallMessage(callMessage, state.recipientId);
+        logger.debug("Sent {} ICE candidates via Signal for call {}", opaqueList.size(), callIdUnsigned(state.callId));
+        return result;
+    }
+
+    private SendMessageResult sendBusyViaSignal(CallState state) {
+        var busyMessage = new BusyMessage(state.callId);
+        var callMessage = SignalServiceCallMessage.forBusy(busyMessage, state.deviceId);
+        return context.getSendHelper().sendCallMessage(callMessage, state.recipientId);
+    }
+
+    private SendMessageResult sendHangupViaSignal(CallState state, String hangupType) {
+        var type = switch (hangupType) {
+            case "accepted", "acceptedonanotherdevice" -> HangupMessage.Type.ACCEPTED;
+            case "declined", "declinedonanotherdevice" -> HangupMessage.Type.DECLINED;
+            case "busy", "busyonanotherdevice" -> HangupMessage.Type.BUSY;
+            default -> HangupMessage.Type.NORMAL;
+        };
+        var hangupMessage = new HangupMessage(state.callId, type, 0);
+        var callMessage = SignalServiceCallMessage.forHangup(hangupMessage, state.deviceId);
+        final var result = context.getSendHelper().sendCallMessage(callMessage, state.recipientId);
+        logger.debug("Sent hangup ({}) via Signal for call {}", hangupType, callIdUnsigned(state.callId));
+        return result;
+    }
+
+    private byte[] getRemoteIdentityKey(CallState state) {
+        try {
+            var address = context.getRecipientHelper().resolveSignalServiceAddress(state.recipientId);
+            var serviceId = address.getServiceId();
+            var identityInfo = account.getIdentityKeyStore().getIdentityInfo(serviceId);
+            if (identityInfo != null) {
+                return getRawIdentityKeyBytes(identityInfo.getIdentityKey());
+            }
+        } catch (Exception e) {
+            logger.warn("Failed to get remote identity key for call {}", callIdUnsigned(state.callId), e);
+        }
+        logger.warn("Using local identity key as fallback for remote identity key");
+        return getRawIdentityKeyBytes(account.getAciIdentityKeyPair().getPublicKey());
+    }
+
+    /**
+     * Strip the 0x05 DJB type prefix from a serialized identity key to get the
+     * raw 32-byte Curve25519 public key. Signal Android does this via
+     * WebRtcUtil.getPublicKeyBytes() before passing keys to RingRTC.
+     */
+    private static byte[] getRawIdentityKeyBytes(IdentityKey identityKey) {
+        var serializedKey = identityKey.serialize();
+        return getRawIdentityKeyBytes(serializedKey);
+    }
+
+    private static byte[] getRawIdentityKeyBytes(final byte[] serializedKey) {
+        if (serializedKey.length == 33 && serializedKey[0] == 0x05) {
+            return java.util.Arrays.copyOfRange(serializedKey, 1, serializedKey.length);
+        }
+        return serializedKey;
+    }
+
+    private static String writeJson(ObjectNode node) {
+        try {
+            return mapper.writeValueAsString(node);
+        } catch (com.fasterxml.jackson.core.JsonProcessingException e) {
+            throw new RuntimeException("Failed to serialize JSON", e);
+        }
+    }
+
+    private void endCall(final long callId, final String reason) {
+        var state = activeCalls.remove(callId);
+        dependencies.getAuthenticatedSignalWebSocket().removeKeepAliveToken("call" + callId);
+        dependencies.getUnauthenticatedSignalWebSocket().removeKeepAliveToken("call" + callId);
+        if (state == null) return;
+
+        state.state = CallInfo.State.ENDED;
+        fireCallEvent(state, reason);
+        logger.debug("Call {} ended: {}", callIdUnsigned(callId), reason);
+
+        // Send Signal protocol hangup to remote peer (unless they initiated the end)
+        if (!"remote_hangup".equals(reason)
+                && !"rejected".equals(reason)
+                && !"remote_busy".equals(reason)
+                && !"ringrtc_hangup".equals(reason)) {
+            var hangupMessage = new HangupMessage(callId, HangupMessage.Type.NORMAL, 0);
+            var callMessage = SignalServiceCallMessage.forHangup(hangupMessage, null);
+            final var result = context.getSendHelper().sendCallMessage(callMessage, state.recipientId);
+            if (!result.isSuccess()) {
+                logger.warn("Failed to send hangup to remote for call {}", callIdUnsigned(callId));
+                logSendMessageResult(result);
+            }
+        }
+
+        // Send hangup via control channel (stdin) before killing process
+        if (state.controlWriter != null) {
+            try {
+                var hangupMsg = mapper.createObjectNode();
+                hangupMsg.put("type", "hangup");
+                state.controlWriter.println(writeJson(hangupMsg));
+                state.controlWriter.close();
+            } catch (Exception e) {
+                logger.debug("Failed to send hangup via control channel", e);
+            }
+        }
+
+        // Kill tunnel process
+        if (state.tunnelProcess != null && state.tunnelProcess.isAlive()) {
+            state.tunnelProcess.destroy();
+        }
+    }
+
+    private void handleRingTimeout(final long callId) {
+        var state = activeCalls.get(callId);
+        if (state == null) return;
+
+        if (state.state == CallInfo.State.RINGING_INCOMING || state.state == CallInfo.State.RINGING_OUTGOING) {
+            logger.debug("Call {} ring timeout", callIdUnsigned(callId));
+            endCall(callId, "ring_timeout");
+        }
+    }
+
+    private static long generateCallId() {
+        return new BigInteger(64, new SecureRandom()).longValue();
+    }
+
+    @Override
+    public void close() {
+        scheduler.shutdownNow();
+        for (var callId : new ArrayList<>(activeCalls.keySet())) {
+            endCall(callId, "shutdown");
+        }
+        synchronized (callEventListeners) {
+            callEventListeners.clear();
+        }
+    }
+
+    // --- Internal call state tracking ---
+
+    static class CallState {
+
+        final long callId;
+        volatile CallInfo.State state;
+        final RecipientId recipientId;
+        volatile Integer deviceId;
+        final boolean isOutgoing;
+        volatile String inputDeviceName;
+        volatile String outputDeviceName;
+        volatile Process tunnelProcess;
+        volatile PrintWriter controlWriter;
+        // Control messages queued before the tunnel process starts
+        final List<String> pendingControlMessages = Collections.synchronizedList(new ArrayList<>());
+        // Accept deferred until tunnel reports Ringing state
+        volatile boolean acceptPending = false;
+        // True once the tunnel has reported "Ringing" (ready to accept)
+        volatile boolean tunnelRinging = false;
+
+        CallState(
+                long callId,
+                CallInfo.State state,
+                RecipientId recipientId,
+                final Integer deviceId,
+                boolean isOutgoing
+        ) {
+            this.callId = callId;
+            this.state = state;
+            this.recipientId = recipientId;
+            this.deviceId = deviceId;
+            this.isOutgoing = isOutgoing;
+        }
+
+        CallInfo toCallInfo(RecipientAddressResolver addressResolver) {
+            return new CallInfo(callId,
+                    state,
+                    addressResolver.resolveRecipientAddress(recipientId).toApiRecipientAddress(),
+                    inputDeviceName,
+                    outputDeviceName,
+                    isOutgoing);
+        }
+    }
+}

lib/src/main/java/org/asamk/signal/manager/helper/ContactHelper.java

@@ -85,12 +85,18 @@ public class ContactHelper {
     }
 
     public void setContactBlocked(RecipientId recipientId, boolean blocked) {
+        setContactBlocked(recipientId, blocked, blocked ? System.currentTimeMillis() : 0);
+    }
+
+    public void setContactBlocked(RecipientId recipientId, boolean blocked, long blockedAt) {
         var contact = account.getContactStore().getContact(recipientId);
         final var builder = contact == null ? Contact.newBuilder() : Contact.newBuilder(contact);
         if (blocked) {
             builder.withIsProfileSharingEnabled(false);
         }
-        account.getContactStore().storeContact(recipientId, builder.withIsBlocked(blocked).build());
+        account.getContactStore()
+                .storeContact(recipientId,
+                        builder.withIsBlocked(blocked).withBlockedAt(blocked ? blockedAt : 0).build());
     }
 
     public void setContactProfileSharing(RecipientId recipientId, boolean profileSharing) {

lib/src/main/java/org/asamk/signal/manager/helper/Context.java

@@ -23,6 +23,7 @@ public class Context implements AutoCloseable {
 
     private AccountHelper accountHelper;
     private AttachmentHelper attachmentHelper;
+    private CallManager callManager;
     private ContactHelper contactHelper;
     private GroupHelper groupHelper;
     private GroupV2Helper groupV2Helper;
@@ -92,6 +93,10 @@ public class Context implements AutoCloseable {
         return getOrCreate(() -> attachmentHelper, () -> attachmentHelper = new AttachmentHelper(this));
     }
 
+    public CallManager getCallManager() {
+        return getOrCreate(() -> callManager, () -> callManager = new CallManager(this));
+    }
+
     public ContactHelper getContactHelper() {
         return getOrCreate(() -> contactHelper, () -> contactHelper = new ContactHelper(account));
     }
@@ -172,6 +177,9 @@ public class Context implements AutoCloseable {
 
     @Override
     public void close() {
+        if (callManager != null) {
+            callManager.close();
+        }
         jobExecutor.close();
     }
 

lib/src/main/java/org/asamk/signal/manager/helper/GroupHelper.java

@@ -28,15 +28,16 @@ import org.asamk.signal.manager.storage.recipients.RecipientId;
 import org.asamk.signal.manager.util.AttachmentUtils;
 import org.asamk.signal.manager.util.IOUtils;
 import org.asamk.signal.manager.util.Utils;
+import org.signal.core.models.ServiceId;
 import org.signal.libsignal.zkgroup.InvalidInputException;
 import org.signal.libsignal.zkgroup.groups.GroupMasterKey;
 import org.signal.libsignal.zkgroup.groups.GroupSecretParams;
 import org.signal.libsignal.zkgroup.groupsend.GroupSendEndorsementsResponse;
 import org.signal.libsignal.zkgroup.profiles.ProfileKey;
-import org.signal.storageservice.protos.groups.GroupChangeResponse;
-import org.signal.storageservice.protos.groups.local.DecryptedGroup;
-import org.signal.storageservice.protos.groups.local.DecryptedGroupChange;
-import org.signal.storageservice.protos.groups.local.DecryptedGroupJoinInfo;
+import org.signal.storageservice.storage.protos.groups.GroupChangeResponse;
+import org.signal.storageservice.storage.protos.groups.local.DecryptedGroup;
+import org.signal.storageservice.storage.protos.groups.local.DecryptedGroupChange;
+import org.signal.storageservice.storage.protos.groups.local.DecryptedGroupJoinInfo;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.groupsv2.DecryptedGroupChangeLog;
@@ -47,7 +48,6 @@ import org.whispersystems.signalservice.api.messages.SignalServiceAttachmentStre
 import org.whispersystems.signalservice.api.messages.SignalServiceDataMessage;
 import org.whispersystems.signalservice.api.messages.SignalServiceGroup;
 import org.whispersystems.signalservice.api.messages.SignalServiceGroupV2;
-import org.whispersystems.signalservice.api.push.ServiceId;
 import org.whispersystems.signalservice.api.push.exceptions.ConflictException;
 
 import java.io.IOException;
@@ -123,14 +123,15 @@ public class GroupHelper {
             return Optional.empty();
         }
 
-        final var uploadSpec = dependencies.getMessageSender().getResumableUploadSpec();
+        final var uploadSpec = context.getAttachmentHelper().getResumableUploadSpec(streamDetails);
         return Optional.of(AttachmentUtils.createAttachmentStream(streamDetails, Optional.empty(), uploadSpec));
     }
 
     public GroupInfoV2 getOrMigrateGroup(
             final GroupMasterKey groupMasterKey,
             final int revision,
-            final byte[] signedGroupChange
+            final byte[] signedGroupChange,
+            final boolean ignoreAvatars
     ) {
         final var groupSecretParams = GroupSecretParams.deriveFromMasterKey(groupMasterKey);
 
@@ -166,7 +167,7 @@ public class GroupHelper {
             if (group != null) {
                 storeProfileKeysFromMembers(group);
                 final var avatar = group.avatar;
-                if (!avatar.isEmpty()) {
+                if (!avatar.isEmpty() && !ignoreAvatars) {
                     downloadGroupAvatar(groupId, groupSecretParams, avatar);
                 }
             }
@@ -192,9 +193,9 @@ public class GroupHelper {
             final GroupInfoV2 groupInfoV2,
             final GroupChangeResponse groupChangeResponse
     ) {
-        if (groupChangeResponse.groupSendEndorsementsResponse.size() > 0) {
+        if (groupChangeResponse.group_send_endorsements_response.size() > 0) {
             try {
-                final var groupSendEndorsementsResponse = new GroupSendEndorsementsResponse(groupChangeResponse.groupSendEndorsementsResponse.toByteArray());
+                final var groupSendEndorsementsResponse = new GroupSendEndorsementsResponse(groupChangeResponse.group_send_endorsements_response.toByteArray());
 
                 updateGroupEndorsements(groupInfoV2.getGroupId(),
                         groupInfoV2.getMasterKey(),
@@ -298,7 +299,9 @@ public class GroupHelper {
             final GroupPermission editDetailsPermission,
             final String avatarFile,
             final Integer expirationTimer,
-            final Boolean isAnnouncementGroup
+            final Boolean isAnnouncementGroup,
+            final String labelEmoji,
+            final String labelString
     ) throws IOException, GroupNotFoundException, AttachmentInvalidException, NotAGroupMemberException, GroupSendingNotAllowedException {
         var group = getGroupForUpdating(groupId);
         final var avatarBytes = readAvatarBytes(avatarFile);
@@ -322,7 +325,9 @@ public class GroupHelper {
                             editDetailsPermission,
                             avatarBytes,
                             expirationTimer,
-                            isAnnouncementGroup);
+                            isAnnouncementGroup,
+                            labelEmoji,
+                            labelString);
                 } catch (ConflictException e) {
                     // Detected conflicting update, refreshing group and trying again
                     group = getGroup(groupId, true);
@@ -341,7 +346,9 @@ public class GroupHelper {
                             editDetailsPermission,
                             avatarBytes,
                             expirationTimer,
-                            isAnnouncementGroup);
+                            isAnnouncementGroup,
+                            labelEmoji,
+                            labelString);
                 }
             }
 
@@ -356,6 +363,28 @@ public class GroupHelper {
         return results;
     }
 
+    public SendGroupMessageResults terminateGroup(final GroupId groupId) throws IOException, GroupNotFoundException, NotAGroupMemberException {
+        final var group = getGroupForUpdating(groupId);
+        if (!(group instanceof GroupInfoV2)) {
+            throw new IOException("Terminating a group is only supported for Signal group v2 groups.");
+        }
+
+        SendGroupMessageResults results;
+        try {
+            results = terminateGroupV2((GroupInfoV2) group);
+        } catch (ConflictException e) {
+            // Detected conflicting update, refreshing group and trying again
+            results = terminateGroupV2((GroupInfoV2) getGroup(groupId, true));
+        }
+        context.getJobExecutor().enqueueJob(new SyncStorageJob());
+        return results;
+    }
+
+    private SendGroupMessageResults terminateGroupV2(final GroupInfoV2 group) throws IOException {
+        final var groupGroupChangePair = context.getGroupV2Helper().terminateGroup(group);
+        return sendUpdateGroupV2Message(group, groupGroupChangePair.first(), groupGroupChangePair.second());
+    }
+
     public void updateGroupProfileKey(GroupIdV2 groupId) throws GroupNotFoundException, NotAGroupMemberException, IOException {
         var group = getGroupForUpdating(groupId);
 
@@ -391,7 +420,8 @@ public class GroupHelper {
                 .joinGroup(inviteLinkUrl.getGroupMasterKey(), inviteLinkUrl.getPassword(), groupJoinInfo);
         final var group = getOrMigrateGroup(inviteLinkUrl.getGroupMasterKey(),
                 groupJoinInfo.revision + 1,
-                changeResponse.groupChange == null ? null : changeResponse.groupChange.encode());
+                changeResponse.group_change == null ? null : changeResponse.group_change.encode(),
+                false);
 
         if (group.getGroup() == null) {
             // Only requested member, can't send update to group members
@@ -429,12 +459,21 @@ public class GroupHelper {
     }
 
     public void setGroupBlocked(final GroupId groupId, final boolean blocked) throws GroupNotFoundException {
+        setGroupBlocked(groupId, blocked, blocked ? System.currentTimeMillis() : 0);
+    }
+
+    public void setGroupBlocked(
+            final GroupId groupId,
+            final boolean blocked,
+            final long blockedAt
+    ) throws GroupNotFoundException {
         var group = getGroup(groupId);
         if (group == null) {
             throw new GroupNotFoundException(groupId);
         }
 
         group.setBlocked(blocked);
+        group.setBlockedAt(blocked ? blockedAt : 0);
         account.getGroupStore().updateGroup(group);
         context.getJobExecutor().enqueueJob(new SyncStorageJob());
     }
@@ -550,16 +589,24 @@ public class GroupHelper {
     private void storeProfileKeysFromMembers(final DecryptedGroup group) {
         for (var member : group.members) {
             final var serviceId = ServiceId.parseOrThrow(member.aciBytes);
-            final var recipientId = account.getRecipientResolver().resolveRecipient(serviceId);
-            final var profileStore = account.getProfileStore();
-            if (profileStore.getProfileKey(recipientId) != null) {
-                // We already have a profile key, not updating it from a non-authoritative source
-                continue;
-            }
-            try {
-                profileStore.storeProfileKey(recipientId, new ProfileKey(member.profileKey.toByteArray()));
-            } catch (InvalidInputException ignored) {
-            }
+            storeProfileKeyIfMissing(serviceId, member.profileKey.toByteArray());
+        }
+        for (var member : group.requestingMembers) {
+            final var serviceId = ServiceId.parseOrThrow(member.aciBytes);
+            storeProfileKeyIfMissing(serviceId, member.profileKey.toByteArray());
+        }
+    }
+
+    private void storeProfileKeyIfMissing(final ServiceId serviceId, final byte[] profileKeyBytes) {
+        final var recipientId = account.getRecipientResolver().resolveRecipient(serviceId);
+        final var profileStore = account.getProfileStore();
+        if (profileStore.getProfileKey(recipientId) != null) {
+            // We already have a profile key, not updating it from a non-authoritative source
+            return;
+        }
+        try {
+            profileStore.storeProfileKey(recipientId, new ProfileKey(profileKeyBytes));
+        } catch (InvalidInputException ignored) {
         }
     }
 
@@ -680,7 +727,7 @@ public class GroupHelper {
 
     private void sendExpirationTimerUpdate(GroupIdV1 groupId) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException {
         final var messageBuilder = SignalServiceDataMessage.newBuilder().asExpirationUpdate();
-        context.getSendHelper().sendAsGroupMessage(messageBuilder, groupId, false, Optional.empty());
+        context.getSendHelper().sendAsGroupMessage(messageBuilder, groupId, false, Optional.empty(), true);
     }
 
     private SendGroupMessageResults updateGroupV2(
@@ -699,7 +746,9 @@ public class GroupHelper {
             final GroupPermission editDetailsPermission,
             final byte[] avatarFile,
             final Integer expirationTimer,
-            final Boolean isAnnouncementGroup
+            final Boolean isAnnouncementGroup,
+            final String labelEmoji,
+            final String labelString
     ) throws IOException {
         SendGroupMessageResults result = null;
         final var groupV2Helper = context.getGroupV2Helper();
@@ -716,7 +765,7 @@ public class GroupHelper {
                 result = sendUpdateGroupV2Message(group, groupGroupChangePair.first(), groupGroupChangePair.second());
             }
             final var newMembers = new HashSet<>(members);
-            newMembers.removeAll(group.getMembers());
+            newMembers.removeAll(group.getMemberRecipientIds());
             newMembers.removeAll(group.getRequestingMembers());
             if (!newMembers.isEmpty()) {
                 var groupGroupChangePair = groupV2Helper.addMembers(group, newMembers);
@@ -729,7 +778,7 @@ public class GroupHelper {
             if (banMembers != null) {
                 existingRemoveMembers.addAll(banMembers);
             }
-            existingRemoveMembers.retainAll(group.getMembers());
+            existingRemoveMembers.retainAll(group.getMemberRecipientIds());
             if (members != null) {
                 existingRemoveMembers.removeAll(members);
             }
@@ -755,28 +804,20 @@ public class GroupHelper {
 
         if (admins != null) {
             final var newAdmins = new HashSet<>(admins);
-            newAdmins.retainAll(group.getMembers());
-            newAdmins.removeAll(group.getAdminMembers());
+            newAdmins.retainAll(group.getMemberRecipientIds());
+            newAdmins.removeAll(group.getAdminMemberRecipientIds());
             if (!newAdmins.isEmpty()) {
-                for (var admin : newAdmins) {
-                    var groupGroupChangePair = groupV2Helper.setMemberAdmin(group, admin, true);
-                    result = sendUpdateGroupV2Message(group,
-                            groupGroupChangePair.first(),
-                            groupGroupChangePair.second());
-                }
+                var groupGroupChangePair = groupV2Helper.setMemberAdmin(group, newAdmins, true);
+                result = sendUpdateGroupV2Message(group, groupGroupChangePair.first(), groupGroupChangePair.second());
             }
         }
 
         if (removeAdmins != null) {
             final var existingRemoveAdmins = new HashSet<>(removeAdmins);
-            existingRemoveAdmins.retainAll(group.getAdminMembers());
+            existingRemoveAdmins.retainAll(group.getAdminMemberRecipientIds());
             if (!existingRemoveAdmins.isEmpty()) {
-                for (var admin : existingRemoveAdmins) {
-                    var groupGroupChangePair = groupV2Helper.setMemberAdmin(group, admin, false);
-                    result = sendUpdateGroupV2Message(group,
-                            groupGroupChangePair.first(),
-                            groupGroupChangePair.second());
-                }
+                var groupGroupChangePair = groupV2Helper.setMemberAdmin(group, existingRemoveAdmins, false);
+                result = sendUpdateGroupV2Message(group, groupGroupChangePair.first(), groupGroupChangePair.second());
             }
         }
 
@@ -828,6 +869,15 @@ public class GroupHelper {
             result = sendUpdateGroupV2Message(group, groupGroupChangePair.first(), groupGroupChangePair.second());
         }
 
+        if (labelString != null || labelEmoji != null) {
+            final var selfRecipientId = account.getSelfRecipientId();
+            final var selfMember = group.getMember(selfRecipientId);
+            var groupGroupChangePair = groupV2Helper.setMemberLabels(group,
+                    labelEmoji != null ? labelEmoji : selfMember.labelEmoji(),
+                    labelString != null ? labelString : selfMember.labelString());
+            result = sendUpdateGroupV2Message(group, groupGroupChangePair.first(), groupGroupChangePair.second());
+        }
+
         if (name != null || description != null || avatarFile != null) {
             var groupGroupChangePair = groupV2Helper.updateGroup(group, name, description, avatarFile);
             if (avatarFile != null) {
@@ -857,9 +907,9 @@ public class GroupHelper {
             final GroupInfoV2 groupInfoV2,
             final Set<RecipientId> newAdmins
     ) throws LastGroupAdminException, IOException {
-        final var currentAdmins = groupInfoV2.getAdminMembers();
+        final var currentAdmins = groupInfoV2.getAdminMemberRecipientIds();
         newAdmins.removeAll(currentAdmins);
-        newAdmins.retainAll(groupInfoV2.getMembers());
+        newAdmins.retainAll(groupInfoV2.getMemberRecipientIds());
         if (currentAdmins.contains(account.getSelfRecipientId())
                 && currentAdmins.size() == 1
                 && groupInfoV2.getMembers().size() > 1
@@ -873,10 +923,10 @@ public class GroupHelper {
 
         final var groupChangeResponse = groupGroupChangePair.second();
         handleGroupChangeResponse(groupInfoV2, groupChangeResponse);
-        if (groupChangeResponse.groupChange == null) {
+        if (groupChangeResponse.group_change == null) {
             throw new AssertionError("groupChange is null");
         }
-        var messageBuilder = getGroupUpdateMessageBuilder(groupInfoV2, groupChangeResponse.groupChange.encode());
+        var messageBuilder = getGroupUpdateMessageBuilder(groupInfoV2, groupChangeResponse.group_change.encode());
         return sendGroupMessage(messageBuilder,
                 groupInfoV2.getMembersIncludingPendingWithout(account.getSelfRecipientId()),
                 groupInfoV2);
@@ -886,7 +936,7 @@ public class GroupHelper {
         var group = SignalServiceGroup.newBuilder(SignalServiceGroup.Type.UPDATE)
                 .withId(g.getGroupId().serialize())
                 .withName(g.name)
-                .withMembers(g.getMembers()
+                .withMembers(g.getMemberRecipientIds()
                         .stream()
                         .map(context.getRecipientHelper()::resolveSignalServiceAddress)
                         .toList());
@@ -924,10 +974,10 @@ public class GroupHelper {
         members.addAll(group.getMembersIncludingPendingWithout(selfRecipientId));
         account.getGroupStore().updateGroup(group);
 
-        if (groupChangeResponse.groupChange == null) {
+        if (groupChangeResponse.group_change == null) {
             throw new AssertionError("groupChange is null");
         }
-        final var messageBuilder = getGroupUpdateMessageBuilder(group, groupChangeResponse.groupChange.encode());
+        final var messageBuilder = getGroupUpdateMessageBuilder(group, groupChangeResponse.group_change.encode());
         return sendGroupMessage(messageBuilder, members, group);
     }
 

lib/src/main/java/org/asamk/signal/manager/helper/GroupV2Helper.java

@@ -10,6 +10,10 @@ import org.asamk.signal.manager.internal.SignalDependencies;
 import org.asamk.signal.manager.storage.groups.GroupInfoV2;
 import org.asamk.signal.manager.storage.recipients.RecipientId;
 import org.asamk.signal.manager.util.Utils;
+import org.signal.core.models.ServiceId;
+import org.signal.core.models.ServiceId.ACI;
+import org.signal.core.models.ServiceId.PNI;
+import org.signal.core.util.UuidUtil;
 import org.signal.libsignal.zkgroup.InvalidInputException;
 import org.signal.libsignal.zkgroup.VerificationFailedException;
 import org.signal.libsignal.zkgroup.auth.AuthCredentialWithPniResponse;
@@ -17,15 +21,16 @@ import org.signal.libsignal.zkgroup.groups.GroupMasterKey;
 import org.signal.libsignal.zkgroup.groups.GroupSecretParams;
 import org.signal.libsignal.zkgroup.groups.UuidCiphertext;
 import org.signal.libsignal.zkgroup.profiles.ProfileKey;
-import org.signal.storageservice.protos.groups.AccessControl;
-import org.signal.storageservice.protos.groups.GroupChange;
-import org.signal.storageservice.protos.groups.GroupChangeResponse;
-import org.signal.storageservice.protos.groups.Member;
-import org.signal.storageservice.protos.groups.local.DecryptedGroup;
-import org.signal.storageservice.protos.groups.local.DecryptedGroupChange;
-import org.signal.storageservice.protos.groups.local.DecryptedGroupJoinInfo;
-import org.signal.storageservice.protos.groups.local.DecryptedMember;
-import org.signal.storageservice.protos.groups.local.DecryptedPendingMember;
+import org.signal.network.exceptions.NonSuccessfulResponseCodeException;
+import org.signal.storageservice.storage.protos.groups.AccessControl;
+import org.signal.storageservice.storage.protos.groups.GroupChange;
+import org.signal.storageservice.storage.protos.groups.GroupChangeResponse;
+import org.signal.storageservice.storage.protos.groups.Member;
+import org.signal.storageservice.storage.protos.groups.local.DecryptedGroup;
+import org.signal.storageservice.storage.protos.groups.local.DecryptedGroupChange;
+import org.signal.storageservice.storage.protos.groups.local.DecryptedGroupJoinInfo;
+import org.signal.storageservice.storage.protos.groups.local.DecryptedMember;
+import org.signal.storageservice.storage.protos.groups.local.DecryptedPendingMember;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.groupsv2.DecryptChangeVerificationMode;
@@ -38,12 +43,7 @@ import org.whispersystems.signalservice.api.groupsv2.GroupsV2AuthorizationString
 import org.whispersystems.signalservice.api.groupsv2.GroupsV2Operations;
 import org.whispersystems.signalservice.api.groupsv2.InvalidGroupStateException;
 import org.whispersystems.signalservice.api.groupsv2.NotAbleToApplyGroupV2ChangeException;
-import org.whispersystems.signalservice.api.push.ServiceId;
-import org.whispersystems.signalservice.api.push.ServiceId.ACI;
-import org.whispersystems.signalservice.api.push.ServiceId.PNI;
 import org.whispersystems.signalservice.api.push.SignalServiceAddress;
-import org.whispersystems.signalservice.api.push.exceptions.NonSuccessfulResponseCodeException;
-import org.whispersystems.signalservice.api.util.UuidUtil;
 import org.whispersystems.signalservice.internal.push.exceptions.NotInGroupException;
 
 import java.io.IOException;
@@ -136,7 +136,7 @@ class GroupV2Helper {
 
     int findRevisionWeWereAdded(DecryptedGroup partialDecryptedGroup) {
         ByteString aciBytes = getSelfAci().toByteString();
-        ByteString pniBytes = getSelfPni().toByteString();
+        ByteString pniBytes = getSelfPni() == null ? null : getSelfPni().toByteString();
         for (DecryptedMember decryptedMember : partialDecryptedGroup.members) {
             if (decryptedMember.aciBytes.equals(aciBytes) || decryptedMember.pniBytes.equals(pniBytes)) {
                 return decryptedMember.joinedAtRevision;
@@ -225,7 +225,7 @@ class GroupV2Helper {
             change.modifyAvatar(new GroupChange.Actions.ModifyAvatarAction.Builder().avatar(avatarCdnKey).build());
         }
 
