@aunucore/baileys 1.0.73 → 1.0.75

package/README.md

@@ -128,10 +128,9 @@ Everything else is the upstream core. The patch layer stays small and deliberate
 
 ### 📰 Recent releases
 
+- **1.0.75 — Partial-config safety + watchdog cleanup.** A partial `transactionOpts` in the socket config can no longer kill every key-store transaction: the config is deep-merged over the defaults and the transaction layer falls back per-field (`maxCommitRetries` 10, `delayBetweenTriesMs` 3000, retries clamped to at least 1 so an explicit `0` means exactly one attempt) — previously the shallow config spread replaced the whole default object, `maxCommitRetries` came out `undefined`, and every transaction threw `failed to commit transaction mutations` without a single commit attempt. The session watchdog's interval is now stopped when the socket ends (its `stop()` existed but was never called anywhere), closing a one-timer-and-socket-graph leak per reconnect cycle.
+- **1.0.74 — Fix-all batch.** The entire 1.0.74 heartbeat queue, closed in one version: `resyncAppState` can no longer spin forever holding the key-store transaction mutex (server-omitted collections finish with a warning, plus a 25-round cap), `startByte`-only media downloads no longer silently return an empty stream, an all-failed sticker pack throws Boom 400 instead of uploading empty, key-material guards now check TYPES (Buffer/string only) at six sites so wrong-typed creds fail descriptively instead of as raw TypeErrors, the noise handshake guards a missing `noiseKey` up front, the pre-login `creds.me` dereference family is closed (acks for `<unavailable>` stanzas survive fresh pairing), and two per-entity maps (`RateLimiter.hits`, bug-guard `recentBySender`) evict stale keys with a lazy sweep.
 - **1.0.73 — Heartbeat queue + a new README.** Three verified heartbeat fixes: a corrupt frame header can no longer wedge `decodeFrame` (zero-length headers are skipped, frames over 10 MiB fail loudly instead of buffering forever), `botRecentSecretsByChat` is capped at 1,000 chats FIFO, and bare key-store writes are serialized through the transaction mutex so a `migrateSession` commit can't overwrite a fresher session record. Plus a fully rewritten README and 46 curated npm keywords.
-- **1.0.72 — Send integrity.** Fixes a critical regression in 1.0.71 that made `sendMessage` relay an empty message, plus auditor-verified fixes: media-cache contamination, sent-message cache LID/PN resolution, newsletter media stanza typing, USync backoff wired with a 60s clamp, and a 30-item heartbeat sweep (HB-61…HB-90).
-- **1.0.71 — The farm batch.** Polls V6 + image polls, spoiler & group-status proto fields, A2UI widgets, the crash-payload detector, MEX username management, six USync protocols, msmsg decryption, heartbeat fixes HB-49…HB-59 — every viable harvest from a 2,500-package ecosystem sweep, in one release.
-
 Full changelog for every version since 1.0.2: **[docs](https://docsjs.aunucore.eu.cc)** · **[GitHub Releases](https://github.com/AunuCore/AunuBaileys-lib/releases)**.
 
