@aunucore/baileys 1.0.83 → 1.0.85

package/lib/Socket/chats.js

@@ -1,4 +1,3 @@
-import NodeCache from '@cacheable/node-cache';
 import { Boom } from '@hapi/boom';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CACHE_TTLS, PROCESSABLE_HISTORY_TYPES } from '../Defaults/index.js';
@@ -6,6 +5,7 @@ import { ALL_WA_PATCH_NAMES } from '../Types/index.js';
 import { SyncState } from '../Types/State.js';
 import { chatModificationToAppPatch, decodePatches, decodeSyncdSnapshot, encodeSyncdPatch, extractSyncdPatches, generateProfilePicture, getHistoryMsg, newLTHashState, processSyncAction } from '../Utils/index.js';
 import { makeMutex } from '../Utils/make-mutex.js';
+import { makeBoundedTTLCache } from '../Utils/bounded-cache.js';
 import processMessage from '../Utils/process-message.js';
 import { getBinaryNodeChild, getBinaryNodeChildren, isJidUser, isLidUser, jidDecode, jidNormalizedUser, reduceBinaryNodeToDictionary, S_WHATSAPP_NET } from '../WABinary/index.js';
 import { USyncQuery, USyncUser } from '../WAUSync/index.js';
@@ -24,10 +24,16 @@ export const makeChatsSocket = (config) => {
     // Timeout for AwaitingInitialSync state
     let awaitingSyncTimeout;
     const placeholderResendCache = config.placeholderResendCache ||
-        new NodeCache({
-            stdTTL: DEFAULT_CACHE_TTLS.MSG_RETRY, // 1 hour
-            useClones: false
-        });
+        // AunuBaileys (1.0.84, HB-231): in the standard
+        // makeWASocket composition this factory runs BEFORE
+        // messages-recv creates its own default, and the
+        // write-back below means the instance created HERE is
+        // the one the whole receive path actually uses. It used
+        // to be a NodeCache with no size cap, silently shadowing
+        // the bounded default messages-recv intended ("bounded
+        // by default — a TTL alone lets these grow without
+        // limit"). Build the same bounded cache here.
+        makeBoundedTTLCache({ ttlSeconds: DEFAULT_CACHE_TTLS.MSG_RETRY, maxEntries: 1000 });
     if (!config.placeholderResendCache) {
         config.placeholderResendCache = placeholderResendCache;
     }