-        change.sourceServiceId(getSelfAci().toByteString());
+        change.sourceUserId(getSelfAci().toByteString());
 
         return commitChange(groupInfoV2, change);
     }
@@ -252,7 +252,7 @@ class GroupV2Helper {
         final var aci = getSelfAci();
         final var change = groupOperations.createModifyGroupMembershipChange(candidates, bannedUuids, aci);
 
-        change.sourceServiceId(getSelfAci().toByteString());
+        change.sourceUserId(getSelfAci().toByteString());
 
         return commitChange(groupInfoV2, change);
     }
@@ -264,6 +264,9 @@ class GroupV2Helper {
         var pendingMembersList = groupInfoV2.getGroup().pendingMembers;
         final var selfAci = getSelfAci();
         var selfPendingMember = DecryptedGroupUtil.findPendingByServiceId(pendingMembersList, selfAci);
+        if (selfPendingMember.isEmpty() && getSelfPni() != null) {
+            selfPendingMember = DecryptedGroupUtil.findPendingByServiceId(pendingMembersList, getSelfPni());
+        }
 
         if (selfPendingMember.isPresent()) {
             return revokeInvites(groupInfoV2, Set.of(selfPendingMember.get()));
@@ -343,7 +346,7 @@ class GroupV2Helper {
                 false,
                 groupInfoV2.getGroup().bannedMembers);
 
-        change.sourceServiceId(getSelfAci().toByteString());
+        change.sourceUserId(getSelfAci().toByteString());
 
         return commitChange(groupInfoV2, change);
     }
@@ -360,7 +363,7 @@ class GroupV2Helper {
 
         final var change = groupOperations.createUnbanServiceIdsChange(serviceIds);
 
-        change.sourceServiceId(getSelfAci().toByteString());
+        change.sourceUserId(getSelfAci().toByteString());
 
         return commitChange(groupInfoV2, change);
     }
@@ -436,7 +439,7 @@ class GroupV2Helper {
 
         final GroupsV2Operations.GroupOperations groupOperations = getGroupOperations(groupInfoV2);
         final var change = groupOperations.createUpdateProfileKeyCredentialChange(profileKeyCredential);
-        change.sourceServiceId(getSelfAci().toByteString());
+        change.sourceUserId(getSelfAci().toByteString());
         return commitChange(groupInfoV2, change);
     }
 
@@ -459,7 +462,7 @@ class GroupV2Helper {
                 ? groupOperations.createGroupJoinRequest(profileKeyCredential)
                 : groupOperations.createGroupJoinDirect(profileKeyCredential);
 
-        change.sourceServiceId(context.getRecipientHelper()
+        change.sourceUserId(context.getRecipientHelper()
                 .resolveSignalServiceAddress(selfRecipientId)
                 .getServiceId()
                 .toByteString());
@@ -476,28 +479,50 @@ class GroupV2Helper {
             throw new IOException("Cannot join a V2 group as self does not have a versioned profile");
         }
 
-        final var change = groupOperations.createAcceptInviteChange(profileKeyCredential);
+        // We need to accept the invite with the ACI or PNI that was used for the invitation
+        final var selfAddress = context.getRecipientHelper().resolveSignalServiceAddress(selfRecipientId);
+        final var selfServiceId = groupInfoV2.getPendingMemberAddresses()
+                .stream()
+                .filter(s -> s.matches(selfAddress))
+                .findFirst();
+        if (selfServiceId.isEmpty()) {
+            throw new IOException("Cannot find service ID for self to accept invite");
+        }
+        final var serviceId = selfServiceId.get().getServiceId();
 
-        final var aci = context.getRecipientHelper().resolveSignalServiceAddress(selfRecipientId).getServiceId();
-        change.sourceServiceId(aci.toByteString());
+        final GroupChange.Actions.Builder change;
+        if (serviceId instanceof ACI) {
+            change = groupOperations.createAcceptInviteChange(profileKeyCredential);
+        } else {
+            change = groupOperations.createAcceptPniInviteChange(profileKeyCredential);
+        }
+
+        change.sourceUserId(serviceId.toByteString());
 
         return commitChange(groupInfoV2, change);
     }
 
     Pair<DecryptedGroup, GroupChangeResponse> setMemberAdmin(
             GroupInfoV2 groupInfoV2,
-            RecipientId recipientId,
+            Set<RecipientId> recipientIds,
             boolean admin
     ) throws IOException {
         final GroupsV2Operations.GroupOperations groupOperations = getGroupOperations(groupInfoV2);
-        final var address = context.getRecipientHelper().resolveSignalServiceAddress(recipientId);
         final var newRole = admin ? Member.Role.ADMINISTRATOR : Member.Role.DEFAULT;
-        if (address.getServiceId() instanceof ACI aci) {
-            final var change = groupOperations.createChangeMemberRole(aci, newRole);
-            return commitChange(groupInfoV2, change);
-        } else {
+        final var change = new GroupChange.Actions.Builder();
+        final var memberRoles = recipientIds.stream()
+                .map(context.getRecipientHelper()::resolveSignalServiceAddress)
+                .map(SignalServiceAddress::getServiceId)
+                .filter(m -> m instanceof ACI)
+                .map(m -> (ACI) m)
+                .map(aci -> new GroupChange.Actions.ModifyMemberRoleAction.Builder().userId(groupOperations.encryptServiceId(
+                        aci)).role(newRole).build())
+                .toList();
+        if (memberRoles.size() < recipientIds.size()) {
             throw new IllegalArgumentException("Can't make a PNI a group admin.");
         }
+        change.modifyMemberRoles(memberRoles);
+        return commitChange(groupInfoV2, change);
     }
 
     Pair<DecryptedGroup, GroupChangeResponse> setMessageExpirationTimer(
@@ -518,6 +543,26 @@ class GroupV2Helper {
         return commitChange(groupInfoV2, change);
     }
 
+    Pair<DecryptedGroup, GroupChangeResponse> terminateGroup(
+            GroupInfoV2 groupInfoV2
+    ) throws IOException {
+        final GroupsV2Operations.GroupOperations groupOperations = getGroupOperations(groupInfoV2);
+        final var change = groupOperations.createTerminateGroup();
+        return commitChange(groupInfoV2, change);
+    }
+
+    Pair<DecryptedGroup, GroupChangeResponse> setMemberLabels(
+            GroupInfoV2 groupInfoV2,
+            String labelEmoji,
+            String labelString
+    ) throws IOException {
+        final GroupsV2Operations.GroupOperations groupOperations = getGroupOperations(groupInfoV2);
+        final var change = groupOperations.createChangeMemberLabel(getSelfAci(),
+                labelString == null ? "" : labelString,
+                labelEmoji);
+        return commitChange(groupInfoV2, change);
+    }
+
     private AccessControl.AccessRequired toAccessControl(final GroupLinkState state) {
         return switch (state) {
             case DISABLED -> AccessControl.AccessRequired.UNSATISFIABLE;
@@ -585,7 +630,7 @@ class GroupV2Helper {
         final var groupOperations = dependencies.getGroupsV2Operations().forGroup(groupSecretParams);
         final var previousGroupState = groupInfoV2.getGroup();
         final var nextRevision = previousGroupState.revision + 1;
-        final var changeActions = change.revision(nextRevision).build();
+        final var changeActions = change.version(nextRevision).build();
         final DecryptedGroupChange decryptedChange;
         final DecryptedGroup decryptedGroupState;
 
@@ -611,7 +656,7 @@ class GroupV2Helper {
             GroupLinkPassword password
     ) throws IOException {
         final var nextRevision = currentRevision + 1;
-        final var changeActions = change.revision(nextRevision).build();
+        final var changeActions = change.version(nextRevision).build();
 
         return dependencies.getGroupsV2Api()
                 .patchGroup(changeActions,
@@ -621,6 +666,9 @@ class GroupV2Helper {
 
     Pair<ServiceId, ProfileKey> getAuthoritativeProfileKeyFromChange(final DecryptedGroupChange change) {
         UUID editor = UuidUtil.fromByteStringOrNull(change.editorServiceIdBytes);
+        if (editor == null) {
+            return null;
+        }
         final var editorProfileKeyBytes = Stream.concat(Stream.of(change.newMembers.stream(),
                                 change.promotePendingMembers.stream(),
                                 change.modifiedProfileKeys.stream())
@@ -710,8 +758,14 @@ class GroupV2Helper {
         var authCredentialResponse = groupApiCredentials.get(todaySeconds);
         final var aci = getSelfAci();
         final var pni = getSelfPni();
+        final var authCredentialSalt = context.getAccount().getAuthCredentialSalt();
         return dependencies.getGroupsV2Api()
-                .getGroupsV2AuthorizationString(aci, pni, todaySeconds, groupSecretParams, authCredentialResponse);
+                .getGroupsV2AuthorizationString(aci,
+                        pni,
+                        authCredentialSalt,
+                        todaySeconds,
+                        groupSecretParams,
+                        authCredentialResponse);
     }
 
     private ACI getSelfAci() {

lib/src/main/java/org/asamk/signal/manager/helper/IdentityHelper.java

@@ -4,6 +4,7 @@ import org.asamk.signal.manager.api.TrustLevel;
 import org.asamk.signal.manager.storage.SignalAccount;
 import org.asamk.signal.manager.storage.recipients.RecipientId;
 import org.asamk.signal.manager.util.Utils;
+import org.signal.core.models.ServiceId;
 import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.fingerprint.Fingerprint;
 import org.signal.libsignal.protocol.fingerprint.FingerprintParsingException;
@@ -12,7 +13,6 @@ import org.signal.libsignal.protocol.fingerprint.ScannableFingerprint;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.messages.SendMessageResult;
-import org.whispersystems.signalservice.api.push.ServiceId;
 
 import java.util.Arrays;
 import java.util.function.BiFunction;

lib/src/main/java/org/asamk/signal/manager/helper/IncomingMessageHandler.java

@@ -5,6 +5,7 @@ import org.asamk.signal.manager.actions.HandleAction;
 import org.asamk.signal.manager.actions.RefreshPreKeysAction;
 import org.asamk.signal.manager.actions.RenewSessionAction;
 import org.asamk.signal.manager.actions.ResendMessageAction;
+import org.asamk.signal.manager.actions.RetrieveDeviceNameAction;
 import org.asamk.signal.manager.actions.RetrieveProfileAction;
 import org.asamk.signal.manager.actions.SendGroupInfoAction;
 import org.asamk.signal.manager.actions.SendGroupInfoRequestAction;
@@ -34,6 +35,9 @@ import org.asamk.signal.manager.storage.groups.GroupInfoV1;
 import org.asamk.signal.manager.storage.recipients.RecipientAddress;
 import org.asamk.signal.manager.storage.recipients.RecipientId;
 import org.asamk.signal.manager.storage.stickers.StickerPack;
+import org.asamk.signal.manager.util.MimeUtils;
+import org.signal.core.models.ServiceId;
+import org.signal.core.models.ServiceId.ACI;
 import org.signal.libsignal.metadata.ProtocolInvalidKeyException;
 import org.signal.libsignal.metadata.ProtocolInvalidKeyIdException;
 import org.signal.libsignal.metadata.ProtocolInvalidMessageException;
@@ -41,7 +45,6 @@ import org.signal.libsignal.metadata.ProtocolNoSessionException;
 import org.signal.libsignal.metadata.ProtocolUntrustedIdentityException;
 import org.signal.libsignal.metadata.SelfSendException;
 import org.signal.libsignal.protocol.InvalidMessageException;
-import org.signal.libsignal.protocol.UsePqRatchet;
 import org.signal.libsignal.protocol.groups.GroupSessionBuilder;
 import org.signal.libsignal.protocol.message.DecryptionErrorMessage;
 import org.signal.libsignal.zkgroup.InvalidInputException;
@@ -61,17 +64,21 @@ import org.whispersystems.signalservice.api.messages.SignalServiceGroupV2;
 import org.whispersystems.signalservice.api.messages.SignalServicePniSignatureMessage;
 import org.whispersystems.signalservice.api.messages.SignalServiceReceiptMessage;
 import org.whispersystems.signalservice.api.messages.SignalServiceStoryMessage;
+import org.whispersystems.signalservice.api.messages.calls.SignalServiceCallMessage;
 import org.whispersystems.signalservice.api.messages.multidevice.SignalServiceSyncMessage;
 import org.whispersystems.signalservice.api.messages.multidevice.StickerPackOperationMessage;
-import org.whispersystems.signalservice.api.push.ServiceId;
-import org.whispersystems.signalservice.api.push.ServiceId.ACI;
 import org.whispersystems.signalservice.api.push.ServiceIdType;
 import org.whispersystems.signalservice.api.push.SignalServiceAddress;
 import org.whispersystems.signalservice.internal.push.Envelope;
 import org.whispersystems.signalservice.internal.push.UnsupportedDataMessageException;
 
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.stream.Collectors;
 
@@ -102,11 +109,11 @@ public final class IncomingMessageHandler {
         SignalServiceContent content = null;
         if (!envelope.isReceipt()) {
             account.getIdentityKeyStore().setRetryingDecryption(true);
-            final var destination = getDestination(envelope).serviceId();
             try {
+                final var destination = getDestination(envelope).serviceId();
                 final var cipherResult = dependencies.getCipher(destination == null
                                 || destination.equals(account.getAci()) ? ServiceIdType.ACI : ServiceIdType.PNI)
-                        .decrypt(envelope.getProto(), envelope.getServerDeliveredTimestamp(), UsePqRatchet.NO);
+                        .decrypt(envelope.getProto(), envelope.getServerDeliveredTimestamp());
                 content = validate(envelope.getProto(), cipherResult, envelope.getServerDeliveredTimestamp());
                 if (content == null) {
                     return new Pair<>(List.of(), null);
@@ -133,18 +140,33 @@ public final class IncomingMessageHandler {
             final Manager.ReceiveMessageHandler handler
     ) {
         final var actions = new ArrayList<HandleAction>();
+        if (envelope.isPreKeySignalMessage()) {
+            actions.add(RefreshPreKeysAction.create());
+        }
         SignalServiceContent content = null;
         Exception exception = null;
-        envelope.getSourceServiceId().map(ServiceId::parseOrNull)
-                // Store uuid if we don't have it already
-                // uuid in envelope is sent by server
-                .ifPresent(serviceId -> account.getRecipientResolver().resolveRecipient(serviceId));
+        if (envelope.getSourceServiceId() != null) {
+            // Store uuid if we don't have it already
+            // uuid in envelope is sent by server
+            account.getRecipientResolver().resolveRecipient(envelope.getSourceServiceId());
+        }
         if (!envelope.isReceipt()) {
-            final var destination = getDestination(envelope).serviceId();
             try {
+                final var destination = getDestination(envelope).serviceId();
+
+                if (destination == account.getPni() && envelope.getSourceServiceId() == null) {
+                    throw new InvalidMessageException(
+                            "Got a sealed sender message to our PNI? Invalid message, ignoring.");
+                }
+
+                if (envelope.getSourceServiceId() instanceof ServiceId.PNI
+                        && envelope.getProto().type != Envelope.Type.SERVER_DELIVERY_RECEIPT) {
+                    throw new InvalidMessageException("Got a message from a PNI that was not a SERVER_DELIVERY_RECEIPT.");
+                }
+
                 final var cipherResult = dependencies.getCipher(destination == null
                                 || destination.equals(account.getAci()) ? ServiceIdType.ACI : ServiceIdType.PNI)
-                        .decrypt(envelope.getProto(), envelope.getServerDeliveredTimestamp(), UsePqRatchet.NO);
+                        .decrypt(envelope.getProto(), envelope.getServerDeliveredTimestamp());
                 content = validate(envelope.getProto(), cipherResult, envelope.getServerDeliveredTimestamp());
                 if (content == null) {
                     return new Pair<>(List.of(), null);
@@ -166,7 +188,13 @@ public final class IncomingMessageHandler {
                     logger.debug("Received invalid message from blocked contact, ignoring.");
                 } else {
                     var serviceId = ServiceId.parseOrNull(e.getSender());
-                    if (serviceId != null) {
+                    ServiceId destination;
+                    try {
+                        destination = getDestination(envelope).serviceId();
+                    } catch (InvalidMessageException ex) {
+                        destination = null;
+                    }
+                    if (serviceId != null && destination != null) {
                         final var isSelf = sender.equals(account.getSelfRecipientId())
                                 && e.getSenderDevice() == account.getDeviceId();
                         logger.debug("Received invalid message, queuing renew session action.");
@@ -200,7 +228,10 @@ public final class IncomingMessageHandler {
     ) throws ProtocolInvalidKeyException, ProtocolInvalidMessageException, UnsupportedDataMessageException, InvalidMessageStructureException {
         final var content = cipherResult.getContent();
         final var envelopeMetadata = cipherResult.getMetadata();
-        final var validationResult = EnvelopeContentValidator.INSTANCE.validate(envelope, content, account.getAci());
+        final var validationResult = EnvelopeContentValidator.INSTANCE.validate(envelope,
+                content,
+                account.getAci(),
+                cipherResult.getMetadata().getCiphertextMessageType());
 
         if (validationResult instanceof EnvelopeContentValidator.Result.Invalid v) {
             logger.warn("Invalid content! {}", v.getReason(), v.getThrowable());
@@ -254,7 +285,7 @@ public final class IncomingMessageHandler {
         var notAllowedToSendToGroup = isNotAllowedToSendToGroup(envelope, content);
         final var groupContext = getGroupContext(content);
         if (groupContext != null && groupContext.getGroupV2().isPresent()) {
-            handleGroupV2Context(groupContext.getGroupV2().get());
+            handleGroupV2Context(groupContext.getGroupV2().get(), receiveConfig.ignoreAvatars());
         }
         // Check again in case the user just joined the group
         notAllowedToSendToGroup = notAllowedToSendToGroup && isNotAllowedToSendToGroup(envelope, content);
@@ -270,13 +301,18 @@ public final class IncomingMessageHandler {
             return List.of();
         } else {
             List<HandleAction> actions;
+            Map<String, String> longTexts;
             if (content != null) {
-                actions = handleMessage(envelope, content, receiveConfig);
+                final var results = handleMessage(envelope, content, receiveConfig);
+                actions = results.first();
+                longTexts = results.second();
             } else {
                 actions = List.of();
+                longTexts = Map.of();
             }
             handler.handleMessage(MessageEnvelope.from(envelope,
                     content,
+                    longTexts,
                     account.getRecipientResolver(),
                     account.getRecipientAddressResolver(),
                     context.getAttachmentHelper()::getAttachmentFile,
@@ -285,22 +321,28 @@ public final class IncomingMessageHandler {
         }
     }
 
-    public List<HandleAction> handleMessage(
+    public Pair<List<HandleAction>, Map<String, String>> handleMessage(
             SignalServiceEnvelope envelope,
             SignalServiceContent content,
             ReceiveConfig receiveConfig
     ) {
-        var actions = new ArrayList<HandleAction>();
+        final var actions = new ArrayList<HandleAction>();
+        final var longTexts = new HashMap<String, String>();
         final var senderDeviceAddress = getSender(envelope, content);
         final var sender = senderDeviceAddress.recipientId();
         final var senderServiceId = senderDeviceAddress.serviceId();
         final var senderDeviceId = senderDeviceAddress.deviceId();
-        final var destination = getDestination(envelope);
+        final DeviceAddress destination;
+        try {
+            destination = getDestination(envelope);
+        } catch (InvalidMessageException e) {
+            throw new AssertionError(e);
+        }
 
-        if (account.getPni().equals(destination.serviceId)) {
-            account.getRecipientStore().markNeedsPniSignature(destination.recipientId, true);
+        if (destination.serviceId.equals(account.getPni())) {
+            account.getRecipientStore().markNeedsPniSignature(sender, true);
         } else if (account.getAci().equals(destination.serviceId)) {
-            account.getRecipientStore().markNeedsPniSignature(destination.recipientId, false);
+            account.getRecipientStore().markNeedsPniSignature(sender, false);
         }
 
         if (content.getReceiptMessage().isPresent()) {
@@ -365,27 +407,73 @@ public final class IncomingMessageHandler {
                         message.getTimestamp()));
             }
 
-            actions.addAll(handleSignalServiceDataMessage(message,
+            final var dataResults = handleSignalServiceDataMessage(message,
                     false,
                     senderDeviceAddress,
                     destination,
-                    receiveConfig.ignoreAttachments()));
+                    receiveConfig);
+            actions.addAll(dataResults.first());
+            longTexts.putAll(dataResults.second());
         }
 
         if (content.getStoryMessage().isPresent()) {
             final var message = content.getStoryMessage().get();
-            actions.addAll(handleSignalServiceStoryMessage(message, sender, receiveConfig.ignoreAttachments()));
+            actions.addAll(handleSignalServiceStoryMessage(message, sender, receiveConfig));
         }
 
         if (content.getSyncMessage().isPresent()) {
             var syncMessage = content.getSyncMessage().get();
-            actions.addAll(handleSyncMessage(envelope,
-                    syncMessage,
-                    senderDeviceAddress,
-                    receiveConfig.ignoreAttachments()));
+            final var syncResults = handleSyncMessage(envelope, syncMessage, senderDeviceAddress, receiveConfig);
+            actions.addAll(syncResults.first());
+            longTexts.putAll(syncResults.second());
         }
 
-        return actions;
+        if (content.getCallMessage().isPresent()) {
+            handleCallMessage(content.getCallMessage().get(), sender, senderDeviceId);
+        }
+
+        return new Pair<>(actions, longTexts);
+    }
+
+    private void handleCallMessage(
+            final SignalServiceCallMessage callMessage,
+            final RecipientId sender,
+            final int deviceId
+    ) {
+        var callManager = context.getCallManager();
+        if (callMessage.getDestinationDeviceId().isPresent()
+                && callMessage.getDestinationDeviceId().get() != account.getDeviceId()) {
+            return;
+        }
+
+        callMessage.getOfferMessage().ifPresent(offer -> {
+            var type = offer.getType()
+                    == org.whispersystems.signalservice.api.messages.calls.OfferMessage.Type.VIDEO_CALL
+                    ? org.asamk.signal.manager.api.MessageEnvelope.Call.Offer.Type.VIDEO_CALL
+                    : org.asamk.signal.manager.api.MessageEnvelope.Call.Offer.Type.AUDIO_CALL;
+            callManager.handleIncomingOffer(sender, deviceId, offer.getId(), type, offer.getOpaque());
+        });
+
+        callMessage.getAnswerMessage()
+                .ifPresent(answer -> callManager.handleIncomingAnswer(answer.getId(), deviceId, answer.getOpaque()));
+
+        callMessage.getIceUpdateMessages().ifPresent(iceUpdates -> {
+            for (var ice : iceUpdates) {
+                callManager.handleIncomingIceCandidate(ice.getId(), ice.getOpaque(), deviceId);
+            }
+        });
+
+        callMessage.getHangupMessage().ifPresent(hangup -> {
+            // Only NORMAL hangups actually end the call. ACCEPTED/DECLINED/BUSY
+            // are multi-device notifications irrelevant for single-device signal-cli.
+            var hangupType = hangup.getType();
+            if (hangupType == org.whispersystems.signalservice.api.messages.calls.HangupMessage.Type.NORMAL
+                    || hangupType == null) {
+                callManager.handleIncomingHangup(hangup.getId());
+            }
+        });
+
+        callMessage.getBusyMessage().ifPresent(busy -> callManager.handleIncomingBusy(busy.getId()));
     }
 
     private boolean handlePniSignatureMessage(
@@ -410,10 +498,11 @@ public final class IncomingMessageHandler {
         }
 
         logger.debug("Verified association of ACI {} with PNI {}", aci, pni);
-        account.getRecipientTrustedResolver()
+        final var recipientId = account.getRecipientTrustedResolver()
                 .resolveRecipientTrusted(Optional.of(ACI.from(aci.getRawUuid())),
                         Optional.of(pni),
                         senderAddress.getNumber());
+        account.getRecipientStore().markPniSignatureVerified(recipientId);
         return true;
     }
 
@@ -471,19 +560,20 @@ public final class IncomingMessageHandler {
         }
     }
 
-    private List<HandleAction> handleSyncMessage(
+    private Pair<List<HandleAction>, Map<String, String>> handleSyncMessage(
             final SignalServiceEnvelope envelope,
             final SignalServiceSyncMessage syncMessage,
             final DeviceAddress sender,
-            final boolean ignoreAttachments
+            final ReceiveConfig receiveConfig
     ) {
-        var actions = new ArrayList<HandleAction>();
+        final var actions = new ArrayList<HandleAction>();
+        final var longTexts = new HashMap<String, String>();
         account.setMultiDevice(true);
         if (syncMessage.getSent().isPresent()) {
             var message = syncMessage.getSent().get();
             final var destination = message.getDestination().orElse(null);
             if (message.getDataMessage().isPresent()) {
-                actions.addAll(handleSignalServiceDataMessage(message.getDataMessage().get(),
+                final var dataResults = handleSignalServiceDataMessage(message.getDataMessage().get(),
                         true,
                         sender,
                         destination == null
@@ -491,12 +581,14 @@ public final class IncomingMessageHandler {
                                 : new DeviceAddress(account.getRecipientResolver().resolveRecipient(destination),
                                         destination.getServiceId(),
                                         0),
-                        ignoreAttachments));
+                        receiveConfig);
+                actions.addAll(dataResults.first());
+                longTexts.putAll(dataResults.second());
             }
             if (message.getStoryMessage().isPresent()) {
                 actions.addAll(handleSignalServiceStoryMessage(message.getStoryMessage().get(),
                         sender.recipientId(),
-                        ignoreAttachments));
+                        receiveConfig));
             }
         }
         if (syncMessage.getRequest().isPresent() && account.isPrimaryDevice()) {
@@ -522,7 +614,9 @@ public final class IncomingMessageHandler {
             try {
                 final var groupsMessage = syncMessage.getGroups().get();
                 context.getAttachmentHelper()
-                        .retrieveAttachment(groupsMessage, context.getSyncHelper()::handleSyncDeviceGroups);
+                        .retrieveAttachment(groupsMessage,
+                                input -> context.getSyncHelper()
+                                        .handleSyncDeviceGroups(input, receiveConfig.ignoreAvatars()));
             } catch (Exception e) {
                 logger.warn("Failed to handle received sync groups, ignoring: {}", e.getMessage());
             }
@@ -532,13 +626,12 @@ public final class IncomingMessageHandler {
             for (var individual : blockedListMessage.individuals) {
                 final var address = new RecipientAddress(individual.getAci(), individual.getE164());
                 final var recipientId = account.getRecipientResolver().resolveRecipient(address);
-                context.getContactHelper().setContactBlocked(recipientId, true);
+                context.getContactHelper().setContactBlocked(recipientId, true, individual.getBlockedAt());
             }
-            for (var groupId : blockedListMessage.groupIds.stream()
-                    .map(GroupId::unknownVersion)
-                    .collect(Collectors.toSet())) {
+            for (var group : blockedListMessage.groups) {
+                final var groupId = GroupId.unknownVersion(group.getGroupId());
                 try {
-                    context.getGroupHelper().setGroupBlocked(groupId, true);
+                    context.getGroupHelper().setGroupBlocked(groupId, true, group.getBlockedAt());
                 } catch (GroupNotFoundException e) {
                     logger.warn("BlockedListMessage contained groupID that was not found in GroupStore: {}",
                             groupId.toBase64());
@@ -550,7 +643,8 @@ public final class IncomingMessageHandler {
                 final var contactsMessage = syncMessage.getContacts().get();
                 context.getAttachmentHelper()
                         .retrieveAttachment(contactsMessage.getContactsStream(),
-                                context.getSyncHelper()::handleSyncDeviceContacts);
+                                input -> context.getSyncHelper()
+                                        .handleSyncDeviceContacts(input, receiveConfig.ignoreAvatars()));
             } catch (Exception e) {
                 logger.warn("Failed to handle received sync contacts, ignoring: {}", e.getMessage());
             }
@@ -576,7 +670,7 @@ public final class IncomingMessageHandler {
                 final var sticker = context.getStickerHelper()
                         .addOrUpdateStickerPack(stickerPackId, stickerPackKey, installed);
 
