@aunucore/baileys 1.0.82 → 1.0.84

package/lib/Socket/chats.js

@@ -1,4 +1,3 @@
-import NodeCache from '@cacheable/node-cache';
 import { Boom } from '@hapi/boom';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CACHE_TTLS, PROCESSABLE_HISTORY_TYPES } from '../Defaults/index.js';
@@ -6,6 +5,7 @@ import { ALL_WA_PATCH_NAMES } from '../Types/index.js';
 import { SyncState } from '../Types/State.js';
 import { chatModificationToAppPatch, decodePatches, decodeSyncdSnapshot, encodeSyncdPatch, extractSyncdPatches, generateProfilePicture, getHistoryMsg, newLTHashState, processSyncAction } from '../Utils/index.js';
 import { makeMutex } from '../Utils/make-mutex.js';
+import { makeBoundedTTLCache } from '../Utils/bounded-cache.js';
 import processMessage from '../Utils/process-message.js';
 import { getBinaryNodeChild, getBinaryNodeChildren, isJidUser, isLidUser, jidDecode, jidNormalizedUser, reduceBinaryNodeToDictionary, S_WHATSAPP_NET } from '../WABinary/index.js';
 import { USyncQuery, USyncUser } from '../WAUSync/index.js';
@@ -24,10 +24,16 @@ export const makeChatsSocket = (config) => {
     // Timeout for AwaitingInitialSync state
     let awaitingSyncTimeout;
     const placeholderResendCache = config.placeholderResendCache ||
-        new NodeCache({
-            stdTTL: DEFAULT_CACHE_TTLS.MSG_RETRY, // 1 hour
-            useClones: false
-        });
+        // AunuBaileys (1.0.84, HB-231): in the standard
+        // makeWASocket composition this factory runs BEFORE
+        // messages-recv creates its own default, and the
+        // write-back below means the instance created HERE is
+        // the one the whole receive path actually uses. It used
+        // to be a NodeCache with no size cap, silently shadowing
+        // the bounded default messages-recv intended ("bounded
+        // by default — a TTL alone lets these grow without
+        // limit"). Build the same bounded cache here.
+        makeBoundedTTLCache({ ttlSeconds: DEFAULT_CACHE_TTLS.MSG_RETRY, maxEntries: 1000 });
     if (!config.placeholderResendCache) {
         config.placeholderResendCache = placeholderResendCache;
     }

