@aunucore/baileys 1.0.81 → 1.0.83

package/lib/Socket/messages-recv.js

@@ -44,6 +44,14 @@ export const makeMessagesRecvSocket = (config) => {
      * upstream Baileys retries forever against the same stale session. */
     const decryptFailCounts = new Map();
     const DECRYPT_FAIL_SESSION_RESET_LIMIT = 3;
+    /** AunuBaileys (1.0.82, HB-153): upstream v7 skips the retry for
+     * status broadcasts older than this — the peer has already
+     * deleted the expired status, so a resend can never be honoured
+     * and the failure says nothing about the session. */
+    const STATUS_EXPIRY_SECONDS = 86400;
+    /** AunuBaileys (1.0.82, HB-152): upstream v7 only asks the phone
+     * to resend a placeholder for messages younger than this. */
+    const PLACEHOLDER_MAX_AGE_SECONDS = 14 * 86400;
     /** this mutex ensures that each retryRequest will wait for the previous one to finish */
     const retryMutex = makeMutex();
     // AunuBaileys: bounded by default (see bounded-cache.js) — a TTL
@@ -238,8 +246,28 @@ export const makeMessagesRecvSocket = (config) => {
             }
             if (retryCount > 1 || forceIncludeKeys) {
                 const { update, preKeys } = await getNextPreKeys(authState, 1);
-                const [keyId] = Object.keys(preKeys);
-                const key = preKeys[+keyId];
+                let [keyId] = Object.keys(preKeys);
+                let key = preKeys[+keyId];
+                if (!key) {
+                    // AunuBaileys (1.0.82, HB-154 + addendum): the
+                    // stored head pre-key is missing entirely (store
+                    // cleaned / partial restore) or was filtered out
+                    // as corrupt by getNextPreKeys ({} / wrong-typed
+                    // material, HB-83/98 filter) — the map came back
+                    // empty and the bare deref below used to throw a
+                    // TypeError inside this transaction: the receipt
+                    // was never built, yet the retry counter above
+                    // was already spent. Generate a fresh pair into
+                    // the dead head slot instead: `update` advances
+                    // firstUnuploadedPreKeyId past exactly this id,
+                    // and the write joins this transaction, so the
+                    // private half is persisted before the receipt
+                    // carrying its public half is sent.
+                    keyId = `${authState.creds.firstUnuploadedPreKeyId}`;
+                    key = Curve.generateKeyPair();
+                    await authState.keys.set({ 'pre-key': { [keyId]: key } });
+                    logger.warn({ keyId }, 'aunu: no usable stored pre-key for the retry receipt; generated a fresh one into the head slot');
+                }
                 const content = receipt.content;
                 content.push({
                     tag: 'keys',
@@ -670,7 +698,21 @@ export const makeMessagesRecvSocket = (config) => {
         msgRetryCache.set(key, newValue);
     };
     const sendMessagesAgain = async (key, ids, retryNode, sessionPreInjected = false) => {
-        const msgs = await Promise.all(ids.map(async (id) => (await getMessage({ ...key, id })) ?? sentMessageCacheFor(config, (jid) => aunuLid?.getAltJid?.(jid)).get(key.remoteJid, id)));
+        // AunuBaileys (1.0.82, HB-107): per-id isolation at the FETCH
+        // stage, mirroring HB-61 at the relay stage below. getMessage
+        // is host code (a DB/file store can throw); one throwing id
+        // used to reject the whole Promise.all, so NO id in the batch
+        // was resent this round and no retry counter advanced — the
+        // next peer receipt walked into the same wall.
+        const msgs = await Promise.all(ids.map(async (id) => {
+            try {
+                return (await getMessage({ ...key, id })) ?? sentMessageCacheFor(config, (jid) => aunuLid?.getAltJid?.(jid)).get(key.remoteJid, id);
+            }
+            catch (err) {
+                logger.warn({ err, jid: key.remoteJid, id }, 'aunu: getMessage failed for one id in a retry batch; treating it as unavailable and continuing with the rest');
+                return undefined;
+            }
+        }));
         const remoteJid = key.remoteJid;
         const participant = key.participant || remoteJid;
         // if it's the primary jid sending the request
@@ -775,7 +817,18 @@ export const makeMessagesRecvSocket = (config) => {
                         // correctly set who is asking for the retry
                         key.participant = key.participant || attrs.from;
                         const retryNode = getBinaryNodeChild(node, 'retry');
-                        if (willSendMessageAgain(ids[0], key.participant)) {
+                        // AunuBaileys (1.0.82, HB-160): the gate used
+                        // to check ids[0] ALONE — a capped first id
+                        // starved the fresh ids behind it, and a
+                        // fresh first id let capped ids behind it be
+                        // resent past the cap without limit. Filter
+                        // per id; the loop below only ever sees ids
+                        // that still have budget.
+                        const eligibleIds = ids.filter(id => willSendMessageAgain(id, key.participant));
+                        if (eligibleIds.length < ids.length) {
+                            logger.debug({ skipped: ids.filter(id => !eligibleIds.includes(id)), participant: key.participant }, 'aunu: some ids in the retry receipt are at the resend cap; resending only the rest');
+                        }
+                        if (eligibleIds.length) {
                             if (key.fromMe) {
                                 try {
                                     logger.debug({ attrs, key }, 'recv retry request');
@@ -796,7 +849,7 @@ export const makeMessagesRecvSocket = (config) => {
                                             logger.debug({ err: injErr }, 'aunu: retry receipt bundle injection failed; falling back to server fetch');
                                         }
                                     }
-                                    await sendMessagesAgain(key, ids, retryNode, sessionPreInjected);
+                                    await sendMessagesAgain(key, eligibleIds, retryNode, sessionPreInjected);
                                 }
                                 catch (error) {
                                     logger.error({ key, ids, trace: error.stack }, 'error in sending message again');
@@ -880,13 +933,37 @@ export const makeMessagesRecvSocket = (config) => {
         let response;
         if (getBinaryNodeChild(node, 'unavailable') && !encNode) {
             await sendMessageAck(node);
-            const { key } = decodeMessageNode(node, authState.creds.me?.id, authState.creds.me?.lid || '').fullMessage;
+            // AunuBaileys (1.0.82, HB-146): this decode sat OUTSIDE
+            // any try (the HB-1 fix covered only the decrypt path
+            // below). A stanza whose `from` is not a recognised JID
+            // type — malformed today, a future JID domain tomorrow —
+            // threw 'Unknown message type' after the ack had already
+            // gone out: only logged by the caller, and the
+            // placeholder was never resent nor upserted. Classify
+            // and drop it here, like the main decode path.