-                if (sticker != null && installed) {
+                if (sticker != null && installed && !receiveConfig.ignoreStickers()) {
                     context.getJobExecutor().enqueueJob(new RetrieveStickerPackJob(stickerPackId, sticker.packKey()));
                 }
             }
@@ -593,10 +687,6 @@ public final class IncomingMessageHandler {
                 final var aep = keysMessage.getAccountEntropyPool();
                 account.setAccountEntropyPool(aep);
                 actions.add(SyncStorageDataAction.create());
-            } else if (keysMessage.getMaster() != null) {
-                final var masterKey = keysMessage.getMaster();
-                account.setMasterKey(masterKey);
-                actions.add(SyncStorageDataAction.create());
             } else if (keysMessage.getStorageService() != null) {
                 final var storageKey = keysMessage.getStorageService();
                 account.setStorageKey(storageKey);
@@ -627,14 +717,39 @@ public final class IncomingMessageHandler {
         }
         if (syncMessage.getPniChangeNumber().isPresent()) {
             final var pniChangeNumber = syncMessage.getPniChangeNumber().get();
-            logger.debug("Received PNI change number sync message, applying.");
-            final var updatedPniString = envelope.getUpdatedPni();
-            if (updatedPniString != null && !updatedPniString.isEmpty()) {
-                final var updatedPni = ServiceId.PNI.parseOrThrow(updatedPniString);
-                context.getAccountHelper().handlePniChangeNumberMessage(pniChangeNumber, updatedPni);
+            if (account.isPrimaryDevice()) {
+                logger.warn("Received PNI change number sync message on primary device, ignoring.");
+            } else if (sender.deviceId() != SignalServiceAddress.DEFAULT_DEVICE_ID) {
+                logger.warn("Received PNI change number sync message from non-primary device {}, ignoring.",
+                        sender.deviceId());
+            } else {
+                final var envelopeServerTimestamp = envelope.getServerDeliveredTimestamp();
+                final var lastAppliedServerTimestamp = account.getLastAppliedPniChangeServerTimestamp();
+                if (envelopeServerTimestamp <= lastAppliedServerTimestamp) {
+                    logger.warn(
+                            "PNI change number sync server timestamp ({}) is not newer than last applied ({}), treating as replay.",
+                            envelopeServerTimestamp,
+                            lastAppliedServerTimestamp);
+                } else {
+                    final var updatedPniString = envelope.getUpdatedPni();
+                    if (updatedPniString != null && !updatedPniString.isEmpty()) {
+                        final var updatedPni = ServiceId.PNI.parseOrThrow(updatedPniString);
+                        final var applied = context.getAccountHelper()
+                                .handlePniChangeNumberMessage(pniChangeNumber, updatedPni, true);
+                        if (applied) {
+                            account.setLastAppliedPniChangeServerTimestamp(envelopeServerTimestamp);
+                        }
+                    }
+                }
             }
         }
-        return actions;
+        if (syncMessage.getDeviceNameChange().isPresent()) {
+            final var deviceNameChange = syncMessage.getDeviceNameChange().get();
+            if (deviceNameChange.deviceId != null && deviceNameChange.deviceId == account.getDeviceId()) {
+                actions.add(RetrieveDeviceNameAction.create());
+            }
+        }
+        return new Pair<>(actions, longTexts);
     }
 
     private SignalServiceGroupContext getGroupContext(SignalServiceContent content) {
@@ -700,21 +815,36 @@ public final class IncomingMessageHandler {
             }
         }
 
-        var groupId = GroupUtils.getGroupId(groupContext);
-        var group = context.getGroupHelper().getGroup(groupId);
+        final var message = content.getDataMessage().orElse(null);
+
+        final var recipientId = account.getRecipientResolver().resolveRecipient(source);
+
+        final var groupId = GroupUtils.getGroupId(groupContext);
+        final var group = context.getGroupHelper().getGroup(groupId);
+
+        if (message != null && message.getAdminDelete().isPresent() && (group == null || !group.isAdmin(recipientId))) {
+            return true;
+        }
+
         if (group == null) {
             return false;
         }
 
-        final var message = content.getDataMessage().orElse(null);
-
-        final var recipientId = account.getRecipientResolver().resolveRecipient(source);
         if (!group.isMember(recipientId) && !(
                 group.isPendingMember(recipientId) && message != null && message.isGroupV2Update()
         )) {
             return true;
         }
 
+        if (group.isTerminated()) {
+            return message == null
+                    || message.getBody().isPresent()
+                    || message.getAttachments().isPresent()
+                    || message.getQuote().isPresent()
+                    || message.getPreviews().isPresent()
+                    || message.getMentions().isPresent()
+                    || message.getSticker().isPresent();
+        }
         if (group.isAnnouncementGroup() && !group.isAdmin(recipientId)) {
             return message == null
                     || message.getBody().isPresent()
@@ -727,13 +857,14 @@ public final class IncomingMessageHandler {
         return false;
     }
 
-    private List<HandleAction> handleSignalServiceDataMessage(
+    private Pair<List<HandleAction>, Map<String, String>> handleSignalServiceDataMessage(
             SignalServiceDataMessage message,
             boolean isSync,
             DeviceAddress source,
             DeviceAddress destination,
-            boolean ignoreAttachments
+            ReceiveConfig receiveConfig
     ) {
+        final var longTexts = new HashMap<String, String>();
         var actions = new ArrayList<HandleAction>();
         if (message.getGroupContext().isPresent()) {
             final var groupContext = message.getGroupContext().get();
@@ -749,7 +880,7 @@ public final class IncomingMessageHandler {
                                 groupV1 = new GroupInfoV1(groupId);
                             }
 
-                            if (groupInfo.getAvatar().isPresent()) {
+                            if (groupInfo.getAvatar().isPresent() && !receiveConfig.ignoreAvatars()) {
                                 var avatar = groupInfo.getAvatar().get();
                                 context.getGroupHelper().downloadGroupAvatar(groupV1.getGroupId(), avatar);
                             }
@@ -791,17 +922,12 @@ public final class IncomingMessageHandler {
                 }
             }
             if (groupContext.getGroupV2().isPresent()) {
-                handleGroupV2Context(groupContext.getGroupV2().get());
+                handleGroupV2Context(groupContext.getGroupV2().get(), receiveConfig.ignoreAvatars());
             }
         }
 
         final var selfAddress = isSync ? source : destination;
         final var conversationPartnerAddress = isSync ? destination : source;
-        if (conversationPartnerAddress != null && message.isEndSession()) {
-            account.getAccountData(selfAddress.serviceId())
-                    .getSessionStore()
-                    .deleteAllSessions(conversationPartnerAddress.serviceId());
-        }
         if (message.isExpirationUpdate() || message.getBody().isPresent()) {
             if (message.getGroupContext().isPresent()) {
                 final var groupContext = message.getGroupContext().get();
@@ -824,10 +950,21 @@ public final class IncomingMessageHandler {
                                 message.getExpireTimerVersion());
             }
         }
-        if (!ignoreAttachments) {
+        if (!receiveConfig.ignoreAttachments()) {
             if (message.getAttachments().isPresent()) {
                 for (var attachment : message.getAttachments().get()) {
                     context.getAttachmentHelper().downloadAttachment(attachment);
+                    if (attachment.isPointer()) {
+                        final var file = context.getAttachmentHelper().getAttachmentFile(attachment.asPointer());
+                        if (MimeUtils.LONG_TEXT.equals(attachment.getContentType()) && attachment.isPointer()) {
+                            try {
+                                final var longText = Files.readString(file.toPath());
+                                longTexts.put(attachment.asPointer().getRemoteId().toString(), longText);
+                            } catch (IOException e) {
+                                logger.warn("Failed to read long text attachment, ignoring", e);
+                            }
+                        }
+                    }
                 }
             }
             if (message.getSharedContacts().isPresent()) {
@@ -857,6 +994,21 @@ public final class IncomingMessageHandler {
                     }
                 }
             }
+        } else {
+            if (message.getAttachments().isPresent()) {
+                for (var attachment : message.getAttachments().get()) {
+                    if (MimeUtils.LONG_TEXT.equals(attachment.getContentType()) && attachment.isPointer()) {
+                        try {
+                            context.getAttachmentHelper().retrieveAttachment(attachment, in -> {
+                                final var longText = new String(in.readAllBytes(), StandardCharsets.UTF_8);
+                                longTexts.put(attachment.asPointer().getRemoteId().toString(), longText);
+                            });
+                        } catch (IOException e) {
+                            logger.warn("Failed to download long text attachment, ignoring", e);
+                        }
+                    }
+                }
+            }
         }
         if (message.getGiftBadge().isPresent()) {
             handleIncomingGiftBadge(message.getGiftBadge().get());
@@ -872,9 +1024,12 @@ public final class IncomingMessageHandler {
                 sticker = new StickerPack(stickerPackId, messageSticker.getPackKey());
                 account.getStickerStore().addStickerPack(sticker);
             }
-            context.getJobExecutor().enqueueJob(new RetrieveStickerPackJob(stickerPackId, messageSticker.getPackKey()));
+            if (!receiveConfig.ignoreStickers()) {
+                context.getJobExecutor()
+                        .enqueueJob(new RetrieveStickerPackJob(stickerPackId, messageSticker.getPackKey()));
+            }
         }
-        return actions;
+        return new Pair<>(actions, longTexts);
     }
 
     private void handleIncomingGiftBadge(final SignalServiceDataMessage.GiftBadge giftBadge) {
@@ -884,14 +1039,14 @@ public final class IncomingMessageHandler {
     private List<HandleAction> handleSignalServiceStoryMessage(
             SignalServiceStoryMessage message,
             RecipientId source,
-            boolean ignoreAttachments
+            ReceiveConfig receiveConfig
     ) {
         var actions = new ArrayList<HandleAction>();
         if (message.getGroupContext().isPresent()) {
-            handleGroupV2Context(message.getGroupContext().get());
+            handleGroupV2Context(message.getGroupContext().get(), receiveConfig.ignoreAvatars());
         }
 
-        if (!ignoreAttachments) {
+        if (!receiveConfig.ignoreAttachments()) {
             if (message.getFileAttachment().isPresent()) {
                 context.getAttachmentHelper().downloadAttachment(message.getFileAttachment().get());
             }
@@ -913,13 +1068,14 @@ public final class IncomingMessageHandler {
         return actions;
     }
 
-    private void handleGroupV2Context(final SignalServiceGroupV2 groupContext) {
+    private void handleGroupV2Context(final SignalServiceGroupV2 groupContext, final boolean ignoreAvatars) {
         final var groupMasterKey = groupContext.getMasterKey();
 
         context.getGroupHelper()
                 .getOrMigrateGroup(groupMasterKey,
                         groupContext.getRevision(),
-                        groupContext.hasSignedGroupChange() ? groupContext.getSignedGroupChange() : null);
+                        groupContext.hasSignedGroupChange() ? groupContext.getSignedGroupChange() : null,
+                        ignoreAvatars);
     }
 
     private void handleIncomingProfileKey(final byte[] profileKeyBytes, final RecipientId source) {
@@ -940,7 +1096,7 @@ public final class IncomingMessageHandler {
     }
 
     private SignalServiceAddress getSenderAddress(SignalServiceEnvelope envelope, SignalServiceContent content) {
-        final var serviceId = envelope.getSourceServiceId().map(ServiceId::parseOrNull).orElse(null);
+        final var serviceId = envelope.getSourceServiceId();
         if (!envelope.isUnidentifiedSender() && serviceId != null) {
             return new SignalServiceAddress(serviceId);
         } else if (content != null) {
@@ -951,7 +1107,7 @@ public final class IncomingMessageHandler {
     }
 
     private DeviceAddress getSender(SignalServiceEnvelope envelope, SignalServiceContent content) {
-        final var serviceId = envelope.getSourceServiceId().map(ServiceId::parseOrNull).orElse(null);
+        final var serviceId = envelope.getSourceServiceId();
         if (!envelope.isUnidentifiedSender() && serviceId != null) {
             return new DeviceAddress(account.getRecipientResolver().resolveRecipient(serviceId),
                     serviceId,
@@ -963,10 +1119,13 @@ public final class IncomingMessageHandler {
         }
     }
 
-    private DeviceAddress getDestination(SignalServiceEnvelope envelope) {
+    private DeviceAddress getDestination(SignalServiceEnvelope envelope) throws InvalidMessageException {
         final var destination = envelope.getDestinationServiceId();
         if (destination == null || destination.isUnknown()) {
-            return new DeviceAddress(account.getSelfRecipientId(), account.getAci(), account.getDeviceId());
+            throw new InvalidMessageException("Missing destination");
+        }
+        if (!destination.equals(account.getAci()) && !destination.equals(account.getPni())) {
+            throw new InvalidMessageException("Message not intended for this account");
         }
         return new DeviceAddress(account.getRecipientResolver().resolveRecipient(destination),
                 destination,

lib/src/main/java/org/asamk/signal/manager/helper/PinHelper.java

@@ -1,9 +1,9 @@
 package org.asamk.signal.manager.helper;
 
 import org.asamk.signal.manager.api.IncorrectPinException;
+import org.signal.core.models.MasterKey;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.whispersystems.signalservice.api.kbs.MasterKey;
 import org.whispersystems.signalservice.api.svr.SecureValueRecovery;
 import org.whispersystems.signalservice.internal.push.AuthCredentials;
 import org.whispersystems.signalservice.internal.push.LockedException;
@@ -23,11 +23,15 @@ public class PinHelper {
 
     public void setRegistrationLockPin(String pin, MasterKey masterKey) throws IOException {
         IOException exception = null;
+        var setPinSuccessfully = false;
         for (final var secureValueRecovery : secureValueRecoveries) {
             try {
                 final var backupResponse = secureValueRecovery.setPin(pin, masterKey).execute();
                 switch (backupResponse) {
-                    case SecureValueRecovery.BackupResponse.Success success -> logger.trace("PIN set successfully");
+                    case SecureValueRecovery.BackupResponse.Success success -> {
+                        setPinSuccessfully = true;
+                        logger.trace("PIN set successfully");
+                    }
                     case SecureValueRecovery.BackupResponse.ServerRejected serverRejected ->
                             logger.warn("Backup svr failed: ServerRejected");
                     case SecureValueRecovery.BackupResponse.EnclaveNotFound enclaveNotFound ->
@@ -43,7 +47,7 @@ public class PinHelper {
                 exception = e;
             }
         }
-        if (exception != null) {
+        if (!setPinSuccessfully && exception != null) {
             throw exception;
         }
     }
@@ -54,11 +58,13 @@ public class PinHelper {
 
     public void removeRegistrationLockPin() throws IOException {
         IOException exception = null;
+        var removedPinSuccessfully = false;
         for (final var secureValueRecovery : secureValueRecoveries) {
             try {
                 final var deleteResponse = secureValueRecovery.deleteData();
                 switch (deleteResponse) {
                     case SecureValueRecovery.DeleteResponse.Success success -> {
+                        removedPinSuccessfully = true;
                     }
                     case SecureValueRecovery.DeleteResponse.ServerRejected serverRejected ->
                             logger.warn("Delete svr2 failed: ServerRejected");
@@ -73,7 +79,7 @@ public class PinHelper {
                 exception = e;
             }
         }
-        if (exception != null) {
+        if (!removedPinSuccessfully && exception != null) {
             throw exception;
         }
     }

lib/src/main/java/org/asamk/signal/manager/helper/PreKeyHelper.java

@@ -9,6 +9,7 @@ import org.signal.libsignal.protocol.InvalidKeyIdException;
 import org.signal.libsignal.protocol.state.KyberPreKeyRecord;
 import org.signal.libsignal.protocol.state.PreKeyRecord;
 import org.signal.libsignal.protocol.state.SignedPreKeyRecord;
+import org.signal.network.exceptions.NonSuccessfulResponseCodeException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.NetworkResultUtil;
@@ -16,7 +17,6 @@ import org.whispersystems.signalservice.api.account.PreKeyUpload;
 import org.whispersystems.signalservice.api.keys.OneTimePreKeyCounts;
 import org.whispersystems.signalservice.api.push.ServiceIdType;
 import org.whispersystems.signalservice.api.push.exceptions.AuthorizationFailedException;
-import org.whispersystems.signalservice.api.push.exceptions.NonSuccessfulResponseCodeException;
 
 import java.io.IOException;
 import java.util.List;
@@ -84,7 +84,8 @@ public class PreKeyHelper {
     ) throws IOException {
         OneTimePreKeyCounts preKeyCounts;
         try {
-            preKeyCounts = handleResponseException(dependencies.getKeysApi().getAvailablePreKeyCounts(serviceIdType));
+            preKeyCounts = handleResponseException(dependencies.getKeysApi()
+                    .getAvailablePreKeyCountsSync(serviceIdType));
         } catch (AuthorizationFailedException e) {
             logger.debug("Failed to get pre key count, ignoring: " + e.getClass().getSimpleName());
             preKeyCounts = new OneTimePreKeyCounts(0, 0);
@@ -145,7 +146,7 @@ public class PreKeyHelper {
                 kyberPreKeyRecords);
         var needsReset = false;
         try {
-            NetworkResultUtil.toPreKeysLegacy(dependencies.getKeysApi().setPreKeys(preKeyUpload));
+            NetworkResultUtil.toPreKeysLegacy(dependencies.getKeysApi().setPreKeysSync(preKeyUpload));
             try {
                 if (preKeyRecords != null) {
                     account.addPreKeys(serviceIdType, preKeyRecords);

lib/src/main/java/org/asamk/signal/manager/helper/ProfileHelper.java

@@ -17,10 +17,12 @@ import org.asamk.signal.manager.util.PaymentUtils;
 import org.asamk.signal.manager.util.ProfileUtils;
 import org.asamk.signal.manager.util.Utils;
 import org.jetbrains.annotations.Nullable;
+import org.signal.core.util.ExpiringProfileCredentialUtil;
 import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.InvalidKeyException;
 import org.signal.libsignal.zkgroup.profiles.ExpiringProfileKeyCredential;
 import org.signal.libsignal.zkgroup.profiles.ProfileKey;
+import org.signal.network.exceptions.PushNetworkException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.NetworkResultUtil;
@@ -30,9 +32,7 @@ import org.whispersystems.signalservice.api.profiles.ProfileAndCredential;
 import org.whispersystems.signalservice.api.profiles.SignalServiceProfile;
 import org.whispersystems.signalservice.api.push.SignalServiceAddress;
 import org.whispersystems.signalservice.api.push.exceptions.NotFoundException;
-import org.whispersystems.signalservice.api.push.exceptions.PushNetworkException;
 import org.whispersystems.signalservice.api.services.ProfileService;
-import org.whispersystems.signalservice.api.util.ExpiringProfileCredentialUtil;
 
 import java.io.IOException;
 import java.io.OutputStream;
@@ -103,8 +103,16 @@ public final class ProfileHelper {
         return getRecipientProfiles(recipientIds, false);
     }
 
-    public void refreshRecipientProfile(RecipientId recipientId) {
-        getRecipientProfile(recipientId, true);
+    public boolean refreshRecipientProfile(RecipientId recipientId) {
+        try {
+            blockingGetProfile(retrieveProfile(recipientId, SignalServiceProfile.RequestType.PROFILE, false));
+            return true;
+        } catch (IOException e) {
+            logger.warn("Failed to retrieve profile for {}, ignoring: {}",
+                    context.getRecipientHelper().resolveSignalServiceAddress(recipientId).getIdentifier(),
+                    e.getMessage());
+            return false;
+        }
     }
 
     public void refreshRecipientProfiles(Collection<RecipientId> recipientIds) {
@@ -116,7 +124,8 @@ public final class ProfileHelper {
                 .filter(recipientId -> !ExpiringProfileCredentialUtil.isValid(account.getProfileStore()
                         .getExpiringProfileKeyCredential(recipientId)))
                 .map(recipientId -> retrieveProfile(recipientId,
-                        SignalServiceProfile.RequestType.PROFILE_AND_CREDENTIAL).onErrorComplete());
+                        SignalServiceProfile.RequestType.PROFILE_AND_CREDENTIAL,
+                        false).onErrorComplete());
         Maybe.merge(profileFetches, 10).blockingSubscribe();
 
         return recipientIds.stream().map(r -> account.getProfileStore().getExpiringProfileKeyCredential(r)).toList();
@@ -129,9 +138,13 @@ public final class ProfileHelper {
         }
 
         try {
-            blockingGetProfile(retrieveProfile(recipientId, SignalServiceProfile.RequestType.PROFILE_AND_CREDENTIAL));
+            blockingGetProfile(retrieveProfile(recipientId,
+                    SignalServiceProfile.RequestType.PROFILE_AND_CREDENTIAL,
+                    false));
         } catch (IOException e) {
-            logger.warn("Failed to retrieve profile key credential, ignoring: {}", e.getMessage());
+            logger.warn("Failed to retrieve profile key credential for {}, ignoring: {}",
+                    context.getRecipientHelper().resolveSignalServiceAddress(recipientId).getIdentifier(),
+                    e.getMessage());
             return null;
         }
 
@@ -241,7 +254,8 @@ public final class ProfileHelper {
         final var profileFetches = Flowable.fromIterable(recipientIds)
                 .filter(recipientId -> force || isProfileRefreshRequired(profileStore.getProfile(recipientId)))
                 .map(recipientId -> retrieveProfile(recipientId,
-                        SignalServiceProfile.RequestType.PROFILE).onErrorComplete());
+                        SignalServiceProfile.RequestType.PROFILE,
+                        false).onErrorComplete());
         Maybe.merge(profileFetches, 10).blockingSubscribe();
 
         return recipientIds.stream().map(profileStore::getProfile).toList();
@@ -255,9 +269,11 @@ public final class ProfileHelper {
         }
 
         try {
-            blockingGetProfile(retrieveProfile(recipientId, SignalServiceProfile.RequestType.PROFILE));
+            blockingGetProfile(retrieveProfile(recipientId, SignalServiceProfile.RequestType.PROFILE, false));
         } catch (IOException e) {
-            logger.warn("Failed to retrieve profile, ignoring: {}", e.getMessage());
+            logger.warn("Failed to retrieve profile for {}, ignoring: {}",
+                    context.getRecipientHelper().resolveSignalServiceAddress(recipientId).getIdentifier(),
+                    e.getMessage());
         }
 
         return account.getProfileStore().getProfile(recipientId);
@@ -272,17 +288,6 @@ public final class ProfileHelper {
         return now - profile.getLastUpdateTimestamp() >= 6 * 60 * 60 * 1000;
     }
 
-    private Profile decryptProfileAndDownloadAvatar(
-            final RecipientId recipientId,
-            final ProfileKey profileKey,
-            final SignalServiceProfile encryptedProfile
-    ) {
-        final var avatarPath = encryptedProfile.getAvatar();
-        downloadProfileAvatar(recipientId, avatarPath, profileKey);
-
-        return ProfileUtils.decryptProfile(profileKey, encryptedProfile);
-    }
-
     public void downloadProfileAvatar(
             final RecipientId recipientId,
             final String avatarPath,
@@ -315,7 +320,8 @@ public final class ProfileHelper {
 
     private Single<ProfileAndCredential> retrieveProfile(
             RecipientId recipientId,
-            SignalServiceProfile.RequestType requestType
+            SignalServiceProfile.RequestType requestType,
+            final boolean ignoreAvatars
     ) {
         var unidentifiedAccess = getUnidentifiedAccess(recipientId);
         var profileKey = Optional.ofNullable(account.getProfileStore().getProfileKey(recipientId));
@@ -341,7 +347,12 @@ public final class ProfileHelper {
             Profile newProfile = null;
             if (profileKey.isPresent()) {
                 logger.trace("Decrypting profile");
-                newProfile = decryptProfileAndDownloadAvatar(recipientId, profileKey.get(), encryptedProfile);
+                final var avatarPath = encryptedProfile.getAvatar();
+                if (!ignoreAvatars) {
+                    downloadProfileAvatar(recipientId, avatarPath, profileKey.get());
+                }
+
+                newProfile = ProfileUtils.decryptProfile(profileKey.get(), encryptedProfile);
             }
 
             if (newProfile == null) {
@@ -380,7 +391,9 @@ public final class ProfileHelper {
 
             logger.trace("Done handling retrieved profile");
         }).doOnError(e -> {
-            logger.warn("Failed to retrieve profile, ignoring: {}", e.getMessage());
+            logger.warn("Failed to retrieve profile for {}, ignoring: {}",
+                    context.getRecipientHelper().resolveSignalServiceAddress(recipientId).getIdentifier(),
+                    e.getMessage());
             final var profile = account.getProfileStore().getProfile(recipientId);
             final var newProfile = (
                     profile == null ? Profile.newBuilder() : Profile.newBuilder(profile)

lib/src/main/java/org/asamk/signal/manager/helper/ReceiveHelper.java

@@ -9,18 +9,17 @@ import org.asamk.signal.manager.jobs.CleanOldPreKeysJob;
 import org.asamk.signal.manager.storage.SignalAccount;
 import org.asamk.signal.manager.storage.messageCache.CachedMessage;
 import org.asamk.signal.manager.storage.recipients.RecipientAddress;
+import org.signal.core.models.ServiceId.ACI;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.whispersystems.signalservice.api.messages.EnvelopeResponse;
 import org.whispersystems.signalservice.api.messages.SignalServiceEnvelope;
-import org.whispersystems.signalservice.api.push.ServiceId;
-import org.whispersystems.signalservice.api.push.ServiceId.ACI;
 import org.whispersystems.signalservice.api.websocket.SignalWebSocket;
 import org.whispersystems.signalservice.api.websocket.WebSocketConnectionState;
 import org.whispersystems.signalservice.api.websocket.WebSocketUnavailableException;
 
 import java.io.IOException;
 import java.time.Duration;
-import java.time.Instant;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -41,7 +40,7 @@ public class ReceiveHelper {
     private final SignalDependencies dependencies;
     private final Context context;
 