package/lib/Store/make-in-memory-store.js

@@ -1,7 +1,7 @@
 // AunuCore fork backport: in-memory store dari Baileys 6.6.0, dikonversi ke ESM untuk basis 6.7.x
 import KeyedDBModule from '@adiwajshing/keyed-db';
 const KeyedDB = KeyedDBModule.default || KeyedDBModule;
-import { readFileSync, writeFileSync, existsSync } from 'fs';
+import { readFileSync, writeFileSync, existsSync, renameSync } from 'fs';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CONNECTION_CONFIG } from '../Defaults/index.js';
 import { LabelAssociationType } from '../Types/LabelAssociation.js';
@@ -131,6 +131,16 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             for (const update of updates) {
                 if (contacts[update.id]) {
                     Object.assign(contacts[update.id], update);
+                    // AunuBaileys (1.0.84, HB-245): a picture
+                    // notification arrives as imgUrl 'changed' /
+                    // 'removed' — a sentinel, not a URL. Drop the
+                    // cached URL instead of storing the sentinel:
+                    // fetchImageUrl used to hand the literal string
+                    // 'changed' to the host as the avatar URL, and
+                    // writeToFile persisted the poison to disk.
+                    if (update.imgUrl === 'changed' || update.imgUrl === 'removed') {
+                        delete contacts[update.id].imgUrl;
+                    }
                 }
                 else {
                     logger.debug({ update }, 'got update for non-existant contact');
@@ -258,7 +268,18 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             if (metadata) {
                 switch (action) {
                     case 'add':
-                        metadata.participants.push(...participants.map(id => ({ id, isAdmin: false, isSuperAdmin: false })));
+                        // AunuBaileys (1.0.84, HB-237): skip ids
+                        // that are already listed. The metadata is
+                        // usually populated by a fetch that already
+                        // contains the member, and a redelivery
+                        // replays the notification — both used to
+                        // push a duplicate entry every single time,
+                        // without bound.
+                        for (const participantId of participants) {
+                            if (!metadata.participants.some(p => p.id === participantId)) {
+                                metadata.participants.push({ id: participantId, isAdmin: false, isSuperAdmin: false });
+                            }
+                        }
                         break;
                     case 'demote':
                     case 'promote':
@@ -301,14 +322,43 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
         labelAssociations
     });
     const fromJSON = (json) => {
-        chats.upsert(...json.chats);
-        labelAssociations.upsert(...json.labelAssociations || []);
-        contactsUpsert(Object.values(json.contacts));
-        labelsUpsert(Object.values(json.labels || {}));
-        for (const jid in json.messages) {
+        // AunuBaileys (1.0.84, HB-134 + HB-142 + addenda): every
+        // stage — and every entry — is isolated. One poisoned
+        // message entry used to throw out of fromJSON mid-loop:
+        // that jid's remaining messages and EVERY later jid were
+        // silently lost on every boot, while the stages before
+        // the throw stayed applied and readFromFile logged
+        // "starting with an empty store" — a claim the state did
+        // not match. A missing/null contacts stage threw the
+        // same way (Object.values of undefined), and a poisoned
+        // contacts/labels entry aborted every stage after it.
+        // Wrong-typed stages now read as empty, unusable entries
+        // are skipped, and a bad message entry is caught per
+        // entry with a warning — the healthy remainder of the
+        // file always loads.
+        if (!json || typeof json !== 'object') {
+            return;
+        }
+        const entriesOf = (value) => (Array.isArray(value) ? value : []).filter(e => !!e && typeof e === 'object');
+        const valuesOf = (value) => (value && typeof value === 'object' ? Object.values(value) : []);
+        chats.upsert(...entriesOf(json.chats));
+        labelAssociations.upsert(...entriesOf(json.labelAssociations));
+        contactsUpsert(valuesOf(json.contacts).filter(c => !!c && typeof c === 'object' && typeof c.id === 'string'));
+        labelsUpsert(valuesOf(json.labels).filter(l => !!l && typeof l === 'object' && typeof l.id === 'string'));
+        const messageSets = json.messages && typeof json.messages === 'object' ? json.messages : {};
+        for (const jid in messageSets) {
+            const entries = messageSets[jid];
+            if (!Array.isArray(entries)) {
+                continue;
+            }
             const list = assertMessageList(jid);
-            for (const msg of json.messages[jid]) {
-                list.upsert(proto.WebMessageInfo.fromObject(msg), 'append');
+            for (const msg of entries) {
+                try {
+                    list.upsert(proto.WebMessageInfo.fromObject(msg), 'append');
+                }
+                catch (err) {
+                    logger.warn({ jid, err }, 'aunu: skipped an unreadable message entry while loading the store');
+                }
             }
         }
     };
@@ -329,6 +379,16 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             const cursorKey = !!cursor ? ('before' in cursor ? cursor.before : cursor.after) : undefined;
             const cursorValue = cursorKey ? list.get(cursorKey.id) : undefined;
             let messages;
+            // AunuBaileys (1.0.84, HB-177): a count of 0 means
+            // "no messages" — the slicing below used
+            // slice(-count), and slice(-0) is slice(0), so
+            // loadMessages(jid, 0) returned the chat's ENTIRE
+            // history (and negative counts mis-sliced as well).
+            // Every other path in this function already resolves
+            // to []. An absent count keeps the legacy behaviour.
+            if (typeof count === 'number' && count <= 0) {
+                return [];
+            }
             if (list && mode === 'before' && (!cursorKey || cursorValue)) {
                 if (cursorValue) {
                     const msgIdx = list.array.findIndex(m => m.key.id === (cursorKey === null || cursorKey === void 0 ? void 0 : cursorKey.id));
@@ -386,7 +446,13 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
             if (!contact) {
                 return sock === null || sock === void 0 ? void 0 : sock.profilePictureUrl(jid);
             }
-            if (typeof contact.imgUrl === 'undefined') {
+            // AunuBaileys (1.0.84, HB-245): a store file written
+            // before this fix can still carry the 'changed' /
+            // 'removed' sentinel as imgUrl — treat it as no
+            // cached URL and fetch fresh; never hand a sentinel
+            // back as an avatar URL. A real cached URL is still
+            // returned as-is (and a fresh fetch re-caches it).
+            if (typeof contact.imgUrl === 'undefined' || contact.imgUrl === 'changed' || contact.imgUrl === 'removed') {
                 contact.imgUrl = await (sock === null || sock === void 0 ? void 0 : sock.profilePictureUrl(jid));
             }
             return contact.imgUrl;
@@ -419,7 +485,17 @@ const makeInMemoryStore = ({ logger: _logger, chatKey, labelAssociationKey }) =>
         writeToFile: (path) => {
             // require fs here so that in case "fs" is not available -- the app does not crash
             