package/lib/Socket/messages-send.js

@@ -188,7 +188,11 @@ export const makeMessagesSocket = (config) => {
         }
         const result = await sock.executeUSyncQuery(query);
         if (result) {
-            const extracted = extractDeviceJids(result?.list, authState.creds.me?.id, ignoreZeroDevices);
+            // AunuBaileys (1.0.83, HB-258): pass our LID as well —
+            // comparing only the PN user left our own LID devices in
+            // the extracted list, so group sends encrypted a copy to
+            // our own LID device (upstream v7 made the same fix).
+            const extracted = extractDeviceJids(result?.list, authState.creds.me?.id, authState.creds.me?.lid, ignoreZeroDevices);
             const deviceMap = {};
             for (const item of extracted) {
                 deviceMap[item.user] = deviceMap[item.user] || [];
@@ -327,6 +331,16 @@ export const makeMessagesSocket = (config) => {
         return { nodes: filteredNodes, shouldIncludeDeviceIdentity };
     };
     const relayMessage = async (jid, message, { messageId: msgId, participant, additionalAttributes, additionalNodes, useUserDevicesCache, useCachedGroupMetadata, addBizAttributes, statusJidList, statusPrivacy }) => {
+        // AunuBaileys (1.0.83, HB-253): a non-object message — or an
+        // empty object — proto-encodes to ZERO content bytes without
+        // throwing, so the relay used to report success while the
+        // peer received random padding only: the 1.0.71 silent-empty
+        // class at the one public entry point that never got a guard
+        // (sendMessage fails loudly for the same class of input).
+        // Fail fast, before any wait or network work.
+        if (!message || typeof message !== 'object' || Array.isArray(message) || !Object.keys(message).length) {
+            throw new Boom('relayMessage requires a non-empty message object', { statusCode: 400 });
+        }
         if (!ws.isOpen) {
             // AunuBaileys: a send attempted during a reconnect window used to die
             // instantly with Boom 428 from the first internal query — the message
@@ -412,6 +426,10 @@ export const makeMessagesSocket = (config) => {
             const { user, device } = decodedParticipant;
             devices.push({ user, device });
         }
+        // AunuBaileys (1.0.83, HB-178): the stanza built inside the
+        // transaction is captured here and sent only AFTER the
+        // transaction commits — see the tail of this function.
+        let stanzaToSend;
         await authState.keys.transaction(async () => {
             const mediaType = getMediaType(message);
             if (mediaType) {
@@ -420,6 +438,15 @@ export const makeMessagesSocket = (config) => {
             if (isNewsletter) {
                 // Patch message if needed, then encode as plaintext
                 const patched = patchMessageBeforeSending ? await patchMessageBeforeSending(message, []) : message;
+                // AunuBaileys (1.0.83, HB-212): a per-jid patch ARRAY
+                // is in-contract for patchMessageBeforeSending, but
+                // encodeNewsletterMessage is a bare proto encode —
+                // an array encodes to 0 bytes, so the channel got an
+                // empty post while sendMessage resolved as success.
+                // Mirror the group branch and refuse it loudly.
+                if (Array.isArray(patched)) {
+                    throw new Boom('Per-jid patching is not supported in newsletters', { statusCode: 400 });
+                }
                 const bytes = encodeNewsletterMessage(patched);
                 binaryNodeContent.push({
                     tag: 'plaintext',
@@ -447,8 +474,14 @@ export const makeMessagesSocket = (config) => {
                     content: binaryNodeContent
                 };
                 logger.debug({ msgId }, `sending newsletter message to ${jid}`);
-                await sendNode(stanza);
-                sentMessageCacheFor(config).add(jid, msgId, message);
+                // AunuBaileys (1.0.83, HB-178): captured, not sent —
+                // the send happens after the commit at the tail of
+                // relayMessage, and the sent-message cache add lives
+                // there too (it used to sit here, inside the
+                // transaction; with send-after-commit it would
+                // register a message the commit failure prevented
+                // from ever being sent).
+                stanzaToSend = stanza;
                 return;
             }
             if (normalizeMessageContent(message)?.pinInChatMessage) {
@@ -586,10 +619,43 @@ export const makeMessagesSocket = (config) => {
                     allJids.push(jid);
                 }
                 await assertSessions(allJids, false);
-                const [{ nodes: meNodes, shouldIncludeDeviceIdentity: s1 }, { nodes: otherNodes, shouldIncludeDeviceIdentity: s2 }] = await Promise.all([
+                // AunuBaileys (1.0.83, HB-161): the echo to our own
+                // devices and the send to the peer used to share one
+                // Promise.all — when encrypting for ALL of our own
+                // devices failed (a rotten self-session the one-shot
+                // heal inside createParticipantNodes could not save),
+                // the peer's already-encrypted nodes were thrown away
+                // with it and the DM never left, even though the
+                // peer's sessions were healthy; symmetrically, a
+                // total peer failure took the echo down too. The echo
+                // is best-effort: settle both sides independently and
+                // fail only when the side that must deliver produced
+                // nothing.
+                const [meSettled, otherSettled] = await Promise.allSettled([
                     createParticipantNodes(meJids, meMsg, extraAttrs),
                     createParticipantNodes(otherJids, message, extraAttrs)
                 ]);
+                if (otherSettled.status === 'rejected') {
+                    throw otherSettled.reason;
+                }
+                let meNodes = [];
+                let s1 = false;
+                if (meSettled.status === 'fulfilled') {
+                    meNodes = meSettled.value.nodes;
+                    s1 = meSettled.value.shouldIncludeDeviceIdentity;
+                }
+                else if (!otherSettled.value.nodes.length && meJids.length) {
+                    // Our own devices were the ONLY recipients (a
+                    // retry resend aimed at our own device, a
+                    // self-chat): with the echo gone there is nothing
+                    // to send — keep the original failure instead of
+                    // emitting an empty stanza.
+                    throw meSettled.reason;
+                }
+                else {
+                    logger.warn({ err: meSettled.reason }, 'aunu: encrypting the echo to our own devices failed; sending to the peer without the device-sent echo');
+                }
+                const { nodes: otherNodes, shouldIncludeDeviceIdentity: s2 } = otherSettled.value;
                 participants.push(...meNodes);
                 participants.push(...otherNodes);
                 shouldIncludeDeviceIdentity = shouldIncludeDeviceIdentity || s1 || s2;
@@ -658,8 +724,24 @@ export const makeMessagesSocket = (config) => {
                 stanza.content.push(getBizBinaryNode(message));
             }
             logger.debug({ msgId }, `sending message to ${participants.length} devices`);
-            await sendNode(stanza);
+            stanzaToSend = stanza;
         });
+        // AunuBaileys (1.0.83, HB-178): the stanza goes on the wire
+        // only now — AFTER the transaction above has committed the
+        // ratchet state it was encrypted under. The send used to be