+            let key;
+            try {
+                key = decodeMessageNode(node, authState.creds.me?.id, authState.creds.me?.lid || '').fullMessage.key;
+            }
+            catch (decodeErr) {
+                logger.error({ error: decodeErr, node }, 'aunu: error decoding unavailable message node; acked, skipping placeholder resend');
+                return;
+            }
             // AunuBaileys: bot / hosted / view_once placeholders can never
             // be resent by the phone — don't burn a resend request on
             // them (behaviour learned from @violetix/baileys).
             if (isUnrecoverableUnavailable(node)) {
                 logger.debug({ msgId: key.id, unavailableType: unavailablePlaceholderType(node) }, 'unavailable placeholder cannot be resent; skipping resend request');
             }
+            else if (!authState.creds.me?.id) {
+                // AunuBaileys (1.0.82, HB-106): requestPlaceholderResend
+                // throws Boom 'Not authenticated' in the pre-success
+                // window — and because the ack above has ALREADY gone
+                // out, the throw (caught only by the caller's logger)
+                // lost the placeholder silently: no resend, no upsert.
+                // Skip cleanly, like sendRetryRequest does (HB-6).
+                logger.warn({ msgId: key.id }, 'aunu: cannot request placeholder resend before pairing completes; skipping');
+            }
             else {
                 response = await requestPlaceholderResend(key);
             }
@@ -941,14 +1018,85 @@ export const makeMessagesRecvSocket = (config) => {
                     }
                     // message failed to decrypt
                     if (msg.messageStubType === proto.WebMessageInfo.StubType.CIPHERTEXT) {
-                        if (msg?.messageStubParameters?.[0] === MISSING_KEYS_ERROR_TEXT) {
-                            return sendMessageAck(node, NACK_REASONS.ParsingError);
+                        const stubParam = msg?.messageStubParameters?.[0];
+                        const isMissingKeysFailure = stubParam === MISSING_KEYS_ERROR_TEXT;
+                        const isNoMessageFailure = stubParam === NO_MESSAGE_FOUND_ERROR_TEXT;
+                        // AunuBaileys (1.0.82, HB-170): an msmsg (Meta
+                        // AI) failure is a message-SECRET problem, not
+                        // an E2E session problem — @bot has no resend
+                        // path, so a retry receipt only burns budget
+                        // and the fail counter marched toward a
+                        // pointless @bot session reset.
+                        const isMsmsgFailure = encNode?.attrs?.type === 'msmsg' ||
+                            (typeof stubParam === 'string' && stubParam.startsWith('msmsg'));
+                        // AunuBaileys (1.0.82, HB-153): a status that
+                        // expired on the peer can never be resent.
+                        const isExpiredStatusFailure = !isNoMessageFailure &&
+                            isJidStatusBroadcast(msg.key.remoteJid) &&
+                            Number.isFinite(+node.attrs.t) &&
+                            (unixTimestampSeconds() - +node.attrs.t) > STATUS_EXPIRY_SECONDS;
+                        if (isMissingKeysFailure) {
+                            // AunuBaileys (1.0.82, HB-206): the 487
+                            // NACK stays, but the early return is
+                            // gone. 'Key used already or never filled'
+                            // is a SESSION-layer failure, so it now
+                            // flows through the counting / self-heal
+                            // machinery below and the stub upsert at
+                            // the end of this branch, like every other
+                            // decrypt failure — only the retry receipt
+                            // is skipped (a resend of the same
+                            // ciphertext cannot restore a message key
+                            // our ratchet no longer holds).
+                            await sendMessageAck(node, NACK_REASONS.ParsingError);
+                        }
+                        if (isNoMessageFailure) {
+                            // AunuBaileys (1.0.82, HB-152): the stanza
+                            // carried no encrypted content at all —
+                            // there is nothing to re-decrypt and
+                            // nothing wrong with the session, so no
+                            // retry receipt and no fail count (three
+                            // of these used to reset a healthy
+                            // session). Ask the phone for a placeholder
+                            // resend when eligible (v7 policy:
+                            // recoverable type, fresh enough) and let
+                            // the stub upsert below stand as the
+                            // trace. Fire-and-forget: the resend waits
+                            // 5 s and must not hold the processing
+                            // mutex (see the 1.0.70 note in
+                            // sendRetryRequest).