 ### 🙏 Credits

package/lib/Signal/libsignal.js

@@ -5,6 +5,10 @@ import { jidDecode } from '../WABinary/index.js';
 import { SenderKeyName } from './Group/sender-key-name.js';
 import { SenderKeyRecord } from './Group/sender-key-record.js';
 import { GroupCipher, GroupSessionBuilder, SenderKeyDistributionMessage } from './Group/index.js';
+// AunuBaileys (1.0.74): HB-98 — key material is only ever a Buffer
+// (or a string in a hand-edited creds file). Anything else is a
+// wrong-typed corrupt value, not key material.
+const isKeyMaterial = (value) => Buffer.isBuffer(value) || typeof value === 'string';
 export function makeLibSignalRepository(auth) {
     const storage = signalStorage(auth);
     return {
@@ -153,7 +157,10 @@ function signalStorage({ creds, keys }) {
                 // that peer's pkmsg forever with no self-heal match.
                 // Return undefined instead — libsignal raises the
                 // diagnosable `PreKeyError: Invalid PreKey ID`.
-                if (!key.private || !key.public) {
+                // (1.0.74, HB-98: wrong-TYPED material — e.g. a number —
+                // slipped past the truthiness check and threw the bare
+                // TypeError from Buffer.from anyway; same treatment.)
+                if (!isKeyMaterial(key.private) || !isKeyMaterial(key.public)) {
                     return undefined;
                 }
                 return {
@@ -169,7 +176,7 @@ function signalStorage({ creds, keys }) {
             // keyPair object itself — {keyPair:{}} or {keyPair:{public}}
             // slipped through and threw a bare TypeError on EVERY pkmsg.
             // Check the fields, like getOurIdentity does (HB-26).
-            if (!key?.keyPair?.private || !key?.keyPair?.public) {
+            if (!isKeyMaterial(key?.keyPair?.private) || !isKeyMaterial(key?.keyPair?.public)) {
                 // AunuBaileys: a partial/corrupt creds restore (creds
                 // present, signedPreKey gone) otherwise fails EVERY
                 // pre-key message with a cryptic TypeError and never
@@ -201,7 +208,7 @@ function signalStorage({ creds, keys }) {
             // throw a bare TypeError here on EVERY pkmsg, forever, with
             // no self-heal classifier matching it. Fail descriptively
             // so the host knows a re-pair is the fix.
-            if (!signedIdentityKey?.private || !signedIdentityKey?.public) {
+            if (!isKeyMaterial(signedIdentityKey?.private) || !isKeyMaterial(signedIdentityKey?.public)) {
                 throw new Error('Our signed identity key is missing or incomplete — the auth state is corrupt; re-pair the device');
             }
             return {

package/lib/Socket/chats.js

@@ -11,6 +11,8 @@ import { getBinaryNodeChild, getBinaryNodeChildren, isJidUser, isLidUser, jidDec
 import { USyncQuery, USyncUser } from '../WAUSync/index.js';
 import { makeUSyncSocket } from './usync.js';
 const MAX_SYNC_ATTEMPTS = 2;
+// AunuBaileys (1.0.74): HB-95 — hard cap on resyncAppState rounds.
+const MAX_RESYNC_ROUNDS = 25;
 export const makeChatsSocket = (config) => {
     const { logger, markOnlineOnConnect, fireInitQueries, appStateMacVerification, shouldIgnoreJid, shouldSyncHistoryMessage } = config;
     const sock = makeUSyncSocket(config);
@@ -373,7 +375,17 @@ export const makeChatsSocket = (config) => {
             // keep executing till all collections are done
             // sometimes a single patch request will not return all the patches (God knows why)
             // so we fetch till they're all done (this is determined by the "has_more_patches" flag)
+            let resyncRounds = 0;
             while (collectionsToHandle.size) {
+                // AunuBaileys (1.0.74): HB-95 second safety net — even
+                // with absent collections handled below, never let this
+                // loop spin forever inside the key-store transaction:
+                // past the round cap, bail out descriptively so the
+                // transaction (and its mutex) is always released.
+                resyncRounds += 1;
+                if (resyncRounds > MAX_RESYNC_ROUNDS) {
+                    throw new Boom(`resyncAppState did not converge after ${MAX_RESYNC_ROUNDS} rounds (still pending: ${[...collectionsToHandle].join(', ')})`, { statusCode: 500 });
+                }
                 const states = {};
                 const nodes = [];
                 for (const name of collectionsToHandle) {
@@ -416,6 +428,19 @@ export const makeChatsSocket = (config) => {
                 });
                 // extract from binary node
                 const decoded = await extractSyncdPatches(result, config?.options);
+                // AunuBaileys (1.0.74): HB-95 — a collection the server
+                // omits from its sync response never enters `decoded`,
+                // so it was never deleted from collectionsToHandle and
+                // the loop above re-issued the identical IQ forever,
+                // holding the key-store transaction mutex the whole
+                // time. Treat an absent collection as done, with a
+                // warning.
+                for (const name of [...collectionsToHandle]) {
+                    if (!(name in decoded)) {
+                        logger.warn({ name }, `collection ${name} missing from app-state sync response; treating it as done`);
+                        collectionsToHandle.delete(name);
+                    }
+                }
                 for (const key in decoded) {
                     const name = key;
                     const { patches, hasMorePatches, snapshot } = decoded[name];

