@aunucore/baileys 1.0.86 → 1.0.88

package/WAProto/WAProto.proto

@@ -1779,6 +1779,7 @@ message Message {
     optional StickerPackMessage stickerPackMessage = 86;
     optional FutureProofMessage statusMentionMessage = 87;
     optional PollResultSnapshotMessage pollResultSnapshotMessage = 88;
+    optional PollResultSnapshotMessage pollResultSnapshotMessageV3 = 115;
     optional FutureProofMessage pollCreationOptionImageMessage = 90;
     optional FutureProofMessage associatedChildMessage = 91;
     optional FutureProofMessage groupStatusMentionMessage = 92;

package/WAProto/index.d.ts

@@ -18838,6 +18838,9 @@ export namespace proto {
         /** Message pollResultSnapshotMessage */
         pollResultSnapshotMessage?: (proto.Message.IPollResultSnapshotMessage|null);
 
+        /** Message pollResultSnapshotMessageV3 */
+        pollResultSnapshotMessageV3?: (proto.Message.IPollResultSnapshotMessage|null);
+
         /** Message pollCreationOptionImageMessage */
         pollCreationOptionImageMessage?: (proto.Message.IFutureProofMessage|null);
 
@@ -19118,6 +19121,9 @@ export namespace proto {
         /** Message pollResultSnapshotMessage. */
         public pollResultSnapshotMessage?: (proto.Message.IPollResultSnapshotMessage|null);
 
+        /** Message pollResultSnapshotMessageV3. */
+        public pollResultSnapshotMessageV3?: (proto.Message.IPollResultSnapshotMessage|null);
+
         /** Message pollCreationOptionImageMessage. */
         public pollCreationOptionImageMessage?: (proto.Message.IFutureProofMessage|null);
 

package/WAProto/index.js

@@ -57492,6 +57492,7 @@ export const proto = $root.proto = (() => {
          * @property {proto.Message.IStickerPackMessage|null} [stickerPackMessage] Message stickerPackMessage
          * @property {proto.Message.IFutureProofMessage|null} [statusMentionMessage] Message statusMentionMessage
          * @property {proto.Message.IPollResultSnapshotMessage|null} [pollResultSnapshotMessage] Message pollResultSnapshotMessage
+         * @property {proto.Message.IPollResultSnapshotMessage|null} [pollResultSnapshotMessageV3] Message pollResultSnapshotMessageV3
          * @property {proto.Message.IFutureProofMessage|null} [pollCreationOptionImageMessage] Message pollCreationOptionImageMessage
          * @property {proto.Message.IFutureProofMessage|null} [associatedChildMessage] Message associatedChildMessage
          * @property {proto.Message.IFutureProofMessage|null} [groupStatusMentionMessage] Message groupStatusMentionMessage
@@ -58113,7 +58114,13 @@ export const proto = $root.proto = (() => {
          * @memberof proto.Message
          * @instance
          */
-        Message.prototype.pollResultSnapshotMessage = null;
+        Message.prototype.pollResultSnapshotMessage = null;        /**
+         * Message pollResultSnapshotMessageV3.
+         * @member {proto.Message.IPollResultSnapshotMessage|null|undefined} pollResultSnapshotMessageV3
+         * @memberof proto.Message
+         * @instance
+         */
+        Message.prototype.pollResultSnapshotMessageV3 = null;
 
         /**
          * Message pollCreationOptionImageMessage.
@@ -58685,6 +58692,9 @@ export const proto = $root.proto = (() => {
         Object.defineProperty(Message.prototype, "_pollResultSnapshotMessage", {
             get: $util.oneOfGetter($oneOfFields = ["pollResultSnapshotMessage"]),
             set: $util.oneOfSetter($oneOfFields)
+        });        Object.defineProperty(Message.prototype, "_pollResultSnapshotMessageV3", {
+            get: $util.oneOfGetter($oneOfFields = ["pollResultSnapshotMessageV3"]),
+            set: $util.oneOfSetter($oneOfFields)
         });
 