-            writeFileSync(path, JSON.stringify(toJSON()));
+            // AunuBaileys (1.0.84, HB-120 + addendum): every
+            // other persistence writer in the lib is atomic and
+            // 0600 (auth files HB-116, the lid store); this one
+            // wrote the full chat/contact/message history
+            // world-readable AND non-atomically — a crash
+            // mid-write left a truncated file the next boot read
+            // as corrupt and discarded wholesale. Write a
+            // per-pid temp file, then rename it over the target.
+            const tmpPath = `${path}.tmp-${process.pid}`;
+            writeFileSync(tmpPath, JSON.stringify(toJSON()), { mode: 0o600 });
+            renameSync(tmpPath, path);
         },
         readFromFile: (path) => {
             // require fs here so that in case "fs" is not available -- the app does not crash

package/lib/Utils/auth-utils.js

@@ -16,11 +16,35 @@ export function makeCacheableSignalKeyStore(store, logger, _cache) {
         new NodeCache({
             stdTTL: DEFAULT_CACHE_TTLS.SIGNAL_STORE, // 5 minutes
             useClones: false,
-            deleteOnExpire: true
+            deleteOnExpire: true,
+            // AunuBaileys (1.0.84, HB-199): a TTL bounds an
+            // entry's AGE, not the entry COUNT — a burst of
+            // distinct sender addresses inside the 5-minute
+            // window grew this cache without limit (the exact
+            // warning written in bounded-cache.js). Cap the
+            // number of keys as well. NOTE: NodeCache's maxKeys
+            // does not evict — set() THROWS once the cap is hit —
+            // so every cache write below goes through cacheSet,
+            // which swallows that one error: the underlying store
+            // is authoritative, a skipped cache entry only costs
+            // a re-read, and the cap can never break a session
+            // operation.
+            maxKeys: 1000
         });
     function getUniqueId(type, id) {
         return `${type}.${id}`;
     }
+    // AunuBaileys (1.0.84, HB-199): see the maxKeys note above —
+    // a full cache must degrade to "not cached", never to a throw
+    // escaping into get()/set().
+    function cacheSet(key, value) {
+        try {
+            cache.set(key, value);
+        }
+        catch {
+            // cache is at its key cap; the store stays authoritative
+        }
+    }
     return {
         async get(type, ids) {
             const data = {};
@@ -41,7 +65,7 @@ export function makeCacheableSignalKeyStore(store, logger, _cache) {
                     const item = fetched[id];
                     if (item) {
                         data[id] = item;
-                        cache.set(getUniqueId(type, id), item);
+                        cacheSet(getUniqueId(type, id), item);
                     }
                 }
             }
@@ -67,7 +91,7 @@ export function makeCacheableSignalKeyStore(store, logger, _cache) {
                         cache.del(getUniqueId(type, id));
                     }
                     else {
-                        cache.set(getUniqueId(type, id), data[type][id]);
+                        cacheSet(getUniqueId(type, id), data[type][id]);
                     }
                     keys += 1;
                 }