package/lib/Socket/index.js

@@ -16,6 +16,15 @@ const makeWASocket = (config) => {
         ...DEFAULT_CONNECTION_CONFIG,
         ...config
     };
+    // AunuBaileys (1.0.75, HB-104): transactionOpts is merged per-field —
+    // the shallow spread above replaced the whole default object, so a
+    // host passing a PARTIAL transactionOpts silently lost the other
+    // field's default (and, before the auth-utils fallback, every
+    // key-store commit with it).
+    newConfig.transactionOpts = {
+        ...DEFAULT_CONNECTION_CONFIG.transactionOpts,
+        ...(config?.transactionOpts ?? {})
+    };
     // If the user hasn't provided their own history sync function,
     // let's create a default one that respects the syncFullHistory flag.
     if (config.shouldSyncHistoryMessage === undefined) {
@@ -30,7 +39,18 @@ const makeWASocket = (config) => {
     // config.sessionWatchdog (object = options, true = defaults).
     // It only reports; it never reconnects.
     if (newConfig.sessionWatchdog) {
-        sock.aunuSessionWatchdog = attachSessionWatchdog(sock, newConfig.sessionWatchdog === true ? undefined : newConfig.sessionWatchdog);
+        const watchdog = attachSessionWatchdog(sock, newConfig.sessionWatchdog === true ? undefined : newConfig.sessionWatchdog);
+        sock.aunuSessionWatchdog = watchdog;
+        // AunuBaileys (1.0.75, HB-105): stop() existed but was never
+        // called anywhere in the lib — the interval is unref'd yet its
+        // closure holds ev + sock, so every ended socket with the
+        // watchdog enabled leaked one 30s timer and its whole socket
+        // graph for the life of the process, one per reconnect cycle.
+        // Register stop() as a socket-end handler, the same pattern as
+        // stopOfflineDrain (HB-66). stop() is idempotent (safe on the
+        // double-end path), and sockets without a watchdog never reach
+        // this branch.
+        sock.registerSocketEndHandler?.(() => watchdog.stop());
     }
     sock.aunuHandler = new AunuHandler(sock);
     attachAunuAutoJoin(sock, newConfig);

package/lib/Socket/messages-recv.js

@@ -74,7 +74,7 @@ export const makeMessagesRecvSocket = (config) => {
             stanza.attrs.type = attrs.type;
         }
         if (tag === 'message' && getBinaryNodeChild({ tag, attrs, content }, 'unavailable')) {
-            stanza.attrs.from = authState.creds.me.id;
+            stanza.attrs.from = authState.creds.me?.id;
         }
         logger.debug({ recv: { tag, attrs }, sent: stanza.attrs }, 'sent ack');
         await sendNode(stanza);
@@ -407,7 +407,7 @@ export const makeMessagesRecvSocket = (config) => {
                 break;
             case 'devices': {
                 const devices = getBinaryNodeChildren(child, 'device');
-                if (areJidsSameUser(child.attrs.jid, authState.creds.me.id)) {
+                if (areJidsSameUser(child.attrs.jid, authState.creds.me?.id)) {
                     const deviceJids = devices.map(d => d.attrs.jid);
                     logger.info({ deviceJids }, 'got my own devices');
                 }
@@ -773,7 +773,7 @@ export const makeMessagesRecvSocket = (config) => {
                 processingMutex.mutex(async () => {
                     const msg = await processNotification(node);
                     if (msg) {
-                        const fromMe = areJidsSameUser(node.attrs.participant || remoteJid, authState.creds.me.id);
+                        const fromMe = areJidsSameUser(node.attrs.participant || remoteJid, authState.creds.me?.id);
                         msg.key = {
                             remoteJid,
                             fromMe,
@@ -824,7 +824,7 @@ export const makeMessagesRecvSocket = (config) => {
         let response;
         if (getBinaryNodeChild(node, 'unavailable') && !encNode) {
             await sendMessageAck(node);
-            const { key } = decodeMessageNode(node, authState.creds.me.id, authState.creds.me.lid || '').fullMessage;
+            const { key } = decodeMessageNode(node, authState.creds.me?.id, authState.creds.me?.lid || '').fullMessage;
             // AunuBaileys: bot / hosted / view_once placeholders can never
             // be resent by the phone — don't burn a resend request on
             // them (behaviour learned from @violetix/baileys).