         // Virtual OneOf for proto3 optional field
@@ -58953,7 +58963,8 @@ export const proto = $root.proto = (() => {
             if (message.statusMentionMessage != null && Object.hasOwnProperty.call(message, "statusMentionMessage"))
                 $root.proto.Message.FutureProofMessage.encode(message.statusMentionMessage, writer.uint32(/* id 87, wireType 2 =*/698).fork()).ldelim();
             if (message.pollResultSnapshotMessage != null && Object.hasOwnProperty.call(message, "pollResultSnapshotMessage"))
-                $root.proto.Message.PollResultSnapshotMessage.encode(message.pollResultSnapshotMessage, writer.uint32(/* id 88, wireType 2 =*/706).fork()).ldelim();
+                $root.proto.Message.PollResultSnapshotMessage.encode(message.pollResultSnapshotMessage, writer.uint32(/* id 88, wireType 2 =*/706).fork()).ldelim();            if (message.pollResultSnapshotMessageV3 != null && Object.hasOwnProperty.call(message, "pollResultSnapshotMessageV3"))
+                $root.proto.Message.PollResultSnapshotMessage.encode(message.pollResultSnapshotMessageV3, writer.uint32(/* id 115, wireType 2 =*/922).fork()).ldelim();
             if (message.pollCreationOptionImageMessage != null && Object.hasOwnProperty.call(message, "pollCreationOptionImageMessage"))
                 $root.proto.Message.FutureProofMessage.encode(message.pollCreationOptionImageMessage, writer.uint32(/* id 90, wireType 2 =*/722).fork()).ldelim();
             if (message.associatedChildMessage != null && Object.hasOwnProperty.call(message, "associatedChildMessage"))
@@ -59314,6 +59325,9 @@ export const proto = $root.proto = (() => {
                 case 88: {
                         message.pollResultSnapshotMessage = $root.proto.Message.PollResultSnapshotMessage.decode(reader, reader.uint32());
                         break;
+                    }                case 115: {
+                        message.pollResultSnapshotMessageV3 = $root.proto.Message.PollResultSnapshotMessage.decode(reader, reader.uint32());
+                        break;
                     }
                 case 90: {
                         message.pollCreationOptionImageMessage = $root.proto.Message.FutureProofMessage.decode(reader, reader.uint32());
@@ -60002,6 +60016,13 @@ export const proto = $root.proto = (() => {
                     if (error)
                         return "pollResultSnapshotMessage." + error;
                 }
+            }            if (message.pollResultSnapshotMessageV3 != null && message.hasOwnProperty("pollResultSnapshotMessageV3")) {
+                properties._pollResultSnapshotMessageV3 = 1;
+                {
+                    let error = $root.proto.Message.PollResultSnapshotMessage.verify(message.pollResultSnapshotMessageV3);
+                    if (error)
+                        return "pollResultSnapshotMessageV3." + error;
+                }
             }
             if (message.pollCreationOptionImageMessage != null && message.hasOwnProperty("pollCreationOptionImageMessage")) {
                 properties._pollCreationOptionImageMessage = 1;
@@ -60511,6 +60532,10 @@ export const proto = $root.proto = (() => {
                 if (typeof object.pollResultSnapshotMessage !== "object")
                     throw TypeError(".proto.Message.pollResultSnapshotMessage: object expected");
                 message.pollResultSnapshotMessage = $root.proto.Message.PollResultSnapshotMessage.fromObject(object.pollResultSnapshotMessage);
+            }            if (object.pollResultSnapshotMessageV3 != null) {
+                if (typeof object.pollResultSnapshotMessageV3 !== "object")
+                    throw TypeError(".proto.Message.pollResultSnapshotMessageV3: object expected");
+                message.pollResultSnapshotMessageV3 = $root.proto.Message.PollResultSnapshotMessage.fromObject(object.pollResultSnapshotMessageV3);
             }
             if (object.pollCreationOptionImageMessage != null) {
                 if (typeof object.pollCreationOptionImageMessage !== "object")
@@ -60976,6 +61001,10 @@ export const proto = $root.proto = (() => {
                 object.pollResultSnapshotMessage = $root.proto.Message.PollResultSnapshotMessage.toObject(message.pollResultSnapshotMessage, options);
                 if (options.oneofs)
                     object._pollResultSnapshotMessage = "pollResultSnapshotMessage";
+            }            if (message.pollResultSnapshotMessageV3 != null && message.hasOwnProperty("pollResultSnapshotMessageV3")) {
+                object.pollResultSnapshotMessageV3 = $root.proto.Message.PollResultSnapshotMessage.toObject(message.pollResultSnapshotMessageV3, options);
+                if (options.oneofs)
+                    object._pollResultSnapshotMessageV3 = "pollResultSnapshotMessageV3";
             }
             if (message.pollCreationOptionImageMessage != null && message.hasOwnProperty("pollCreationOptionImageMessage")) {
                 object.pollCreationOptionImageMessage = $root.proto.Message.FutureProofMessage.toObject(message.pollCreationOptionImageMessage, options);