package/lib/Utils/baileys-event-stream.js

@@ -1,6 +1,6 @@
 import EventEmitter from 'events';
 import { createReadStream } from 'fs';
-import { writeFile } from 'fs/promises';
+import { rename, writeFile } from 'fs/promises';
 import { createInterface } from 'readline';
 import { delay } from './generics.js';
 import { makeMutex } from './make-mutex.js';
@@ -13,13 +13,48 @@ export const captureEventStream = (ev, filename) => {
     const oldEmit = ev.emit;
     // write mutex so data is appended in order
     const writeMutex = makeMutex();
+    // AunuBaileys (1.0.84, HB-247): a creds.update payload is the
+    // full credential material (private noise / identity /
+    // signed-pre-key bytes, the adv secret). The capture below
+    // redacts it to the NAMES of the fields that changed, creates
+    // the file 0600, and rotates it to `<filename>.1` once per
+    // 10 MiB so a long-running debug capture cannot grow (or
+    // leak) without bound.
+    let capturedBytes = 0;
+    const MAX_CAPTURE_BYTES = 10 * 1024 * 1024;
     // monkey patch eventemitter to capture all events
     ev.emit = function (...args) {
-        const content = JSON.stringify({ timestamp: Date.now(), event: args[0], data: args[1] }) + '\n';
         const result = oldEmit.apply(ev, args);
+        let content;
+        try {
+            const data = args[0] === 'creds.update' && args[1] && typeof args[1] === 'object'
+                ? { redacted: 'creds.update payload withheld (credential material)', updatedFields: Object.keys(args[1]) }
+                : args[1];
+            content = JSON.stringify({ timestamp: Date.now(), event: args[0], data }) + '\n';
+        }
+        catch {
+            // AunuBaileys (1.0.84, HB-129 addendum): an
+            // unserialisable (circular) payload used to throw
+            // synchronously out of the patched emit — into
+            // whatever lib code had emitted the event — because
+            // the stringify ran before oldEmit. Serialisation now
+            // happens after the real emit, and a payload that
+            // cannot be serialised is simply not captured.
+            return result;
+        }
+        // AunuBaileys (1.0.84, HB-129): the mutex promise used to
+        // be discarded — a failed write (deleted directory, full
+        // disk, permissions) rejected with no handler attached
+        // and crashed the host process (Node >= 15 default). A
+        // debug capture must never take the host down with it.
         writeMutex.mutex(async () => {
-            await writeFile(filename, content, { flag: 'a' });
-        });
+            capturedBytes += Buffer.byteLength(content);
+            if (capturedBytes > MAX_CAPTURE_BYTES) {
+                capturedBytes = Buffer.byteLength(content);
+                await rename(filename, `${filename}.1`).catch(() => { });
+            }
+            await writeFile(filename, content, { flag: 'a', mode: 0o600 });
+        }).catch(() => { });
         return result;
     };
 };