+                            if (!response && !msg.key.fromMe && !isUnrecoverableUnavailable(node) &&
+                                Number.isFinite(+node.attrs.t) &&
+                                (unixTimestampSeconds() - +node.attrs.t) <= PLACEHOLDER_MAX_AGE_SECONDS) {
+                                requestPlaceholderResend(msg.key).then(
+                                    (resendId) => logger.debug({ resendId }, 'aunu: requested placeholder resend for a message with no encrypted content'),
+                                    (err) => logger.debug({ err }, 'aunu: placeholder resend for a message with no encrypted content failed')
+                                );
+                            }
+                            logger.debug({ msgId: msg.key.id, author }, 'aunu: message stanza carried no encrypted content; no retry receipt, no session failure counted');
+                        }
+                        else if (isMsmsgFailure) {
+                            logger.debug({ msgId: msg.key.id, author, stubParam }, 'aunu: msmsg decrypt failure; no retry receipt and no session failure counted (a secret problem, not a session problem)');
                         }
-                        retryMutex.mutex(async () => {
+                        else if (isExpiredStatusFailure) {
+                            logger.debug({ msgId: msg.key.id, author, ageSeconds: unixTimestampSeconds() - +node.attrs.t }, 'aunu: decrypt failure for an expired status; no retry receipt and no session failure counted');
+                        }
+                        else retryMutex.mutex(async () => {
                             if (ws.isOpen) {
-                                if (getBinaryNodeChild(node, 'unavailable')) {
-                                    return;
-                                }
+                                // AunuBaileys (1.0.82, HB-183): the
+                                // blanket early return for stanzas
+                                // carrying an <unavailable> child is
+                                // gone — it suppressed the retry
+                                // receipt, the fail counting, the
+                                // self-heal AND the decrypt-failure
+                                // event for every enc-bearing failure
+                                // that rode along with one (view-once
+                                // above all), leaving the content
+                                // unrecoverable and the rotten session
+                                // uncounted. Upstream v7 has no such
+                                // guard on this path; the placeholder
+                                // choice for unavailable types lives in
+                                // the no-enc branch and in HB-152's
+                                // classification above.
                                 const encNode = getBinaryNodeChild(node, 'enc');
                                 let forceIncludeKeys = !encNode;
                                 if (author) {
@@ -1058,7 +1206,7 @@ export const makeMessagesRecvSocket = (config) => {
                                 // under that device's session; a retry
                                 // receipt would ask ourselves to resend to
                                 // ourselves.
-                                if (!msg.key.fromMe) {
+                                if (!msg.key.fromMe && !isMissingKeysFailure) {
                                     await sendRetryRequest(node, forceIncludeKeys);
                                     if (retryRequestDelayMs) {
                                         await delay(retryRequestDelayMs);
@@ -1474,12 +1622,16 @@ export const makeMessagesRecvSocket = (config) => {
     const offlineNodeProcessor = makeOfflineNodeProcessor();
     const processNode = (type, node, identifier, exec) => {
         // AunuBaileys: ignoreKey filter — a matching stanza is dropped
-        // before any handling (no decryption, no persistence); messages
+        // before any handling (no decryption, no persistence); stanzas
         // are still acked so the server stops redelivering them.
+        // AunuBaileys (1.0.82, HB-210): the ack used to cover only
+        // type 'message' — a dropped receipt/notification/call was
+        // never acked, so the server redelivered it forever while the
+        // rule stayed active (all four real handlers ack in a
+        // finally; the drop bypassed every one of them, against the
+        // filter's own documented intent).
         if (sock.aunuIgnoreFilter?.shouldDrop(type, node, [authState.creds.me?.id, authState.creds.me?.lid].filter(Boolean))) {
-            if (type === 'message') {
-                sendMessageAck(node).catch(() => { });
-            }
+            sendMessageAck(node).catch(() => { });
             logger.debug({ type, from: node.attrs.from, id: node.attrs.id }, 'aunu: stanza dropped by ignoreKey');
             return;
         }

package/lib/Socket/messages-send.js

@@ -188,7 +188,11 @@ export const makeMessagesSocket = (config) => {
         }
         const result = await sock.executeUSyncQuery(query);
         if (result) {
-            const extracted = extractDeviceJids(result?.list, authState.creds.me?.id, ignoreZeroDevices);
+            // AunuBaileys (1.0.83, HB-258): pass our LID as well —
+            // comparing only the PN user left our own LID devices in
+            // the extracted list, so group sends encrypted a copy to
+            // our own LID device (upstream v7 made the same fix).
+            const extracted = extractDeviceJids(result?.list, authState.creds.me?.id, authState.creds.me?.lid, ignoreZeroDevices);
             const deviceMap = {};
             for (const item of extracted) {
                 deviceMap[item.user] = deviceMap[item.user] || [];
@@ -327,6 +331,16 @@ export const makeMessagesSocket = (config) => {
         return { nodes: filteredNodes, shouldIncludeDeviceIdentity };
     };
     const relayMessage = async (jid, message, { messageId: msgId, participant, additionalAttributes, additionalNodes, useUserDevicesCache, useCachedGroupMetadata, addBizAttributes, statusJidList, statusPrivacy }) => {
+        // AunuBaileys (1.0.83, HB-253): a non-object message — or an
+        // empty object — proto-encodes to ZERO content bytes without
+        // throwing, so the relay used to report success while the
+        // peer received random padding only: the 1.0.71 silent-empty
+        // class at the one public entry point that never got a guard
+        // (sendMessage fails loudly for the same class of input).
+        // Fail fast, before any wait or network work.
+        if (!message || typeof message !== 'object' || Array.isArray(message) || !Object.keys(message).length) {
+            throw new Boom('relayMessage requires a non-empty message object', { statusCode: 400 });
+        }
         if (!ws.isOpen) {
             // AunuBaileys: a send attempted during a reconnect window used to die
             // instantly with Boom 428 from the first internal query — the message
@@ -412,6 +426,10 @@ export const makeMessagesSocket = (config) => {
             const { user, device } = decodedParticipant;
             devices.push({ user, device });
         }
+        // AunuBaileys (1.0.83, HB-178): the stanza built inside the
+        // transaction is captured here and sent only AFTER the
+        // transaction commits — see the tail of this function.