+        // the last await INSIDE the transaction, so a commit that
+        // failed through every retry threw after the message was
+        // already delivered: the caller saw an error for a delivered
+        // message (and a host retry then produced a duplicate the
+        // peer could not decrypt, re-using the un-persisted chain
+        // key), while the cache add and the message-secret
+        // registration below were skipped for that delivered
+        // message. Persist first, then send: a commit failure now
+        // fails a message that was never sent, and a sent message
+        // is always registered.
+        if (stanzaToSend) {
+            await sendNode(stanzaToSend);
+        }
         sentMessageCacheFor(config).add(jid, msgId, message);
         // AunuBaileys (1.0.71): register the messageSecret at send time
         // so an msmsg reply can be decrypted even if it arrives before
@@ -759,7 +841,19 @@ export const makeMessagesSocket = (config) => {
         }
         const callId = newCallId();
         const offerContent = buildCallOfferContent(isVideo);
-        const devices = (await getUSyncDevices([toJid], true, false)).map(({ user, device }) => jidEncode(user, 's.whatsapp.net', device));
+        // AunuBaileys (1.0.83, HB-184): the callee's devices take
+        // the server of the DESTINATION jid — a LID callee's devices
+        // live on 'lid'; encoding them on 's.whatsapp.net' addressed
+        // a phone number that does not exist (LID digits are not a
+        // number), so the offer could never ring.
+        const callServer = jidDecode(toJid)?.server === 'lid' ? 'lid' : 's.whatsapp.net';
+        const devices = (await getUSyncDevices([toJid], true, false)).map(({ user, device }) => jidEncode(user, callServer, device));
+        // AunuBaileys (1.0.83, HB-147): an empty device list built
+        // an offer with ZERO <destination> nodes — a call that could
+        // ring nobody, with no client-side complaint. Fail fast.
+        if (!devices.length) {
+            throw new Boom(`offerCall: no devices found for ${toJid}; the call would ring nobody`, { statusCode: 400 });
+        }
         await assertSessions(devices, true);
         const { nodes: destinations, shouldIncludeDeviceIdentity } = await createParticipantNodes(devices, {
             call: { callKey: createCallKey() }
@@ -800,7 +894,25 @@ export const makeMessagesSocket = (config) => {
         }
         const callId = newCallId();
         const offerContent = buildCallOfferContent(isVideo);
-        const devices = (await getUSyncDevices(participants, true, false)).map(({ user, device }) => jidEncode(user, 's.whatsapp.net', device));
+        // AunuBaileys (1.0.83, HB-184): each participant's devices
+        // take the server of that participant's OWN jid — in a
+        // LID-addressed group the participants are LID jids and
+        // their devices live on 'lid', not 's.whatsapp.net'.
+        const serverByUser = new Map();
+        for (const participantJid of participants) {
+            const decodedParticipant = jidDecode(jidNormalizedUser(participantJid) || '');
+            if (decodedParticipant?.user) {
+                serverByUser.set(decodedParticipant.user, decodedParticipant.server === 'lid' ? 'lid' : 's.whatsapp.net');
+            }
+        }
+        const devices = (await getUSyncDevices(participants, true, false)).map(({ user, device }) => jidEncode(user, serverByUser.get(user) ?? 's.whatsapp.net', device));
+        // AunuBaileys (1.0.83, HB-147): the default participants=[]
+        // (or a usync answer with no devices) built an offer with
+        // ZERO <destination> nodes — a call that could ring nobody,
+        // with no client-side complaint. Fail fast.
+        if (!devices.length) {
+            throw new Boom('groupCall: no participant devices to call; the call would ring nobody', { statusCode: 400 });
+        }
         await assertSessions(devices, true);
         const { nodes: destinations, shouldIncludeDeviceIdentity } = await createParticipantNodes(devices, {
             call: { callKey: createCallKey() }
@@ -869,19 +981,44 @@ export const makeMessagesSocket = (config) => {
             throw new Boom(`exclusive target is not a valid JID: ${target}`, { statusCode: 400 });
         }
         const devices = await getUSyncDevices([targetUser], relayOpts.useUserDevicesCache !== false, false);
-        const deviceJids = devices.map(({ user, device }) => jidEncode(user, 's.whatsapp.net', device)).filter(Boolean);
+        // AunuBaileys (1.0.83, HB-188): the target's devices take
+        // the server of the TARGET jid — for a LID member they live
+        // on 'lid'; encoding them on 's.whatsapp.net' addressed a
+        // phone number that does not exist (the LID digits are not
+        // a number), so the exclusive message could never arrive.
+        const targetServer = jidDecode(targetUser)?.server === 'lid' ? 'lid' : 's.whatsapp.net';
+        const deviceJids = devices.map(({ user, device }) => jidEncode(user, targetServer, device)).filter(Boolean);
         // No device list means the member is unknown to usync; addressing
         // the bare jid still reaches their primary device rather than
         // failing the send outright.
         const targets = deviceJids.length ? deviceJids : [targetUser];
         logger.debug({ jid, target: targetUser, devices: targets.length }, 'sending exclusive group message');
+        // AunuBaileys (1.0.83, HB-108): per-device isolation — one
+        // device's failure (a rotten session, a rejected stanza)
+        // used to abort the loop, so the remaining devices never
+        // received the message and the error did not say the
+        // delivery was partial. Deliver to every device that works
+        // and fail only when NONE did; the return value now lists
+        // the devices actually delivered to.
+        const delivered = [];
+        let firstDeviceError;
         for (const deviceJid of targets) {
-            await relayMessage(jid, message, {
-                ...relayOpts,
-                participant: { jid: deviceJid, count: 0 }
-            });
+            try {
+                await relayMessage(jid, message, {
+                    ...relayOpts,
+                    participant: { jid: deviceJid, count: 0 }
+                });
+                delivered.push(deviceJid);
+            }
+            catch (err) {
+                firstDeviceError = firstDeviceError ?? err;
+                logger.warn({ err, jid, deviceJid }, 'aunu: exclusive send failed for one device; continuing with the remaining devices');
+            }
         }
-        return targets;
+        if (!delivered.length) {
+            throw firstDeviceError ?? new Boom('exclusive send failed for every target device', { statusCode: 500 });
+        }
+        return delivered;
     };
     // AunuBaileys (1.0.71): named so the wrappers below can call the
     // socket's own sendMessage — the `sock` closure variable is the
@@ -1094,60 +1231,99 @@ export const makeMessagesSocket = (config) => {
                 // AunuBaileys (1.0.71): the option images follow the parent,
                 // each pointing back at it via messageAssociation.
                 if (imagePollOptionMedia?.length) {
+                    // AunuBaileys (1.0.83, HB-173): per-child
+                    // isolation — one failing option image used to
+                    // abort the loop, leaving the already-sent poll
+                    // parent with only some (or none) of its images
+                    // while the caller saw a total failure. Deliver
+                    // every child that works; fail only when NONE
+                    // did.
+                    let deliveredChildren = 0;
+                    let firstChildError;
                     for (const media of imagePollOptionMedia) {