package/lib/Utils/event-buffer.js

@@ -45,11 +45,25 @@ export const makeEventBuffer = (logger) => {
             // had to run. Log the error and keep dispatching the
             // remaining events of the batch; the event itself
             // still fired, with its payload unchanged.
-            try {
-                ev.emit(event, map[event]);
-            }
-            catch (err) {
-                logger.error({ err, event }, 'error in event listener — dispatch continues');
+            //
+            // AunuBaileys (1.0.84, HB-264): dispatch PER LISTENER.
+            // A single ev.emit stops at the first listener that
+            // throws, so every listener registered AFTER the
+            // thrower silently missed that emit — a throwing
+            // logging listener registered before the host's
+            // saveCreds made that credential update vanish.
+            // rawListeners returns the once-wrappers themselves,
+            // so once semantics are preserved, and each listener
+            // gets its own guard: a throw now costs only the
+            // listener that threw.
+            const listeners = ev.rawListeners(event);
+            for (const listener of listeners) {
+                try {
+                    listener.call(ev, map[event]);
+                }
+                catch (err) {
+                    logger.error({ err, event }, 'error in event listener — dispatch continues');
+                }
             }
         }
     });
@@ -65,6 +79,17 @@ export const makeEventBuffer = (logger) => {
         }
         logger.debug('Flushing event buffer');
         isBuffering = false;
+        // AunuBaileys (1.0.84, HB-130 + addendum): the history
+        // dedup set only has to live for ONE buffering session.
+        // It used to survive every flush (cleared only in
+        // destroy()), so a second history sync inside the same
+        // socket lifetime silently dropped every already-known
+        // chat — and every already-known message key, even when
+        // that message's content had changed: fresh unread
+        // counts and edits never reached the store. Dedup for
+        // THIS session's appends already happened above; the
+        // next session starts empty.
+        historyCache.clear();
         const newData = makeBufferData();
         const chatUpdates = Object.values(data.chatUpdates);
         let conditionalChatUpdatesLeft = 0;
@@ -305,7 +330,14 @@ eventData, logger) {
                     data.contactUpserts[contact.id] = upsert;
                 }
                 if (data.contactUpdates[contact.id]) {
-                    upsert = Object.assign(data.contactUpdates[contact.id], trimUndefined(contact));
+                    // AunuBaileys (1.0.84, HB-182): the pending
+                    // update merges INTO the upsert. The old
+                    // direction merged the contact into the pending
+                    // update object and then deleted that object —
+                    // the merged result went nowhere, and fields
+                    // only the update carried (notify, verifiedName)
+                    // silently vanished from the flushed upsert.
+                    Object.assign(upsert, data.contactUpdates[contact.id]);
                     delete data.contactUpdates[contact.id];
                 }
             }

package/lib/Utils/generics.js

@@ -46,7 +46,26 @@ export const BufferJSON = {
     reviver: (_, value) => {
         if (typeof value === 'object' && !!value && (value.buffer === true || value.type === 'Buffer')) {
             const val = value.data || value.value;
-            return typeof val === 'string' ? Buffer.from(val, 'base64') : Buffer.from(val || []);
+            if (typeof val === 'string') {
+                // AunuBaileys (1.0.84, HB-143): Node's base64
+                // decoder is lenient — it silently DROPS
+                // characters outside the alphabet, so a garbage
+                // or hand-mangled string in a creds/key file
+                // decoded to wrong-length, wrong-value key bytes
+                // with no error anywhere, and the corruption only
+                // surfaced later as baffling Curve / handshake
+                // failures. The replacer above only ever produces
+                // canonical base64; reject anything else loudly.
+                // Both in-tree readers contain the throw: the
+                // auth-state reader logs a corrupt file and starts
+                // clean, and the sender-key reader falls back to
+                // an empty (self-healing) record.
+                if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(val)) {
+                    throw new Error('BufferJSON: invalid base64 in serialized Buffer data');
+                }
+                return Buffer.from(val, 'base64');
+            }
+            return Buffer.from(val || []);
         }
         return value;
     }

package/lib/Utils/index.d.ts

@@ -13,6 +13,7 @@ export * from './auth-utils.js';
 export * from './baileys-event-stream.js';
 export * from './use-multi-file-auth-state.js';
 export * from './link-preview.js';
+export * from './safe-fetch.js';
 export * from './event-buffer.js';
 export * from './process-message.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/Utils/index.js

@@ -31,6 +31,7 @@ export * from './auth-utils.js';
 export * from './baileys-event-stream.js';
 export * from './use-multi-file-auth-state.js';
 export * from './link-preview.js';
+export * from './safe-fetch.js';
 export * from './event-buffer.js';
 export * from './process-message.js';
 //# sourceMappingURL=index.js.map

package/lib/Utils/lid-store.js

@@ -169,7 +169,10 @@ export const makeLIDStore = (options = {}) => {
             // AunuBaileys (1.0.70): atomic tmp+rename — a crash mid-write
             // used to leave a truncated store file behind.
             const tmpPath = `${path}.tmp-${process.pid}`;
-            writeFileSync(tmpPath, JSON.stringify(Object.fromEntries(pnToLid)));
+            // AunuBaileys (1.0.84, HB-120): 0600, like the auth
+            // files (HB-116) — this file maps phone numbers to
+            // LIDs and must not land world-readable.
+            writeFileSync(tmpPath, JSON.stringify(Object.fromEntries(pnToLid)), { mode: 0o600 });
             renameSync(tmpPath, path);
         },
         loadFromFile: (path) => {