+        let stanzaToSend;
         await authState.keys.transaction(async () => {
             const mediaType = getMediaType(message);
             if (mediaType) {
@@ -420,6 +438,15 @@ export const makeMessagesSocket = (config) => {
             if (isNewsletter) {
                 // Patch message if needed, then encode as plaintext
                 const patched = patchMessageBeforeSending ? await patchMessageBeforeSending(message, []) : message;
+                // AunuBaileys (1.0.83, HB-212): a per-jid patch ARRAY
+                // is in-contract for patchMessageBeforeSending, but
+                // encodeNewsletterMessage is a bare proto encode —
+                // an array encodes to 0 bytes, so the channel got an
+                // empty post while sendMessage resolved as success.
+                // Mirror the group branch and refuse it loudly.
+                if (Array.isArray(patched)) {
+                    throw new Boom('Per-jid patching is not supported in newsletters', { statusCode: 400 });
+                }
                 const bytes = encodeNewsletterMessage(patched);
                 binaryNodeContent.push({
                     tag: 'plaintext',
@@ -447,8 +474,14 @@ export const makeMessagesSocket = (config) => {
                     content: binaryNodeContent
                 };
                 logger.debug({ msgId }, `sending newsletter message to ${jid}`);
-                await sendNode(stanza);
-                sentMessageCacheFor(config).add(jid, msgId, message);
+                // AunuBaileys (1.0.83, HB-178): captured, not sent —
+                // the send happens after the commit at the tail of
+                // relayMessage, and the sent-message cache add lives
+                // there too (it used to sit here, inside the
+                // transaction; with send-after-commit it would
+                // register a message the commit failure prevented
+                // from ever being sent).
+                stanzaToSend = stanza;
                 return;
             }
             if (normalizeMessageContent(message)?.pinInChatMessage) {
@@ -586,10 +619,43 @@ export const makeMessagesSocket = (config) => {
                     allJids.push(jid);
                 }
                 await assertSessions(allJids, false);
-                const [{ nodes: meNodes, shouldIncludeDeviceIdentity: s1 }, { nodes: otherNodes, shouldIncludeDeviceIdentity: s2 }] = await Promise.all([
+                // AunuBaileys (1.0.83, HB-161): the echo to our own
+                // devices and the send to the peer used to share one
+                // Promise.all — when encrypting for ALL of our own
+                // devices failed (a rotten self-session the one-shot
+                // heal inside createParticipantNodes could not save),
+                // the peer's already-encrypted nodes were thrown away
+                // with it and the DM never left, even though the
+                // peer's sessions were healthy; symmetrically, a
+                // total peer failure took the echo down too. The echo
+                // is best-effort: settle both sides independently and
+                // fail only when the side that must deliver produced
+                // nothing.
+                const [meSettled, otherSettled] = await Promise.allSettled([
                     createParticipantNodes(meJids, meMsg, extraAttrs),
                     createParticipantNodes(otherJids, message, extraAttrs)
                 ]);
+                if (otherSettled.status === 'rejected') {
+                    throw otherSettled.reason;
+                }
+                let meNodes = [];
+                let s1 = false;
+                if (meSettled.status === 'fulfilled') {
+                    meNodes = meSettled.value.nodes;
+                    s1 = meSettled.value.shouldIncludeDeviceIdentity;
+                }
+                else if (!otherSettled.value.nodes.length && meJids.length) {
+                    // Our own devices were the ONLY recipients (a
+                    // retry resend aimed at our own device, a
+                    // self-chat): with the echo gone there is nothing
+                    // to send — keep the original failure instead of
+                    // emitting an empty stanza.
+                    throw meSettled.reason;
+                }
+                else {
+                    logger.warn({ err: meSettled.reason }, 'aunu: encrypting the echo to our own devices failed; sending to the peer without the device-sent echo');
+                }
+                const { nodes: otherNodes, shouldIncludeDeviceIdentity: s2 } = otherSettled.value;
                 participants.push(...meNodes);
                 participants.push(...otherNodes);
                 shouldIncludeDeviceIdentity = shouldIncludeDeviceIdentity || s1 || s2;
@@ -658,8 +724,24 @@ export const makeMessagesSocket = (config) => {
                 stanza.content.push(getBizBinaryNode(message));
             }
             logger.debug({ msgId }, `sending message to ${participants.length} devices`);
-            await sendNode(stanza);
+            stanzaToSend = stanza;
         });
+        // AunuBaileys (1.0.83, HB-178): the stanza goes on the wire
+        // only now — AFTER the transaction above has committed the
+        // ratchet state it was encrypted under. The send used to be
+        // the last await INSIDE the transaction, so a commit that
+        // failed through every retry threw after the message was
+        // already delivered: the caller saw an error for a delivered
+        // message (and a host retry then produced a duplicate the
+        // peer could not decrypt, re-using the un-persisted chain
+        // key), while the cache add and the message-secret
+        // registration below were skipped for that delivered
+        // message. Persist first, then send: a commit failure now
+        // fails a message that was never sent, and a sent message
+        // is always registered.
+        if (stanzaToSend) {
+            await sendNode(stanzaToSend);
+        }
         sentMessageCacheFor(config).add(jid, msgId, message);
         // AunuBaileys (1.0.71): register the messageSecret at send time
         // so an msmsg reply can be decrypted even if it arrives before
@@ -759,7 +841,19 @@ export const makeMessagesSocket = (config) => {
         }
         const callId = newCallId();
         const offerContent = buildCallOfferContent(isVideo);
-        const devices = (await getUSyncDevices([toJid], true, false)).map(({ user, device }) => jidEncode(user, 's.whatsapp.net', device));
+        // AunuBaileys (1.0.83, HB-184): the callee's devices take
+        // the server of the DESTINATION jid — a LID callee's devices
+        // live on 'lid'; encoding them on 's.whatsapp.net' addressed
+        // a phone number that does not exist (LID digits are not a
+        // number), so the offer could never ring.