-                        const optionMsg = generateWAMessageFromContent(jid, {
-                            pollCreationOptionImageMessage: { message: media },
-                            messageContextInfo: {
-                                messageAssociation: {
-                                    parentMessageKey: fullMsg.key,
-                                    associationType: proto.MessageAssociation.AssociationType.MEDIA_POLL
+                        try {
+                            const optionMsg = generateWAMessageFromContent(jid, {
+                                pollCreationOptionImageMessage: { message: media },
+                                messageContextInfo: {
+                                    messageAssociation: {
+                                        parentMessageKey: fullMsg.key,
+                                        associationType: proto.MessageAssociation.AssociationType.MEDIA_POLL
+                                    }
                                 }
-                            }
-                        }, {
-                            userJid,
-                            messageId: generateMessageIDV2(sock.user?.id)
-                        });
-                        await relay(jid, optionMsg.message, {
-                            messageId: optionMsg.key.id,
-                            useCachedGroupMetadata: options.useCachedGroupMetadata,
-                            additionalAttributes,
-                            additionalNodes: []
-                        });
+                            }, {
+                                userJid,
+                                messageId: generateMessageIDV2(sock.user?.id)
+                            });
+                            await relay(jid, optionMsg.message, {
+                                messageId: optionMsg.key.id,
+                                useCachedGroupMetadata: options.useCachedGroupMetadata,
+                                additionalAttributes,
+                                additionalNodes: []
+                            });
+                            deliveredChildren += 1;
+                        }
+                        catch (err) {
+                            firstChildError = firstChildError ?? err;
+                            logger.warn({ err, jid }, 'aunu: one image-poll option image failed to send; continuing with the rest');
+                        }
+                    }
+                    if (!deliveredChildren) {
+                        throw firstChildError ?? new Boom('all image-poll option images failed to send', { statusCode: 500 });
                     }
                 }
                 // AunuBaileys: kirim isi album sebagai pesan terasosiasi (dari @itsliaaa/baileys)
                 if ('album' in content) {
                     const { delayMs = 1500 } = options;
+                    // AunuBaileys (1.0.83, HB-173): per-item
+                    // isolation — one failing item (upload timeout,
+                    // total encryption failure) used to abort the
+                    // loop, leaving the already-sent album parent
+                    // with only some (or none) of its items while
+                    // the caller saw a total failure (and a retry
+                    // duplicated the parent). Deliver every item
+                    // that works; fail only when NONE did.
+                    let deliveredItems = 0;
+                    let firstItemError;
                     for (const albumMedia of content.album) {
-                        const albumMsg = await generateWAMessage(jid, albumMedia, {
-                            logger,
-                            userJid,
-                            upload: (fp, opts) => waUploadToServer(fp, { ...opts, newsletter: isJidNewsletter(jid) }),
-                            mediaCache: config.mediaCache,
-                            options: config.options,
-                            ...options,
-                            messageId: generateMessageIDV2(sock.user?.id)
-                        });
-                        const normalized = normalizeMessageContent(albumMsg.message);
-                        if (!normalized || !('imageMessage' in normalized || 'videoMessage' in normalized)) {
-                            throw new Boom('Invalid message type for album', { statusCode: 400 });
+                        try {
+                            const albumMsg = await generateWAMessage(jid, albumMedia, {
+                                logger,
+                                userJid,
+                                upload: (fp, opts) => waUploadToServer(fp, { ...opts, newsletter: isJidNewsletter(jid) }),
+                                mediaCache: config.mediaCache,
+                                options: config.options,
+                                ...options,
+                                messageId: generateMessageIDV2(sock.user?.id)
+                            });
+                            const normalized = normalizeMessageContent(albumMsg.message);
+                            if (!normalized || !('imageMessage' in normalized || 'videoMessage' in normalized)) {
+                                throw new Boom('Invalid message type for album', { statusCode: 400 });
+                            }
+                            albumMsg.message.messageContextInfo = albumMsg.message.messageContextInfo || {};
+                            albumMsg.message.messageContextInfo.messageAssociation = {
+                                parentMessageKey: fullMsg.key,
+                                associationType: proto.MessageAssociation.AssociationType.MEDIA_ALBUM
+                            };
+                            await relay(jid, albumMsg.message, {
+                                messageId: albumMsg.key.id,
+                                useCachedGroupMetadata: options.useCachedGroupMetadata,
+                                statusJidList: options.statusJidList,
+                                statusPrivacy: options.statusPrivacy,
+                        statusPrivacy: options.statusPrivacy,
+                                additionalAttributes,
+                                additionalNodes
+                            });
+                            deliveredItems += 1;
+                        }
+                        catch (err) {
+                            firstItemError = firstItemError ?? err;
+                            logger.warn({ err, jid }, 'aunu: one album item failed to send; continuing with the rest of the album');
                         }
-                        albumMsg.message.messageContextInfo = albumMsg.message.messageContextInfo || {};
-                        albumMsg.message.messageContextInfo.messageAssociation = {
-                            parentMessageKey: fullMsg.key,
-                            associationType: proto.MessageAssociation.AssociationType.MEDIA_ALBUM
-                        };
-                        await relay(jid, albumMsg.message, {
-                            messageId: albumMsg.key.id,
-                            useCachedGroupMetadata: options.useCachedGroupMetadata,
-                            statusJidList: options.statusJidList,
-                            statusPrivacy: options.statusPrivacy,
-                    statusPrivacy: options.statusPrivacy,
-                            additionalAttributes,
-                            additionalNodes
-                        });
                         await delay(delayMs);
                     }
+                    if (content.album.length && !deliveredItems) {
+                        throw firstItemError ?? new Boom('all album items failed to send', { statusCode: 500 });
+                    }
                 }
                 if (config.emitOwnEvents) {
                     process.nextTick(() => {

