@aunucore/baileys 1.0.79 → 1.0.80

package/lib/Socket/index.js

@@ -25,6 +25,32 @@ const makeWASocket = (config) => {
         ...DEFAULT_CONNECTION_CONFIG.transactionOpts,
         ...(config?.transactionOpts ?? {})
     };
+    // AunuBaileys (1.0.80, HB-139 + HB-174 + addendum HB-139): the
+    // numeric connection config was spread raw above — an explicit
+    // undefined/NaN from the host (classically `Number(env.X)` of an
+    // unset variable) silently replaced the defaults, and every
+    // failure mode is silent: promiseTimeout(NaN) never settles (a
+    // half-open socket hangs forever), a NaN/0/negative
+    // keepAliveIntervalMs collapses setInterval to 1 ms (~850 ping
+    // IQs per second, and the dead-connection watchdog compares
+    // against NaN so it never fires), and a NaN/Infinity
+    // maxMsgRetryCount breaks both retry gates in opposite
+    // directions at once (retry receipts never capped, resends
+    // never sent). Sanitise once, here at the boundary: timeouts
+    // and intervals must be positive finite (else the documented
+    // default), the retry count must be finite (else the default),
+    // and qrTimeout — which has no Defaults entry (genPairQR falls
+    // back with `|| 60000` / `|| 20000`) — must be positive finite
+    // or absent (a negative value is truthy and would expire every
+    // QR instantly).
+    const positiveFiniteOr = (value, fallback) => (Number.isFinite(value) && value > 0 ? value : fallback);
+    newConfig.connectTimeoutMs = positiveFiniteOr(newConfig.connectTimeoutMs, DEFAULT_CONNECTION_CONFIG.connectTimeoutMs);
+    newConfig.defaultQueryTimeoutMs = positiveFiniteOr(newConfig.defaultQueryTimeoutMs, DEFAULT_CONNECTION_CONFIG.defaultQueryTimeoutMs);
+    newConfig.keepAliveIntervalMs = positiveFiniteOr(newConfig.keepAliveIntervalMs, DEFAULT_CONNECTION_CONFIG.keepAliveIntervalMs);
+    newConfig.maxMsgRetryCount = Number.isFinite(newConfig.maxMsgRetryCount) ? newConfig.maxMsgRetryCount : DEFAULT_CONNECTION_CONFIG.maxMsgRetryCount;
+    if (newConfig.qrTimeout !== undefined && !(Number.isFinite(newConfig.qrTimeout) && newConfig.qrTimeout > 0)) {
+        newConfig.qrTimeout = undefined;
+    }
     // If the user hasn't provided their own history sync function,
     // let's create a default one that respects the syncFullHistory flag.
     if (config.shouldSyncHistoryMessage === undefined) {

package/lib/Utils/bounded-cache.js

@@ -13,7 +13,15 @@
  * the receive path uses.
  */
 export const makeBoundedTTLCache = ({ ttlSeconds = 3600, maxEntries = 1000 } = {}) => {
-    const ttlMs = Math.max(1, ttlSeconds * 1000);
+    // AunuBaileys (1.0.80, HB-145): NaN/Infinity config defeated
+    // both bounds — `size > NaN` is always false (no eviction,
+    // ever) and a NaN ttlMs made expiresAt NaN, which never
+    // compares <= now, so entries lived forever. Sanitise at the
+    // boundary: finite values keep their exact meaning (counts
+    // are floored and clamped at 0), non-finite values fall back
+    // to the documented defaults (3600 s / 1000 entries).
+    const ttlMs = Number.isFinite(ttlSeconds) ? Math.max(1, ttlSeconds * 1000) : 3600 * 1000;
+    const limit = Number.isFinite(maxEntries) ? Math.max(0, Math.floor(maxEntries)) : 1000;
     const map = new Map();
     return {
         get(key) {
@@ -28,11 +36,20 @@ export const makeBoundedTTLCache = ({ ttlSeconds = 3600, maxEntries = 1000 } = {
         },
         set(key, value) {
             map.set(key, { value, expiresAt: Date.now() + ttlMs });
-            while (map.size > maxEntries) {
-                const oldest = map.keys().next().value;
-                if (oldest === undefined)
+            // AunuBaileys (1.0.80, HB-226): the old guard broke out
+            // when the oldest KEY was `undefined` — but a Map can
+            // legitimately HOLD undefined as a key (two in-tree
+            // callers can produce one: a call offer without a
+            // call-id, a placeholder resend without a message id),
+            // and one such entry silently disabled the ceiling
+            // until it expired. The iterator's `done` flag is the
+            // real "map is empty" signal; deleting an undefined
+            // key is perfectly safe.
+            while (map.size > limit) {
+                const oldest = map.keys().next();
+                if (oldest.done)
                     break;
-                map.delete(oldest);
+                map.delete(oldest.value);
             }
         },
         del(key) {