+        const callServer = jidDecode(toJid)?.server === 'lid' ? 'lid' : 's.whatsapp.net';
+        const devices = (await getUSyncDevices([toJid], true, false)).map(({ user, device }) => jidEncode(user, callServer, device));
+        // AunuBaileys (1.0.83, HB-147): an empty device list built
+        // an offer with ZERO <destination> nodes — a call that could
+        // ring nobody, with no client-side complaint. Fail fast.
+        if (!devices.length) {
+            throw new Boom(`offerCall: no devices found for ${toJid}; the call would ring nobody`, { statusCode: 400 });
+        }
         await assertSessions(devices, true);
         const { nodes: destinations, shouldIncludeDeviceIdentity } = await createParticipantNodes(devices, {
             call: { callKey: createCallKey() }
@@ -800,7 +894,25 @@ export const makeMessagesSocket = (config) => {
         }
         const callId = newCallId();
         const offerContent = buildCallOfferContent(isVideo);
-        const devices = (await getUSyncDevices(participants, true, false)).map(({ user, device }) => jidEncode(user, 's.whatsapp.net', device));
+        // AunuBaileys (1.0.83, HB-184): each participant's devices
+        // take the server of that participant's OWN jid — in a
+        // LID-addressed group the participants are LID jids and
+        // their devices live on 'lid', not 's.whatsapp.net'.
+        const serverByUser = new Map();
+        for (const participantJid of participants) {
+            const decodedParticipant = jidDecode(jidNormalizedUser(participantJid) || '');
+            if (decodedParticipant?.user) {
+                serverByUser.set(decodedParticipant.user, decodedParticipant.server === 'lid' ? 'lid' : 's.whatsapp.net');
+            }
+        }
+        const devices = (await getUSyncDevices(participants, true, false)).map(({ user, device }) => jidEncode(user, serverByUser.get(user) ?? 's.whatsapp.net', device));
+        // AunuBaileys (1.0.83, HB-147): the default participants=[]
+        // (or a usync answer with no devices) built an offer with
+        // ZERO <destination> nodes — a call that could ring nobody,
+        // with no client-side complaint. Fail fast.
+        if (!devices.length) {
+            throw new Boom('groupCall: no participant devices to call; the call would ring nobody', { statusCode: 400 });
+        }
         await assertSessions(devices, true);
         const { nodes: destinations, shouldIncludeDeviceIdentity } = await createParticipantNodes(devices, {
             call: { callKey: createCallKey() }
@@ -869,19 +981,44 @@ export const makeMessagesSocket = (config) => {
             throw new Boom(`exclusive target is not a valid JID: ${target}`, { statusCode: 400 });
         }
         const devices = await getUSyncDevices([targetUser], relayOpts.useUserDevicesCache !== false, false);
-        const deviceJids = devices.map(({ user, device }) => jidEncode(user, 's.whatsapp.net', device)).filter(Boolean);
+        // AunuBaileys (1.0.83, HB-188): the target's devices take
+        // the server of the TARGET jid — for a LID member they live
+        // on 'lid'; encoding them on 's.whatsapp.net' addressed a
+        // phone number that does not exist (the LID digits are not
+        // a number), so the exclusive message could never arrive.
+        const targetServer = jidDecode(targetUser)?.server === 'lid' ? 'lid' : 's.whatsapp.net';
+        const deviceJids = devices.map(({ user, device }) => jidEncode(user, targetServer, device)).filter(Boolean);
         // No device list means the member is unknown to usync; addressing
         // the bare jid still reaches their primary device rather than
         // failing the send outright.
         const targets = deviceJids.length ? deviceJids : [targetUser];
         logger.debug({ jid, target: targetUser, devices: targets.length }, 'sending exclusive group message');
+        // AunuBaileys (1.0.83, HB-108): per-device isolation — one
+        // device's failure (a rotten session, a rejected stanza)
+        // used to abort the loop, so the remaining devices never
+        // received the message and the error did not say the
+        // delivery was partial. Deliver to every device that works
+        // and fail only when NONE did; the return value now lists
+        // the devices actually delivered to.
+        const delivered = [];
+        let firstDeviceError;
         for (const deviceJid of targets) {
-            await relayMessage(jid, message, {
-                ...relayOpts,
-                participant: { jid: deviceJid, count: 0 }
-            });
+            try {
+                await relayMessage(jid, message, {
+                    ...relayOpts,
+                    participant: { jid: deviceJid, count: 0 }
+                });
+                delivered.push(deviceJid);
+            }
+            catch (err) {
+                firstDeviceError = firstDeviceError ?? err;
+                logger.warn({ err, jid, deviceJid }, 'aunu: exclusive send failed for one device; continuing with the remaining devices');
+            }
         }
-        return targets;
+        if (!delivered.length) {
+            throw firstDeviceError ?? new Boom('exclusive send failed for every target device', { statusCode: 500 });
+        }
+        return delivered;
     };
     // AunuBaileys (1.0.71): named so the wrappers below can call the
     // socket's own sendMessage — the `sock` closure variable is the
@@ -1094,60 +1231,99 @@ export const makeMessagesSocket = (config) => {
                 // AunuBaileys (1.0.71): the option images follow the parent,
                 // each pointing back at it via messageAssociation.
                 if (imagePollOptionMedia?.length) {
+                    // AunuBaileys (1.0.83, HB-173): per-child
+                    // isolation — one failing option image used to
+                    // abort the loop, leaving the already-sent poll
+                    // parent with only some (or none) of its images
+                    // while the caller saw a total failure. Deliver
+                    // every child that works; fail only when NONE
+                    // did.