package/lib/Store/make-in-memory-store.js

@@ -1,7 +1,7 @@
 // AunuCore fork backport: in-memory store dari Baileys 6.6.0, dikonversi ke ESM untuk basis 6.7.x
 import KeyedDBModule from '@adiwajshing/keyed-db';
 const KeyedDB = KeyedDBModule.default || KeyedDBModule;
-import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { readFileSync, writeFileSync, existsSync, renameSync } from 'fs';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CONNECTION_CONFIG } from '../Defaults/index.js';
 import { LabelAssociationType } from '../Types/LabelAssociation.js';
@@ -131,6 +131,16 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             for (const update of updates) {
                 if (contacts[update.id]) {
                     Object.assign(contacts[update.id], update);
+                    // AunuBaileys (1.0.84, HB-245): a picture
+                    // notification arrives as imgUrl 'changed' /
+                    // 'removed' — a sentinel, not a URL. Drop the
+                    // cached URL instead of storing the sentinel:
+                    // fetchImageUrl used to hand the literal string
+                    // 'changed' to the host as the avatar URL, and
+                    // writeToFile persisted the poison to disk.
+                    if (update.imgUrl === 'changed' || update.imgUrl === 'removed') {
+                        delete contacts[update.id].imgUrl;
+                    }
                 }
                 else {
                     logger.debug({ update }, 'got update for non-existant contact');
@@ -258,7 +268,18 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             if (metadata) {
                 switch (action) {
                     case 'add':
-                        metadata.participants.push(...participants.map(id => ({ id, isAdmin: false, isSuperAdmin: false })));
+                        // AunuBaileys (1.0.84, HB-237): skip ids
+                        // that are already listed. The metadata is
+                        // usually populated by a fetch that already
+                        // contains the member, and a redelivery
+                        // replays the notification — both used to
+                        // push a duplicate entry every single time,
+                        // without bound.
+                        for (const participantId of participants) {
+                            if (!metadata.participants.some(p => p.id === participantId)) {
+                                metadata.participants.push({ id: participantId, isAdmin: false, isSuperAdmin: false });
+                            }
+                        }
                         break;
                     case 'demote':
                     case 'promote':
@@ -301,14 +322,43 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
         labelAssociations
     });
     const fromJSON = (json) => {
-        chats.upsert(...json.chats);
-        labelAssociations.upsert(...json.labelAssociations || []);
-        contactsUpsert(Object.values(json.contacts));
-        labelsUpsert(Object.values(json.labels || {}));
-        for (const jid in json.messages) {
+        // AunuBaileys (1.0.84, HB-134 + HB-142 + addenda): every
+        // stage — and every entry — is isolated. One poisoned
+        // message entry used to throw out of fromJSON mid-loop:
+        // that jid's remaining messages and EVERY later jid were
+        // silently lost on every boot, while the stages before
+        // the throw stayed applied and readFromFile logged
+        // "starting with an empty store" — a claim the state did
+        // not match. A missing/null contacts stage threw the
+        // same way (Object.values of undefined), and a poisoned
+        // contacts/labels entry aborted every stage after it.
+        // Wrong-typed stages now read as empty, unusable entries
+        // are skipped, and a bad message entry is caught per
+        // entry with a warning — the healthy remainder of the
+        // file always loads.
+        if (!json || typeof json !== 'object') {
+            return;
+        }
+        const entriesOf = (value) => (Array.isArray(value) ? value : []).filter(e => !!e && typeof e === 'object');
+        const valuesOf = (value) => (value && typeof value === 'object' ? Object.values(value) : []);
+        chats.upsert(...entriesOf(json.chats));
+        labelAssociations.upsert(...entriesOf(json.labelAssociations));
+        contactsUpsert(valuesOf(json.contacts).filter(c => !!c && typeof c === 'object' && typeof c.id === 'string'));
+        labelsUpsert(valuesOf(json.labels).filter(l => !!l && typeof l === 'object' && typeof l.id === 'string'));
+        const messageSets = json.messages && typeof json.messages === 'object' ? json.messages : {};
+        for (const jid in messageSets) {
+            const entries = messageSets[jid];
+            if (!Array.isArray(entries)) {
+                continue;
+            }
             const list = assertMessageList(jid);
-            for (const msg of json.messages[jid]) {
-                list.upsert(proto.WebMessageInfo.fromObject(msg), 'append');
+            for (const msg of entries) {
+                try {
+                    list.upsert(proto.WebMessageInfo.fromObject(msg), 'append');
+                }
+                catch (err) {
+                    logger.warn({ jid, err }, 'aunu: skipped an unreadable message entry while loading the store');
+                }
             }
         }
     };
@@ -329,6 +379,16 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             const cursorKey = !!cursor ? ('before' in cursor ? cursor.before : cursor.after) : undefined;
             const cursorValue = cursorKey ? list.get(cursorKey.id) : undefined;
             let messages;
+            // AunuBaileys (1.0.84, HB-177): a count of 0 means
+            // "no messages" — the slicing below used
+            // slice(-count), and slice(-0) is slice(0), so
+            // loadMessages(jid, 0) returned the chat's ENTIRE
+            // history (and negative counts mis-sliced as well).
+            // Every other path in this function already resolves
+            // to []. An absent count keeps the legacy behaviour.
+            if (typeof count === 'number' && count <= 0) {
+                return [];
+            }
             if (list && mode === 'before' && (!cursorKey || cursorValue)) {
                 if (cursorValue) {
                     const msgIdx = list.array.findIndex(m => m.key.id === (cursorKey === null || cursorKey === void 0 ? void 0 : cursorKey.id));
@@ -386,7 +446,13 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             if (!contact) {
                 return sock === null || sock === void 0 ? void 0 : sock.profilePictureUrl(jid);
             }
-            if (typeof contact.imgUrl === 'undefined') {
+            // AunuBaileys (1.0.84, HB-245): a store file written
+            // before this fix can still carry the 'changed' /
+            // 'removed' sentinel as imgUrl — treat it as no
+            // cached URL and fetch fresh; never hand a sentinel
+            // back as an avatar URL. A real cached URL is still
+            // returned as-is (and a fresh fetch re-caches it).
+            if (typeof contact.imgUrl === 'undefined' || contact.imgUrl === 'changed' || contact.imgUrl === 'removed') {
                 contact.imgUrl = await (sock === null || sock === void 0 ? void 0 : sock.profilePictureUrl(jid));
             }
             return contact.imgUrl;
@@ -419,7 +485,17 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
         writeToFile: (path) => {
             // require fs here so that in case "fs" is not available -- the app does not crash
             
-            writeFileSync(path, JSON.stringify(toJSON()));
+            // AunuBaileys (1.0.84, HB-120 + addendum): every
+            // other persistence writer in the lib is atomic and
+            // 0600 (auth files HB-116, the lid store); this one
+            // wrote the full chat/contact/message history
+            // world-readable AND non-atomically — a crash
+            // mid-write left a truncated file the next boot read
+            // as corrupt and discarded wholesale. Write a
+            // per-pid temp file, then rename it over the target.
+            const tmpPath = `${path}.tmp-${process.pid}`;
+            writeFileSync(tmpPath, JSON.stringify(toJSON()), { mode: 0o600 });
+            renameSync(tmpPath, path);
         },
         readFromFile: (path) => {
             // require fs here so that in case "fs" is not available -- the app does not crash

package/lib/Utils/auth-utils.js

@@ -16,11 +16,35 @@ export function makeCacheableSignalKeyStore(store, logger, _cache) {
         new NodeCache({
             stdTTL: DEFAULT_CACHE_TTLS.SIGNAL_STORE, // 5 minutes
             useClones: false,
-            deleteOnExpire: true
+            deleteOnExpire: true,
+            // AunuBaileys (1.0.84, HB-199): a TTL bounds an
+            // entry's AGE, not the entry COUNT — a burst of
+            // distinct sender addresses inside the 5-minute
+            // window grew this cache without limit (the exact
+            // warning written in bounded-cache.js). Cap the
+            // number of keys as well. NOTE: NodeCache's maxKeys
+            // does not evict — set() THROWS once the cap is hit —
+            // so every cache write below goes through cacheSet,
+            // which swallows that one error: the underlying store
+            // is authoritative, a skipped cache entry only costs
+            // a re-read, and the cap can never break a session
+            // operation.
+            maxKeys: 1000
         });
     function getUniqueId(type, id) {
         return `${type}.${id}`;
     }
+    // AunuBaileys (1.0.84, HB-199): see the maxKeys note above —
+    // a full cache must degrade to "not cached", never to a throw
+    // escaping into get()/set().
+    function cacheSet(key, value) {
+        try {
+            cache.set(key, value);
+        }
+        catch {
+            // cache is at its key cap; the store stays authoritative
+        }
+    }
     return {
         async get(type, ids) {
             const data = {};
@@ -41,7 +65,7 @@ export function makeCacheableSignalKeyStore(store, logger, _cache) {
                     const item = fetched[id];
                     if (item) {
                         data[id] = item;
-                        cache.set(getUniqueId(type, id), item);
+                        cacheSet(getUniqueId(type, id), item);
                     }
                 }
             }
@@ -67,7 +91,7 @@ export function makeCacheableSignalKeyStore(store, logger, _cache) {
                         cache.del(getUniqueId(type, id));
                     }
                     else {
-                        cache.set(getUniqueId(type, id), data[type][id]);
+                        cacheSet(getUniqueId(type, id), data[type][id]);
                     }
                     keys += 1;
                 }