package/lib/Utils/lid-store.js

@@ -15,7 +15,16 @@ import { jidNormalizedUser, isJidUser, isLidUser } from '../WABinary/jid-utils.j
  * fed manually via `learnFromMessage` / `addPair`.
  */
 export const makeLIDStore = (options = {}) => {
-    const maxEntries = options.maxEntries ?? 5000;
+    // AunuBaileys (1.0.80, HB-190 + addendum HB-145): `?? 5000`
+    // let NaN through (the eviction comparison `size > NaN` is
+    // always false — the store grew without bound) and let
+    // negatives through (evictIfNeeded's while loop then spun
+    // forever on an empty map: `size > -1` stays true while
+    // delete(undefined) is a no-op — a wedged process, no error).
+    // Sanitise at the boundary: finite values are floored and
+    // clamped at 0 (0 = store nothing, which terminates),
+    // non-finite values fall back to the default 5000.
+    const maxEntries = Number.isFinite(options.maxEntries) ? Math.max(0, Math.floor(options.maxEntries)) : 5000;
     // AunuBaileys (1.0.71): optional listener fired when a genuinely
     // NEW or changed PN<->LID pair is learned (re-learning an already
     // known pair does not fire). The socket wires it to 'lid-mapping.update'.
@@ -29,7 +38,17 @@ export const makeLIDStore = (options = {}) => {
     };
     const evictIfNeeded = () => {
         while (pnToLid.size > maxEntries) {
-            const oldestPn = pnToLid.keys().next().value;
+            // AunuBaileys (1.0.80, HB-190 defence in depth): with a
+            // sanitised maxEntries (>= 0) this loop always
+            // terminates, but never trust a loop whose only exit is
+            // a size comparison — bail out if the map is somehow
+            // already empty (the iterator's `done`, not the key's
+            // value, is the empty signal).
+            const oldest = pnToLid.keys().next();
+            if (oldest.done) {
+                break;
+            }
+            const oldestPn = oldest.value;
             const lid = pnToLid.get(oldestPn);
             pnToLid.delete(oldestPn);
             if (lid) {

package/lib/Utils/sent-message-cache.js

@@ -15,6 +15,14 @@
  * `sentMessagesCacheSize: 0` in the socket config to disable.
  */
 export const makeSentMessageCache = (maxEntries = 256, resolveAlternateJid) => {
+    // AunuBaileys (1.0.80, HB-145): a NaN cap (host config from an
+    // unset env var — sentMessageCacheFor's typeof check passes NaN
+    // straight through) made `cache.size > NaN` false forever, so
+    // the cache grew without bound; Infinity did the same.
+    // Sanitise at the boundary: finite values are floored and
+    // clamped at 0 (0 keeps its documented meaning — the cache is
+    // disabled), non-finite values fall back to the default 256.
+    const limit = Number.isFinite(maxEntries) ? Math.max(0, Math.floor(maxEntries)) : 256;
     const cache = new Map();
     const keyOf = (remoteJid, id) => `${remoteJid}:${id}`;
     let altResolver = typeof resolveAlternateJid === 'function' ? resolveAlternateJid : undefined;
@@ -30,13 +38,13 @@ export const makeSentMessageCache = (maxEntries = 256, resolveAlternateJid) => {
             }
         },
         add: (remoteJid, id, message) => {
-            if (!remoteJid || !id || !message || maxEntries <= 0) {
+            if (!remoteJid || !id || !message || limit <= 0) {
                 return;
             }
             const key = keyOf(remoteJid, id);
             cache.delete(key);
             cache.set(key, message);
-            while (cache.size > maxEntries) {
+            while (cache.size > limit) {
                 cache.delete(cache.keys().next().value);
             }
         },

package/lib/Utils/signal.js

@@ -35,6 +35,19 @@ export const generateOrGetPreKeys = (creds, range) => {
         throw new Error('AunuBaileys: creds.nextPreKeyId / creds.firstUnuploadedPreKeyId are missing — the auth state is incomplete or corrupt; restore a full backup or pair again');
     }
     const avaliable = creds.nextPreKeyId - creds.firstUnuploadedPreKeyId;
+    // AunuBaileys (1.0.80, HB-140 + HB-225): finite-but-INVERTED
+    // counters (firstUnuploadedPreKeyId > nextPreKeyId — hand-edited
+    // or partially restored creds) made `remaining` exceed `range`
+    // by the size of the gap, so the loop below generated keys for
+    // the GAP, not the request: gap 50k ≈ 5 s and +48 MB, gap 200k
+    // ≈ 21 s and +238 MB, and a ~2^31 gap would freeze the process
+    // outright — synchronously, inside the keys transaction, at
+    // every login. Same class as HB-84 above (corrupt counters),
+    // same answer: refuse descriptively. With consistent counters
+    // `remaining` can never exceed `range` by construction.
+    if (avaliable < 0) {
+        throw new Error('AunuBaileys: creds pre-key counters are inverted (firstUnuploadedPreKeyId > nextPreKeyId) — the auth state is corrupt; restore a full backup or pair again');
+    }
     const remaining = range - avaliable;
     const lastPreKeyId = creds.nextPreKeyId + remaining - 1;
     const newPreKeys = {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aunucore/baileys",
   "type": "module",
-  "version": "1.0.79",
+  "version": "1.0.80",
   "description": "AunuBaileys — the self-healing WhatsApp Web API for Node.js. Bad MAC and \"2000 messages into the future\" errors repair themselves, LID and phone-number identities stay in sync, anti-ban is built in, pairing codes are custom — plus 29 experimental features no other Baileys fork ships: invisible watermarks, per-person tag-all cards, side-profile text, ghost mentions and more. ESM, CJS and full TypeScript types.",
   "keywords": [
     "whatsapp",