-    private ReceiveConfig receiveConfig = new ReceiveConfig(false, false, false);
+    private ReceiveConfig receiveConfig = new ReceiveConfig(false, false, false, false, false);
     private boolean hasCaughtUpWithOldMessages = false;
     private boolean isWaitingForMessage = false;
     private boolean shouldStop = false;
@@ -123,7 +122,6 @@ public class ReceiveHelper {
             Manager.ReceiveMessageHandler handler,
             final Map<HandleAction, HandleAction> queuedActions
     ) throws IOException {
-        final var timeoutInstant = timeout.map(t -> Instant.now().plus(t));
         int remainingMessages = maxMessages == null ? -1 : maxMessages;
         var backOffCounter = 0;
         isWaitingForMessage = false;
@@ -142,8 +140,7 @@ public class ReceiveHelper {
             logger.trace("Checking for new message from server");
             try {
                 isWaitingForMessage = true;
-                final var timeoutMs = timeoutInstant.isPresent() ? Math.min(60_000,
-                        Duration.between(Instant.now(), timeoutInstant.get()).toMillis()) : 60_000L;
+                final var timeoutMs = timeout.orElseGet(() -> Duration.ofMinutes(1)).toMillis();
                 if (timeoutMs <= 0L) {
                     return;
                 }
@@ -151,15 +148,19 @@ public class ReceiveHelper {
                     logger.debug("Retrieved {} envelopes!", batch.size());
                     isWaitingForMessage = false;
                     for (final var it : batch) {
-                        SignalServiceEnvelope envelope1 = new SignalServiceEnvelope(it.getEnvelope(),
-                                it.getServerDeliveredTimestamp());
-                        final var recipientId = envelope1.getSourceServiceId()
-                                .map(ServiceId::parseOrNull)
-                                .map(s -> account.getRecipientResolver().resolveRecipient(s))
-                                .orElse(null);
-                        logger.trace("Storing new message from {}", recipientId);
-                        // store message on disk, before acknowledging receipt to the server
-                        cachedMessage[0] = account.getMessageCache().cacheMessage(envelope1, recipientId);
+                        if (it instanceof EnvelopeResponse.Unparseable) {
+                            logger.warn("Received unparseable envelope from server, ignoring.");
+                        } else if (it instanceof EnvelopeResponse.Parsed parsed) {
+                            SignalServiceEnvelope envelope1 = new SignalServiceEnvelope(parsed.getEnvelope(),
+                                    parsed.getServerDeliveredTimestamp());
+                            final var sourceServiceId = envelope1.getSourceServiceId();
+                            final var recipientId = sourceServiceId == null
+                                    ? null
+                                    : account.getRecipientResolver().resolveRecipient(sourceServiceId);
+                            logger.trace("Storing new message from {}", recipientId);
+                            // store message on disk, before acknowledging receipt to the server
+                            cachedMessage[0] = account.getMessageCache().cacheMessage(envelope1, recipientId);
+                        }
                         try {
                             signalWebSocket.sendAck(it);
                         } catch (IOException e) {
@@ -171,6 +172,9 @@ public class ReceiveHelper {
                 backOffCounter = 0;
 
                 if (queueNotEmpty) {
+                    if (cachedMessage[0] == null) {
+                        continue;
+                    }
                     if (remainingMessages > 0) {
                         remainingMessages -= 1;
                     }
@@ -212,7 +216,7 @@ public class ReceiveHelper {
                 throw e;
             } catch (TimeoutException e) {
                 backOffCounter = 0;
-                if (timeoutInstant.isPresent() && timeoutInstant.get().isBefore(Instant.now())) {
+                if (timeout.isPresent()) {
                     return;
                 }
                 continue;
@@ -241,7 +245,7 @@ public class ReceiveHelper {
                     if (exception instanceof UntrustedIdentityException) {
                         logger.debug("Keeping message with untrusted identity in message cache");
                         final var address = ((UntrustedIdentityException) exception).getSender();
-                        if (envelope.getSourceServiceId().isEmpty() && address.aci().isPresent()) {
+                        if (envelope.getSourceServiceId() == null && address.aci().isPresent()) {
                             final var recipientId = account.getRecipientResolver()
                                     .resolveRecipient(ACI.parseOrThrow(address.aci().get()));
                             try {
@@ -295,7 +299,7 @@ public class ReceiveHelper {
                 cachedMessage.delete();
                 return null;
             }
-            if (envelope.getSourceServiceId().isEmpty()) {
+            if (envelope.getSourceServiceId() == null) {
                 final var identifier = ((UntrustedIdentityException) exception).getSender();
                 final var recipientId = account.getRecipientResolver()
                         .resolveRecipient(new RecipientAddress(identifier));

lib/src/main/java/org/asamk/signal/manager/helper/RecipientHelper.java

@@ -6,18 +6,18 @@ import org.asamk.signal.manager.api.UsernameLinkUrl;
 import org.asamk.signal.manager.internal.SignalDependencies;
 import org.asamk.signal.manager.storage.SignalAccount;
 import org.asamk.signal.manager.storage.recipients.RecipientId;
+import org.signal.core.models.ServiceId;
+import org.signal.core.models.ServiceId.ACI;
+import org.signal.core.models.ServiceId.PNI;
 import org.signal.libsignal.usernames.BaseUsernameException;
 import org.signal.libsignal.usernames.Username;
+import org.signal.network.exceptions.NonSuccessfulResponseCodeException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.cds.CdsiV2Service;
-import org.whispersystems.signalservice.api.push.ServiceId;
-import org.whispersystems.signalservice.api.push.ServiceId.ACI;
-import org.whispersystems.signalservice.api.push.ServiceId.PNI;
 import org.whispersystems.signalservice.api.push.SignalServiceAddress;
 import org.whispersystems.signalservice.api.push.exceptions.CdsiInvalidArgumentException;
 import org.whispersystems.signalservice.api.push.exceptions.CdsiInvalidTokenException;
-import org.whispersystems.signalservice.api.push.exceptions.NonSuccessfulResponseCodeException;
 
 import java.io.IOException;
 import java.util.Collection;
@@ -145,11 +145,8 @@ public class RecipientHelper {
         try {
             final var usernameLinkUrl = UsernameLinkUrl.fromUri(username);
             final var components = usernameLinkUrl.getComponents();
-            final var encryptedUsername = handleResponseException(dependencies.getUsernameApi()
-                    .getEncryptedUsernameFromLinkServerId(components.getServerId()));
-            final var link = new Username.UsernameLink(components.getEntropy(), encryptedUsername);
-
-            return Username.fromLink(link);
+            return handleResponseException(dependencies.getUsernameApi()
+                    .getDecryptedUsernameFromLinkServerIdAndEntropy(components.getServerId(), components.getEntropy()));
         } catch (UsernameLinkUrl.InvalidUsernameLinkException e) {
             return new Username(username);
         }

lib/src/main/java/org/asamk/signal/manager/helper/SendHelper.java

@@ -15,6 +15,7 @@ import org.asamk.signal.manager.storage.groups.GroupInfo;
 import org.asamk.signal.manager.storage.groups.GroupInfoV2;
 import org.asamk.signal.manager.storage.recipients.RecipientId;
 import org.asamk.signal.manager.storage.sendLog.MessageSendLogEntry;
+import org.signal.core.models.ServiceId.ACI;
 import org.signal.libsignal.protocol.InvalidKeyException;
 import org.signal.libsignal.protocol.InvalidRegistrationIdException;
 import org.signal.libsignal.protocol.NoSessionException;
@@ -34,11 +35,13 @@ import org.whispersystems.signalservice.api.messages.SendMessageResult;
 import org.whispersystems.signalservice.api.messages.SignalServiceDataMessage;
 import org.whispersystems.signalservice.api.messages.SignalServiceEditMessage;
 import org.whispersystems.signalservice.api.messages.SignalServiceReceiptMessage;
+import org.whispersystems.signalservice.api.messages.SignalServiceStoryMessage;
+import org.whispersystems.signalservice.api.messages.SignalServiceStoryMessageRecipient;
 import org.whispersystems.signalservice.api.messages.SignalServiceTypingMessage;
+import org.whispersystems.signalservice.api.messages.calls.SignalServiceCallMessage;
 import org.whispersystems.signalservice.api.messages.multidevice.SentTranscriptMessage;
 import org.whispersystems.signalservice.api.messages.multidevice.SignalServiceSyncMessage;
 import org.whispersystems.signalservice.api.push.DistributionId;
-import org.whispersystems.signalservice.api.push.ServiceId.ACI;
 import org.whispersystems.signalservice.api.push.SignalServiceAddress;
 import org.whispersystems.signalservice.api.push.exceptions.NotFoundException;
 import org.whispersystems.signalservice.api.push.exceptions.ProofRequiredException;
@@ -84,7 +87,8 @@ public class SendHelper {
     public SendMessageResult sendMessage(
             final SignalServiceDataMessage.Builder messageBuilder,
             final RecipientId recipientId,
-            Optional<Long> editTargetTimestamp
+            Optional<Long> editTargetTimestamp,
+            boolean urgent
     ) {
         var contact = account.getContactStore().getContact(recipientId);
         if (contact == null || !contact.isProfileSharingEnabled() || contact.isHidden()) {
@@ -102,7 +106,7 @@ public class SendHelper {
         }
 
         final var message = messageBuilder.build();
-        return sendMessage(message, recipientId, editTargetTimestamp);
+        return sendMessage(message, recipientId, editTargetTimestamp, urgent);
     }
 
     /**
@@ -113,10 +117,11 @@ public class SendHelper {
             final SignalServiceDataMessage.Builder messageBuilder,
             final GroupId groupId,
             final boolean includeSelf,
-            final Optional<Long> editTargetTimestamp
+            final Optional<Long> editTargetTimestamp,
+            boolean urgent
     ) throws IOException, GroupNotFoundException, NotAGroupMemberException, GroupSendingNotAllowedException {
         final var g = getGroupForSending(groupId);
-        return sendAsGroupMessage(messageBuilder, g, includeSelf, editTargetTimestamp);
+        return sendAsGroupMessage(messageBuilder, g, includeSelf, editTargetTimestamp, urgent);
     }
 
     /**
@@ -128,7 +133,7 @@ public class SendHelper {
             final Set<RecipientId> recipientIds,
             final GroupInfo groupInfo
     ) throws IOException {
-        return sendGroupMessage(message, recipientIds, groupInfo, ContentHint.IMPLICIT, Optional.empty());
+        return sendGroupMessage(message, recipientIds, groupInfo, ContentHint.IMPLICIT, Optional.empty(), true);
     }
 
     public SendMessageResult sendReceiptMessage(
@@ -307,17 +312,125 @@ public class SendHelper {
         return result;
     }
 
+    public SendMessageResult sendCallMessage(
+            final SignalServiceCallMessage callMessage,
+            final RecipientId recipientId
+    ) {
+        final var messageSendLogStore = account.getMessageSendLogStore();
+        final var result = handleSendMessage(recipientId,
+                (messageSender, address, unidentifiedAccess, includePniSignature) -> messageSender.sendCallMessage(
+                        address,
+                        unidentifiedAccess,
+                        callMessage));
+        if (callMessage.getTimestamp().isPresent()) {
+            messageSendLogStore.insertIfPossible(callMessage.getTimestamp().get(),
+                    result,
+                    ContentHint.IMPLICIT,
+                    callMessage.isUrgent());
+        }
+        handleSendMessageResult(result);
+        return result;
+    }
+
+    /**
+     * Send a story message (file attachment) to "My Story".
+     */
+    public List<SendMessageResult> sendStoryMessage(
+            SignalServiceStoryMessage storyMessage,
+            long timestamp,
+            Set<RecipientId> recipientIds,
+            boolean allowsReplies
+    ) throws IOException {
+        final var messageSender = dependencies.getMessageSender();
+
+        final var recipientIdList = List.copyOf(recipientIds);
+        final var addressesMap = recipientIdList.stream()
+                .collect(Collectors.toMap(id -> id, context.getRecipientHelper()::resolveSignalServiceAddress));
+        final var unidentifiedAccessesMap = context.getUnidentifiedAccessHelper().getAccessFor(recipientIds);
+
+        final var addresses = recipientIdList.stream().map(addressesMap::get).toList();
+        final var unidentifiedAccesses = recipientIdList.stream().map(unidentifiedAccessesMap::get).toList();
+        final var storyMessageRecipients = recipientIdList.stream()
+                .map(id -> new SignalServiceStoryMessageRecipient(addressesMap.get(id),
+                        List.of(DistributionId.MY_STORY.asUuid().toString()),
+                        allowsReplies))
+                .collect(Collectors.toSet());
+
+        final List<SendMessageResult> results;
+        try {
+            results = messageSender.sendGroupStory(DistributionId.MY_STORY,
+                    Optional.empty(),
+                    addresses,
+                    unidentifiedAccesses,
+                    null,
+                    false,
+                    storyMessage,
+                    timestamp,
+                    storyMessageRecipients,
+                    null);
+        } catch (UntrustedIdentityException | InvalidKeyException | NoSessionException |
+                 InvalidRegistrationIdException e) {
+            throw new IOException(e);
+        }
+
+        for (var r : results) {
+            handleSendMessageResult(r);
+        }
+
+        return results;
+    }
+
+    /**
+     * Send a story message (file attachment) to a group.
+     */
+    public List<SendMessageResult> sendGroupStoryMessage(
+            SignalServiceStoryMessage storyMessage,
+            long timestamp,
+            GroupInfoV2 groupInfo,
+            boolean allowsReplies
+    ) throws IOException {
+        final var messageSender = dependencies.getMessageSender();
+
+        final var allRecipientIds = groupInfo.getMembersWithout(account.getSelfRecipientId());
+
+        final SenderKeySenderHandler senderKeySender = (distId, recipients, unidentifiedAccess, groupSendEndorsements, isRecipientUpdate) -> messageSender.sendGroupStory(
+                distId,
+                Optional.of(groupInfo.getMasterKey().serialize()),
+                recipients,
+                unidentifiedAccess,
+                groupSendEndorsements,
+                isRecipientUpdate,
+                storyMessage,
+                timestamp,
+                recipients.stream()
+                        .map(address -> new SignalServiceStoryMessageRecipient(address,
+                                List.of(groupInfo.getDistributionId().asUuid().toString()),
+                                allowsReplies))
+                        .collect(Collectors.toSet()),
+                null);
+        final var results = sendGroupMessageInternal(null, senderKeySender, allRecipientIds, groupInfo, false);
+
+        for (var r : results) {
+            handleSendMessageResult(r);
+        }
+
+        return results;
+    }
+
     private List<SendMessageResult> sendAsGroupMessage(
             final SignalServiceDataMessage.Builder messageBuilder,
             final GroupInfo g,
             final boolean includeSelf,
-            final Optional<Long> editTargetTimestamp
+            final Optional<Long> editTargetTimestamp,
+            boolean urgent
     ) throws IOException, GroupSendingNotAllowedException {
         GroupUtils.setGroupContext(messageBuilder, g);
         messageBuilder.withExpiration(g.getMessageExpirationTimer());
 
         final var message = messageBuilder.build();
-        final var recipients = includeSelf ? g.getMembers() : g.getMembersWithout(account.getSelfRecipientId());
+        final var recipients = includeSelf
+                ? g.getMemberRecipientIds()
+                : g.getMembersWithout(account.getSelfRecipientId());
 
         if (g.isAnnouncementGroup() && !g.isAdmin(account.getSelfRecipientId())) {
             if (message.getBody().isPresent()
@@ -330,7 +443,7 @@ public class SendHelper {
             }
         }
 
-        return sendGroupMessage(message, recipients, g, ContentHint.RESENDABLE, editTargetTimestamp);
+        return sendGroupMessage(message, recipients, g, ContentHint.RESENDABLE, editTargetTimestamp, urgent);
     }
 
     private List<SendMessageResult> sendGroupMessage(
@@ -338,13 +451,13 @@ public class SendHelper {
             final Set<RecipientId> recipientIds,
             final GroupInfo groupInfo,
             final ContentHint contentHint,
-            final Optional<Long> editTargetTimestamp
+            final Optional<Long> editTargetTimestamp,
+            boolean urgent
     ) throws IOException {
         final var messageSender = dependencies.getMessageSender();
         final var messageSendLogStore = account.getMessageSendLogStore();
         final AtomicLong entryId = new AtomicLong(-1);
 
-        final var urgent = true;
         final PartialSendCompleteListener partialSendCompleteListener = sendResult -> {
             logger.trace("Partial message send result: {}", sendResult.isSuccess());
             synchronized (entryId) {
@@ -454,7 +567,7 @@ public class SendHelper {
         return results;
     }
 
-    private GroupInfo getGroupForSending(GroupId groupId) throws GroupNotFoundException, NotAGroupMemberException {
+    private GroupInfo getGroupForSending(GroupId groupId) throws GroupNotFoundException, NotAGroupMemberException, GroupSendingNotAllowedException {
         var g = context.getGroupHelper().getGroup(groupId);
         if (g == null) {
             throw new GroupNotFoundException(groupId);
@@ -462,6 +575,10 @@ public class SendHelper {
         if (!g.isMember(account.getSelfRecipientId())) {
             throw new NotAGroupMemberException(groupId, g.getTitle());
         }
+        if (g.isTerminated()) {
+            // Other clients drop messages sent to a terminated group.
+            throw new GroupSendingNotAllowedException(groupId, g.getTitle());
+        }
         if (!g.isProfileSharingEnabled()) {
             g.setProfileSharingEnabled(true);
             account.getGroupStore().updateGroup(g);
@@ -481,9 +598,31 @@ public class SendHelper {
     ) throws IOException {
         long startTime = System.currentTimeMillis();
 
-        final var addressesMap = recipientIds.stream()
+        // Recipients that are already known to be unregistered are skipped here.
+        // Otherwise every group send re-attempts them via the slow legacy 1:1
+        // fan-out, which on large groups can take tens of seconds (and time out).
+        // The unregistered flag is maintained independently by profile/CDS
+        // discovery, which clears it once a recipient registers again, so they
+        // are re-included automatically. An unregisteredFailure result is still
+        // returned for each skipped recipient, so callers see them unchanged.
+        final var skippedResults = new ArrayList<SendMessageResult>();
+        final Set<RecipientId> targetRecipientIds;
+        final var unregisteredRecipientIds = account.getRecipientStore().getUnregisteredRecipientIds(recipientIds);
+        if (unregisteredRecipientIds.isEmpty()) {
+            targetRecipientIds = recipientIds;
+        } else {
+            logger.debug("Skipping {} known-unregistered recipient(s) in group send.", unregisteredRecipientIds.size());
+            targetRecipientIds = new HashSet<>(recipientIds);
+            targetRecipientIds.removeAll(unregisteredRecipientIds);
+            for (final var recipientId : unregisteredRecipientIds) {
+                skippedResults.add(SendMessageResult.unregisteredFailure(context.getRecipientHelper()
+                        .resolveSignalServiceAddress(recipientId)));
+            }
+        }
+
+        final var addressesMap = targetRecipientIds.stream()
                 .collect(Collectors.toMap(id -> id, context.getRecipientHelper()::resolveSignalServiceAddress));
-        final var unidentifiedAccessesMap = context.getUnidentifiedAccessHelper().getAccessFor(recipientIds);
+        final var unidentifiedAccessesMap = context.getUnidentifiedAccessHelper().getAccessFor(targetRecipientIds);
         final var groupSendEndorsementsResult = getGroupSendEndorsements(groupInfo);
         final var groupSecretParams = groupInfo instanceof GroupInfoV2 gv2
                 ? GroupSecretParams.deriveFromMasterKey((gv2.getMasterKey()))
@@ -497,7 +636,7 @@ public class SendHelper {
                 : groupSendEndorsementsResult.first();
         Set<RecipientId> senderKeyTargets = groupInfo.getDistributionId() == null || groupSendEndorsements == null
                 ? Set.of()
-                : recipientIds.stream()
+                : targetRecipientIds.stream()
                         .filter(s -> this.isSenderKeyCapable(s,
                                 addressesMap.get(s),
                                 unidentifiedAccessesMap.get(s),
@@ -507,7 +646,9 @@ public class SendHelper {
             logger.debug("Too few sender-key-capable users ({}). Doing all legacy sends.", senderKeyTargets.size());
             senderKeyTargets = Set.of();
         } else {
-            logger.debug("Can use sender key for {}/{} recipients.", senderKeyTargets.size(), recipientIds.size());
+            logger.debug("Can use sender key for {}/{} recipients.",
+                    senderKeyTargets.size(),
+                    targetRecipientIds.size());
         }
 
         final var allResults = new ArrayList<SendMessageResult>(recipientIds.size());
@@ -543,11 +684,11 @@ public class SendHelper {
             }
         }
 
-        final var legacyTargets = new HashSet<>(recipientIds);
+        final var legacyTargets = new HashSet<>(targetRecipientIds);
         legacyTargets.removeAll(senderKeyTargets);
-        final boolean onlyTargetIsSelfWithLinkedDevice = recipientIds.isEmpty() && account.isMultiDevice();
+        final boolean onlyTargetIsSelfWithLinkedDevice = targetRecipientIds.isEmpty() && account.isMultiDevice();
 
-        if (!legacyTargets.isEmpty() || onlyTargetIsSelfWithLinkedDevice) {
+        if (legacySender != null && (!legacyTargets.isEmpty() || onlyTargetIsSelfWithLinkedDevice)) {
             if (!legacyTargets.isEmpty()) {
                 logger.debug("Need to do {} legacy sends.", legacyTargets.size());
             } else {
@@ -579,6 +720,7 @@ public class SendHelper {
                     isRecipientUpdate || !allResults.isEmpty());
             allResults.addAll(results);
         }
+        allResults.addAll(skippedResults);
         final var duration = Duration.ofMillis(System.currentTimeMillis() - startTime);
         logger.debug("Sending took {}", duration.toString());
         return allResults;
@@ -641,7 +783,7 @@ public class SendHelper {
             final var successCount = results.stream().filter(SendMessageResult::isSuccess).count();
             logger.debug("Successfully sent using 1:1 to {}/{} legacy targets.", successCount, addresses.size());
             return results;
-        } catch (org.whispersystems.signalservice.api.crypto.UntrustedIdentityException e) {
+        } catch (org.whispersystems.signalservice.api.crypto.UntrustedIdentityException | NoSessionException e) {
             return List.of();
         }
     }
@@ -712,10 +854,10 @@ public class SendHelper {
     private SendMessageResult sendMessage(
             SignalServiceDataMessage message,
             RecipientId recipientId,
-            Optional<Long> editTargetTimestamp
+            Optional<Long> editTargetTimestamp,
+            boolean urgent
     ) {
         final var messageSendLogStore = account.getMessageSendLogStore();
-        final var urgent = true;
         final var result = handleSendMessage(recipientId,
                 editTargetTimestamp.isEmpty()
                         ? (messageSender, address, unidentifiedAccess, includePniSignature) -> messageSender.sendDataMessage(
@@ -744,7 +886,8 @@ public class SendHelper {
 
         var address = context.getRecipientHelper().resolveSignalServiceAddress(recipientId);
         try {
-            final boolean includePniSignature = account.getRecipientStore().needsPniSignature(recipientId);
+            final boolean includePniSignature = account.getPni() != null && account.getRecipientStore()
+                    .needsPniSignature(recipientId);
             try {
                 return s.send(messageSender,
                         address,
@@ -833,7 +976,7 @@ public class SendHelper {
                 SignalServiceAddress address,
                 SealedSenderAccess unidentifiedAccess,
                 boolean includePniSignature
-        ) throws IOException, UnregisteredUserException, ProofRequiredException, RateLimitException, org.whispersystems.signalservice.api.crypto.UntrustedIdentityException;
+        ) throws IOException, UnregisteredUserException, ProofRequiredException, RateLimitException, org.whispersystems.signalservice.api.crypto.UntrustedIdentityException, NoSessionException;
     }
 
     interface SenderKeySenderHandler {
@@ -853,6 +996,6 @@ public class SendHelper {
                 List<SignalServiceAddress> recipients,
                 List<SealedSenderAccess> unidentifiedAccess,
                 boolean isRecipientUpdate
-        ) throws IOException, UntrustedIdentityException;
+        ) throws IOException, UntrustedIdentityException, NoSessionException;
     }
 }

lib/src/main/java/org/asamk/signal/manager/helper/StickerHelper.java

@@ -7,10 +7,10 @@ import org.asamk.signal.manager.storage.SignalAccount;
 import org.asamk.signal.manager.storage.stickerPacks.JsonStickerPack;
 import org.asamk.signal.manager.storage.stickers.StickerPack;
 import org.asamk.signal.manager.util.IOUtils;
+import org.signal.core.util.Hex;
 import org.signal.libsignal.protocol.InvalidMessageException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.whispersystems.signalservice.internal.util.Hex;
 
 import java.io.IOException;
 import java.util.HashSet;

lib/src/main/java/org/asamk/signal/manager/helper/StorageHelper.java

@@ -2,20 +2,29 @@ package org.asamk.signal.manager.helper;
 
 import org.asamk.signal.manager.api.GroupIdV1;
 import org.asamk.signal.manager.api.GroupIdV2;
+import org.asamk.signal.manager.api.Pair;
 import org.asamk.signal.manager.api.Profile;
+import org.asamk.signal.manager.api.StickerPackId;
 import org.asamk.signal.manager.internal.SignalDependencies;
 import org.asamk.signal.manager.storage.SignalAccount;
 import org.asamk.signal.manager.storage.recipients.RecipientId;
+import org.asamk.signal.manager.storage.stickers.StickerPack;
 import org.asamk.signal.manager.syncStorage.AccountRecordProcessor;
 import org.asamk.signal.manager.syncStorage.ContactRecordProcessor;
 import org.asamk.signal.manager.syncStorage.GroupV1RecordProcessor;
 import org.asamk.signal.manager.syncStorage.GroupV2RecordProcessor;
+import org.asamk.signal.manager.syncStorage.StickerPackRecordProcessor;
+import org.asamk.signal.manager.syncStorage.StorageSyncLoopDetector;
 import org.asamk.signal.manager.syncStorage.StorageSyncModels;
 import org.asamk.signal.manager.syncStorage.StorageSyncValidations;
 import org.asamk.signal.manager.syncStorage.WriteOperationResult;
 import org.asamk.signal.manager.util.KeyUtils;
+import org.signal.core.models.storageservice.StorageKey;
 import org.signal.core.util.SetUtil;
 import org.signal.libsignal.protocol.InvalidKeyException;
+import org.signal.network.service.StorageServiceService;
+import org.signal.network.service.StorageServiceService.ManifestIfDifferentVersionResult;
+import org.signal.network.service.StorageServiceService.WriteStorageRecordsResult;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.push.exceptions.NotFoundException;
@@ -23,11 +32,7 @@ import org.whispersystems.signalservice.api.storage.RecordIkm;
 import org.whispersystems.signalservice.api.storage.SignalStorageManifest;
 import org.whispersystems.signalservice.api.storage.SignalStorageRecord;
 import org.whispersystems.signalservice.api.storage.StorageId;
-import org.whispersystems.signalservice.api.storage.StorageKey;
 import org.whispersystems.signalservice.api.storage.StorageRecordConvertersKt;
-import org.whispersystems.signalservice.api.storage.StorageServiceRepository;
-import org.whispersystems.signalservice.api.storage.StorageServiceRepository.ManifestIfDifferentVersionResult;
-import org.whispersystems.signalservice.api.storage.StorageServiceRepository.WriteStorageRecordsResult;
 import org.whispersystems.signalservice.internal.storage.protos.ManifestRecord;
 import org.whispersystems.signalservice.internal.storage.protos.StorageRecord;
 
@@ -38,8 +43,10 @@ import java.util.ArrayList;
 import java.util.Base64;
 import java.util.Collection;
 import java.util.Collections;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.stream.Collectors;
 
 import static org.asamk.signal.manager.util.Utils.handleResponseException;
@@ -50,16 +57,19 @@ public class StorageHelper {
     private static final List<Integer> KNOWN_TYPES = List.of(ManifestRecord.Identifier.Type.CONTACT.getValue(),
             ManifestRecord.Identifier.Type.GROUPV1.getValue(),
             ManifestRecord.Identifier.Type.GROUPV2.getValue(),
-            ManifestRecord.Identifier.Type.ACCOUNT.getValue());
+            ManifestRecord.Identifier.Type.ACCOUNT.getValue(),
+            ManifestRecord.Identifier.Type.STICKER_PACK.getValue());
 
     private final SignalAccount account;
     private final SignalDependencies dependencies;
     private final Context context;
+    private final StorageSyncLoopDetector storageSyncLoopDetector;
 
     public StorageHelper(final Context context) {
         this.account = context.getAccount();
         this.dependencies = context.getDependencies();
         this.context = context;
+        this.storageSyncLoopDetector = new StorageSyncLoopDetector(account::isMultiDevice);
     }
 
     public void syncDataWithStorage() throws IOException {
@@ -78,6 +88,8 @@ public class StorageHelper {
         final var storageServiceRepository = dependencies.getStorageServiceRepository();
         final var result = storageServiceRepository.getStorageManifestIfDifferentVersion(storageKey,
                 localManifestVersion);
+        final var fetchedRemoteManifest = result instanceof ManifestIfDifferentVersionResult.DifferentVersion;
+        final Set<StorageId> identityConflictsPendingRepair = new HashSet<>();
 
         var needsForcePush = false;
         final var remoteManifest = switch (result) {
@@ -106,18 +118,22 @@ public class StorageHelper {
 
             if (remoteManifest.version > localManifestVersion) {
                 logger.trace("Remote version was newer, reading records.");
-                needsForcePush = readDataFromStorage(storageKey, localManifest, remoteManifest);
+                needsForcePush = readDataFromStorage(storageKey,
+                        localManifest,
+                        remoteManifest,
+                        identityConflictsPendingRepair);
             } else if (remoteManifest.version < localManifest.version) {
                 logger.debug("Remote storage manifest version was older. User might have switched accounts.");
             }
             logger.trace("Done reading data from remote storage");
 
-            readRecordsWithPreviouslyUnknownTypes(storageKey, remoteManifest);
+            readRecordsWithPreviouslyUnknownTypes(storageKey, remoteManifest, identityConflictsPendingRepair);
         }
 
         logger.trace("Adding missing storageIds to local data");
         account.getRecipientStore().setMissingStorageIds();
         account.getGroupStore().setMissingStorageIds();
+        account.getStickerStore().setMissingStorageIds();
 
         var needsMultiDeviceSync = false;
 
@@ -139,7 +155,11 @@ public class StorageHelper {
             needsForcePush = true;
         } else {
             try {
-                needsMultiDeviceSync = writeToStorage(storageKey, remoteManifest, needsForcePush);
+                needsMultiDeviceSync = writeToStorage(storageKey,
+                        remoteManifest,
+                        needsForcePush,
+                        fetchedRemoteManifest,
+                        identityConflictsPendingRepair);
             } catch (RetryLaterException e) {
                 // TODO retry later
                 return;
@@ -184,7 +204,8 @@ public class StorageHelper {
     private boolean readDataFromStorage(
             final StorageKey storageKey,
             final SignalStorageManifest localManifest,
-            final SignalStorageManifest remoteManifest
+            final SignalStorageManifest remoteManifest,
+            final Set<StorageId> identityConflictsPendingRepair
     ) throws IOException {
         var needsForcePush = false;
         try (final var connection = account.getAccountDatabase().getConnection()) {
@@ -211,19 +232,28 @@ public class StorageHelper {
                             remoteOnlyRecords.size());
                 }
 
+                final var listListPair = processKnownRecords(connection,
+                        remoteOnlyRecords,
+                        identityConflictsPendingRepair);
+                final var unknownInserts = listListPair.first();
+                final var updatedStorageIds = listListPair.second();
+                final var oldUnregisteredLocalOnlyIds = new HashSet<>(idDifference.localOnlyIds());
+                updatedStorageIds.forEach(oldUnregisteredLocalOnlyIds::remove);
                 if (!idDifference.localOnlyIds().isEmpty()) {
                     final var updated = account.getRecipientStore()
                             .removeStorageIdsFromLocalOnlyUnregisteredRecipients(connection,
-                                    idDifference.localOnlyIds());
+                                    oldUnregisteredLocalOnlyIds);
+                    final var updatedStickers = account.getStickerStore()
+                            .removeStorageIdsFromLocalOnlyDeletedStickerPacks(connection, oldUnregisteredLocalOnlyIds);
 
-                    if (updated > 0) {
+                    if (updated > 0 || updatedStickers > 0) {
                         logger.warn(
-                                "Found {} records that were deleted remotely but only marked unregistered locally. Removed those from local store.",
-                                updated);
+                                "Found {} recipients and {} sticker packs that were deleted remotely but only marked deleted locally. Removed those from local store.",
+                                updated,
+                                updatedStickers);
                     }
                 }
 