package/lib/Utils/baileys-event-stream.js

@@ -1,6 +1,6 @@
 import EventEmitter from 'events';
 import { createReadStream } from 'fs';
-import { writeFile } from 'fs/promises';
+import { rename, writeFile } from 'fs/promises';
 import { createInterface } from 'readline';
 import { delay } from './generics.js';
 import { makeMutex } from './make-mutex.js';
@@ -13,13 +13,48 @@ export const captureEventStream = (ev, filename) => {
     const oldEmit = ev.emit;
     // write mutex so data is appended in order
     const writeMutex = makeMutex();
+    // AunuBaileys (1.0.84, HB-247): a creds.update payload is the
+    // full credential material (private noise / identity /
+    // signed-pre-key bytes, the adv secret). The capture below
+    // redacts it to the NAMES of the fields that changed, creates
+    // the file 0600, and rotates it to `<filename>.1` once per
+    // 10 MiB so a long-running debug capture cannot grow (or
+    // leak) without bound.
+    let capturedBytes = 0;
+    const MAX_CAPTURE_BYTES = 10 * 1024 * 1024;
     // monkey patch eventemitter to capture all events
     ev.emit = function (...args) {
-        const content = JSON.stringify({ timestamp: Date.now(), event: args[0], data: args[1] }) + '\n';
         const result = oldEmit.apply(ev, args);
+        let content;
+        try {
+            const data = args[0] === 'creds.update' && args[1] && typeof args[1] === 'object'
+                ? { redacted: 'creds.update payload withheld (credential material)', updatedFields: Object.keys(args[1]) }
+                : args[1];
+            content = JSON.stringify({ timestamp: Date.now(), event: args[0], data }) + '\n';
+        }
+        catch {
+            // AunuBaileys (1.0.84, HB-129 addendum): an
+            // unserialisable (circular) payload used to throw
+            // synchronously out of the patched emit — into
+            // whatever lib code had emitted the event — because
+            // the stringify ran before oldEmit. Serialisation now
+            // happens after the real emit, and a payload that
+            // cannot be serialised is simply not captured.
+            return result;
+        }
+        // AunuBaileys (1.0.84, HB-129): the mutex promise used to
+        // be discarded — a failed write (deleted directory, full
+        // disk, permissions) rejected with no handler attached
+        // and crashed the host process (Node >= 15 default). A
+        // debug capture must never take the host down with it.
         writeMutex.mutex(async () => {
-            await writeFile(filename, content, { flag: 'a' });
-        });
+            capturedBytes += Buffer.byteLength(content);
+            if (capturedBytes > MAX_CAPTURE_BYTES) {
+                capturedBytes = Buffer.byteLength(content);
+                await rename(filename, `${filename}.1`).catch(() => { });
+            }
+            await writeFile(filename, content, { flag: 'a', mode: 0o600 });
+        }).catch(() => { });
         return result;
     };
 };

package/lib/Utils/event-buffer.js

@@ -45,11 +45,25 @@ export const makeEventBuffer = (logger) => {
             // had to run. Log the error and keep dispatching the
             // remaining events of the batch; the event itself
             // still fired, with its payload unchanged.
-            try {
-                ev.emit(event, map[event]);
-            }
-            catch (err) {
-                logger.error({ err, event }, 'error in event listener — dispatch continues');
+            //
+            // AunuBaileys (1.0.84, HB-264): dispatch PER LISTENER.
+            // A single ev.emit stops at the first listener that
+            // throws, so every listener registered AFTER the
+            // thrower silently missed that emit — a throwing
+            // logging listener registered before the host's
+            // saveCreds made that credential update vanish.
+            // rawListeners returns the once-wrappers themselves,
+            // so once semantics are preserved, and each listener
+            // gets its own guard: a throw now costs only the
+            // listener that threw.
+            const listeners = ev.rawListeners(event);
+            for (const listener of listeners) {
+                try {
+                    listener.call(ev, map[event]);
+                }
+                catch (err) {
+                    logger.error({ err, event }, 'error in event listener — dispatch continues');
+                }
             }
         }
     });
@@ -65,6 +79,17 @@ export const makeEventBuffer = (logger) => {
         }
         logger.debug('Flushing event buffer');
         isBuffering = false;
+        // AunuBaileys (1.0.84, HB-130 + addendum): the history
+        // dedup set only has to live for ONE buffering session.
+        // It used to survive every flush (cleared only in
+        // destroy()), so a second history sync inside the same
+        // socket lifetime silently dropped every already-known
+        // chat — and every already-known message key, even when
+        // that message's content had changed: fresh unread
+        // counts and edits never reached the store. Dedup for
+        // THIS session's appends already happened above; the
+        // next session starts empty.
+        historyCache.clear();
         const newData = makeBufferData();
         const chatUpdates = Object.values(data.chatUpdates);
         let conditionalChatUpdatesLeft = 0;
@@ -305,7 +330,14 @@ eventData, logger) {
                     data.contactUpserts[contact.id] = upsert;
                 }
                 if (data.contactUpdates[contact.id]) {
-                    upsert = Object.assign(data.contactUpdates[contact.id], trimUndefined(contact));
+                    // AunuBaileys (1.0.84, HB-182): the pending
+                    // update merges INTO the upsert. The old
+                    // direction merged the contact into the pending
+                    // update object and then deleted that object —
+                    // the merged result went nowhere, and fields
+                    // only the update carried (notify, verifiedName)
+                    // silently vanished from the flushed upsert.
+                    Object.assign(upsert, data.contactUpdates[contact.id]);
                     delete data.contactUpdates[contact.id];
                 }
             }