package/lib/Types/Auth.d.ts

@@ -89,8 +89,8 @@ export type SignalKeyStoreWithTransaction = SignalKeyStore & {
     transaction<T>(exec: () => Promise<T>): Promise<T>;
 };
 export type TransactionCapabilityOptions = {
-    maxCommitRetries: number;
-    delayBetweenTriesMs: number;
+    maxCommitRetries?: number;
+    delayBetweenTriesMs?: number;
 };
 export type SignalAuthState = {
     creds: SignalCreds;

package/lib/Utils/antiban.js

@@ -28,9 +28,28 @@ export class RateLimiter {
         this.windowMs = windowMs;
         this.hits = new Map();
     }
+    /**
+     * AunuBaileys (1.0.74): HB-103 — acquire/tryAcquire prune a key's
+     * old timestamps but never deleted the KEY, so one entry per
+     * recipient JID accumulated for the life of the socket. Lazy
+     * sweep, run only once the map passes the threshold: evict every
+     * key whose newest hit is already outside its rate-limit window
+     * (such a key would behave as brand-new anyway — no behaviour
+     * change, amortised cost).
+     */
+    sweepStaleKeys(now = Date.now()) {
+        for (const [key, arr] of this.hits) {
+            if (!arr.length || now - arr[arr.length - 1] >= this.windowMs) {
+                this.hits.delete(key);
+            }
+        }
+    }
     /** Tunggu sampai ada slot untuk key; kembalikan waktu tunggu (ms). */
     async acquire(key) {
         const now = Date.now();
+        if (this.hits.size > 10000) {
+            this.sweepStaleKeys(now);
+        }
         let arr = this.hits.get(key);
         if (!arr) {
             arr = [];
@@ -49,6 +68,9 @@ export class RateLimiter {
     /** Cek tanpa menunggu; true bila masih boleh. */
     tryAcquire(key) {
         const now = Date.now();
+        if (this.hits.size > 10000) {
+            this.sweepStaleKeys(now);
+        }
         let arr = this.hits.get(key);
         if (!arr) {
             arr = [];

package/lib/Utils/aunu-bug-guard.js

@@ -303,6 +303,20 @@ export const attachAunuBugGuard = (sock, options = {}) => {
         const stamps = (recentBySender.get(sender) || []).filter((t) => now - t < burstWindowMs);
         stamps.push(now);
         recentBySender.set(sender, stamps);
+        // AunuBaileys (1.0.74): HB-103 — stale senders were never
+        // evicted from this map (their stamp lists got filtered, the
+        // keys stayed), so it grew by one entry per distinct flagged
+        // sender for the life of the process. Lazy sweep, only past
+        // the threshold: drop senders whose newest detection is
+        // already outside the burst window.
+        if (recentBySender.size > 1000) {
+            for (const [other, otherStamps] of recentBySender) {
+                const newest = otherStamps[otherStamps.length - 1];
+                if (newest === undefined || now - newest >= burstWindowMs) {
+                    recentBySender.delete(other);
+                }
+            }
+        }
         return stamps.length >= burstThreshold;
     };
     const handleBug = async (message, result, where) => {