-                final var unknownInserts = processKnownRecords(connection, remoteOnlyRecords);
                 final var unknownDeletes = idDifference.localOnlyIds()
                         .stream()
                         .filter(id -> !KNOWN_TYPES.contains(id.getType()))
@@ -247,7 +277,8 @@ public class StorageHelper {
 
     private void readRecordsWithPreviouslyUnknownTypes(
             final StorageKey storageKey,
-            final SignalStorageManifest remoteManifest
+            final SignalStorageManifest remoteManifest,
+            final Set<StorageId> identityConflictsPendingRepair
     ) throws IOException {
         try (final var connection = account.getAccountDatabase().getConnection()) {
             connection.setAutoCommit(false);
@@ -261,9 +292,8 @@ public class StorageHelper {
 
                 logger.debug("Found {} of the known-unknowns remotely.", remote.size());
 
-                processKnownRecords(connection, remote);
-                account.getUnknownStorageIdStore()
-                        .deleteUnknownStorageIds(connection, remote.stream().map(SignalStorageRecord::getId).toList());
+                processKnownRecords(connection, remote, identityConflictsPendingRepair);
+                account.getUnknownStorageIdStore().deleteUnknownStorageIds(connection, knownUnknownIds);
             }
             connection.commit();
         } catch (SQLException e) {
@@ -274,7 +304,9 @@ public class StorageHelper {
     private boolean writeToStorage(
             final StorageKey storageKey,
             final SignalStorageManifest remoteManifest,
-            final boolean needsForcePush
+            final boolean needsForcePush,
+            final boolean fetchedRemoteManifest,
+            final Set<StorageId> identityConflictsPendingRepair
     ) throws IOException, RetryLaterException {
         final WriteOperationResult remoteWriteOperation;
         try (final var connection = account.getAccountDatabase().getConnection()) {
@@ -284,10 +316,8 @@ public class StorageHelper {
             var idDifference = findIdDifference(remoteManifest.storageIds, localStorageIds);
             logger.debug("ID Difference :: {}", idDifference);
 
-            final var unknownOnlyLocal = idDifference.localOnlyIds()
-                    .stream()
-                    .filter(id -> !KNOWN_TYPES.contains(id.getType()))
-                    .toList();
+            final var unknownStorageIds = account.getUnknownStorageIdStore().getUnknownStorageIds(connection);
+            final var unknownOnlyLocal = findUnknownOnlyLocalStorageIds(idDifference.localOnlyIds(), unknownStorageIds);
 
             if (!unknownOnlyLocal.isEmpty()) {
                 logger.debug("Storage ids with unknown type: {} to delete", unknownOnlyLocal.size());
@@ -312,6 +342,28 @@ public class StorageHelper {
 
         if (remoteWriteOperation.isEmpty()) {
             logger.debug("No remote writes needed. Still at version: {}", remoteManifest.version);
+            storageSyncLoopDetector.onConverged();
+            return false;
+        }
+
+        final var onlyIdentityConflictsPendingRepair = containsOnlyIdentityConflictsPendingRepair(remoteWriteOperation,
+                identityConflictsPendingRepair);
+        if (onlyIdentityConflictsPendingRepair) {
+            logger.warn(
+                    "Deferring remote write until the profile fetch says whose identity key is correct. WriteOperationResult :: {}",
+                    remoteWriteOperation);
+            return false;
+        }
+
+        final var loopCheck = storageSyncLoopDetector.onWriteAttempt(remoteWriteOperation,
+                fetchedRemoteManifest,
+                false);
+        if (loopCheck instanceof StorageSyncLoopDetector.Decision.Denied denied) {
+            logger.warn(
+                    "Skipping remote write, another device is likely undoing it. Cause: {}, level: {}. WriteOperationResult :: {}",
+                    denied.cause(),
+                    denied.level(),
+                    remoteWriteOperation);
             return false;
         }
 
@@ -330,11 +382,18 @@ public class StorageHelper {
                         remoteWriteOperation.deletes());
         switch (result) {
             case WriteStorageRecordsResult.ConflictError ignored -> {
+                storageSyncLoopDetector.onWriteFailed();
                 logger.debug("Hit a conflict when trying to resolve the conflict! Retrying.");
                 throw new RetryLaterException();
             }
-            case WriteStorageRecordsResult.NetworkError networkError -> throw networkError.getException();
-            case WriteStorageRecordsResult.StatusCodeError statusCodeError -> throw statusCodeError.getException();
+            case WriteStorageRecordsResult.NetworkError networkError -> {
+                storageSyncLoopDetector.onWriteFailed();
+                throw networkError.getException();
+            }
+            case WriteStorageRecordsResult.StatusCodeError statusCodeError -> {
+                storageSyncLoopDetector.onWriteFailed();
+                throw statusCodeError.getException();
+            }
             case WriteStorageRecordsResult.Success ignored -> {
                 logger.debug("Saved new manifest. Now at version: {}", remoteWriteOperation.manifest().version);
                 storeManifestLocally(remoteWriteOperation.manifest());
@@ -344,6 +403,22 @@ public class StorageHelper {
         }
     }
 
+    static List<StorageId> findUnknownOnlyLocalStorageIds(
+            final List<StorageId> localOnlyStorageIds,
+            final Set<StorageId> unknownStorageIds
+    ) {
+        return localOnlyStorageIds.stream().filter(unknownStorageIds::contains).toList();
+    }
+
+    static boolean containsOnlyIdentityConflictsPendingRepair(
+            final WriteOperationResult writeOperation,
+            final Set<StorageId> identityConflictsPendingRepair
+    ) {
+        return writeOperation.deletes().isEmpty() && !writeOperation.inserts().isEmpty() && writeOperation.inserts()
+                .stream()
+                .allMatch(record -> identityConflictsPendingRepair.contains(record.getId()));
+    }
+
     private void forcePushToStorage(
             final StorageKey storageServiceKey
     ) throws IOException, RetryLaterException {
@@ -360,6 +435,7 @@ public class StorageHelper {
         final Map<RecipientId, StorageId> newContactStorageIds;
         final Map<GroupIdV1, StorageId> newGroupV1StorageIds;
         final Map<GroupIdV2, StorageId> newGroupV2StorageIds;
+        final Map<StickerPackId, StorageId> newStickerPackStorageIds;
 
         try (final var connection = account.getAccountDatabase().getConnection()) {
             connection.setAutoCommit(false);
@@ -406,6 +482,19 @@ public class StorageHelper {
                         new StorageRecord.Builder().groupV2(record).build()));
             }
 
+            final var stickerPacks = account.getStickerStore()
+                    .getStickerPacks(connection)
+                    .stream()
+                    .filter(pack -> pack.storageId() != null)
+                    .toList();
+            newStickerPackStorageIds = generateStickerPackStorageIds(stickerPacks);
+            for (final var stickerPack : stickerPacks) {
+                final var storageId = newStickerPackStorageIds.get(stickerPack.packId());
+                final var record = StorageSyncModels.localToRemoteRecord(stickerPack);
+                newStorageRecords.add(new SignalStorageRecord(storageId,
+                        new StorageRecord.Builder().stickerPack(record).build()));
+            }
+
             connection.commit();
         } catch (SQLException e) {
             throw new RuntimeException("Failed to sync remote storage", e);
@@ -456,6 +545,7 @@ public class StorageHelper {
             connection.setAutoCommit(false);
             account.getRecipientStore().updateStorageIds(connection, newContactStorageIds);
             account.getGroupStore().updateStorageIds(connection, newGroupV1StorageIds, newGroupV2StorageIds);
+            account.getStickerStore().updateStorageIds(connection, newStickerPackStorageIds);
 
             // delete all unknown storage ids
             account.getUnknownStorageIdStore().deleteAllUnknownStorageIds(connection);
@@ -479,13 +569,21 @@ public class StorageHelper {
     private Map<GroupIdV1, StorageId> generateGroupV1StorageIds(List<GroupIdV1> groupIds) {
         return groupIds.stream()
                 .collect(Collectors.toMap(recipientId -> recipientId,
-                        recipientId -> StorageId.forGroupV1(KeyUtils.createRawStorageId())));
+                        _ -> StorageId.forGroupV1(KeyUtils.createRawStorageId())));
     }
 
     private Map<GroupIdV2, StorageId> generateGroupV2StorageIds(List<GroupIdV2> groupIds) {
         return groupIds.stream()
                 .collect(Collectors.toMap(recipientId -> recipientId,
-                        recipientId -> StorageId.forGroupV2(KeyUtils.createRawStorageId())));
+                        _ -> StorageId.forGroupV2(KeyUtils.createRawStorageId())));
+    }
+
+    private Map<StickerPackId, StorageId> generateStickerPackStorageIds(
+            final List<StickerPack> stickerPacks
+    ) {
+        return stickerPacks.stream()
+                .collect(Collectors.toMap(stickerPack -> stickerPack.packId(),
+                        _ -> StorageId.forStickerPack(KeyUtils.createRawStorageId())));
     }
 
     private void storeManifestLocally(
@@ -503,7 +601,7 @@ public class StorageHelper {
         final var result = dependencies.getStorageServiceRepository()
                 .readStorageRecords(storageKey, manifest.recordIkm, storageIds);
         return switch (result) {
-            case StorageServiceRepository.StorageRecordResult.DecryptionError decryptionError -> {
+            case StorageServiceService.StorageRecordResult.DecryptionError decryptionError -> {
                 if (decryptionError.getException() instanceof InvalidKeyException) {
                     logger.warn("Failed to read storage records, ignoring.");
                     yield List.of();
@@ -513,11 +611,11 @@ public class StorageHelper {
                     throw new IOException(decryptionError.getException());
                 }
             }
-            case StorageServiceRepository.StorageRecordResult.NetworkError networkError ->
+            case StorageServiceService.StorageRecordResult.NetworkError networkError ->
                     throw networkError.getException();
-            case StorageServiceRepository.StorageRecordResult.StatusCodeError statusCodeError ->
+            case StorageServiceService.StorageRecordResult.StatusCodeError statusCodeError ->
                     throw statusCodeError.getException();
-            case StorageServiceRepository.StorageRecordResult.Success success -> success.getRecords();
+            case StorageServiceService.StorageRecordResult.Success success -> success.getRecords();
             default -> throw new IllegalStateException("Unexpected value: " + result);
         };
     }
@@ -527,6 +625,7 @@ public class StorageHelper {
         storageIds.addAll(account.getUnknownStorageIdStore().getUnknownStorageIds(connection));
         storageIds.addAll(account.getGroupStore().getStorageIds(connection));
         storageIds.addAll(account.getRecipientStore().getStorageIds(connection));
+        storageIds.addAll(account.getStickerStore().getStorageIds(connection));
         storageIds.add(account.getRecipientStore().getSelfStorageId(connection));
         return storageIds;
     }
@@ -575,6 +674,14 @@ public class StorageHelper {
                         account.getUsernameLink());
                 yield new SignalStorageRecord(storageId, new StorageRecord.Builder().account(record).build());
             }
+            case ManifestRecord.Identifier.Type.STICKER_PACK -> {
+                final var stickerPack = account.getStickerStore().getStickerPack(connection, storageId);
+                if (stickerPack == null) {
+                    throw new AssertionError("Missing local sticker pack model for storage id: " + storageId);
+                }
+                final var record = StorageSyncModels.localToRemoteRecord(stickerPack);
+                yield new SignalStorageRecord(storageId, new StorageRecord.Builder().stickerPack(record).build());
+            }
             case null, default -> {
                 throw new AssertionError("Got unknown local storage record type: " + storageId);
             }
@@ -629,16 +736,29 @@ public class StorageHelper {
         return new IdDifferenceResult(remoteOnlyKeys, localOnlyKeys, hasTypeMismatch);
     }
 
-    private List<StorageId> processKnownRecords(
+    private Pair<List<StorageId>, List<StorageId>> processKnownRecords(
             final Connection connection,
-            List<SignalStorageRecord> records
+            List<SignalStorageRecord> records,
+            final Set<StorageId> identityConflictsPendingRepair
     ) throws SQLException {
         final var unknownRecords = new ArrayList<StorageId>();
+        final var processedRecords = new ArrayList<StorageId>();
 
         final var accountRecordProcessor = new AccountRecordProcessor(account, connection, context.getJobExecutor());
-        final var contactRecordProcessor = new ContactRecordProcessor(account, connection, context.getJobExecutor());
         final var groupV1RecordProcessor = new GroupV1RecordProcessor(account, connection);
         final var groupV2RecordProcessor = new GroupV2RecordProcessor(account, connection);
+        final var contactRecordProcessor = new ContactRecordProcessor(account,
+                connection,
+                context.getJobExecutor(),
+                identityConflictsPendingRepair);
+        final var stickerPackRecordProcessor = new StickerPackRecordProcessor(account, connection);
+
+        final var contactRecords = records.stream()
+                .filter(record -> record.getProto().contact != null)
+                .map(record -> StorageRecordConvertersKt.toSignalContactRecord(record.getProto().contact,
+                        record.getId()))
+                .toList();
+        contactRecordProcessor.prepare(contactRecords);
 
         for (final var record : records) {
             if (record.getProto().account != null) {
@@ -657,12 +777,21 @@ public class StorageHelper {
                 logger.debug("Reading record {} of type contact", record.getId());
                 contactRecordProcessor.process(StorageRecordConvertersKt.toSignalContactRecord(record.getProto().contact,
                         record.getId()));
+            } else if (record.getProto().stickerPack != null) {
+                logger.debug("Reading record {} of type stickerPack", record.getId());
+                stickerPackRecordProcessor.process(StorageRecordConvertersKt.toSignalStickerPackRecord(record.getProto().stickerPack,
+                        record.getId()));
             } else {
                 unknownRecords.add(record.getId());
             }
         }
+        processedRecords.addAll(accountRecordProcessor.getUpdatedStorageIds());
+        processedRecords.addAll(groupV1RecordProcessor.getUpdatedStorageIds());
+        processedRecords.addAll(groupV2RecordProcessor.getUpdatedStorageIds());
+        processedRecords.addAll(contactRecordProcessor.getUpdatedStorageIds());
+        processedRecords.addAll(stickerPackRecordProcessor.getUpdatedStorageIds());
 
-        return unknownRecords;
+        return new Pair<>(unknownRecords, processedRecords);
     }
 
     /**

lib/src/main/java/org/asamk/signal/manager/helper/SyncHelper.java

@@ -12,6 +12,7 @@ import org.asamk.signal.manager.storage.stickers.StickerPack;
 import org.asamk.signal.manager.util.IOUtils;
 import org.asamk.signal.manager.util.MimeUtils;
 import org.jetbrains.annotations.NotNull;
+import org.signal.core.models.ServiceId;
 import org.signal.libsignal.protocol.IdentityKey;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -36,8 +37,8 @@ import org.whispersystems.signalservice.api.messages.multidevice.SignalServiceSy
 import org.whispersystems.signalservice.api.messages.multidevice.StickerPackOperationMessage;
 import org.whispersystems.signalservice.api.messages.multidevice.VerifiedMessage;
 import org.whispersystems.signalservice.api.messages.multidevice.ViewedMessage;
-import org.whispersystems.signalservice.api.push.ServiceId;
 import org.whispersystems.signalservice.api.push.SignalServiceAddress;
+import org.whispersystems.signalservice.api.util.StreamDetails;
 import org.whispersystems.signalservice.internal.push.SyncMessage;
 
 import java.io.FileInputStream;
@@ -52,6 +53,8 @@ import java.util.Optional;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+import okio.ByteString;
+
 public class SyncHelper {
 
     private static final Logger logger = LoggerFactory.getLogger(SyncHelper.class);
@@ -86,7 +89,7 @@ public class SyncHelper {
                 .sendSyncMessage(SignalServiceSyncMessage.forFetchLatest(SignalServiceSyncMessage.FetchType.STORAGE_MANIFEST));
     }
 
-    public void sendSyncReceiptMessage(ServiceId sender, SignalServiceReceiptMessage receiptMessage) {
+    public void sendSyncReceiptMessage(ServiceId.ACI sender, SignalServiceReceiptMessage receiptMessage) {
         if (receiptMessage.isReadReceipt()) {
             final var readMessages = receiptMessage.getTimestamps()
                     .stream()
@@ -112,7 +115,7 @@ public class SyncHelper {
                     if (record instanceof GroupInfoV1 groupInfo) {
                         out.write(new DeviceGroup(groupInfo.getGroupId().serialize(),
                                 Optional.ofNullable(groupInfo.name),
-                                groupInfo.getMembers()
+                                groupInfo.getMemberRecipientIds()
                                         .stream()
                                         .map(context.getRecipientHelper()::resolveSignalServiceAddress)
                                         .toList(),
@@ -129,11 +132,14 @@ public class SyncHelper {
 
             if (groupsFile.exists() && groupsFile.length() > 0) {
                 try (var groupsFileStream = new FileInputStream(groupsFile)) {
-                    final var uploadSpec = context.getDependencies().getMessageSender().getResumableUploadSpec();
+                    final var streamDetails = new StreamDetails(groupsFileStream,
+                            MimeUtils.OCTET_STREAM,
+                            groupsFile.length());
+                    final var uploadSpec = context.getAttachmentHelper().getResumableUploadSpec(streamDetails);
                     var attachmentStream = SignalServiceAttachment.newStreamBuilder()
-                            .withStream(groupsFileStream)
-                            .withContentType(MimeUtils.OCTET_STREAM)
-                            .withLength(groupsFile.length())
+                            .withStream(streamDetails.getStream())
+                            .withContentType(streamDetails.getContentType())
+                            .withLength(streamDetails.getLength())
                             .withResumableUploadSpec(uploadSpec)
                             .build();
 
@@ -188,11 +194,14 @@ public class SyncHelper {
 
             if (contactsFile.exists() && contactsFile.length() > 0) {
                 try (var contactsFileStream = new FileInputStream(contactsFile)) {
-                    final var uploadSpec = context.getDependencies().getMessageSender().getResumableUploadSpec();
+                    final var streamDetails = new StreamDetails(contactsFileStream,
+                            MimeUtils.OCTET_STREAM,
+                            contactsFile.length());
+                    final var uploadSpec = context.getAttachmentHelper().getResumableUploadSpec(streamDetails);
                     var attachmentStream = SignalServiceAttachment.newStreamBuilder()
-                            .withStream(contactsFileStream)
-                            .withContentType(MimeUtils.OCTET_STREAM)
-                            .withLength(contactsFile.length())
+                            .withStream(streamDetails.getStream())
+                            .withContentType(streamDetails.getContentType())
+                            .withLength(streamDetails.getLength())
                             .withResumableUploadSpec(uploadSpec)
                             .build();
 
@@ -228,18 +237,19 @@ public class SyncHelper {
                 final var address = account.getRecipientAddressResolver().resolveRecipientAddress(record.first());
                 if (address.aci().isPresent() || address.number().isPresent()) {
                     addresses.add(new BlockedListMessage.Individual(address.aci().orElse(null),
-                            address.number().orElse(null)));
+                            address.number().orElse(null),
+                            record.second().blockedAt()));
                 }
             }
         }
-        var groupIds = new ArrayList<byte[]>();
+        var groups = new ArrayList<BlockedListMessage.Group>();
         for (var record : account.getGroupStore().getGroups()) {
             if (record.isBlocked()) {
-                groupIds.add(record.getGroupId().serialize());
+                groups.add(new BlockedListMessage.Group(record.getGroupId().serialize(), record.getBlockedAt()));
             }
         }
         return context.getSendHelper()
-                .sendSyncMessage(SignalServiceSyncMessage.forBlocked(new BlockedListMessage(addresses, groupIds)));
+                .sendSyncMessage(SignalServiceSyncMessage.forBlocked(new BlockedListMessage(addresses, groups)));
     }
 
     public SendMessageResult sendVerifiedMessage(
@@ -256,7 +266,6 @@ public class SyncHelper {
 
     public SendMessageResult sendKeysMessage() {
         var keysMessage = new KeysMessage(account.getOrCreateStorageKey(),
-                account.getOrCreatePinMasterKey(),
                 account.getOrCreateAccountEntropyPool(),
                 account.getOrCreateMediaRootBackupKey());
         return context.getSendHelper().sendSyncMessage(SignalServiceSyncMessage.forKeys(keysMessage));
@@ -291,7 +300,7 @@ public class SyncHelper {
         return context.getSendHelper().sendSyncMessage(SignalServiceSyncMessage.forConfiguration(configurationMessage));
     }
 
-    public void handleSyncDeviceGroups(final InputStream input) {
+    public void handleSyncDeviceGroups(final InputStream input, final boolean ignoreAvatars) {
         final var s = new DeviceGroupsInputStream(input);
         DeviceGroup g;
         while (true) {
@@ -324,7 +333,7 @@ public class SyncHelper {
                     syncGroup.color = g.getColor().get();
                 }
 
-                if (g.getAvatar().isPresent()) {
+                if (g.getAvatar().isPresent() && !ignoreAvatars) {
                     context.getGroupHelper().downloadGroupAvatar(syncGroup.getGroupId(), g.getAvatar().get());
                 }
                 syncGroup.archived = g.isArchived();
@@ -333,7 +342,7 @@ public class SyncHelper {
         }
     }
 
-    public void handleSyncDeviceContacts(final InputStream input) throws IOException {
+    public void handleSyncDeviceContacts(final InputStream input, final boolean ignoreAvatars) throws IOException {
         final var s = new DeviceContactsInputStream(input);
         DeviceContact c;
         while (true) {
@@ -379,7 +388,11 @@ public class SyncHelper {
             account.getContactStore().storeContact(recipientId, builder.build());
 
             if (c.getAvatar().isPresent()) {
-                storeContactAvatar(c.getAvatar().get(), address);
+                if (!ignoreAvatars) {
+                    storeContactAvatar(c.getAvatar().get(), address);
+                } else {
+                    IOUtils.discardStream(c.getAvatar().get().getInputStream());
+                }
             }
         }
     }
@@ -406,6 +419,11 @@ public class SyncHelper {
         return context.getSendHelper().sendSyncMessage(SignalServiceSyncMessage.forMessageRequestResponse(response));
     }
 
+    public SendMessageResult sendDeviceNameChange(final int deviceId) {
+        final var deviceNameChange = new SyncMessage.DeviceNameChange(deviceId, ByteString.EMPTY);
+        return context.getSendHelper().sendSyncMessage(SignalServiceSyncMessage.forDeviceNameChange(deviceNameChange));
+    }
+
     private SendMessageResult requestSyncData(final SyncMessage.Request.Type type) {
         var r = new SyncMessage.Request.Builder().type(type).build();
         var message = SignalServiceSyncMessage.forRequest(new RequestMessage(r));

lib/src/main/java/org/asamk/signal/manager/internal/AccountFileUpdaterImpl.java

@@ -2,7 +2,7 @@ package org.asamk.signal.manager.internal;
 
 import org.asamk.signal.manager.helper.AccountFileUpdater;
 import org.asamk.signal.manager.storage.accounts.AccountsStore;
-import org.whispersystems.signalservice.api.push.ServiceId.ACI;
+import org.signal.core.models.ServiceId.ACI;
 
 public class AccountFileUpdaterImpl implements AccountFileUpdater {
 

lib/src/main/java/org/asamk/signal/manager/internal/JobExecutor.java

@@ -20,7 +20,7 @@ public class JobExecutor implements AutoCloseable {
 
     public JobExecutor(final Context context) {
         this.context = context;
-        this.executorService = Executors.newCachedThreadPool();
+        this.executorService = Executors.newVirtualThreadPerTaskExecutor();
     }
 
     public void enqueueJob(Job job) {

lib/src/main/java/org/asamk/signal/manager/internal/ManagerImpl.java

@@ -19,6 +19,8 @@ package org.asamk.signal.manager.internal;
 import org.asamk.signal.manager.Manager;
 import org.asamk.signal.manager.api.AlreadyReceivingException;
 import org.asamk.signal.manager.api.AttachmentInvalidException;
+import org.asamk.signal.manager.api.CallInfo;
+import org.asamk.signal.manager.api.CallOffer;
 import org.asamk.signal.manager.api.CaptchaRejectedException;
 import org.asamk.signal.manager.api.CaptchaRequiredException;
 import org.asamk.signal.manager.api.Configuration;
@@ -62,6 +64,7 @@ import org.asamk.signal.manager.api.StickerPackId;
 import org.asamk.signal.manager.api.StickerPackInvalidException;
 import org.asamk.signal.manager.api.StickerPackUrl;
 import org.asamk.signal.manager.api.TextStyle;
+import org.asamk.signal.manager.api.TurnServer;
 import org.asamk.signal.manager.api.TypingAction;
 import org.asamk.signal.manager.api.UnregisteredRecipientException;
 import org.asamk.signal.manager.api.UpdateGroup;
@@ -80,6 +83,7 @@ import org.asamk.signal.manager.storage.AttachmentStore;
 import org.asamk.signal.manager.storage.AvatarStore;
 import org.asamk.signal.manager.storage.SignalAccount;
 import org.asamk.signal.manager.storage.groups.GroupInfo;
+import org.asamk.signal.manager.storage.groups.GroupInfoV2;
 import org.asamk.signal.manager.storage.identities.IdentityInfo;
 import org.asamk.signal.manager.storage.recipients.RecipientAddress;
 import org.asamk.signal.manager.storage.recipients.RecipientId;
@@ -91,27 +95,36 @@ import org.asamk.signal.manager.util.KeyUtils;
 import org.asamk.signal.manager.util.MimeUtils;
 import org.asamk.signal.manager.util.PhoneNumberFormatter;
 import org.asamk.signal.manager.util.StickerUtils;
-import org.signal.core.util.Base64;
+import org.signal.core.models.ServiceId;
+import org.signal.core.models.ServiceId.ACI;
+import org.signal.core.models.ServiceId.PNI;
+import org.signal.core.util.Hex;
+import org.signal.core.util.crypto.DeviceName;
+import org.signal.core.util.crypto.DeviceNameCipher;
+import org.signal.libsignal.net.LinkedDevice;
 import org.signal.libsignal.protocol.InvalidMessageException;
+import org.signal.libsignal.protocol.NoSessionException;
 import org.signal.libsignal.usernames.BaseUsernameException;
+import org.signal.network.exceptions.NonSuccessfulResponseCodeException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.whispersystems.signalservice.api.crypto.UntrustedIdentityException;
 import org.whispersystems.signalservice.api.messages.SignalServiceAttachment;
 import org.whispersystems.signalservice.api.messages.SignalServiceDataMessage;
+import org.whispersystems.signalservice.api.messages.SignalServiceGroupV2;
 import org.whispersystems.signalservice.api.messages.SignalServicePreview;
 import org.whispersystems.signalservice.api.messages.SignalServiceReceiptMessage;
+import org.whispersystems.signalservice.api.messages.SignalServiceStoryMessage;
 import org.whispersystems.signalservice.api.messages.SignalServiceTypingMessage;
-import org.whispersystems.signalservice.api.messages.multidevice.DeviceInfo;
-import org.whispersystems.signalservice.api.push.ServiceId;
-import org.whispersystems.signalservice.api.push.ServiceId.ACI;
-import org.whispersystems.signalservice.api.push.ServiceId.PNI;
+import org.whispersystems.signalservice.api.messages.calls.AnswerMessage;
+import org.whispersystems.signalservice.api.messages.calls.BusyMessage;
+import org.whispersystems.signalservice.api.messages.calls.HangupMessage;
+import org.whispersystems.signalservice.api.messages.calls.IceUpdateMessage;
+import org.whispersystems.signalservice.api.messages.calls.OfferMessage;
+import org.whispersystems.signalservice.api.messages.calls.SignalServiceCallMessage;
 import org.whispersystems.signalservice.api.push.ServiceIdType;
 import org.whispersystems.signalservice.api.push.exceptions.CdsiResourceExhaustedException;
-import org.whispersystems.signalservice.api.push.exceptions.UsernameMalformedException;
-import org.whispersystems.signalservice.api.push.exceptions.UsernameTakenException;
-import org.whispersystems.signalservice.api.util.DeviceNameUtil;
 import org.whispersystems.signalservice.api.util.StreamDetails;
-import org.whispersystems.signalservice.internal.util.Hex;
 import org.whispersystems.signalservice.internal.util.Util;
 
 import java.io.ByteArrayInputStream;
@@ -147,6 +160,7 @@ import okio.Utf8;
 
 import static org.asamk.signal.manager.config.ServiceConfig.MAX_MESSAGE_SIZE_BYTES;
 import static org.asamk.signal.manager.util.Utils.handleResponseException;
+import static org.asamk.signal.manager.util.Utils.handleResponseExceptionSuspend;
 import static org.signal.core.util.StringExtensionsKt.splitByByteLength;
 
 public class ManagerImpl implements Manager {
@@ -157,7 +171,7 @@ public class ManagerImpl implements Manager {
     private final SignalDependencies dependencies;
     private final Context context;
 