package/lib/Utils/generics.js

@@ -46,7 +46,26 @@ export const BufferJSON = {
     reviver: (_, value) => {
         if (typeof value === 'object' && !!value && (value.buffer === true || value.type === 'Buffer')) {
             const val = value.data || value.value;
-            return typeof val === 'string' ? Buffer.from(val, 'base64') : Buffer.from(val || []);
+            if (typeof val === 'string') {
+                // AunuBaileys (1.0.84, HB-143): Node's base64
+                // decoder is lenient — it silently DROPS
+                // characters outside the alphabet, so a garbage
+                // or hand-mangled string in a creds/key file
+                // decoded to wrong-length, wrong-value key bytes
+                // with no error anywhere, and the corruption only
+                // surfaced later as baffling Curve / handshake
+                // failures. The replacer above only ever produces
+                // canonical base64; reject anything else loudly.
+                // Both in-tree readers contain the throw: the
+                // auth-state reader logs a corrupt file and starts
+                // clean, and the sender-key reader falls back to
+                // an empty (self-healing) record.
+                if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(val)) {
+                    throw new Error('BufferJSON: invalid base64 in serialized Buffer data');
+                }
+                return Buffer.from(val, 'base64');
+            }
+            return Buffer.from(val || []);
         }
         return value;
     }

package/lib/Utils/lid-store.js

@@ -169,7 +169,10 @@ export const makeLIDStore = (options = {}) => {
             // AunuBaileys (1.0.70): atomic tmp+rename — a crash mid-write
             // used to leave a truncated store file behind.
             const tmpPath = `${path}.tmp-${process.pid}`;
-            writeFileSync(tmpPath, JSON.stringify(Object.fromEntries(pnToLid)));
+            // AunuBaileys (1.0.84, HB-120): 0600, like the auth
+            // files (HB-116) — this file maps phone numbers to
+            // LIDs and must not land world-readable.
+            writeFileSync(tmpPath, JSON.stringify(Object.fromEntries(pnToLid)), { mode: 0o600 });
             renameSync(tmpPath, path);
         },
         loadFromFile: (path) => {

package/lib/Utils/messages.js

@@ -603,6 +603,18 @@ const withAunuButtonIcon = (button) => {
         buttonParamsJson: typeof params === 'string' ? params : JSON.stringify(params ?? {})
     };
 };
+// AunuBaileys (1.0.83, HB-254): delete / pin / edit each carry a
+// message KEY, and WAProto.Message.fromObject silently DROPS a key
+// whose value is undefined — so { delete: undefined } used to relay
+// a key-less REVOKE (pin and edit likewise) that "succeeded" but
+// could never take effect, because the server had no key to act
+// on. Mirror the pollUpdate branch's discipline: the argument
+// must be a real key object carrying a message id.
+const assertMessageKeyArg = (value, field) => {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || typeof value.id !== 'string' || !value.id) {
+        throw new Boom(`"${field}" requires a valid message key (an object with a message id)`, { statusCode: 400 });
+    }
+};
 export const generateWAMessageContent = async (message, options) => {
     var _a, _b;
     let m = {};
@@ -610,8 +622,13 @@ export const generateWAMessageContent = async (message, options) => {
     // straight through to generateWAMessage() unprocessed (donor:
     // @violetix/baileys). The caller owns the proto shape entirely.
     if (message && typeof message === 'object' && 'raw' in message && !!message.raw) {
-        delete message.raw;
-        return message;
+        // AunuBaileys (1.0.83, HB-165): work on a copy — the object
+        // belongs to the caller, and deleting `raw` from it made a
+        // second send of the same object silently lose the raw
+        // passthrough entirely.
+        const rawContent = { ...message };
+        delete rawContent.raw;
+        return rawContent;
     }
     // AunuBaileys: rich response — blok kode / tabel / tautan (dari @itsliaaa/baileys)
     if ('code' in message || 'links' in message || 'table' in message || 'richResponse' in message || 'html' in message || 'richHtml' in message) {
@@ -664,12 +681,19 @@ export const generateWAMessageContent = async (message, options) => {
         m.locationMessage = WAProto.Message.LocationMessage.fromObject(message.location);
     }
     else if ('react' in message) {
-        if (!message.react.senderTimestampMs) {
-            message.react.senderTimestampMs = Date.now();
+        // AunuBaileys (1.0.83, HB-165): stamp the timestamp on a
+        // copy — the caller's react object used to keep it, so a
+        // re-send of the same object carried the first send's
+        // (stale) timestamp. A non-object react keeps the original
+        // behaviour (the deref below throws, caller-visible).
+        const react = message.react && typeof message.react === 'object' ? { ...message.react } : message.react;
+        if (!react.senderTimestampMs) {
+            react.senderTimestampMs = Date.now();
         }
-        m.reactionMessage = WAProto.Message.ReactionMessage.fromObject(message.react);
+        m.reactionMessage = WAProto.Message.ReactionMessage.fromObject(react);
     }
     else if ('delete' in message) {
+        assertMessageKeyArg(message.delete, 'delete');
         m.protocolMessage = {
             key: message.delete,
             type: WAProto.Message.ProtocolMessage.Type.REVOKE
@@ -706,6 +730,7 @@ export const generateWAMessageContent = async (message, options) => {
         }
     }
     else if ('pin' in message) {
+        assertMessageKeyArg(message.pin, 'pin');
         m.pinInChatMessage = {};
         m.messageContextInfo = {};
         m.pinInChatMessage.key = message.pin;
@@ -729,6 +754,13 @@ export const generateWAMessageContent = async (message, options) => {
                     type: proto.Message.ButtonsResponseMessage.Type.DISPLAY_TEXT
                 };
                 break;
+            default:
+                // AunuBaileys (1.0.83, HB-253 family): an unknown
+                // reply type used to fall through the switch,
+                // leaving m empty — a content-less message was
+                // relayed as if the reply had been sent. Fail
+                // loudly instead.
+                throw new Boom(`Unknown buttonReply type: ${message.type} (expected 'template' or 'plain')`, { statusCode: 400 });
         }
     }
     else if ('ptv' in message && message.ptv) {
@@ -814,6 +846,10 @@ export const generateWAMessageContent = async (message, options) => {
         throw new Boom('Event responses (RSVPs) are sent as encEventResponseMessage (Message field 76), encrypted with the event creation key — not yet implemented in AunuBaileys', { statusCode: 501 });
     }
     else if ('poll' in message) {
+        // AunuBaileys (1.0.83, HB-165): the default stamps below
+        // (selectableCount / toAnnouncementGroup) land on a copy of
+        // the caller's content, not on the caller's poll object.
+        message = { ...message, poll: { ...message.poll } };
         (_a = message.poll).selectableCount || (_a.selectableCount = 0);
         (_b = message.poll).toAnnouncementGroup || (_b.toAnnouncementGroup = false);
         if (!Array.isArray(message.poll.values)) {
@@ -1190,7 +1226,10 @@ export const generateWAMessageContent = async (message, options) => {
             };
         }
         m = { groupStatusMessageV2: { message: m } };
-        delete message.groupStatus;
+        // AunuBaileys (1.0.83, HB-165): the flag used to be deleted
+        // from the CALLER's object here — a re-send of the same
+        // content object silently lost its group-status wrapping.
+        // The flag is already consumed into m; leave it in place.
     }
     // AunuBaileys (1.0.71): spoiler — set contextInfo.isSpoiler and wrap
     // the message into spoilerMessage (Message field 118).
@@ -1206,7 +1245,9 @@ export const generateWAMessageContent = async (message, options) => {
             };
         }
         m = { spoilerMessage: { message: m } };
-        delete message.spoiler;
+        // AunuBaileys (1.0.83, HB-165): same caller-object mutation
+        // as the groupStatus block above — the flag stays on the
+        // caller's object, so a re-send wraps identically.
     }
     // AunuBaileys: interactiveAsTemplate (dari @itsliaaa/baileys) — bungkus interactiveMessage
     // ke templateMessage; messageContextInfo (deviceListMetadata) dipertahankan di sisinya
@@ -1223,6 +1264,7 @@ export const generateWAMessageContent = async (message, options) => {
         };
     }
     if ('edit' in message) {
+        assertMessageKeyArg(message.edit, 'edit');
         m = {
             protocolMessage: {
                 key: message.edit,