package/lib/Utils/auth-utils.js

@@ -87,7 +87,17 @@ export function makeCacheableSignalKeyStore(store, logger, _cache) {
  * @param logger logger to log events
  * @returns SignalKeyStore with transaction capability
  */
-export const addTransactionCapability = (state, logger, { maxCommitRetries, delayBetweenTriesMs }) => {
+export const addTransactionCapability = (state, logger, { maxCommitRetries, delayBetweenTriesMs } = {}) => {
+    // AunuBaileys (1.0.75, HB-104): a partial transactionOpts from the
+    // host (makeWASocket's shallow spread used to replace the whole
+    // default object) left maxCommitRetries undefined, so the commit
+    // loop below never ran even once and EVERY mutating transaction
+    // threw 'failed to commit transaction mutations' without a single
+    // commit attempt. Fall back per-field to the Defaults values, and
+    // clamp retries to at least 1 so an explicit 0 means exactly one
+    // attempt, matching host intent.
+    const commitRetries = Math.max(1, maxCommitRetries ?? 10);
+    const commitDelayMs = delayBetweenTriesMs ?? 3000;
     // number of queries made to the DB during the transaction
     // only there for logging purposes
     let dbQueriesInTransaction = 0;
@@ -116,7 +126,7 @@ export const addTransactionCapability = (state, logger, { maxCommitRetries, dela
                     logger.trace('committing transaction');
                     // retry mechanism to ensure we've some recovery
                     // in case a transaction fails in the first attempt
-                    let tries = maxCommitRetries;
+                    let tries = commitRetries;
                     let committed = false;
                     let lastCommitError;
                     while (tries) {
@@ -131,7 +141,7 @@ export const addTransactionCapability = (state, logger, { maxCommitRetries, dela
                         catch (error) {
                             lastCommitError = error;
                             logger.warn(`failed to commit ${Object.keys(mutations).length} mutations, tries left=${tries}`);
-                            await delay(delayBetweenTriesMs);
+                            await delay(commitDelayMs);
                         }
                     }
                     if (!committed) {

package/lib/Utils/crypto.js

@@ -5,7 +5,18 @@ import { KEY_BUNDLE_TYPE } from '../Defaults/index.js';
 // insure browser & node compatibility
 const { subtle } = globalThis.crypto;
 /** prefix version byte to the pub keys, required for some curve crypto functions */
-export const generateSignalPubKey = (pubKey) => pubKey.length === 33 ? pubKey : Buffer.concat([KEY_BUNDLE_TYPE, pubKey]);
+export const generateSignalPubKey = (pubKey) => {
+    // AunuBaileys (1.0.74): HB-98 — a wrong-typed public key (e.g. a
+    // number from a hand-edited creds file, via getOurIdentity) used
+    // to explode as a bare TypeError inside Buffer.concat. Key
+    // material is a Buffer (or a string in an edited creds file);
+    // anything else is corrupt — fail descriptively.
+    if (!Buffer.isBuffer(pubKey) && typeof pubKey !== 'string') {
+        throw new Error('AunuBaileys: invalid public key material — the auth state is incomplete or corrupt; restore a full backup or pair again');
+    }
+    const buf = typeof pubKey === 'string' ? Buffer.from(pubKey) : pubKey;
+    return buf.length === 33 ? buf : Buffer.concat([KEY_BUNDLE_TYPE, buf]);
+};
 export const Curve = {
     generateKeyPair: () => {
         const { pubKey, privKey } = libsignal.curve.generateKeyPair();

package/lib/Utils/messages-media.js

@@ -664,7 +664,13 @@ export const downloadEncryptedContent = async (downloadUrl, { cipherKey, iv }, {
     const pushBytes = (bytes, push) => {
         if (startByte || endByte) {
             const start = bytesFetched >= startByte ? undefined : Math.max(startByte - bytesFetched, 0);
-            const end = bytesFetched + bytes.length < endByte ? undefined : Math.max(endByte - bytesFetched, 0);
+            // AunuBaileys (1.0.74): HB-96 — with a startByte but NO
+            // endByte, `endByte - bytesFetched` was NaN and every chunk
+            // sliced to zero bytes (a silent empty download). No
+            // endByte means "to the end of the stream": end stays
+            // undefined. (When endByte IS set, an end past this chunk
+            // clamps inside slice() exactly like undefined did.)
+            const end = endByte == null ? undefined : Math.max(endByte - bytesFetched, 0);
             push(bytes.slice(start, end));
             bytesFetched += bytes.length;
         }