-    private final ExecutorService executor = Executors.newCachedThreadPool();
+    private final ExecutorService executor = Executors.newVirtualThreadPerTaskExecutor();
 
     private Thread receiveThread;
     private boolean isReceivingSynchronous;
@@ -182,6 +196,7 @@ public class ManagerImpl implements Manager {
                 userAgent,
                 account.getCredentialsProvider(),
                 account.getSignalServiceDataStore(),
+                account.getDeviceId(),
                 executor,
                 sessionLock);
         final var avatarStore = new AvatarStore(pathConfig.avatarsPath());
@@ -235,6 +250,11 @@ public class ManagerImpl implements Manager {
         return account.getNumber();
     }
 
+    @Override
+    public String getSelfACI() {
+        return account.getAci().toString();
+    }
+
     public void checkAccountState() throws IOException {
         context.getAccountHelper().checkAccountState();
         final var lastRecipientsRefresh = account.getLastRecipientsRefresh();
@@ -270,7 +290,7 @@ public class ManagerImpl implements Manager {
             registeredUsers = context.getRecipientHelper().getRegisteredUsers(canonicalizedNumbersSet);
         } catch (CdsiResourceExhaustedException e) {
             logger.debug("CDSI resource exhausted: {}", e.getMessage());
-            throw new RateLimitException(System.currentTimeMillis() + e.getRetryAfterSeconds() * 1000L);
+            throw new RateLimitException(e.getRetryAfterSeconds() * 1000L);
         }
 
         return numbers.stream().collect(Collectors.toMap(n -> n, n -> {
@@ -402,10 +422,8 @@ public class ManagerImpl implements Manager {
             } else {
                 context.getAccountHelper().reserveUsernameFromNickname(username);
             }
-        } catch (UsernameMalformedException e) {
-            throw new InvalidUsernameException("Username is malformed", e);
-        } catch (UsernameTakenException e) {
-            throw new InvalidUsernameException("Username is already registered", e);
+        } catch (NonSuccessfulResponseCodeException e) {
+            throw new InvalidUsernameException("Username is malformed or already taken", e);
         } catch (BaseUsernameException e) {
             throw new InvalidUsernameException(e.getMessage() + " (" + e.getClass().getSimpleName() + ")", e);
         }
@@ -466,28 +484,46 @@ public class ManagerImpl implements Manager {
 
     @Override
     public List<Device> getLinkedDevices() throws IOException {
-        var devices = handleResponseException(dependencies.getLinkDeviceApi().getDevices());
+        final List<LinkedDevice> devices = handleResponseExceptionSuspend(cont -> dependencies.getLinkDeviceApi()
+                .getDevices(cont));
         account.setMultiDevice(devices.size() > 1);
-        var identityKey = account.getAciIdentityKeyPair().getPrivateKey();
+        var identityKey = account.getAciIdentityKeyPair();
         return devices.stream().map(d -> {
-            String deviceName = d.getName();
-            if (deviceName != null) {
+            String deviceName = null;
+            if (d.getEncryptedName() != null && d.getEncryptedName().length > 0) {
                 try {
-                    deviceName = DeviceNameUtil.decryptDeviceName(deviceName, identityKey);
-                } catch (IOException e) {
+                    deviceName = new String(DeviceNameCipher.decryptDeviceName(DeviceName.ADAPTER.decode(d.getEncryptedName()),
+                            identityKey), StandardCharsets.UTF_8);
+                } catch (Exception e) {
                     logger.debug("Failed to decrypt device name, maybe plain text?", e);
+                    deviceName = new String(d.getEncryptedName(), StandardCharsets.UTF_8);
                 }
             }
             final var createdAt = getPlaintextCreatedAt(d);
             return new Device(d.getId(),
                     deviceName,
                     createdAt == null ? 0 : createdAt,
-                    d.getLastSeen(),
+                    d.getLastSeen().toEpochMilli(),
                     d.getId() == account.getDeviceId());
         }).toList();
     }
 
-    private Long getPlaintextCreatedAt(DeviceInfo d) {
+    @Override
+    public void updateLinkedDevice(
+            final int deviceId,
+            final String name
+    ) throws IOException, NotPrimaryDeviceException {
+        if (deviceId == account.getDeviceId()) {
+            context.getAccountHelper().setDeviceName(name);
+        } else {
+            if (!account.isPrimaryDevice()) {
+                throw new NotPrimaryDeviceException();
+            }
+            context.getAccountHelper().setDeviceName(deviceId, name);
+        }
+    }
+
+    private Long getPlaintextCreatedAt(LinkedDevice d) {
         final var DECRYPTION_INFO = "deviceCreatedAt";
         var identityKey = account.getAciIdentityKeyPair().getPrivateKey();
         try {
@@ -495,8 +531,9 @@ public class ManagerImpl implements Manager {
             var associatedData = new ByteArrayOutputStream();
             associatedData.write(d.getId());
             associatedData.write(ByteBuffer.allocate(4).putInt(d.getRegistrationId()).array());
-            var createdAtPlaintext = identityKey.open(Base64.decode(d.getCreatedAtCiphertext()
-                    .getBytes(StandardCharsets.UTF_8)), DECRYPTION_INFO, associatedData.toByteArray());
+            var createdAtPlaintext = identityKey.open(d.getCreatedAtCiphertext(),
+                    DECRYPTION_INFO,
+                    associatedData.toByteArray());
             return ByteBuffer.wrap(createdAtPlaintext).getLong();
         } catch (Exception e) {
             logger.warn("Failed while reading the protobuf.", e);
@@ -573,6 +610,11 @@ public class ManagerImpl implements Manager {
         context.getGroupHelper().deleteGroup(groupId);
     }
 
+    @Override
+    public SendGroupMessageResults terminateGroup(GroupId groupId) throws IOException, GroupNotFoundException, NotAGroupMemberException {
+        return context.getGroupHelper().terminateGroup(groupId);
+    }
+
     @Override
     public Pair<GroupId, SendGroupMessageResults> createGroup(
             String name,
@@ -618,7 +660,9 @@ public class ManagerImpl implements Manager {
                         updateGroup.getEditDetailsPermission(),
                         updateGroup.getAvatarFile(),
                         updateGroup.getExpirationTimer(),
-                        updateGroup.getIsAnnouncementGroup());
+                        updateGroup.getIsAnnouncementGroup(),
+                        updateGroup.getLabelEmoji(),
+                        updateGroup.getLabelString());
     }
 
     @Override
@@ -651,14 +695,15 @@ public class ManagerImpl implements Manager {
             Set<RecipientIdentifier> recipients,
             boolean notifySelf
     ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException {
-        return sendMessage(messageBuilder, recipients, notifySelf, Optional.empty());
+        return sendMessage(messageBuilder, recipients, notifySelf, Optional.empty(), true);
     }
 
     private SendMessageResults sendMessage(
             SignalServiceDataMessage.Builder messageBuilder,
             Set<RecipientIdentifier> recipients,
             boolean notifySelf,
-            Optional<Long> editTargetTimestamp
+            Optional<Long> editTargetTimestamp,
+            boolean urgent
     ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException {
         var results = new HashMap<RecipientIdentifier, List<SendMessageResult>>();
         long timestamp = getNextMessageTimestamp();
@@ -670,22 +715,22 @@ public class ManagerImpl implements Manager {
             )) {
                 final var result = notifySelf
                         ? context.getSendHelper()
-                        .sendMessage(messageBuilder, account.getSelfRecipientId(), editTargetTimestamp)
+                        .sendMessage(messageBuilder, account.getSelfRecipientId(), editTargetTimestamp, urgent)
                         : context.getSendHelper().sendSelfMessage(messageBuilder, editTargetTimestamp);
                 results.put(recipient, List.of(toSendMessageResult(result)));
             } else if (recipient instanceof RecipientIdentifier.Single single) {
                 try {
                     final var recipientId = context.getRecipientHelper().resolveRecipient(single);
                     final var result = context.getSendHelper()
-                            .sendMessage(messageBuilder, recipientId, editTargetTimestamp);
+                            .sendMessage(messageBuilder, recipientId, editTargetTimestamp, urgent);
                     results.put(recipient, List.of(toSendMessageResult(result)));
                 } catch (UnregisteredRecipientException e) {
                     results.put(recipient,
                             List.of(SendMessageResult.unregisteredFailure(single.toPartialRecipientAddress())));
                 }
-            } else if (recipient instanceof RecipientIdentifier.Group group) {
+            } else if (recipient instanceof RecipientIdentifier.Group(GroupId groupId)) {
                 final var result = context.getSendHelper()
-                        .sendAsGroupMessage(messageBuilder, group.groupId(), notifySelf, editTargetTimestamp);
+                        .sendAsGroupMessage(messageBuilder, groupId, notifySelf, editTargetTimestamp, urgent);
                 results.put(recipient, result.stream().map(this::toSendMessageResult).toList());
             }
         }
@@ -758,15 +803,20 @@ public class ManagerImpl implements Manager {
     ) {
         try {
             final var recipientId = context.getRecipientHelper().resolveRecipient(sender);
-            final var result = context.getSendHelper().sendReceiptMessage(receiptMessage, recipientId);
-
-            final var serviceId = account.getRecipientAddressResolver()
-                    .resolveRecipientAddress(recipientId)
-                    .serviceId();
-            if (serviceId.isPresent()) {
-                context.getSyncHelper().sendSyncReceiptMessage(serviceId.get(), receiptMessage);
+            List<SendMessageResult> results;
+            if (receiptMessage.isDeliveryReceipt() || !Boolean.FALSE.equals(account.getConfigurationStore()
+                    .getReadReceipts())) {
+                final var result = context.getSendHelper().sendReceiptMessage(receiptMessage, recipientId);
+                results = List.of(toSendMessageResult(result));
+            } else {
+                results = List.of();
             }
-            return new SendMessageResults(timestamp, Map.of(sender, List.of(toSendMessageResult(result))));
+
+            final var aci = account.getRecipientAddressResolver().resolveRecipientAddress(recipientId).aci();
+            if (aci.isPresent()) {
+                context.getSyncHelper().sendSyncReceiptMessage(aci.get(), receiptMessage);
+            }
+            return new SendMessageResults(timestamp, Map.of(sender, results));
         } catch (UnregisteredRecipientException e) {
             return new SendMessageResults(timestamp,
                     Map.of(sender, List.of(SendMessageResult.unregisteredFailure(sender.toPartialRecipientAddress()))));
@@ -786,7 +836,7 @@ public class ManagerImpl implements Manager {
         }
         final var messageBuilder = SignalServiceDataMessage.newBuilder();
         applyMessage(messageBuilder, message);
-        return sendMessage(messageBuilder, recipients, notifySelf);
+        return sendMessage(messageBuilder, recipients, notifySelf, Optional.empty(), message.urgent());
     }
 
     @Override
@@ -797,7 +847,99 @@ public class ManagerImpl implements Manager {
     ) throws IOException, AttachmentInvalidException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException, InvalidStickerException {
         final var messageBuilder = SignalServiceDataMessage.newBuilder();
         applyMessage(messageBuilder, message);
-        return sendMessage(messageBuilder, recipients, false, Optional.of(editTargetTimestamp));
+        return sendMessage(messageBuilder, recipients, false, Optional.of(editTargetTimestamp), message.urgent());
+    }
+
+    @Override
+    public SendMessageResults sendStory(
+            String attachment,
+            boolean allowsReplies,
+            Optional<GroupId> groupId
+    ) throws IOException, AttachmentInvalidException, GroupNotFoundException, NotAGroupMemberException {
+        final var file = new File(attachment);
+        final var mimeType = MimeUtils.getFileMimeType(file);
+        if (mimeType.isEmpty() || (!mimeType.get().startsWith("image/") && !mimeType.get().startsWith("video/"))) {
+            throw new AttachmentInvalidException(attachment,
+                    new IOException("Stories only support image and video attachments"));
+        }
+
+        if (groupId.isPresent()) {
+            return sendGroupStory(attachment, allowsReplies, groupId.get());
+        }
+
+        final var recipients = account.getRecipientStore()
+                .getRecipients(true, Optional.of(false), Set.of(), Optional.empty());
+        final var recipientIds = recipients.stream()
+                .filter(r -> !r.getRecipientId().equals(account.getSelfRecipientId()))
+                .filter(r -> r.getContact() != null && !r.getContact().hideStory())
+                .map(r -> r.getRecipientId())
+                .collect(Collectors.toSet());
+
+        if (recipientIds.isEmpty()) {
+            throw new IOException("No eligible contacts found for story delivery");
+        }
+
+        final var uploadedAttachment = context.getAttachmentHelper().uploadAttachment(attachment);
+        final var storyMessage = SignalServiceStoryMessage.forFileAttachment(account.getProfileKey().serialize(),
+                null,
+                uploadedAttachment,
+                allowsReplies,
+                List.of());
+        final var timestamp = getNextMessageTimestamp();
+
+        final var sendResults = context.getSendHelper()
+                .sendStoryMessage(storyMessage, timestamp, recipientIds, allowsReplies);
+
+        final var results = new HashMap<RecipientIdentifier, List<SendMessageResult>>();
+        for (final var sendResult : sendResults) {
+            final var result = toSendMessageResult(sendResult);
+            results.put(RecipientIdentifier.Single.fromAddress(result.address()), List.of(result));
+        }
+
+        return new SendMessageResults(timestamp, results);
+    }
+
+    private SendMessageResults sendGroupStory(
+            String attachment,
+            boolean allowsReplies,
+            GroupId groupId
+    ) throws IOException, AttachmentInvalidException, GroupNotFoundException, NotAGroupMemberException {
+        final var groupInfo = context.getGroupHelper().getGroup(groupId);
+        if (groupInfo == null) {
+            throw new GroupNotFoundException(groupId);
+        }
+        if (!groupInfo.isMember(account.getSelfRecipientId())) {
+            throw new NotAGroupMemberException(groupId, groupInfo.getTitle());
+        }
+        if (!(groupInfo instanceof GroupInfoV2 groupInfoV2)) {
+            throw new IOException("Stories are only supported for V2 groups");
+        }
+        if (groupInfoV2.isTerminated()) {
+            // Other clients drop messages sent to a terminated group.
+            throw new IOException("Cannot send a story to a group that has been terminated");
+        }
+
+        final var uploadedAttachment = context.getAttachmentHelper().uploadAttachment(attachment);
+        final var groupContext = SignalServiceGroupV2.newBuilder(groupInfoV2.getMasterKey())
+                .withRevision(groupInfoV2.getGroup() == null ? 0 : groupInfoV2.getGroup().revision)
+                .build();
+        final var storyMessage = SignalServiceStoryMessage.forFileAttachment(account.getProfileKey().serialize(),
+                groupContext,
+                uploadedAttachment,
+                allowsReplies,
+                List.of());
+        final var timestamp = getNextMessageTimestamp();
+
+        final var sendResults = context.getSendHelper()
+                .sendGroupStoryMessage(storyMessage, timestamp, groupInfoV2, allowsReplies);
+
+        final var results = new HashMap<RecipientIdentifier, List<SendMessageResult>>();
+        for (final var sendResult : sendResults) {
+            final var result = toSendMessageResult(sendResult);
+            results.put(RecipientIdentifier.Single.fromAddress(result.address()), List.of(result));
+        }
+
+        return new SendMessageResults(timestamp, results);
     }
 
     private void applyMessage(
@@ -811,10 +953,10 @@ public class ManagerImpl implements Manager {
             final var remainder = result.getSecond();
             if (remainder != null) {
                 final var messageBytes = message.messageText().getBytes(StandardCharsets.UTF_8);
-                final var uploadSpec = dependencies.getMessageSender().getResumableUploadSpec();
                 final var streamDetails = new StreamDetails(new ByteArrayInputStream(messageBytes),
                         MimeUtils.LONG_TEXT,
                         messageBytes.length);
+                final var uploadSpec = context.getAttachmentHelper().getResumableUploadSpec(streamDetails);
                 final var textAttachment = AttachmentUtils.createAttachmentStream(streamDetails,
                         Optional.empty(),
                         uploadSpec);
@@ -827,7 +969,11 @@ public class ManagerImpl implements Manager {
             messageBuilder.withBody(message.messageText());
         }
         if (!message.attachments().isEmpty()) {
-            final var uploadedAttachments = context.getAttachmentHelper().uploadAttachments(message.attachments());
+            final var uploadedAttachments = context.getAttachmentHelper()
+                    .uploadAttachments(message.attachments(),
+                            message.attachmentDimensions(),
+                            message.attachmentBlurHashes(),
+                            message.voiceNote());
             if (!additionalAttachments.isEmpty()) {
                 additionalAttachments.addAll(uploadedAttachments);
                 messageBuilder.withAttachments(additionalAttachments);
@@ -881,7 +1027,7 @@ public class ManagerImpl implements Manager {
             if (streamDetails == null) {
                 throw new InvalidStickerException("Missing local sticker file");
             }
-            final var uploadSpec = dependencies.getMessageSender().getResumableUploadSpec();
+            final var uploadSpec = context.getAttachmentHelper().getResumableUploadSpec(streamDetails);
             final var stickerAttachment = AttachmentUtils.createAttachmentStream(streamDetails,
                     Optional.empty(),
                     uploadSpec);
@@ -933,12 +1079,10 @@ public class ManagerImpl implements Manager {
         var delete = new SignalServiceDataMessage.RemoteDelete(targetSentTimestamp);
         final var messageBuilder = SignalServiceDataMessage.newBuilder().withRemoteDelete(delete);
         for (final var recipient : recipients) {
-            if (recipient instanceof RecipientIdentifier.Uuid u) {
-                account.getMessageSendLogStore()
-                        .deleteEntryForRecipientNonGroup(targetSentTimestamp, ACI.from(u.uuid()));
-            } else if (recipient instanceof RecipientIdentifier.Pni pni) {
-                account.getMessageSendLogStore()
-                        .deleteEntryForRecipientNonGroup(targetSentTimestamp, PNI.from(pni.pni()));
+            if (recipient instanceof RecipientIdentifier.Uuid(var uuid)) {
+                account.getMessageSendLogStore().deleteEntryForRecipientNonGroup(targetSentTimestamp, ACI.from(uuid));
+            } else if (recipient instanceof RecipientIdentifier.Pni(var pni)) {
+                account.getMessageSendLogStore().deleteEntryForRecipientNonGroup(targetSentTimestamp, PNI.from(pni));
             } else if (recipient instanceof RecipientIdentifier.Single r) {
                 try {
                     final var recipientId = context.getRecipientHelper().resolveRecipient(r);
@@ -949,8 +1093,8 @@ public class ManagerImpl implements Manager {
                     }
                 } catch (UnregisteredRecipientException ignored) {
                 }
-            } else if (recipient instanceof RecipientIdentifier.Group r) {
-                account.getMessageSendLogStore().deleteEntryForGroup(targetSentTimestamp, r.groupId());
+            } else if (recipient instanceof RecipientIdentifier.Group(var groupId)) {
+                account.getMessageSendLogStore().deleteEntryForGroup(targetSentTimestamp, groupId);
             }
         }
         return sendMessage(messageBuilder, recipients, false);
@@ -963,6 +1107,7 @@ public class ManagerImpl implements Manager {
             RecipientIdentifier.Single targetAuthor,
             long targetSentTimestamp,
             Set<RecipientIdentifier> recipients,
+            final boolean notifySelf,
             final boolean isStory
     ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException {
         var targetAuthorRecipientId = context.getRecipientHelper().resolveRecipient(targetAuthor);
@@ -975,7 +1120,78 @@ public class ManagerImpl implements Manager {
             messageBuilder.withStoryContext(new SignalServiceDataMessage.StoryContext(authorServiceId,
                     targetSentTimestamp));
         }
-        return sendMessage(messageBuilder, recipients, false);
+        return sendMessage(messageBuilder, recipients, notifySelf);
+    }
+
+    @Override
+    public SendMessageResults sendAdminDelete(
+            RecipientIdentifier.Single targetAuthor,
+            long targetSentTimestamp,
+            Set<RecipientIdentifier.Group> recipients,
+            final boolean notifySelf,
+            final boolean isStory
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException {
+        final var targetAuthorRecipientId = context.getRecipientHelper().resolveRecipient(targetAuthor);
+        final var authorServiceId = context.getRecipientHelper()
+                .resolveSignalServiceAddress(targetAuthorRecipientId)
+                .getServiceId();
+        final var adminDelete = new SignalServiceDataMessage.AdminDelete(authorServiceId, targetSentTimestamp);
+        final var messageBuilder = SignalServiceDataMessage.newBuilder().withAdminDelete(adminDelete);
+        if (isStory) {
+            messageBuilder.withStoryContext(new SignalServiceDataMessage.StoryContext(authorServiceId,
+                    targetSentTimestamp));
+        }
+        return sendMessage(messageBuilder,
+                recipients.stream().map(r -> (RecipientIdentifier) r).collect(Collectors.toSet()),
+                notifySelf);
+    }
+
+    @Override
+    public SendMessageResults sendPinMessage(
+            int pinDuration,
+            RecipientIdentifier.Single targetAuthor,
+            long targetSentTimestamp,
+            Set<RecipientIdentifier> recipients,
+            final boolean notifySelf,
+            final boolean isStory
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException {
+        final var targetAuthorRecipientId = context.getRecipientHelper().resolveRecipient(targetAuthor);
+        final var authorServiceId = context.getRecipientHelper()
+                .resolveSignalServiceAddress(targetAuthorRecipientId)
+                .getServiceId();
+        final var duration = pinDuration >= 0 ? pinDuration : null;
+        final var forever = pinDuration < 0;
+        final var pinnedMessage = new SignalServiceDataMessage.PinnedMessage(authorServiceId,
+                targetSentTimestamp,
+                duration,
+                forever);
+        final var messageBuilder = SignalServiceDataMessage.newBuilder().withPinnedMessage(pinnedMessage);
+        if (isStory) {
+            messageBuilder.withStoryContext(new SignalServiceDataMessage.StoryContext(authorServiceId,
+                    targetSentTimestamp));
+        }
+        return sendMessage(messageBuilder, recipients, notifySelf);
+    }
+
+    @Override
+    public SendMessageResults sendUnpinMessage(
+            RecipientIdentifier.Single targetAuthor,
+            long targetSentTimestamp,
+            Set<RecipientIdentifier> recipients,
+            final boolean notifySelf,
+            final boolean isStory
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException {
+        final var targetAuthorRecipientId = context.getRecipientHelper().resolveRecipient(targetAuthor);
+        final var authorServiceId = context.getRecipientHelper()
+                .resolveSignalServiceAddress(targetAuthorRecipientId)
+                .getServiceId();
+        final var unpinnedMessage = new SignalServiceDataMessage.UnpinnedMessage(authorServiceId, targetSentTimestamp);
+        final var messageBuilder = SignalServiceDataMessage.newBuilder().withUnpinnedMessage(unpinnedMessage);
+        if (isStory) {
+            messageBuilder.withStoryContext(new SignalServiceDataMessage.StoryContext(authorServiceId,
+                    targetSentTimestamp));
+        }
+        return sendMessage(messageBuilder, recipients, notifySelf);
     }
 
     @Override
@@ -995,30 +1211,26 @@ public class ManagerImpl implements Manager {
     }
 
     @Override
-    public SendMessageResults sendEndSessionMessage(Set<RecipientIdentifier.Single> recipients) throws IOException {
-        var messageBuilder = SignalServiceDataMessage.newBuilder().asEndSessionMessage();
-
-        try {
-            return sendMessage(messageBuilder,
-                    recipients.stream().map(RecipientIdentifier.class::cast).collect(Collectors.toSet()),
-                    false);
-        } catch (GroupNotFoundException | NotAGroupMemberException | GroupSendingNotAllowedException e) {
-            throw new AssertionError(e);
-        } finally {
-            for (var recipient : recipients) {
-                final RecipientId recipientId;
-                try {
-                    recipientId = context.getRecipientHelper().resolveRecipient(recipient);
-                } catch (UnregisteredRecipientException e) {
-                    continue;
-                }
-                final var serviceId = context.getAccount()
-                        .getRecipientAddressResolver()
-                        .resolveRecipientAddress(recipientId)
-                        .serviceId();
-                if (serviceId.isPresent()) {
-                    account.getAccountData(ServiceIdType.ACI).getSessionStore().deleteAllSessions(serviceId.get());
-                }
+    public void sendEndSessionMessage(Set<RecipientIdentifier.Single> recipients) throws IOException {
+        for (var recipient : recipients) {
+            final RecipientId recipientId;
+            try {
+                recipientId = context.getRecipientHelper().resolveRecipient(recipient);
+            } catch (UnregisteredRecipientException e) {
+                continue;
+            }
+            final var recipientAddress = context.getAccount()
+                    .getRecipientAddressResolver()
+                    .resolveRecipientAddress(recipientId);
+            final var aciSessionStore = account.getAccountData(ServiceIdType.ACI).getSessionStore();
+            final var pniSessionStore = account.getAccountData(ServiceIdType.PNI).getSessionStore();
+            if (recipientAddress.aci().isPresent()) {
+                aciSessionStore.archiveSessions(recipientAddress.aci().get());
+                pniSessionStore.archiveSessions(recipientAddress.aci().get());
+            }
+            if (recipientAddress.pni().isPresent()) {
+                aciSessionStore.archiveSessions(recipientAddress.pni().get());
+                pniSessionStore.archiveSessions(recipientAddress.pni().get());
             }
         }
     }
@@ -1051,14 +1263,59 @@ public class ManagerImpl implements Manager {
                     results.put(recipient,
                             List.of(SendMessageResult.unregisteredFailure(single.toPartialRecipientAddress())));
                 }
-            } else if (recipient instanceof RecipientIdentifier.Group group) {
-                final var result = context.getSyncHelper().sendMessageRequestResponse(type, group.groupId());
+            } else if (recipient instanceof RecipientIdentifier.Group(GroupId groupId)) {
+                final var result = context.getSyncHelper().sendMessageRequestResponse(type, groupId);
                 results.put(recipient, List.of(toSendMessageResult(result)));
             }
         }
         return new SendMessageResults(0, results);
     }
 
+    @Override
+    public SendMessageResults sendPollCreateMessage(
+            final String question,
+            final boolean allowMultiple,
+            final List<String> options,
+            final Set<RecipientIdentifier> recipients,
+            final boolean notifySelf
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException {
+        final var pollCreate = new SignalServiceDataMessage.PollCreate(question, allowMultiple, options);
+        final var messageBuilder = SignalServiceDataMessage.newBuilder().withPollCreate(pollCreate);
+        return sendMessage(messageBuilder, recipients, notifySelf);
+    }
+
+    @Override
+    public SendMessageResults sendPollVoteMessage(
+            final RecipientIdentifier.Single targetAuthor,
+            final long targetSentTimestamp,
+            final List<Integer> optionIndexes,
+            final int voteCount,
+            final Set<RecipientIdentifier> recipients,
+            final boolean notifySelf
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException, UnregisteredRecipientException {
+        final var targetAuthorRecipientId = context.getRecipientHelper().resolveRecipient(targetAuthor);
+        final var authorServiceId = context.getRecipientHelper()
+                .resolveSignalServiceAddress(targetAuthorRecipientId)
+                .getServiceId();
+        final var pollVote = new SignalServiceDataMessage.PollVote(authorServiceId,
+                targetSentTimestamp,
+                optionIndexes,
+                voteCount);
+        final var messageBuilder = SignalServiceDataMessage.newBuilder().withPollVote(pollVote);
+        return sendMessage(messageBuilder, recipients, notifySelf);
+    }
+
+    @Override
+    public SendMessageResults sendPollTerminateMessage(
+            final long targetSentTimestamp,
+            final Set<RecipientIdentifier> recipients,
+            final boolean notifySelf
+    ) throws IOException, NotAGroupMemberException, GroupNotFoundException, GroupSendingNotAllowedException {
+        final var pollTerminate = new SignalServiceDataMessage.PollTerminate(targetSentTimestamp);
+        final var messageBuilder = SignalServiceDataMessage.newBuilder().withPollTerminate(pollTerminate);
+        return sendMessage(messageBuilder, recipients, notifySelf);
+    }
+
     @Override
     public void hideRecipient(final RecipientIdentifier.Single recipient) {
         final var recipientIdOptional = context.getRecipientHelper().resolveRecipientOptional(recipient);
@@ -1094,10 +1351,7 @@ public class ManagerImpl implements Manager {
             final String nickGivenName,
             final String nickFamilyName,
             final String note
-    ) throws NotPrimaryDeviceException, UnregisteredRecipientException {
-        if (!account.isPrimaryDevice()) {
-            throw new NotPrimaryDeviceException();
-        }
+    ) throws UnregisteredRecipientException {
         context.getContactHelper()
                 .setContactName(context.getRecipientHelper().resolveRecipient(recipient),
                         givenName,
@@ -1423,7 +1677,21 @@ public class ManagerImpl implements Manager {
             return List.of();
         }
         // refresh profiles of explicitly given recipients
-        context.getProfileHelper().refreshRecipientProfiles(recipientIds);
+        if (recipientIds.isEmpty()) {
+            final var rIds = account.getRecipientStore()
+                    .getRecipients(onlyContacts, blocked, recipientIds, name)
+                    .stream()
+                    .filter(r -> r.isRegistered())
+                    .map(r -> r.getRecipientId())
+                    .toList();
+            try {
+                context.getProfileHelper().getRecipientProfiles(rIds);
+            } catch (Exception e) {
+                logger.warn("Failed to refresh profiles for recipients", e);
+            }
+        } else {
+            context.getProfileHelper().refreshRecipientProfiles(recipientIds);
+        }
         return account.getRecipientStore()
                 .getRecipients(onlyContacts, blocked, recipientIds, name)
                 .stream()
@@ -1447,8 +1715,15 @@ public class ManagerImpl implements Manager {
         }
 
         final var contact = account.getContactStore().getContact(recipientId);
-        if (contact != null && !Util.isEmpty(contact.getName())) {
-            return contact.getName();
+        if (contact != null) {
+            final var nickname = contact.getDisplayNickname();
+            if (!Util.isEmpty(nickname)) {
+                return nickname;
+            }
+
+            if (!Util.isEmpty(contact.getName())) {
+                return contact.getName();
+            }
         }
 
         final var profile = context.getProfileHelper().getRecipientProfile(recipientId);
@@ -1560,6 +1835,16 @@ public class ManagerImpl implements Manager {
         }
     }
 