package/lib/Signal/Group/group-session-builder.js

@@ -38,6 +38,28 @@ export class GroupSessionBuilder {
             senderKeyRecord.setSenderKeyState(keyId, 0, senderKey, signingKey);
             await this.senderKeyStore.storeSenderKey(senderKeyName, senderKeyRecord);
         }
+        else {
+            // AunuBaileys (1.0.88, HB-124 addendum): a stored OWN
+            // state whose signing key has no PRIVATE half can never
+            // encrypt — GroupCipher's calculateSignature(undefined)
+            // dies in libsignal's validatePrivKey ('Undefined
+            // private key') on EVERY group send. The load sanitiser
+            // deliberately KEEPS private-less states (a received
+            // AUTHOR state legitimately has no private half), and
+            // the branch above only regenerated an EMPTY record, so
+            // the brick was permanent until the record was cleared
+            // by hand. Replace a private-less current state with a
+            // fresh own state; the SKDM returned below distributes
+            // the new key, so peers heal on this very send.
+            const current = senderKeyRecord.getSenderKeyState();
+            if (current && !current.getSigningKeyPrivate()) {
+                const keyId = keyhelper.generateSenderKeyId();
+                const senderKey = keyhelper.generateSenderKey();
+                const signingKey = keyhelper.generateSenderSigningKey();
+                senderKeyRecord.setSenderKeyState(keyId, 0, senderKey, signingKey);
+                await this.senderKeyStore.storeSenderKey(senderKeyName, senderKeyRecord);
+            }
+        }
         const state = senderKeyRecord.getSenderKeyState();
         if (!state) {
             throw new Error('No session state available');

package/lib/Signal/Group/sender-key-record.js

@@ -38,7 +38,13 @@ const sanitizeSenderKeyStructure = (structure) => {
         return null;
     }
     const iteration = storedCountToNumber(chainKey.iteration);
-    if (iteration === null) {
+    // AunuBaileys (1.0.88, HB-202): a NEGATIVE iteration passes the
+    // integer check above, but protobufjs encodes the field as
+    // uint32 — it wraps (-5 -> 4294967291), so peers fail every
+    // message from this state until a 3-strike resync heals it.
+    // The finite/integer check alone cannot see this; reject
+    // negatives exactly like missing values.
+    if (iteration === null || iteration < 0) {
         return null;
     }
     const signingPublic = storedSeedToBuffer(signingKey.public);
@@ -68,7 +74,9 @@ const sanitizeSenderKeyStructure = (structure) => {
             }
             const mkIteration = storedCountToNumber(entry.iteration);
             const mkSeed = storedSeedToBuffer(entry.seed);
-            if (mkIteration === null || !mkSeed || mkSeed.length !== 32) {
+            // (1.0.88, HB-202): negative message-key iterations wrap
+            // on the wire the same way — skip those entries too.
+            if (mkIteration === null || mkIteration < 0 || !mkSeed || mkSeed.length !== 32) {
                 continue;
             }
             messageKeys.push({ iteration: mkIteration, seed: mkSeed });

package/lib/Signal/libsignal.js

@@ -92,7 +92,22 @@ export function makeLibSignalRepository(auth) {
             const chained = prev.then(run);
             // the stored chain must never stay rejected, or one failed
             // send would poison every later send to the group
-            groupEncryptChains.set(group, chained.catch(() => { }));
+            const stored = chained.catch(() => { });
+            groupEncryptChains.set(group, stored);
+            // AunuBaileys (1.0.88, HB-256): the map used to keep one
+            // entry per group FOREVER (a settled promise + the group
+            // string, ~81 bytes each — small, but unbounded over the
+            // socket's life: 6000 groups measured +477 KiB retained
+            // after every store record was gone). Drop the entry
+            // once its chain settles; the identity check protects a
+            // NEWER chain for the same group from being deleted by
+            // an older one, and `stored` never rejects, so this
+            // cannot float an unhandled rejection.
+            stored.then(() => {
+                if (groupEncryptChains.get(group) === stored) {
+                    groupEncryptChains.delete(group);
+                }
+            });
             return chained;
         },
         async deleteSenderKey(group, authorJid) {