+                    let deliveredChildren = 0;
+                    let firstChildError;
                     for (const media of imagePollOptionMedia) {
-                        const optionMsg = generateWAMessageFromContent(jid, {
-                            pollCreationOptionImageMessage: { message: media },
-                            messageContextInfo: {
-                                messageAssociation: {
-                                    parentMessageKey: fullMsg.key,
-                                    associationType: proto.MessageAssociation.AssociationType.MEDIA_POLL
+                        try {
+                            const optionMsg = generateWAMessageFromContent(jid, {
+                                pollCreationOptionImageMessage: { message: media },
+                                messageContextInfo: {
+                                    messageAssociation: {
+                                        parentMessageKey: fullMsg.key,
+                                        associationType: proto.MessageAssociation.AssociationType.MEDIA_POLL
+                                    }
                                 }
-                            }
-                        }, {
-                            userJid,
-                            messageId: generateMessageIDV2(sock.user?.id)
-                        });
-                        await relay(jid, optionMsg.message, {
-                            messageId: optionMsg.key.id,
-                            useCachedGroupMetadata: options.useCachedGroupMetadata,
-                            additionalAttributes,
-                            additionalNodes: []
-                        });
+                            }, {
+                                userJid,
+                                messageId: generateMessageIDV2(sock.user?.id)
+                            });
+                            await relay(jid, optionMsg.message, {
+                                messageId: optionMsg.key.id,
+                                useCachedGroupMetadata: options.useCachedGroupMetadata,
+                                additionalAttributes,
+                                additionalNodes: []
+                            });
+                            deliveredChildren += 1;
+                        }
+                        catch (err) {
+                            firstChildError = firstChildError ?? err;
+                            logger.warn({ err, jid }, 'aunu: one image-poll option image failed to send; continuing with the rest');
+                        }
+                    }
+                    if (!deliveredChildren) {
+                        throw firstChildError ?? new Boom('all image-poll option images failed to send', { statusCode: 500 });
                     }
                 }
                 // AunuBaileys: kirim isi album sebagai pesan terasosiasi (dari @itsliaaa/baileys)
                 if ('album' in content) {
                     const { delayMs = 1500 } = options;
+                    // AunuBaileys (1.0.83, HB-173): per-item
+                    // isolation — one failing item (upload timeout,
+                    // total encryption failure) used to abort the
+                    // loop, leaving the already-sent album parent
+                    // with only some (or none) of its items while
+                    // the caller saw a total failure (and a retry
+                    // duplicated the parent). Deliver every item
+                    // that works; fail only when NONE did.
+                    let deliveredItems = 0;
+                    let firstItemError;
                     for (const albumMedia of content.album) {
-                        const albumMsg = await generateWAMessage(jid, albumMedia, {
-                            logger,
-                            userJid,
-                            upload: (fp, opts) => waUploadToServer(fp, { ...opts, newsletter: isJidNewsletter(jid) }),
-                            mediaCache: config.mediaCache,
-                            options: config.options,
-                            ...options,
-                            messageId: generateMessageIDV2(sock.user?.id)
-                        });
-                        const normalized = normalizeMessageContent(albumMsg.message);
-                        if (!normalized || !('imageMessage' in normalized || 'videoMessage' in normalized)) {
-                            throw new Boom('Invalid message type for album', { statusCode: 400 });
+                        try {
+                            const albumMsg = await generateWAMessage(jid, albumMedia, {
+                                logger,
+                                userJid,
+                                upload: (fp, opts) => waUploadToServer(fp, { ...opts, newsletter: isJidNewsletter(jid) }),
+                                mediaCache: config.mediaCache,
+                                options: config.options,
+                                ...options,
+                                messageId: generateMessageIDV2(sock.user?.id)
+                            });
+                            const normalized = normalizeMessageContent(albumMsg.message);
+                            if (!normalized || !('imageMessage' in normalized || 'videoMessage' in normalized)) {
+                                throw new Boom('Invalid message type for album', { statusCode: 400 });
+                            }
+                            albumMsg.message.messageContextInfo = albumMsg.message.messageContextInfo || {};
+                            albumMsg.message.messageContextInfo.messageAssociation = {
+                                parentMessageKey: fullMsg.key,
+                                associationType: proto.MessageAssociation.AssociationType.MEDIA_ALBUM
+                            };
+                            await relay(jid, albumMsg.message, {
+                                messageId: albumMsg.key.id,
+                                useCachedGroupMetadata: options.useCachedGroupMetadata,
+                                statusJidList: options.statusJidList,
+                                statusPrivacy: options.statusPrivacy,
+                        statusPrivacy: options.statusPrivacy,
+                                additionalAttributes,
+                                additionalNodes
+                            });
+                            deliveredItems += 1;
+                        }
+                        catch (err) {
+                            firstItemError = firstItemError ?? err;
+                            logger.warn({ err, jid }, 'aunu: one album item failed to send; continuing with the rest of the album');
                         }
-                        albumMsg.message.messageContextInfo = albumMsg.message.messageContextInfo || {};
-                        albumMsg.message.messageContextInfo.messageAssociation = {
-                            parentMessageKey: fullMsg.key,
-                            associationType: proto.MessageAssociation.AssociationType.MEDIA_ALBUM
-                        };
-                        await relay(jid, albumMsg.message, {
-                            messageId: albumMsg.key.id,
-                            useCachedGroupMetadata: options.useCachedGroupMetadata,
-                            statusJidList: options.statusJidList,
-                            statusPrivacy: options.statusPrivacy,
-                    statusPrivacy: options.statusPrivacy,
-                            additionalAttributes,
-                            additionalNodes
-                        });
                         await delay(delayMs);
                     }
+                    if (content.album.length && !deliveredItems) {
+                        throw firstItemError ?? new Boom('all album items failed to send', { statusCode: 500 });
+                    }
                 }
                 if (config.emitOwnEvents) {
                     process.nextTick(() => {

package/lib/Utils/decode-wa-message.js

@@ -287,6 +287,17 @@ export const decryptMessageNode = (stanza, meId, meLid, repository, logger) => {
                                 // 'last' = complete response, 'first' =
                                 // streaming partial, intentionally skipped.