+    @Override
+    public void addCallEventListener(final CallEventListener listener) {
+        context.getCallManager().addCallEventListener(listener);
+    }
+
+    @Override
+    public void removeCallEventListener(final CallEventListener listener) {
+        context.getCallManager().removeCallEventListener(listener);
+    }
+
     @Override
     public InputStream retrieveAttachment(final String id) throws IOException {
         return context.getAttachmentHelper().retrieveAttachment(id).getStream();
@@ -1617,6 +1902,142 @@ public class ManagerImpl implements Manager {
         return streamDetails.getStream();
     }
 
+    // --- Voice call methods ---
+
+    @Override
+    public CallInfo startCall(final RecipientIdentifier.Single recipient) throws IOException, UnregisteredRecipientException {
+        final var recipientId = context.getRecipientHelper().resolveRecipient(recipient);
+        return context.getCallManager().startOutgoingCall(recipientId);
+    }
+
+    @Override
+    public CallInfo acceptCall(final long callId) throws IOException {
+        return context.getCallManager().acceptIncomingCall(callId);
+    }
+
+    @Override
+    public void hangupCall(final long callId) throws IOException {
+        context.getCallManager().hangupCall(callId);
+    }
+
+    @Override
+    public SendMessageResult rejectCall(final long callId) throws IOException {
+        final var result = context.getCallManager().rejectCall(callId);
+        return toSendMessageResult(result);
+    }
+
+    @Override
+    public List<CallInfo> listActiveCalls() {
+        return context.getCallManager().listActiveCalls();
+    }
+
+    @Override
+    public void sendCallOffer(
+            final RecipientIdentifier.Single recipient,
+            final CallOffer offer
+    ) throws IOException, UnregisteredRecipientException {
+        final var recipientId = context.getRecipientHelper().resolveRecipient(recipient);
+        final var address = context.getRecipientHelper().resolveSignalServiceAddress(recipientId);
+        var offerMessage = new OfferMessage(offer.callId(),
+                offer.type() == CallOffer.Type.VIDEO ? OfferMessage.Type.VIDEO_CALL : OfferMessage.Type.AUDIO_CALL,
+                offer.opaque());
+        var callMessage = SignalServiceCallMessage.forOffer(offerMessage, null);
+        try {
+            dependencies.getMessageSender().sendCallMessage(address, null, callMessage);
+        } catch (UntrustedIdentityException e) {
+            throw new IOException("Untrusted identity for call recipient", e);
+        } catch (NoSessionException e) {
+            throw new IOException("No session for call recipient", e);
+        }
+    }
+
+    @Override
+    public void sendCallAnswer(
+            final RecipientIdentifier.Single recipient,
+            final long callId,
+            final byte[] answerOpaque
+    ) throws IOException, UnregisteredRecipientException {
+        final var recipientId = context.getRecipientHelper().resolveRecipient(recipient);
+        final var address = context.getRecipientHelper().resolveSignalServiceAddress(recipientId);
+        var answerMessage = new AnswerMessage(callId, answerOpaque);
+        var callMessage = SignalServiceCallMessage.forAnswer(answerMessage, null);
+        try {
+            dependencies.getMessageSender().sendCallMessage(address, null, callMessage);
+        } catch (UntrustedIdentityException e) {
+            throw new IOException("Untrusted identity for call recipient", e);
+        } catch (NoSessionException e) {
+            throw new IOException("No session for call recipient", e);
+        }
+    }
+
+    @Override
+    public void sendIceUpdate(
+            final RecipientIdentifier.Single recipient,
+            final long callId,
+            final List<byte[]> iceCandidates
+    ) throws IOException, UnregisteredRecipientException {
+        final var recipientId = context.getRecipientHelper().resolveRecipient(recipient);
+        final var address = context.getRecipientHelper().resolveSignalServiceAddress(recipientId);
+        var iceUpdates = iceCandidates.stream().map(opaque -> new IceUpdateMessage(callId, opaque)).toList();
+        var callMessage = SignalServiceCallMessage.forIceUpdates(iceUpdates, null);
+        try {
+            dependencies.getMessageSender().sendCallMessage(address, null, callMessage);
+        } catch (UntrustedIdentityException e) {
+            throw new IOException("Untrusted identity for call recipient", e);
+        } catch (NoSessionException e) {
+            throw new IOException("No session for call recipient", e);
+        }
+    }
+
+    @Override
+    public void sendHangup(
+            final RecipientIdentifier.Single recipient,
+            final long callId,
+            final MessageEnvelope.Call.Hangup.Type type
+    ) throws IOException, UnregisteredRecipientException {
+        final var recipientId = context.getRecipientHelper().resolveRecipient(recipient);
+        final var address = context.getRecipientHelper().resolveSignalServiceAddress(recipientId);
+        var hangupType = switch (type) {
+            case NORMAL -> HangupMessage.Type.NORMAL;
+            case ACCEPTED -> HangupMessage.Type.ACCEPTED;
+            case DECLINED -> HangupMessage.Type.DECLINED;
+            case BUSY -> HangupMessage.Type.BUSY;
+            case NEED_PERMISSION -> HangupMessage.Type.NEED_PERMISSION;
+        };
+        var hangupMessage = new HangupMessage(callId, hangupType, 0);
+        var callMessage = SignalServiceCallMessage.forHangup(hangupMessage, null);
+        try {
+            dependencies.getMessageSender().sendCallMessage(address, null, callMessage);
+        } catch (UntrustedIdentityException e) {
+            throw new IOException("Untrusted identity for call recipient", e);
+        } catch (NoSessionException e) {
+            throw new IOException("No session for call recipient", e);
+        }
+    }
+
+    @Override
+    public void sendBusy(
+            final RecipientIdentifier.Single recipient,
+            final long callId
+    ) throws IOException, UnregisteredRecipientException {
+        final var recipientId = context.getRecipientHelper().resolveRecipient(recipient);
+        final var address = context.getRecipientHelper().resolveSignalServiceAddress(recipientId);
+        var busyMessage = new BusyMessage(callId);
+        var callMessage = SignalServiceCallMessage.forBusy(busyMessage, null);
+        try {
+            dependencies.getMessageSender().sendCallMessage(address, null, callMessage);
+        } catch (UntrustedIdentityException e) {
+            throw new IOException("Untrusted identity for call recipient", e);
+        } catch (NoSessionException e) {
+            throw new IOException("No session for call recipient", e);
+        }
+    }
+
+    @Override
+    public List<TurnServer> getTurnServerInfo() throws IOException {
+        return context.getCallManager().getTurnServers();
+    }
+
     @Override
     public void close() {
         Thread thread;

lib/src/main/java/org/asamk/signal/manager/internal/MultiAccountManagerImpl.java

@@ -7,6 +7,7 @@ import org.asamk.signal.manager.RegistrationManager;
 import org.asamk.signal.manager.SignalAccountFiles;
 import org.asamk.signal.manager.api.AccountCheckException;
 import org.asamk.signal.manager.api.NotRegisteredException;
+import org.signal.core.util.UuidUtil;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -38,13 +39,6 @@ public class MultiAccountManagerImpl implements MultiAccountManager {
         managers.forEach(m -> m.addClosedListener(() -> this.removeManager(m)));
     }
 
-    @Override
-    public List<String> getAccountNumbers() {
-        synchronized (managers) {
-            return managers.stream().map(Manager::getSelfNumber).toList();
-        }
-    }
-
     @Override
     public List<Manager> getManagers() {
         synchronized (managers) {
@@ -95,23 +89,47 @@ public class MultiAccountManagerImpl implements MultiAccountManager {
     }
 
     @Override
-    public Manager getManager(final String number) {
+    public Manager getManager(final String identifier) {
         synchronized (managers) {
-            final var manager = managers.stream()
-                    .filter(m -> m.getSelfNumber().equals(number))
-                    .findFirst()
-                    .orElse(null);
-            if (manager != null) {
-                return manager;
-            }
-            try {
-                final var newManager = signalAccountFiles.initManager(number);
-                managers.add(newManager);
-                return newManager;
-            } catch (IOException | NotRegisteredException | AccountCheckException e) {
-                logger.warn("Failed to load new manager", e);
-                return null;
+            if (UuidUtil.INSTANCE.isUuid(identifier)) {
+                // Check if UUID corresponds to an already-loaded manager
+                final var existing = managers.stream()
+                        .filter(m -> m.getSelfACI().equals(identifier))
+                        .findFirst()
+                        .orElse(null);
+                if (existing != null) {
+                    logger.debug("Found already loaded manager for ACI: {}", identifier);
+                    return existing;
+                }
+                // Load by ACI
+                try {
+                    final var newManager = signalAccountFiles.initManagerByAci(identifier);
+                    managers.add(newManager);
+                    return newManager;
+                } catch (NotRegisteredException e) {
+                    logger.debug("Manager not found by ACI: {}", identifier);
+                } catch (IOException | IllegalArgumentException | AccountCheckException e) {
+                    logger.warn("Failed to load new manager by ACI: {}", identifier, e);
+                }
+            } else {
+                // Phone number — check already loaded managers
+                var existing = managers.stream()
+                        .filter(m -> identifier.equals(m.getSelfNumber()))
+                        .findFirst()
+                        .orElse(null);
+                if (existing != null) {
+                    return existing;
+                }
+                // Load by phone number
+                try {
+                    final var newManager = signalAccountFiles.initManagerByNumber(identifier);
+                    managers.add(newManager);
+                    return newManager;
+                } catch (NotRegisteredException | IOException | IllegalArgumentException | AccountCheckException e) {
+                    logger.warn("Failed to load manager by number: {}", identifier, e);
+                }
             }
+            return null;
         }
     }
 

lib/src/main/java/org/asamk/signal/manager/internal/ProvisioningManagerImpl.java

@@ -19,34 +19,59 @@ package org.asamk.signal.manager.internal;
 import org.asamk.signal.manager.Manager;
 import org.asamk.signal.manager.ProvisioningManager;
 import org.asamk.signal.manager.Settings;
-import org.asamk.signal.manager.api.DeviceLinkUrl;
+import org.asamk.signal.manager.api.BadRequestException;
 import org.asamk.signal.manager.api.UserAlreadyExistsException;
-import org.asamk.signal.manager.config.ServiceConfig;
 import org.asamk.signal.manager.config.ServiceEnvironmentConfig;
 import org.asamk.signal.manager.storage.SignalAccount;
 import org.asamk.signal.manager.storage.accounts.AccountsStore;
 import org.asamk.signal.manager.util.KeyUtils;
+import org.signal.core.models.AccountEntropyPool;
+import org.signal.core.models.ServiceId.ACI;
+import org.signal.core.models.ServiceId.PNI;
+import org.signal.core.models.backup.MediaRootBackupKey;
+import org.signal.core.util.crypto.DeviceNameCipher;
+import org.signal.libsignal.protocol.IdentityKey;
 import org.signal.libsignal.protocol.IdentityKeyPair;
+import org.signal.libsignal.protocol.ecc.ECPrivateKey;
+import org.signal.libsignal.zkgroup.profiles.ProfileKey;
+import org.signal.network.api.RegistrationApiV2;
+import org.signal.network.api.RegistrationApiV2.LinkDeviceResponse;
+import org.signal.network.api.RegistrationApiV2.RegisterAsLinkedDeviceError;
+import org.signal.network.rest.SignalRestClient;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.whispersystems.signalservice.api.account.PreKeyCollection;
+import org.whispersystems.signalservice.api.provisioning.ProvisioningSocket;
 import org.whispersystems.signalservice.api.push.ServiceIdType;
-import org.whispersystems.signalservice.api.push.SignalServiceAddress;
 import org.whispersystems.signalservice.api.push.exceptions.AuthorizationFailedException;
-import org.whispersystems.signalservice.api.registration.ProvisioningApi;
-import org.whispersystems.signalservice.api.util.DeviceNameUtil;
-import org.whispersystems.signalservice.internal.push.ProvisioningSocket;
-import org.whispersystems.signalservice.internal.push.PushServiceSocket;
-import org.whispersystems.signalservice.internal.util.DynamicCredentialsProvider;
+import org.whispersystems.signalservice.internal.crypto.SecondaryProvisioningCipher;
+import org.whispersystems.signalservice.internal.push.ProvisionMessage;
 
+import java.io.Closeable;
 import java.io.IOException;
 import java.net.URI;
+import java.net.URISyntaxException;
 import java.nio.channels.OverlappingFileLockException;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import java.util.function.Consumer;
 
-import static org.asamk.signal.manager.util.KeyUtils.generatePreKeysForType;
+import kotlin.ResultKt;
+import kotlin.Unit;
+import kotlin.coroutines.Continuation;
+import kotlin.coroutines.EmptyCoroutineContext;
+import kotlin.coroutines.intrinsics.IntrinsicsKt;
+import kotlin.jvm.functions.Function3;
+import kotlinx.coroutines.BuildersKt;
+import kotlinx.coroutines.CoroutineScope;
 
-public class ProvisioningManagerImpl implements ProvisioningManager {
+import static org.asamk.signal.manager.util.KeyUtils.generatePreKeysForType;
+import static org.asamk.signal.manager.util.Utils.handleResponseExceptionSuspend;
+
+public class ProvisioningManagerImpl implements ProvisioningManager, Closeable {
 
     private static final Logger logger = LoggerFactory.getLogger(ProvisioningManagerImpl.class);
 
@@ -56,9 +81,10 @@ public class ProvisioningManagerImpl implements ProvisioningManager {
     private final Consumer<Manager> newManagerListener;
     private final AccountsStore accountsStore;
 
-    private final ProvisioningApi provisioningApi;
-    private final IdentityKeyPair tempIdentityKey;
     private final String password;
+    private final CompletableFuture<String> urlFuture = new CompletableFuture<>();
+    private final CompletableFuture<SecondaryProvisioningCipher.ProvisioningDecryptResult<ProvisionMessage>> messageFuture = new CompletableFuture<>();
+    private final Closeable socketHandle;
 
     public ProvisioningManagerImpl(
             PathConfig pathConfig,
@@ -73,46 +99,72 @@ public class ProvisioningManagerImpl implements ProvisioningManager {
         this.newManagerListener = newManagerListener;
         this.accountsStore = accountsStore;
 
-        tempIdentityKey = KeyUtils.generateIdentityKeyPair();
+        final IdentityKeyPair tempIdentityKey = KeyUtils.generateIdentityKeyPair();
         password = KeyUtils.createPassword();
-        final var credentialsProvider = new DynamicCredentialsProvider(null,
-                null,
-                null,
-                password,
-                SignalServiceAddress.DEFAULT_DEVICE_ID);
-        final var pushServiceSocket = new PushServiceSocket(serviceEnvironmentConfig.signalServiceConfiguration(),
-                credentialsProvider,
-                userAgent,
-                ServiceConfig.AUTOMATIC_NETWORK_RETRY);
-        final var provisioningSocket = new ProvisioningSocket(serviceEnvironmentConfig.signalServiceConfiguration(),
-                userAgent);
-        this.provisioningApi = new ProvisioningApi(pushServiceSocket, provisioningSocket, credentialsProvider);
+
+        socketHandle = ProvisioningSocket.Companion.start(new ProvisioningSocket.Mode.Link(false),
+                tempIdentityKey,
+                serviceEnvironmentConfig.signalServiceConfiguration(),
+                (id, t) -> {
+                    urlFuture.completeExceptionally(t);
+                    messageFuture.completeExceptionally(t);
+                },
+                new ProvisioningBlock());
     }
 
     @Override
     public URI getDeviceLinkUri() throws TimeoutException, IOException {
-        var deviceUuid = provisioningApi.getNewDeviceUuid();
-
-        return new DeviceLinkUrl(deviceUuid, tempIdentityKey.getPublicKey().getPublicKey()).createDeviceLinkUri();
+        try {
+            var url = urlFuture.get(30, TimeUnit.SECONDS);
+            // Mode.Link(false) does not advertise any capabilities itself.
+            return new URI(url + "&capabilities=nopni");
+        } catch (java.util.concurrent.TimeoutException e) {
+            throw new TimeoutException("Timed out waiting for provisioning URL");
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IOException("Interrupted while waiting for provisioning URL", e);
+        } catch (ExecutionException e) {
+            throw new IOException("Failed to get provisioning URL", e.getCause());
+        } catch (URISyntaxException e) {
+            throw new IOException("Invalid provisioning URL", e);
+        }
     }
 
     @Override
     public String finishDeviceLink(String deviceName) throws IOException, TimeoutException, UserAlreadyExistsException {
-        var ret = provisioningApi.getNewDeviceRegistration(tempIdentityKey);
-        var number = ret.getNumber();
-        var aci = ret.getAci();
-        var pni = ret.getPni();
+        SecondaryProvisioningCipher.ProvisioningDecryptResult<ProvisionMessage> decryptResult;
+        try {
+            decryptResult = messageFuture.get(120, TimeUnit.SECONDS);
+        } catch (java.util.concurrent.TimeoutException e) {
+            throw new TimeoutException("Timed out waiting for provisioning message");
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IOException("Interrupted while waiting for provisioning message", e);
+        } catch (ExecutionException e) {
+            throw new IOException("Failed to receive provisioning message", e.getCause());
+        }
 
-        logger.info("Received link information from {}, linking in progress ...", number);
+        if (!(decryptResult instanceof SecondaryProvisioningCipher.ProvisioningDecryptResult.Success<ProvisionMessage> success)) {
+            throw new IOException("Failed to decrypt provisioning message");
+        }
+        var msg = success.getMessage();
+
+        var number = msg.number;
+        var aci = ACI.parseOrThrow(msg.aci, msg.aciBinary);
+        var pni = parsePni(msg);
+        var identifier = number != null ? number : aci.toString();
+
+        logger.info("Received link information from {}, linking in progress ...", identifier);
 
         var accountPath = accountsStore.getPathByAci(aci);
-        if (accountPath == null) {
+        if (accountPath == null && number != null) {
             accountPath = accountsStore.getPathByNumber(number);
         }
         final var accountExists = accountPath != null && SignalAccount.accountFileExists(pathConfig.dataPath(),
                 accountPath);
         if (accountExists && !canRelinkExistingAccount(accountPath)) {
-            throw new UserAlreadyExistsException(number, SignalAccount.getFileName(pathConfig.dataPath(), accountPath));
+            throw new UserAlreadyExistsException(identifier,
+                    SignalAccount.getFileName(pathConfig.dataPath(), accountPath));
         }
         if (accountPath == null) {
             accountPath = accountsStore.addAccount(number, aci);
@@ -120,21 +172,44 @@ public class ProvisioningManagerImpl implements ProvisioningManager {
             accountsStore.updateAccount(accountPath, number, aci);
         }
 
+        final IdentityKeyPair aciIdentity;
+        final IdentityKeyPair pniIdentity;
+        final ProfileKey profileKey;
+        try {
+            aciIdentity = new IdentityKeyPair(new IdentityKey(msg.aciIdentityKeyPublic.toByteArray()),
+                    new ECPrivateKey(msg.aciIdentityKeyPrivate.toByteArray()));
+            pniIdentity = pni == null
+                    ? null
+                    : new IdentityKeyPair(new IdentityKey(msg.pniIdentityKeyPublic.toByteArray()),
+                            new ECPrivateKey(msg.pniIdentityKeyPrivate.toByteArray()));
+            profileKey = msg.profileKey == null
+                    ? KeyUtils.createProfileKey()
+                    : new ProfileKey(msg.profileKey.toByteArray());
+        } catch (Exception e) {
+            throw new IOException("Invalid key material in provisioning message", e);
+        }
+
         var encryptedDeviceName = deviceName == null
                 ? null
-                : DeviceNameUtil.encryptDeviceName(deviceName, ret.getAciIdentity().getPrivateKey());
-        // Create new account with the synced identity
-        var profileKey = ret.getProfileKey() == null ? KeyUtils.createProfileKey() : ret.getProfileKey();
+                : DeviceNameCipher.encryptDeviceName(deviceName.getBytes(StandardCharsets.UTF_8), aciIdentity);
+        var accountEntropyPool = msg.accountEntropyPool == null ? null : new AccountEntropyPool(msg.accountEntropyPool);
+        var mediaRootBackupKey = msg.mediaRootBackupKey == null
+                ? null
+                : new MediaRootBackupKey(msg.mediaRootBackupKey.toByteArray());
 
         SignalAccount account = null;
+        var cleanUpPartialAccountOnFailure = false;
+        var linkingFinished = false;
         try {
             if (!accountExists) {
                 account = SignalAccount.createLinkedAccount(pathConfig.dataPath(),
                         accountPath,
                         serviceEnvironmentConfig.type(),
                         Settings.DEFAULT);
+                cleanUpPartialAccountOnFailure = true;
             } else {
                 account = SignalAccount.load(pathConfig.dataPath(), accountPath, true, Settings.DEFAULT);
+                cleanUpPartialAccountOnFailure = false;
             }
 
             account.setProvisioningData(number,
@@ -142,25 +217,34 @@ public class ProvisioningManagerImpl implements ProvisioningManager {
                     pni,
                     password,
                     encryptedDeviceName,
-                    ret.getAciIdentity(),
-                    ret.getPniIdentity(),
+                    aciIdentity,
+                    pniIdentity,
                     profileKey,
-                    ret.getMasterKey(),
-                    ret.getAccountEntropyPool(),
-                    ret.getMediaRootBackupKey());
+                    accountEntropyPool,
+                    msg.authCredentialSalt == null ? null : msg.authCredentialSalt.toByteArray(),
+                    mediaRootBackupKey);
 
-            account.getConfigurationStore().setReadReceipts(ret.isReadReceipts());
+            if (msg.readReceipts != null) {
+                account.getConfigurationStore().setReadReceipts(msg.readReceipts);
+            }
 
             final var aciPreKeys = generatePreKeysForType(account.getAccountData(ServiceIdType.ACI));
-            final var pniPreKeys = generatePreKeysForType(account.getAccountData(ServiceIdType.PNI));
+            final var pniPreKeys = pni == null
+                    ? null
+                    : generatePreKeysForType(account.getAccountData(ServiceIdType.PNI));
 
             logger.debug("Finishing new device registration");
-            var deviceId = provisioningApi.finishNewDeviceRegistration(ret.getProvisioningCode(),
-                    account.getAccountAttributes(null),
+            final var restClient = new SignalRestClient(serviceEnvironmentConfig.signalServiceConfiguration(),
+                    userAgent);
+            final var registrationApi = new RegistrationApiV2(restClient, false);
+            final var deviceId = registerLinkedDevice(registrationApi,
+                    account,
+                    msg.provisioningCode,
                     aciPreKeys,
                     pniPreKeys);
 
             account.finishLinking(deviceId, aciPreKeys, pniPreKeys);
+            linkingFinished = true;
 
             ManagerImpl m = null;
             try {
@@ -191,12 +275,18 @@ public class ProvisioningManagerImpl implements ProvisioningManager {
                     newManagerListener.accept(m);
                     m = null;
                 }
-                return number;
+                return identifier;
             } finally {
                 if (m != null) {
                     m.close();
                 }
             }
+        } catch (Exception e) {
+            if (!linkingFinished && cleanUpPartialAccountOnFailure && account != null) {
+                cleanupPartialAccount(account, accountPath, e);
+                account = null;
+            }
+            throw e;
         } finally {
             if (account != null) {
                 account.close();
@@ -204,6 +294,98 @@ public class ProvisioningManagerImpl implements ProvisioningManager {
         }
     }
 
+    static PNI parsePni(final ProvisionMessage message) throws IOException {
+        if (message.number != null) {
+            return PNI.parseOrThrow(message.pni, message.pniBinary);
+        }
+        if (message.pni != null
+                || message.pniBinary != null
+                || message.pniIdentityKeyPublic != null
+                || message.pniIdentityKeyPrivate != null) {
+            throw new IOException("Provisioning message has PNI material without a phone number");
+        }
+        if (message.authCredentialSalt == null || message.authCredentialSalt.size() == 0) {
+            throw new IOException("Numberless provisioning message is missing the group auth credential salt");
+        }
+        return null;
+    }
+
+    static int registerLinkedDevice(
+            final RegistrationApiV2 registrationApi,
+            final SignalAccount account,
+            final String provisioningCode,
+            final PreKeyCollection aciPreKeys,
+            final PreKeyCollection pniPreKeys
+    ) throws IOException {
+        final var attrs = account.getAccountAttributesV2();
+        final var deviceAttributes = new RegistrationApiV2.DeviceAttributes(attrs.getFetchesMessages(),
+                attrs.getRegistrationId(),
+                attrs.getPniRegistrationId(),
+                attrs.getName(),
+                attrs.getCapabilities());
+        try {
+            final LinkDeviceResponse result = handleResponseExceptionSuspend(cont -> registrationApi.registerAsSecondaryDevice(
+                    account.getAci(),
+                    account.getPassword(),
+                    provisioningCode,
+                    deviceAttributes,
+                    toRegistrationPreKeys(aciPreKeys),
+                    toRegistrationPreKeys(pniPreKeys),
+                    null,
+                    cont));
+            return result.getDeviceId();
+        } catch (BadRequestException e) {
+            throw switch (e.getError()) {
+                case RegisterAsLinkedDeviceError.IncorrectVerification ignored ->
+                        new AuthorizationFailedException(403, "Device verification failed");
+                case RegisterAsLinkedDeviceError.MissingCapability ignored ->
+                        new IOException("Linked device is missing a required account capability");
+                case RegisterAsLinkedDeviceError.MaxLinkedDevices ignored ->
+                        new IOException("Account has reached its linked device limit");
+                case RegisterAsLinkedDeviceError.InvalidRequest ignored ->
+                        new IOException("Signal rejected the device linking request");
+                case RegisterAsLinkedDeviceError.RateLimited ignored ->
+                        new IOException("Device linking rate limited; try again later");
+                default -> new IOException("Unexpected device linking response");
+            };
+        }
+    }
+
+    static RegistrationApiV2.PreKeyCollection toRegistrationPreKeys(final PreKeyCollection preKeys) {
+        return preKeys == null
+                ? null
+                : new RegistrationApiV2.PreKeyCollection(preKeys.getIdentityKey(),
+                        preKeys.getSignedPreKey(),
+                        preKeys.getLastResortKyberPreKey());
+    }
+
+    @Override
+    public void close() throws IOException {
+        socketHandle.close();
+    }
+
+    private void cleanupPartialAccount(final SignalAccount account, final String accountPath, final Exception cause) {
+        logger.warn("Link attempt failed before registration completed, removing partial account state for {}.",
+                accountPath,
+                cause);
+        try {
+            account.deleteAccountData();
+        } catch (IOException cleanupError) {
+            logger.warn("Failed to delete partial account data for {}: {}",
+                    accountPath,
+                    cleanupError.getMessage(),
+                    cleanupError);
+        }
+        try {
+            accountsStore.removeAccount(accountPath);
+        } catch (RuntimeException cleanupError) {
+            logger.warn("Failed to remove partial account entry for {}: {}",
+                    accountPath,
+                    cleanupError.getMessage(),
+                    cleanupError);
+        }
+    }
+
     private boolean canRelinkExistingAccount(final String accountPath) throws IOException {
         final SignalAccount signalAccount;
         try {
@@ -217,6 +399,10 @@ public class ProvisioningManagerImpl implements ProvisioningManager {
         }
 
         try (signalAccount) {
+            if (signalAccount.getDeviceId() <= 0) {
+                logger.debug("Account has invalid deviceId {}, allowing relink.", signalAccount.getDeviceId());
+                return true;
+            }
             if (signalAccount.isPrimaryDevice()) {
                 logger.debug("Account is a primary device.");
                 return false;
@@ -244,4 +430,36 @@ public class ProvisioningManagerImpl implements ProvisioningManager {
             return false;
         }
     }
+
+    private class ProvisioningBlock implements Function3<CoroutineScope, ProvisioningSocket<ProvisionMessage>, Continuation<? super Unit>, Object> {
+
+        @Override
+        public Object invoke(
+                CoroutineScope scope,
+                ProvisioningSocket<ProvisionMessage> socket,
+                Continuation<? super Unit> cont
+        ) {
+            Thread.ofVirtual().start(() -> {
+                try {
+                    urlFuture.complete(BuildersKt.runBlocking(EmptyCoroutineContext.INSTANCE,
+                            (s, c) -> socket.getProvisioningUrl(c)));
+                    messageFuture.complete(BuildersKt.runBlocking(EmptyCoroutineContext.INSTANCE,
+                            (s, c) -> socket.getProvisioningMessageDecryptResult(c)));
+                    cont.resumeWith(Unit.INSTANCE);
+                } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
+                    failBoth(new RuntimeException(e), cont);
+                } catch (Throwable t) {
+                    failBoth(t, cont);
+                }
+            });
+            return IntrinsicsKt.getCOROUTINE_SUSPENDED();
+        }
+
+        private void failBoth(Throwable t, Continuation<? super Unit> cont) {
+            urlFuture.completeExceptionally(t);
+            messageFuture.completeExceptionally(t);
+            cont.resumeWith(ResultKt.createFailure(t));
+        }
+    }
 }

lib/src/main/java/org/asamk/signal/manager/internal/RegistrationManagerImpl.java

@@ -18,12 +18,14 @@ package org.asamk.signal.manager.internal;
 
 import org.asamk.signal.manager.Manager;
 import org.asamk.signal.manager.RegistrationManager;
+import org.asamk.signal.manager.api.BadRequestException;
 import org.asamk.signal.manager.api.CaptchaRequiredException;
 import org.asamk.signal.manager.api.IncorrectPinException;
 import org.asamk.signal.manager.api.NonNormalizedPhoneNumberException;
 import org.asamk.signal.manager.api.PinLockMissingException;
 import org.asamk.signal.manager.api.PinLockedException;
 import org.asamk.signal.manager.api.RateLimitException;
+import org.asamk.signal.manager.api.TotpRequiredException;
 import org.asamk.signal.manager.api.UpdateProfile;
 import org.asamk.signal.manager.api.VerificationMethodNotAvailableException;
 import org.asamk.signal.manager.config.ServiceConfig;
@@ -33,31 +35,46 @@ import org.asamk.signal.manager.helper.PinHelper;
 import org.asamk.signal.manager.storage.SignalAccount;
 import org.asamk.signal.manager.util.KeyUtils;
 import org.asamk.signal.manager.util.NumberVerificationUtils;
+import org.signal.core.models.AccountEntropyPool;
+import org.signal.core.models.MasterKey;
+import org.signal.core.models.ServiceId.ACI;
+import org.signal.core.models.ServiceId.PNI;
 import org.signal.libsignal.usernames.BaseUsernameException;
+import org.signal.network.api.RegistrationApiV2;
+import org.signal.network.api.RegistrationApiV2.RegisterAccountError;
+import org.signal.network.rest.SignalRestClient;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.SignalServiceAccountManager;
 import org.whispersystems.signalservice.api.account.PreKeyCollection;
-import org.whispersystems.signalservice.api.kbs.MasterKey;
-import org.whispersystems.signalservice.api.push.ServiceId.ACI;
-import org.whispersystems.signalservice.api.push.ServiceId.PNI;
 import org.whispersystems.signalservice.api.push.ServiceIdType;
 import org.whispersystems.signalservice.api.push.SignalServiceAddress;
 import org.whispersystems.signalservice.api.push.exceptions.AlreadyVerifiedException;
 import org.whispersystems.signalservice.api.push.exceptions.DeprecatedVersionException;
+import org.whispersystems.signalservice.api.push.exceptions.MustRequestNewCodeException;
 import org.whispersystems.signalservice.api.svr.SecureValueRecovery;
 import org.whispersystems.signalservice.internal.push.VerifyAccountResponse;
 
 import java.io.IOException;
+import java.util.Base64;
 import java.util.function.Consumer;
 