package/lib/Utils/signal.d.ts

@@ -18,7 +18,7 @@ export declare const xmppPreKey: (pair: KeyPair, id: number) => BinaryNode;
 export declare const parseAndInjectE2ESessions: (node: BinaryNode, repository: SignalRepository) => Promise<void>;
 /** AunuBaileys: session parsed from a retry receipt's embedded key bundle, or undefined when absent. */
 export declare const parseRetryReceiptSession: (node: BinaryNode) => { registrationId: number; identityKey: Buffer; signedPreKey?: { keyId: number; publicKey: Buffer; signature?: Buffer }; preKey?: { keyId: number; publicKey: Buffer } } | undefined;
-export declare const extractDeviceJids: (result: USyncQueryResultList[], myJid: string, excludeZeroDevices: boolean) => JidWithDevice[];
+export declare const extractDeviceJids: (result: USyncQueryResultList[], myJid: string, myLid: string | undefined, excludeZeroDevices: boolean) => JidWithDevice[];
 /**
  * get the next N keys for upload or processing
  * @param count number of pre-keys to get or generate

package/lib/Utils/signal.js

@@ -184,8 +184,19 @@ export const parseAndInjectE2ESessions = async (node, repository, logger) => {
         }));
     }
 };
-export const extractDeviceJids = (result, myJid, excludeZeroDevices) => {
+export const extractDeviceJids = (result, myJid, myLid, excludeZeroDevices) => {
     const { user: myUser, device: myDevice } = jidDecode(myJid) || {};
+    // AunuBaileys (1.0.83, HB-258): our own devices exist under TWO
+    // identities — the PN user and the LID user. Comparing only the
+    // PN user left our own LID devices in the extracted list, so a
+    // group send encrypted and delivered a copy to our own LID
+    // device (self-delivery plus wasted encryption). Upstream v7
+    // added the same myLid parameter; the comparison below decodes
+    // it to its user first, so the current device is excluded
+    // under BOTH identities while our other devices stay listed
+    // (group sender-key distribution and the DM echo still need
+    // them, exactly like the PN side).
+    const myLidUser = myLid ? jidDecode(myLid)?.user : undefined;
     const extracted = [];
     for (const userResult of result) {
         const { devices, id } = userResult;
@@ -197,7 +208,7 @@ export const extractDeviceJids = (result, myJid, excludeZeroDevices) => {
         if (Array.isArray(deviceList)) {
             for (const { id: device, keyIndex } of deviceList) {
                 if ((!excludeZeroDevices || device !== 0) && // if zero devices are not-excluded, or device is non zero
-                    (myUser !== user || myDevice !== device) && // either different user or if me user, not this device
+                    ((myUser !== user && myLidUser !== user) || myDevice !== device) && // either a different user (neither our PN nor our LID) or if me user, not this device
                     device !== 99 && // AunuBaileys: hosted / Cloud-API companion devices (:99) are not E2E targets — libsignal rejects them ("Unexpected non-hosted device JID with device 99"); skip them when building the device list
                     (device === 0 || !!keyIndex) // ensure that "key-index" is specified for "non-zero" devices, produces a bad req otherwise
                 ) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aunucore/baileys",
   "type": "module",
-  "version": "1.0.82",
+  "version": "1.0.84",
   "description": "AunuBaileys — the self-healing WhatsApp Web API for Node.js. Bad MAC and \"2000 messages into the future\" errors repair themselves, LID and phone-number identities stay in sync, anti-ban is built in, pairing codes are custom — plus 29 experimental features no other Baileys fork ships: invisible watermarks, per-person tag-all cards, side-profile text, ghost mentions and more. ESM, CJS and full TypeScript types.",
   "keywords": [
     "whatsapp",