                                 if (botType !== null && !['full', 'last'].includes(botType)) {
+                                    // AunuBaileys (1.0.82, HB-171
+                                    // addendum): the skip used to leave
+                                    // no trace at all — the caller took
+                                    // the SUCCESS branch, sent a
+                                    // 'delivered' receipt and upserted
+                                    // an empty message for content that
+                                    // was never read. Leave a CIPHERTEXT
+                                    // stub, like any other undecrypted
+                                    // content.
+                                    fullMessage.messageStubType = proto.WebMessageInfo.StubType.CIPHERTEXT;
+                                    fullMessage.messageStubParameters = [`msmsg streaming partial skipped (edit=${botType})`];
                                     break;
                                 }
                                 const secretIdCandidates = [botEditTargetId, metaTargetId, fullMessage.key?.id].filter(Boolean);
@@ -315,6 +326,16 @@ export const decryptMessageNode = (stanza, meId, meLid, repository, logger) => {
                                 }
                                 if (!secretCandidates.length) {
                                     logger.warn({ metaTargetId, botType, secretIdCandidates }, 'msmsg: no candidate messageSecret found, skipping');
+                                    // AunuBaileys (1.0.82, HB-171): same
+                                    // false-success as the partial skip
+                                    // above — without a stub the caller
+                                    // receipts this as delivered and
+                                    // stores an empty message. The stub
+                                    // is the trace; messages-recv
+                                    // excludes the msmsg class from
+                                    // retry/fail counting (HB-170).
+                                    fullMessage.messageStubType = proto.WebMessageInfo.StubType.CIPHERTEXT;
+                                    fullMessage.messageStubParameters = ['msmsg: no candidate messageSecret found'];
                                     break;
                                 }
                                 const msMsg = proto.MessageSecretMessage.decode(content);

package/lib/Utils/messages.js

@@ -603,6 +603,18 @@ const withAunuButtonIcon = (button) => {
         buttonParamsJson: typeof params === 'string' ? params : JSON.stringify(params ?? {})
     };
 };
+// AunuBaileys (1.0.83, HB-254): delete / pin / edit each carry a
+// message KEY, and WAProto.Message.fromObject silently DROPS a key
+// whose value is undefined — so { delete: undefined } used to relay
+// a key-less REVOKE (pin and edit likewise) that "succeeded" but
+// could never take effect, because the server had no key to act
+// on. Mirror the pollUpdate branch's discipline: the argument
+// must be a real key object carrying a message id.
+const assertMessageKeyArg = (value, field) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || typeof value.id !== 'string' || !value.id) {
+        throw new Boom(`"${field}" requires a valid message key (an object with a message id)`, { statusCode: 400 });
+    }
+};
 export const generateWAMessageContent = async (message, options) => {
     var _a, _b;
     let m = {};
@@ -610,8 +622,13 @@ export const generateWAMessageContent = async (message, options) => {
     // straight through to generateWAMessage() unprocessed (donor:
     // @violetix/baileys). The caller owns the proto shape entirely.
     if (message && typeof message === 'object' && 'raw' in message && !!message.raw) {
-        delete message.raw;
-        return message;
+        // AunuBaileys (1.0.83, HB-165): work on a copy — the object
+        // belongs to the caller, and deleting `raw` from it made a
+        // second send of the same object silently lose the raw
+        // passthrough entirely.
+        const rawContent = { ...message };
+        delete rawContent.raw;
+        return rawContent;
     }
     // AunuBaileys: rich response — blok kode / tabel / tautan (dari @itsliaaa/baileys)
     if ('code' in message || 'links' in message || 'table' in message || 'richResponse' in message || 'html' in message || 'richHtml' in message) {
@@ -664,12 +681,19 @@ export const generateWAMessageContent = async (message, options) => {
         m.locationMessage = WAProto.Message.LocationMessage.fromObject(message.location);
     }
     else if ('react' in message) {
-        if (!message.react.senderTimestampMs) {
-            message.react.senderTimestampMs = Date.now();
+        // AunuBaileys (1.0.83, HB-165): stamp the timestamp on a
+        // copy — the caller's react object used to keep it, so a
+        // re-send of the same object carried the first send's
+        // (stale) timestamp. A non-object react keeps the original
+        // behaviour (the deref below throws, caller-visible).
+        const react = message.react && typeof message.react === 'object' ? { ...message.react } : message.react;
+        if (!react.senderTimestampMs) {
+            react.senderTimestampMs = Date.now();
         }
-        m.reactionMessage = WAProto.Message.ReactionMessage.fromObject(message.react);
+        m.reactionMessage = WAProto.Message.ReactionMessage.fromObject(react);
     }
     else if ('delete' in message) {
+        assertMessageKeyArg(message.delete, 'delete');
         m.protocolMessage = {
             key: message.delete,
             type: WAProto.Message.ProtocolMessage.Type.REVOKE
@@ -706,6 +730,7 @@ export const generateWAMessageContent = async (message, options) => {
         }
     }
     else if ('pin' in message) {
+        assertMessageKeyArg(message.pin, 'pin');
         m.pinInChatMessage = {};
         m.messageContextInfo = {};
         m.pinInChatMessage.key = message.pin;
@@ -729,6 +754,13 @@ export const generateWAMessageContent = async (message, options) => {
                     type: proto.Message.ButtonsResponseMessage.Type.DISPLAY_TEXT
                 };
                 break;
+            default:
+                // AunuBaileys (1.0.83, HB-253 family): an unknown
+                // reply type used to fall through the switch,
+                // leaving m empty — a content-less message was
+                // relayed as if the reply had been sent. Fail
+                // loudly instead.