+import static org.asamk.signal.manager.internal.ProvisioningManagerImpl.toRegistrationPreKeys;
 import static org.asamk.signal.manager.util.KeyUtils.generatePreKeysForType;
 import static org.asamk.signal.manager.util.Utils.handleResponseException;
+import static org.asamk.signal.manager.util.Utils.handleResponseExceptionSuspend;
 
 public class RegistrationManagerImpl implements RegistrationManager {
 
     private static final Logger logger = LoggerFactory.getLogger(RegistrationManagerImpl.class);
 
+    private static final class RecoveryRequestFailedException extends IOException {
+
+        private RecoveryRequestFailedException(final String message, final Throwable cause) {
+            super(message, cause);
+        }
+    }
+
     private SignalAccount account;
     private final PathConfig pathConfig;
     private final ServiceEnvironmentConfig serviceEnvironmentConfig;
@@ -106,7 +123,7 @@ public class RegistrationManagerImpl implements RegistrationManager {
             boolean voiceVerification,
             String captcha,
             final boolean forceRegister
-    ) throws IOException, CaptchaRequiredException, NonNormalizedPhoneNumberException, RateLimitException, VerificationMethodNotAvailableException {
+    ) throws IOException, CaptchaRequiredException, NonNormalizedPhoneNumberException, RateLimitException, TotpRequiredException, VerificationMethodNotAvailableException {
         if (account.isRegistered()
                 && account.getServiceEnvironment() != null
                 && account.getServiceEnvironment() != serviceEnvironmentConfig.type()) {
@@ -128,6 +145,13 @@ public class RegistrationManagerImpl implements RegistrationManager {
             if (recoveryPassword != null && account.isPrimaryDevice() && attemptReregisterAccount(recoveryPassword)) {
                 return;
             }
+            if (account.getAci() != null && account.getAccountEntropyPool() != null && attemptRecoverAccount(null)) {
+                return;
+            }
+
+            if (account.getNumber() == null) {
+                throw new IOException("Failed to recover account using its ACI and Account Entropy Pool");
+            }
 
             final var registrationApi = unauthenticatedAccountManager.getRegistrationApi();
             logger.trace("Creating verification session");
@@ -161,7 +185,11 @@ public class RegistrationManagerImpl implements RegistrationManager {
 
         final var aciPreKeys = generatePreKeysForType(account.getAccountData(ServiceIdType.ACI));
         final var pniPreKeys = generatePreKeysForType(account.getAccountData(ServiceIdType.PNI));
-        final var result = NumberVerificationUtils.verifyNumber(account.getSessionId(account.getNumber()),
+        final var sessionId = account.getSessionId(account.getNumber());
+        if (sessionId == null) {
+            throw new IOException("No registration verification session active");
+        }
+        final var result = NumberVerificationUtils.verifyNumber(sessionId,
                 verificationCode,
                 pin,
                 pinHelper,
@@ -179,6 +207,108 @@ public class RegistrationManagerImpl implements RegistrationManager {
         finishAccountRegistration(response, pin, masterKey, aciPreKeys, pniPreKeys);
     }
 
+    @Override
+    public void registerWithRecoveryKey(
+            final String recoveryKey,
+            final boolean forceRegister,
+            final Integer totp
+    ) throws IOException, RateLimitException, TotpRequiredException {
+        if (account.getAci() == null) {
+            throw new IOException("Recovery-key registration requires an ACI account identifier");
+        }
+        if (account.isRegistered() && !forceRegister) {
+            throw new IOException("Account is already registered; use --reregister to register it again");
+        }
+        final var accountEntropyPool = AccountEntropyPool.Companion.parseOrNull(recoveryKey);
+        if (accountEntropyPool == null || !AccountEntropyPool.Companion.isFullyValid(accountEntropyPool.getValue())) {
+            throw new IOException("Invalid recovery key");
+        }
+        recoverAccount(totp, false, accountEntropyPool);
+    }
+
+    private boolean attemptRecoverAccount(
+            final Integer totp
+    ) throws IOException, RateLimitException, TotpRequiredException {
+        final var accountEntropyPool = account.getAccountEntropyPool();
+        try {
+            recoverAccount(totp, false, accountEntropyPool);
+            logger.info("Reregistered existing account using its ACI and Account Entropy Pool.");
+            return true;
+        } catch (TotpRequiredException | RateLimitException e) {
+            throw e;
+        } catch (RecoveryRequestFailedException e) {
+            logger.debug("Failed to reregister account using its ACI and Account Entropy Pool", e);
+            return false;
+        }
+    }
+
+    private void recoverAccount(
+            final Integer totp,
+            final boolean includeRegistrationLock,
+            final AccountEntropyPool accountEntropyPool
+    ) throws IOException, RateLimitException, TotpRequiredException {
+        if (account.getPniIdentityKeyPair() == null) {
+            account.setPniIdentityKeyPair(KeyUtils.generateIdentityKeyPair());
+        }
+
+        final var aciPreKeys = generatePreKeysForType(account.getAccountData(ServiceIdType.ACI));
+        final var pniPreKeys = generatePreKeysForType(account.getAccountData(ServiceIdType.PNI));
+        final var masterKey = accountEntropyPool.deriveMasterKey();
+        final var recoveryPassword = masterKey.deriveRegistrationRecoveryPassword();
+        final var registrationLock = includeRegistrationLock ? masterKey.deriveRegistrationLock() : null;
+        final var restClient = new SignalRestClient(serviceEnvironmentConfig.signalServiceConfiguration(), userAgent);
+        final var registrationApi = new RegistrationApiV2(restClient, true);
+
+        final RegistrationApiV2.RegisterAccountResponse response;
+        try {
+            response = handleResponseExceptionSuspend(cont -> registrationApi.registerAccount(null,
+                    account.getPassword(),
+                    null,
+                    recoveryPassword,
+                    null,
+                    account.getAccountAttributesV2ForRecovery(registrationLock, recoveryPassword),
+                    toRegistrationPreKeys(aciPreKeys),
+                    toRegistrationPreKeys(pniPreKeys),
+                    null,
+                    true,
+                    account.getAci(),
+                    totp,
+                    cont));
+        } catch (BadRequestException e) {
+            switch (e.getError()) {
+                case RegisterAccountError.RegistrationLock ignored -> {
+                    if (includeRegistrationLock) {
+                        throw new RecoveryRequestFailedException("Registration lock recovery failed", e);
+                    }
+                    recoverAccount(totp, true, accountEntropyPool);
+                    return;
+                }
+                case RegisterAccountError.TotpMissingOrIncorrect ignored -> throw new TotpRequiredException();
+                case RegisterAccountError.RegistrationRecoveryPasswordIncorrect ignored ->
+                        throw new RecoveryRequestFailedException("Account key or recovery key is incorrect", e);
+                case RegisterAccountError.RateLimited ignored -> throw new RateLimitException(null);
+                case RegisterAccountError.PostQuantumRatchetRequired ignored ->
+                    throw new IOException("signal-cli is too old to register this account", e);
+                default -> throw new IOException("Signal rejected recovery-key registration", e);
+            }
+        }
+
+        final var aci = ACI.parseOrThrow(response.getAci());
+        final var pni = response.getPni() == null ? null : PNI.parseOrThrow(response.getPni());
+        final var authCredentialSalt = response.getAuthCredentialSalt() == null
+                ? null
+                : Base64.getDecoder().decode(response.getAuthCredentialSalt());
+        account.finishRecoveryRegistration(aci,
+                pni,
+                response.getE164(),
+                accountEntropyPool,
+                authCredentialSalt,
+                aciPreKeys,
+                pni == null ? null : pniPreKeys);
+        accountFileUpdater.updateAccountIdentifiers(response.getE164(), aci);
+        finishManagerRegistration(response.getStorageCapable());
+    }
+
     @Override
     public void deleteLocalAccountData() throws IOException {
         account.deleteAccountData();
@@ -226,6 +356,7 @@ public class RegistrationManagerImpl implements RegistrationManager {
                     userAgent,
                     account.getCredentialsProvider(),
                     account.getSignalServiceDataStore(),
+                    0,
                     null,
                     new ReentrantSignalSessionLock());
             handleResponseException(dependencies.getAccountApi()
@@ -258,6 +389,8 @@ public class RegistrationManagerImpl implements RegistrationManager {
         final var registrationApi = unauthenticatedAccountManager.getRegistrationApi();
         try {
             handleResponseException(registrationApi.verifyAccount(sessionId, verificationCode));
+        } catch (MustRequestNewCodeException e) {
+            throw new IOException("Verification code expired, please request a new one by registering again.", e);
         } catch (AlreadyVerifiedException e) {
             // Already verified so can continue registering
         }
@@ -283,13 +416,17 @@ public class RegistrationManagerImpl implements RegistrationManager {
         account.finishRegistration(aci, pni, masterKey, pin, aciPreKeys, pniPreKeys);
         accountFileUpdater.updateAccountIdentifiers(account.getNumber(), aci);
 
+        finishManagerRegistration(response.isStorageCapable());
+    }
+
+    private void finishManagerRegistration(final boolean storageCapable) throws IOException {
         ManagerImpl m = null;
         try {
             m = new ManagerImpl(account, pathConfig, accountFileUpdater, serviceEnvironmentConfig, userAgent);
             account = null;
 
             m.refreshPreKeys();
-            if (response.isStorageCapable()) {
+            if (storageCapable) {
                 m.syncRemoteStorage();
             }
             // Set an initial empty profile so user can be added to groups

lib/src/main/java/org/asamk/signal/manager/internal/SignalDependencies.java

@@ -3,10 +3,22 @@ package org.asamk.signal.manager.internal;
 import org.asamk.signal.manager.config.ServiceConfig;
 import org.asamk.signal.manager.config.ServiceEnvironmentConfig;
 import org.asamk.signal.manager.util.Utils;
+import org.signal.core.util.UptimeSleepTimer;
 import org.signal.libsignal.metadata.certificate.CertificateValidator;
 import org.signal.libsignal.net.Network;
-import org.signal.libsignal.protocol.UsePqRatchet;
+import org.signal.libsignal.protocol.SignalProtocolAddress;
 import org.signal.libsignal.zkgroup.profiles.ClientZkProfileOperations;
+import org.signal.network.api.AccountApiV2;
+import org.signal.network.api.AttachmentApi;
+import org.signal.network.api.CallingApi;
+import org.signal.network.api.CdsApi;
+import org.signal.network.api.CertificateApi;
+import org.signal.network.api.LinkDeviceApi;
+import org.signal.network.api.RateLimitChallengeApi;
+import org.signal.network.api.UsernameApi;
+import org.signal.network.rest.SignalRestClient;
+import org.signal.network.service.CdnService;
+import org.signal.network.service.StorageServiceService;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.whispersystems.signalservice.api.SignalServiceAccountManager;
@@ -15,28 +27,21 @@ import org.whispersystems.signalservice.api.SignalServiceMessageReceiver;
 import org.whispersystems.signalservice.api.SignalServiceMessageSender;
 import org.whispersystems.signalservice.api.SignalSessionLock;
 import org.whispersystems.signalservice.api.account.AccountApi;
-import org.whispersystems.signalservice.api.attachment.AttachmentApi;
-import org.whispersystems.signalservice.api.cds.CdsApi;
-import org.whispersystems.signalservice.api.certificate.CertificateApi;
 import org.whispersystems.signalservice.api.crypto.SignalServiceCipher;
 import org.whispersystems.signalservice.api.groupsv2.ClientZkOperations;
 import org.whispersystems.signalservice.api.groupsv2.GroupsV2Api;
 import org.whispersystems.signalservice.api.groupsv2.GroupsV2Operations;
 import org.whispersystems.signalservice.api.keys.KeysApi;
-import org.whispersystems.signalservice.api.link.LinkDeviceApi;
+import org.whispersystems.signalservice.api.keys.PreKeyRepository;
 import org.whispersystems.signalservice.api.message.MessageApi;
 import org.whispersystems.signalservice.api.profiles.ProfileApi;
 import org.whispersystems.signalservice.api.push.ServiceIdType;
 import org.whispersystems.signalservice.api.push.SignalServiceAddress;
-import org.whispersystems.signalservice.api.ratelimit.RateLimitChallengeApi;
 import org.whispersystems.signalservice.api.registration.RegistrationApi;
 import org.whispersystems.signalservice.api.services.ProfileService;
 import org.whispersystems.signalservice.api.storage.StorageServiceApi;
-import org.whispersystems.signalservice.api.storage.StorageServiceRepository;
 import org.whispersystems.signalservice.api.svr.SecureValueRecovery;
-import org.whispersystems.signalservice.api.username.UsernameApi;
 import org.whispersystems.signalservice.api.util.CredentialsProvider;
-import org.whispersystems.signalservice.api.util.UptimeSleepTimer;
 import org.whispersystems.signalservice.api.websocket.SignalWebSocket;
 import org.whispersystems.signalservice.internal.push.PushServiceSocket;
 import org.whispersystems.signalservice.internal.websocket.LibSignalChatConnection;
@@ -45,6 +50,7 @@ import java.io.IOException;
 import java.net.InetSocketAddress;
 import java.net.Proxy;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.TimeUnit;
@@ -60,6 +66,7 @@ public class SignalDependencies {
     private final String userAgent;
     private final CredentialsProvider credentialsProvider;
     private final SignalServiceDataStore dataStore;
+    private final int deviceId;
     private final ExecutorService executor;
     private final SignalSessionLock sessionLock;
 
@@ -67,6 +74,7 @@ public class SignalDependencies {
 
     private SignalServiceAccountManager accountManager;
     private AccountApi accountApi;
+    private AccountApiV2 accountApiV2;
     private RateLimitChallengeApi rateLimitChallengeApi;
     private CdsApi cdsApi;
     private UsernameApi usernameApi;
@@ -76,10 +84,16 @@ public class SignalDependencies {
     private StorageServiceApi storageServiceApi;
     private CertificateApi certificateApi;
     private AttachmentApi attachmentApi;
+    private CallingApi callingApi;
     private MessageApi messageApi;
     private KeysApi keysApi;
     private GroupsV2Operations groupsV2Operations;
     private ClientZkOperations clientZkOperations;
+    private ProfileService profileService;
+    private ProfileApi profileApi;
+    private CdnService cdnService;
+    private PreKeyRepository preKeyRepository;
+    private SignalRestClient signalRestClient;
 
     private PushServiceSocket pushServiceSocket;
     private Network libSignalNetwork;
@@ -89,14 +103,13 @@ public class SignalDependencies {
     private SignalServiceMessageSender messageSender;
 
     private List<SecureValueRecovery> secureValueRecovery;
-    private ProfileService profileService;
-    private ProfileApi profileApi;
 
     SignalDependencies(
             final ServiceEnvironmentConfig serviceEnvironmentConfig,
             final String userAgent,
             final CredentialsProvider credentialsProvider,
             final SignalServiceDataStore dataStore,
+            final int deviceId,
             final ExecutorService executor,
             final SignalSessionLock sessionLock
     ) {
@@ -104,6 +117,7 @@ public class SignalDependencies {
         this.userAgent = userAgent;
         this.credentialsProvider = credentialsProvider;
         this.dataStore = dataStore;
+        this.deviceId = deviceId;
         this.executor = executor;
         this.sessionLock = sessionLock;
     }
@@ -153,7 +167,10 @@ public class SignalDependencies {
 
     public Network getLibSignalNetwork() {
         return getOrCreate(() -> libSignalNetwork, () -> {
-            libSignalNetwork = new Network(serviceEnvironmentConfig.netEnvironment(), userAgent);
+            libSignalNetwork = new Network(serviceEnvironmentConfig.netEnvironment(),
+                    userAgent,
+                    Map.of(),
+                    Network.BuildVariant.PRODUCTION);
             setSignalNetworkProxy(libSignalNetwork);
         });
     }
@@ -206,6 +223,11 @@ public class SignalDependencies {
         return getOrCreate(() -> accountApi, () -> accountApi = new AccountApi(getAuthenticatedSignalWebSocket()));
     }
 
+    public AccountApiV2 getAccountApiV2() {
+        return getOrCreate(() -> accountApiV2,
+                () -> accountApiV2 = new AccountApiV2(getAuthenticatedSignalWebSocket()));
+    }
+
     public RateLimitChallengeApi getRateLimitChallengeApi() {
         return getOrCreate(() -> rateLimitChallengeApi,
                 () -> rateLimitChallengeApi = new RateLimitChallengeApi(getAuthenticatedSignalWebSocket()));
@@ -238,8 +260,8 @@ public class SignalDependencies {
                         getPushServiceSocket()));
     }
 
-    public StorageServiceRepository getStorageServiceRepository() {
-        return new StorageServiceRepository(getStorageServiceApi());
+    public StorageServiceService getStorageServiceRepository() {
+        return new StorageServiceService(getStorageServiceApi());
     }
 
     public CertificateApi getCertificateApi() {
@@ -252,6 +274,13 @@ public class SignalDependencies {
                 () -> attachmentApi = new AttachmentApi(getAuthenticatedSignalWebSocket(), getPushServiceSocket()));
     }
 
+    public CallingApi getCallingApi() {
+        return getOrCreate(() -> callingApi,
+                () -> callingApi = new CallingApi(getAuthenticatedSignalWebSocket(),
+                        getUnauthenticatedSignalWebSocket(),
+                        getPushServiceSocket()));
+    }
+
     public MessageApi getMessageApi() {
         return getOrCreate(() -> messageApi,
                 () -> messageApi = new MessageApi(getAuthenticatedSignalWebSocket(),
@@ -289,7 +318,7 @@ public class SignalDependencies {
                     getLibSignalNetwork(),
                     credentialsProvider,
                     allowStories,
-                    healthMonitor), () -> true, timer, TimeUnit.SECONDS.toMillis(10));
+                    healthMonitor), () -> true, timer, TimeUnit.SECONDS.toMillis(30));
             healthMonitor.monitor(authenticatedSignalWebSocket);
         });
     }
@@ -304,7 +333,7 @@ public class SignalDependencies {
                     getLibSignalNetwork(),
                     null,
                     allowStories,
-                    healthMonitor), () -> true, timer, TimeUnit.SECONDS.toMillis(10));
+                    healthMonitor), () -> true, timer, TimeUnit.SECONDS.toMillis(30));
             healthMonitor.monitor(unauthenticatedSignalWebSocket);
         });
     }
@@ -314,19 +343,42 @@ public class SignalDependencies {
                 () -> messageReceiver = new SignalServiceMessageReceiver(getPushServiceSocket()));
     }
 
+    private SignalRestClient getSignalRestClient() {
+        return getOrCreate(() -> signalRestClient,
+                () -> signalRestClient = new SignalRestClient(serviceEnvironmentConfig.signalServiceConfiguration(),
+                        userAgent,
+                        credentialsProvider,
+                        ServiceConfig.AUTOMATIC_NETWORK_RETRY));
+    }
+
+    public CdnService getCdnService() {
+        return getOrCreate(() -> cdnService,
+                () -> cdnService = new CdnService(getSignalRestClient(), getAttachmentApi()));
+    }
+
+    public PreKeyRepository getPreKeyRepository() {
+        final SignalProtocolAddress localProtocolAddress = credentialsProvider.getAci().toProtocolAddress(deviceId);
+        return getOrCreate(() -> preKeyRepository,
+                () -> preKeyRepository = new PreKeyRepository(getKeysApi(),
+                        dataStore.aci(),
+                        localProtocolAddress,
+                        getSessionLock(),
+                        Runnable::run));
+    }
+
     public SignalServiceMessageSender getMessageSender() {
         return getOrCreate(() -> messageSender,
                 () -> messageSender = new SignalServiceMessageSender(getPushServiceSocket(),
                         dataStore,
                         sessionLock,
-                        getAttachmentApi(),
                         getMessageApi(),
                         getKeysApi(),
                         Optional.empty(),
                         executor,
                         ServiceConfig.MAX_ENVELOPE_SIZE,
+                        ServiceConfig.MAX_INCREMENTAL_MACS_PER_ENVELOPE,
                         () -> true,
-                        UsePqRatchet.NO));
+                        getPreKeyRepository()));
     }
 
     public List<SecureValueRecovery> getSecureValueRecovery() {
@@ -354,7 +406,10 @@ public class SignalDependencies {
 
     public SignalServiceCipher getCipher(ServiceIdType serviceIdType) {
         final var certificateValidator = new CertificateValidator(serviceEnvironmentConfig.unidentifiedSenderTrustRoots());
-        final var address = new SignalServiceAddress(credentialsProvider.getAci(), credentialsProvider.getE164());
+        final var serviceId = serviceIdType == ServiceIdType.ACI
+                ? credentialsProvider.getAci()
+                : credentialsProvider.getPni();
+        final var address = new SignalServiceAddress(serviceId, credentialsProvider.getE164());
         final var deviceId = credentialsProvider.getDeviceId();
         return new SignalServiceCipher(address,
                 deviceId,

lib/src/main/java/org/asamk/signal/manager/internal/SignalLogger.java

@@ -0,0 +1,46 @@
+package org.asamk.signal.manager.internal;
+
+import org.signal.core.util.logging.Log;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+public class SignalLogger extends Log.Logger {
+
+    private static final Logger logger = LoggerFactory.getLogger("LibSignalService");
+
+    public static void initLogger() {
+        Log.initialize(() -> true, new SignalLogger());
+    }
+
+    private SignalLogger() {
+    }
+
+    @Override
+    public void v(final String tag, final String message, final Throwable throwable, final boolean b) {
+        logger.trace("[{}]: {}", tag, message, throwable);
+    }
+
+    @Override
+    public void d(final String tag, final String message, final Throwable throwable, final boolean b) {
+        logger.debug("[{}]: {}", tag, message, throwable);
+    }
+
+    @Override
+    public void i(final String tag, final String message, final Throwable throwable, final boolean b) {
+        logger.info("[{}]: {}", tag, message, throwable);
+    }
+
+    @Override
+    public void w(final String tag, final String message, final Throwable throwable, final boolean b) {
+        logger.warn("[{}]: {}", tag, message, throwable);
+    }
+
+    @Override
+    public void e(final String tag, final String message, final Throwable throwable, final boolean b) {
+        logger.error("[{}]: {}", tag, message, throwable);
+    }
+
+    @Override
+    public void flush() {
+    }
+}

lib/src/main/java/org/asamk/signal/manager/internal/SignalWebSocketHealthMonitor.java

@@ -1,13 +1,15 @@
 package org.asamk.signal.manager.internal;
 
+import org.jetbrains.annotations.NotNull;
+import org.signal.core.util.SleepTimer;
+import org.signal.network.util.Preconditions;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.whispersystems.signalservice.api.util.Preconditions;
-import org.whispersystems.signalservice.api.util.SleepTimer;
 import org.whispersystems.signalservice.api.websocket.HealthMonitor;
 import org.whispersystems.signalservice.api.websocket.SignalWebSocket;
 import org.whispersystems.signalservice.api.websocket.WebSocketConnectionState;
 
+import java.time.Duration;
 import java.util.concurrent.Executor;
 import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
@@ -94,6 +96,26 @@ final class SignalWebSocketHealthMonitor implements HealthMonitor {
         return needsKeepAlive && webSocket != null && webSocket.shouldSendKeepAlives();
     }
 
+    @Override
+    public void onReceivedAlerts(@NotNull final String[] strings, final boolean b) {
+        if (strings.length == 0) {
+            return;
+        }
+        logger.info("Received alerts: {}", String.join(", ", strings));
+    }
+
+    @Override
+    public void onServerTimestamp(final long serverTimestamp, final boolean isIdentifiedWebsocket) {
+        final var skew = skewFrom(serverTimestamp);
+        if (skew.compareTo(Duration.ofDays(1)) > 0) {
+            logger.warn("Local clock is off from the server by {}, which exceeds the allowed limit..", skew);
+        }
+    }
+
+    private Duration skewFrom(long serverTime) {
+        return Duration.ofMillis(Math.abs(System.currentTimeMillis() - serverTime));
+    }
+
     /**
      * Sends periodic heartbeats/keep-alives over the WebSocket to prevent connection timeouts. If
      * the WebSocket fails to get a return heartbeat after [KEEP_ALIVE_TIMEOUT] seconds, it is forced to be recreated.

lib/src/main/java/org/asamk/signal/manager/jobs/DownloadProfileJob.java

@@ -9,9 +9,15 @@ public class DownloadProfileJob implements Job {
 
     private static final Logger logger = LoggerFactory.getLogger(DownloadProfileJob.class);
     private final RecipientAddress address;
+    private final boolean resolveIdentityKeyConflict;
 
     public DownloadProfileJob(RecipientAddress address) {
+        this(address, false);
+    }
+
+    public DownloadProfileJob(RecipientAddress address, boolean resolveIdentityKeyConflict) {
         this.address = address;
+        this.resolveIdentityKeyConflict = resolveIdentityKeyConflict;
     }
 
     @Override
@@ -19,6 +25,9 @@ public class DownloadProfileJob implements Job {
         logger.trace("Refreshing profile for {}", address);
         final var account = context.getAccount();
         final var recipientId = account.getRecipientStore().resolveRecipient(address);
-        context.getProfileHelper().refreshRecipientProfile(recipientId);
+        final var refreshed = context.getProfileHelper().refreshRecipientProfile(recipientId);
+        if (refreshed && resolveIdentityKeyConflict) {
+            context.getJobExecutor().enqueueJob(new SyncStorageJob());
+        }
     }
 }

lib/src/main/java/org/asamk/signal/manager/jobs/RetrieveStickerPackJob.java

@@ -2,10 +2,10 @@ package org.asamk.signal.manager.jobs;
 
 import org.asamk.signal.manager.api.StickerPackId;
 import org.asamk.signal.manager.helper.Context;
+import org.signal.core.util.Hex;
 import org.signal.libsignal.protocol.InvalidMessageException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
-import org.whispersystems.signalservice.internal.util.Hex;
 
 import java.io.IOException;