package/lib/Utils/link-preview.js

@@ -1,15 +1,71 @@
 import { prepareWAMessageMedia } from './messages.js';
-import { extractImageThumb, getHttpStream } from './messages-media.js';
+import { extractImageThumb } from './messages-media.js';
+import { readImageDimensions, safeHttpGet } from './safe-fetch.js';
 const THUMBNAIL_WIDTH_PX = 192;
+// AunuBaileys (1.0.85): everything in this module is fetched on behalf
+// of a REMOTE PAGE — the URL comes from message text and the og:image
+// from the fetched page itself — so all of it now goes through the
+// SSRF-safe fetch (lib/Utils/safe-fetch.js): non-public addresses are
+// refused at connect time (peer-supplied URLs used to be able to make
+// the host GET loopback / RFC1918 / cloud-metadata addresses), and
+// every response is size- and time-bounded. link-preview-js is used
+// for HTML parsing ONLY (getPreviewFromContent); it no longer
+// performs any network access, so the protections do not depend on
+// the installed link-preview-js version. This also closes HB-205:
+// the HTML body used to be read in full with no cap and no overall
+// timeout (the library's abort timer covered only time-to-headers).
+const MAX_HTML_BYTES = 1024 * 1024; // og: tags live in <head>; the rest is cut off
+const MAX_THUMBNAIL_BYTES = 5 * 1024 * 1024;
+const MAX_THUMBNAIL_PIXELS = 40000000; // refuse decompression bombs before the image library sees them
+const MAX_PREVIEW_TIMEOUT_MS = 30000;
+const HTMLISH = /^(text\/html|application\/xhtml\+xml|text\/xml|application\/xml)\b/i;
+/** Only these keys of the caller's fetchOpts are honoured now. */
+const transportOpts = (fetchOpts = {}) => ({
+    // Sanitised at the boundary: a finite positive timeout is honored
+    // (clamped to a sane preview ceiling), anything else gets the
+    // historical 3000 ms default.
+    timeout: typeof fetchOpts.timeout === 'number' && Number.isFinite(fetchOpts.timeout) && fetchOpts.timeout > 0
+        ? Math.min(fetchOpts.timeout, MAX_PREVIEW_TIMEOUT_MS)
+        : 3000,
+    headers: fetchOpts.headers,
+    // Explicit, host-controlled hooks only — never derived from
+    // message content: an opt-in for deployments that really want
+    // previews of intranet links, and resolver/policy overrides.
+    allowPrivateNetworks: fetchOpts.allowPrivateNetworks === true,
+    isBlocked: typeof fetchOpts.isBlockedAddress === 'function' ? fetchOpts.isBlockedAddress : undefined,
+    lookup: typeof fetchOpts.lookup === 'function' ? fetchOpts.lookup : undefined
+});
+const decodeBody = (body, contentType) => {
+    const charset = /charset=["']?([\w-]+)/i.exec(contentType || '')?.[1];
+    try {
+        return new TextDecoder(charset || 'utf-8').decode(body);
+    }
+    catch {
+        return new TextDecoder('utf-8').decode(body);
+    }
+};
+/** Fetches an og:image through the safe fetch, with byte + pixel bounds. */
+const fetchThumbnailBuffer = async (imageUrl, fetchOpts) => {
+    const res = await safeHttpGet(imageUrl, {
+        ...transportOpts(fetchOpts),
+        maxBytes: MAX_THUMBNAIL_BYTES,
+        onLimit: 'throw'
+    });
+    const dims = readImageDimensions(res.body);
+    if (dims && dims.width * dims.height > MAX_THUMBNAIL_PIXELS) {
+        throw new Error(`thumbnail dimensions ${dims.width}x${dims.height} exceed the safety limit`);
+    }
+    return res.body;
+};
 /** Fetches an image and generates a thumbnail for it */
-// AunuBaileys (1.0.72): an og:image only ever becomes a small JPEG —
-// cap the source download instead of buffering a hostile endless
-// stream in full (HB-89). getUrlInfo catches thumbnail errors and
-// degrades to no thumbnail.
-const MAX_THUMBNAIL_SOURCE_BYTES = 8 * 1024 * 1024;
 const getCompressedJpegThumbnail = async (url, { thumbnailWidth, fetchOpts }) => {
-    const stream = await getHttpStream(url, fetchOpts);