package/lib/Utils/messages.js

@@ -453,6 +453,14 @@ async function prepareStickerPackMessage(stickerPack, options) {
         }
     });
     const stickerMetadata = (await Promise.all(stickerPromises)).filter(Boolean);
+    // AunuBaileys (1.0.74): HB-97 — the input guard above only checks
+    // the REQUESTED stickers; if every one of them failed (404, too
+    // big, unconvertible) the pack used to upload happily with
+    // `stickers: []` and report success. An all-failed pack is an
+    // error; a partially-failed pack still succeeds.
+    if (stickerMetadata.length === 0) {
+        throw new Boom('All stickers in the pack failed to process — refusing to upload an empty sticker pack', { statusCode: 400 });
+    }
     // Process and add cover/tray icon to the ZIP
     const trayIconFileName = `${stickerPackIdValue}.webp`;
     const { stream: coverStream } = await getStream(cover);

package/lib/Utils/noise-handler.js

@@ -85,6 +85,15 @@ export const makeNoiseHandler = ({ keyPair: { private: privateKey, public: publi
         mixIntoKey,
         finishInit,
         processHandshake: async ({ serverHello }, noiseKey) => {
+            // AunuBaileys (1.0.74): HB-102 — a partial creds restore can
+            // reach the handshake with noiseKey missing; dereferencing
+            // it below threw a bare TypeError BEFORE the descriptive
+            // HB-80 guard in generateRegistrationNode could run, and
+            // the host reconnect-looped on it at every boot. Fail
+            // descriptively, in the HB-80 style.
+            if (!noiseKey?.public || !noiseKey?.private) {
+                throw new Error('AunuBaileys: creds.noiseKey is missing or incomplete — the auth state is incomplete or corrupt; restore a full backup or pair again');
+            }
             authenticate(serverHello.ephemeral);
             await mixIntoKey(Curve.sharedKey(privateKey, serverHello.ephemeral));
             const decStaticContent = decrypt(serverHello.static);

package/lib/Utils/signal.js

@@ -2,6 +2,10 @@ import { KEY_BUNDLE_TYPE } from '../Defaults/index.js';
 import { assertNodeErrorFree, getBinaryNodeChild, getBinaryNodeChildBuffer, getBinaryNodeChildren, getBinaryNodeChildUInt, jidDecode, S_WHATSAPP_NET } from '../WABinary/index.js';
 import { Curve, generateSignalPubKey } from './crypto.js';
 import { encodeBigEndian } from './generics.js';
+// AunuBaileys (1.0.74): HB-98 — key material is only ever a Buffer
+// (or a string in a hand-edited creds file). Anything else is a
+// wrong-typed corrupt value, not key material.
+const isKeyMaterial = (value) => Buffer.isBuffer(value) || typeof value === 'string';
 function chunk(array, size) {
     const chunks = [];
     for (let i = 0; i < array.length; i += size) {
@@ -204,9 +208,12 @@ export const getNextPreKeys = async ({ creds, keys }, count) => {
     // ({} — valid JSON, no key material) used to be uploaded as an
     // EMPTY <value> (HB-83); the decrypt path has guarded this since
     // 1.0.71 (loadPreKey). Skip entries without a public key here too.
+    // (1.0.74, HB-98: truthiness alone also let a wrong-TYPED public —
+    // e.g. a number — through to the node encoder, which threw
+    // "invalid children". Only Buffer/string material counts.)
     const preKeys = {};
     for (const [preKeyId, pair] of Object.entries(storedPreKeys)) {
-        if (pair?.public) {
+        if (isKeyMaterial(pair?.public)) {
             preKeys[preKeyId] = pair;
         }
     }
@@ -218,7 +225,7 @@ export const getNextPreKeysNode = async (state, count) => {
     // below — partial creds turned that into a bare TypeError and a
     // reconnect loop at every boot (HB-68). Fail descriptively, like
     // loadSignedPreKey (HB-26/54).
-    if (!creds.signedIdentityKey?.public || !creds.signedPreKey?.keyPair?.public || typeof creds.signedPreKey?.keyId === 'undefined') {
+    if (!isKeyMaterial(creds.signedIdentityKey?.public) || !isKeyMaterial(creds.signedPreKey?.keyPair?.public) || !isKeyMaterial(creds.signedPreKey?.signature) || typeof creds.signedPreKey?.keyId === 'undefined') {
         throw new Error('AunuBaileys: creds.signedIdentityKey / creds.signedPreKey are missing or incomplete — the auth state is incomplete or corrupt; restore a full backup or pair again');
     }
     const { update, preKeys } = await getNextPreKeys(state, count);