+                throw new Boom(`Unknown buttonReply type: ${message.type} (expected 'template' or 'plain')`, { statusCode: 400 });
         }
     }
     else if ('ptv' in message && message.ptv) {
@@ -814,6 +846,10 @@ export const generateWAMessageContent = async (message, options) => {
         throw new Boom('Event responses (RSVPs) are sent as encEventResponseMessage (Message field 76), encrypted with the event creation key — not yet implemented in AunuBaileys', { statusCode: 501 });
     }
     else if ('poll' in message) {
+        // AunuBaileys (1.0.83, HB-165): the default stamps below
+        // (selectableCount / toAnnouncementGroup) land on a copy of
+        // the caller's content, not on the caller's poll object.
+        message = { ...message, poll: { ...message.poll } };
         (_a = message.poll).selectableCount || (_a.selectableCount = 0);
         (_b = message.poll).toAnnouncementGroup || (_b.toAnnouncementGroup = false);
         if (!Array.isArray(message.poll.values)) {
@@ -1190,7 +1226,10 @@ export const generateWAMessageContent = async (message, options) => {
             };
         }
         m = { groupStatusMessageV2: { message: m } };
-        delete message.groupStatus;
+        // AunuBaileys (1.0.83, HB-165): the flag used to be deleted
+        // from the CALLER's object here — a re-send of the same
+        // content object silently lost its group-status wrapping.
+        // The flag is already consumed into m; leave it in place.
     }
     // AunuBaileys (1.0.71): spoiler — set contextInfo.isSpoiler and wrap
     // the message into spoilerMessage (Message field 118).
@@ -1206,7 +1245,9 @@ export const generateWAMessageContent = async (message, options) => {
             };
         }
         m = { spoilerMessage: { message: m } };
-        delete message.spoiler;
+        // AunuBaileys (1.0.83, HB-165): same caller-object mutation
+        // as the groupStatus block above — the flag stays on the
+        // caller's object, so a re-send wraps identically.
     }
     // AunuBaileys: interactiveAsTemplate (dari @itsliaaa/baileys) — bungkus interactiveMessage
     // ke templateMessage; messageContextInfo (deviceListMetadata) dipertahankan di sisinya
@@ -1223,6 +1264,7 @@ export const generateWAMessageContent = async (message, options) => {
         };
     }
     if ('edit' in message) {
+        assertMessageKeyArg(message.edit, 'edit');
         m = {
             protocolMessage: {
                 key: message.edit,

package/lib/Utils/signal.d.ts

@@ -18,7 +18,7 @@ export declare const xmppPreKey: (pair: KeyPair, id: number) => BinaryNode;
 export declare const parseAndInjectE2ESessions: (node: BinaryNode, repository: SignalRepository) => Promise<void>;
 /** AunuBaileys: session parsed from a retry receipt's embedded key bundle, or undefined when absent. */
 export declare const parseRetryReceiptSession: (node: BinaryNode) => { registrationId: number; identityKey: Buffer; signedPreKey?: { keyId: number; publicKey: Buffer; signature?: Buffer }; preKey?: { keyId: number; publicKey: Buffer } } | undefined;
-export declare const extractDeviceJids: (result: USyncQueryResultList[], myJid: string, excludeZeroDevices: boolean) => JidWithDevice[];
+export declare const extractDeviceJids: (result: USyncQueryResultList[], myJid: string, myLid: string | undefined, excludeZeroDevices: boolean) => JidWithDevice[];
 /**
  * get the next N keys for upload or processing
  * @param count number of pre-keys to get or generate

package/lib/Utils/signal.js

@@ -184,8 +184,19 @@ export const parseAndInjectE2ESessions = async (node, repository, logger) => {
         }));
     }
 };
-export const extractDeviceJids = (result, myJid, excludeZeroDevices) => {
+export const extractDeviceJids = (result, myJid, myLid, excludeZeroDevices) => {
     const { user: myUser, device: myDevice } = jidDecode(myJid) || {};
+    // AunuBaileys (1.0.83, HB-258): our own devices exist under TWO
+    // identities — the PN user and the LID user. Comparing only the
+    // PN user left our own LID devices in the extracted list, so a
+    // group send encrypted and delivered a copy to our own LID
+    // device (self-delivery plus wasted encryption). Upstream v7
+    // added the same myLid parameter; the comparison below decodes
+    // it to its user first, so the current device is excluded
+    // under BOTH identities while our other devices stay listed
+    // (group sender-key distribution and the DM echo still need
+    // them, exactly like the PN side).
+    const myLidUser = myLid ? jidDecode(myLid)?.user : undefined;
     const extracted = [];
     for (const userResult of result) {
         const { devices, id } = userResult;
@@ -197,7 +208,7 @@ export const extractDeviceJids = (result, myJid, excludeZeroDevices) => {
         if (Array.isArray(deviceList)) {
             for (const { id: device, keyIndex } of deviceList) {
                 if ((!excludeZeroDevices || device !== 0) && // if zero devices are not-excluded, or device is non zero
-                    (myUser !== user || myDevice !== device) && // either different user or if me user, not this device
+                    ((myUser !== user && myLidUser !== user) || myDevice !== device) && // either a different user (neither our PN nor our LID) or if me user, not this device
                     device !== 99 && // AunuBaileys: hosted / Cloud-API companion devices (:99) are not E2E targets — libsignal rejects them ("Unexpected non-hosted device JID with device 99"); skip them when building the device list
                     (device === 0 || !!keyIndex) // ensure that "key-index" is specified for "non-zero" devices, produces a bad req otherwise
                 ) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aunucore/baileys",
   "type": "module",
-  "version": "1.0.81",
+  "version": "1.0.83",
   "description": "AunuBaileys — the self-healing WhatsApp Web API for Node.js. Bad MAC and \"2000 messages into the future\" errors repair themselves, LID and phone-number identities stay in sync, anti-ban is built in, pairing codes are custom — plus 29 experimental features no other Baileys fork ships: invisible watermarks, per-person tag-all cards, side-profile text, ghost mentions and more. ESM, CJS and full TypeScript types.",
   "keywords": [
     "whatsapp",