-    const result = await extractImageThumb(stream, thumbnailWidth, MAX_THUMBNAIL_SOURCE_BYTES);
+    // AunuBaileys (1.0.72): an og:image only ever becomes a small
+    // JPEG — cap the source download instead of buffering a hostile
+    // endless stream in full (HB-89). (1.0.85): the cap is now
+    // enforced by the safe fetch (5 MiB, throw) before the bytes
+    // reach the image library, and pixel bombs are refused up front.
+    const buffer = await fetchThumbnailBuffer(url, fetchOpts);
+    const result = await extractImageThumb(buffer, thumbnailWidth);
     return result;
 };
 /**
@@ -23,34 +79,22 @@ export const getUrlInfo = async (text, opts = {
     fetchOpts: { timeout: 3000 }
 }) => {
     try {
-        // retries
-        const retries = 0;
-        const maxRetry = 5;
-        const { getLinkPreview } = await import('link-preview-js');
+        const { getPreviewFromContent } = await import('link-preview-js');
         let previewLink = text;
         if (!text.startsWith('https://') && !text.startsWith('http://')) {
             previewLink = 'https://' + previewLink;
         }
-        const info = await getLinkPreview(previewLink, {
-            ...opts.fetchOpts,
-            followRedirects: 'follow',
-            handleRedirects: (baseURL, forwardedURL) => {
-                const urlObj = new URL(baseURL);
-                const forwardedURLObj = new URL(forwardedURL);
-                if (retries >= maxRetry) {
-                    return false;
-                }
-                if (forwardedURLObj.hostname === urlObj.hostname ||
-                    forwardedURLObj.hostname === 'www.' + urlObj.hostname ||
-                    'www.' + forwardedURLObj.hostname === urlObj.hostname) {
-                    retries + 1;
-                    return true;
-                }
-                else {
-                    return false;
-                }
-            },
-            headers: opts.fetchOpts
+        const res = await safeHttpGet(previewLink, {
+            ...transportOpts(opts.fetchOpts),
+            maxBytes: MAX_HTML_BYTES,
+            onLimit: 'truncate',
+            shouldReadBody: (_status, headers) => !headers['content-type'] || HTMLISH.test(headers['content-type'])
+        });
+        const contentType = res.headers['content-type'];
+        const info = await getPreviewFromContent({
+            url: res.url,
+            data: decodeBody(res.body, contentType),
+            headers: contentType ? { 'content-type': contentType } : {}
         });
         if (info && 'title' in info && info.title) {
             const [image] = info.images;
@@ -61,8 +105,16 @@ export const getUrlInfo = async (text, opts = {
                 description: info.description,
                 originalThumbnailUrl: image
             };
-            if (opts.uploadImage) {
-                const { imageMessage } = await prepareWAMessageMedia({ image: { url: image } }, {
+            if (opts.uploadImage && image) {
+                // AunuBaileys (1.0.85): the high-quality thumbnail is
+                // fetched through the safe fetch as a Buffer instead
+                // of handing the page-supplied URL to the generic
+                // media pipeline. The `&& image` guard also closes
+                // HB-150: a page without an og:image used to explode
+                // here with a raw TypeError and lose the whole
+                // preview.
+                const thumb = await fetchThumbnailBuffer(image, opts.fetchOpts);
+                const { imageMessage } = await prepareWAMessageMedia({ image: thumb }, {
                     upload: opts.uploadImage,
                     mediaTypeOverride: 'thumbnail-link',
                     options: opts.fetchOpts
@@ -87,4 +139,4 @@ export const getUrlInfo = async (text, opts = {
         }
     }
 };
-//# sourceMappingURL=link-preview.js.map
+//# sourceMappingURL=link-preview.js.map