package/lib/Utils/validate-connection.js

@@ -6,6 +6,10 @@ import { getBinaryNodeChild, jidDecode, S_WHATSAPP_NET } from '../WABinary/index
 import { Curve, hmacSign } from './crypto.js';
 import { encodeBigEndian } from './generics.js';
 import { createSignalIdentity } from './signal.js';
+// AunuBaileys (1.0.74): HB-98 — key material is only ever a Buffer
+// (or a string in a hand-edited creds file). Anything else is a
+// wrong-typed corrupt value, not key material.
+const isKeyMaterial = (value) => Buffer.isBuffer(value) || typeof value === 'string';
 const getUserAgent = (config) => {
     // AunuBaileys (1.0.70): a host overriding version with undefined
     // used to throw a raw TypeError here; fall back to the bundled
@@ -76,7 +80,7 @@ export const generateRegistrationNode = ({ registrationId, signedPreKey, signedI
     // below — partial creds turned that into a bare TypeError deep in
     // the pairing flow (HB-80). Fail descriptively, like
     // loadSignedPreKey (HB-26/54).
-    if (!signedIdentityKey?.public || !signedPreKey?.keyPair?.public || typeof signedPreKey?.keyId === 'undefined' || !signedPreKey?.signature) {
+    if (!isKeyMaterial(signedIdentityKey?.public) || !isKeyMaterial(signedPreKey?.keyPair?.public) || typeof signedPreKey?.keyId === 'undefined' || !isKeyMaterial(signedPreKey?.signature)) {
         throw new Error('AunuBaileys: creds.signedIdentityKey / creds.signedPreKey are missing or incomplete — the auth state is incomplete or corrupt; restore a full backup or pair again');
     }
     // the app version needs to be md5 hashed

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aunucore/baileys",
   "type": "module",
-  "version": "1.0.73",
+  "version": "1.0.75",
   "description": "AunuBaileys — the self-healing WhatsApp Web API for Node.js. Bad MAC and \"2000 messages into the future\" errors repair themselves, LID and phone-number identities stay in sync, anti-ban is built in, pairing codes are custom — plus 29 experimental features no other Baileys fork ships: invisible watermarks, per-person tag-all cards, side-profile text, ghost mentions and more. ESM, CJS and full TypeScript types.",
   "keywords": [
     "whatsapp",
@@ -69,17 +69,17 @@
     "preinstall": "node ./engine-requirements.js"
   },
   "dependencies": {
+    "@adiwajshing/keyed-db": "^0.2.4",
     "@cacheable/node-cache": "^1.4.0",
     "@hapi/boom": "^9.1.3",
     "async-mutex": "^0.5.0",
     "axios": "^1.6.0",
+    "fflate": "^0.8.2",
     "libsignal": "git+https://github.com/whiskeysockets/libsignal-node",
     "music-metadata": "^11.7.0",
     "pino": "^9.6",
     "protobufjs": "^7.2.4",
-    "ws": "^8.13.0",
-    "@adiwajshing/keyed-db": "^0.2.4",
-    "fflate": "^0.8.2"
+    "ws": "^8.13.0"
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.1",
@@ -112,11 +112,11 @@
     "typescript": "^5.8.2"
   },
   "peerDependencies": {
+    "@napi-rs/image": "^1.12.0",
     "audio-decode": "^2.1.3",
     "jimp": "^1.6.0",
     "link-preview-js": "^3.0.0",
-    "sharp": "*",
-    "@napi-rs/image": "^1.12.0"
+    "sharp": "*"
   },
   "peerDependenciesMeta": {
     "audio-decode": {