package/lib/Socket/chats.js

@@ -82,8 +82,30 @@ export const makeChatsSocket = (config) => {
         // AunuBaileys (1.0.71): a privacy change is a settings change —
         // refetch the full set (the cached copy is now stale) and publish
         // it (donor event: violetix 'privacy.update' on account_sync).
-        privacySettings = await fetchPrivacySettings(true);
-        ev.emit('privacy.update', privacySettings);
+        // AunuBaileys (1.0.87, HB-163): the SET above has already
+        // been applied by the server when this refetch runs. A
+        // refetch failure used to reject the whole privacyQuery —
+        // the caller saw a failed update that had in fact taken
+        // effect, the cache kept the OLD value, and readMessages
+        // derived its receipt type from that stale cache (sending
+        // 'read' receipts against a receipts setting the user had
+        // just switched off). Make the refetch best-effort: on
+        // failure, fold the applied change into the cached copy so
+        // cache and event reflect what the server now holds for
+        // this key. Never fabricate a partial cache when none
+        // exists — that would suppress the next full fetch.
+        try {
+            privacySettings = await fetchPrivacySettings(true);
+        }
+        catch (err) {
+            logger.warn({ err, name, value }, 'failed to refetch privacy settings after a successful set; folding the change into the cached copy');
+            if (privacySettings) {
+                privacySettings = { ...privacySettings, [name]: value };
+            }
+        }
+        if (privacySettings) {
+            ev.emit('privacy.update', privacySettings);
+        }
     };
     const updateMessagesPrivacy = async (value) => {
         await privacyQuery('messages', value);
@@ -946,11 +968,35 @@ export const makeChatsSocket = (config) => {
         const doAppStateSync = async () => {
             if (syncState === SyncState.Syncing) {
                 logger.info('Doing app state sync');
-                await resyncAppState(ALL_WA_PATCH_NAMES, true);
-                // Sync is complete, go online and flush everything
+                // AunuBaileys (1.0.87, HB-241): resyncAppState can
+                // throw OUTSIDE its per-collection handling — the
+                // sync IQ itself, a malformed blob in
+                // extractSyncdPatches, the resync-round cap. That
+                // throw used to reject upsertMessage and leave
+                // syncState at Syncing for the rest of the session:
+                // the full initial sync was never retried (nothing
+                // re-triggers it) and the state machine never
+                // reached Online. A failed sync must END the
+                // Syncing state, not freeze it — go Online and
+                // flush either way, and only count the sync as
+                // complete (the accountSyncCounter advance below)
+                // when it actually succeeded.
+                let syncFailed = false;
+                try {
+                    await resyncAppState(ALL_WA_PATCH_NAMES, true);
+                }
+                catch (err) {
+                    syncFailed = true;
+                    logger.error({ err }, 'app state sync failed; transitioning to Online state anyway');
+                }
+                // Sync ran its course, go online and flush everything
                 syncState = SyncState.Online;
                 logger.info('App state sync complete, transitioning to Online state and flushing buffer');
                 ev.flush();
+                // (HB-241) a failed sync is not a completed one:
+                // do not advance the counter that signals the
+                // initial sync finished.
+                if (!syncFailed) {
                 const accountSyncCounter = (authState.creds.accountSyncCounter || 0) + 1;
                 // AunuBaileys (1.0.81, HB-257): same guard as the
                 // pushName emit above — a throwing 'creds.update'
@@ -963,6 +1009,7 @@ export const makeChatsSocket = (config) => {
                 catch (err) {
                     onUnexpectedError(err, 'creds.update (accountSyncCounter)');
                 }
+                }
             }
         };
         await Promise.all([

package/lib/Socket/communities.js

@@ -355,7 +355,13 @@ export const extractCommunityMetadata = (result) => {
         memberAddMode,
         participants: getBinaryNodeChildren(community, 'participant').map(({ attrs }) => {
             return {
-                id: attrs.jid,
+                // AunuBaileys (1.0.88, HB-40 addendum): the id
+                // fallback extractGroupMetadata gained for groups
+                // was never mirrored here — a participant stanza
+                // carrying only phone_number (or only lid) produced
+                // id: undefined, a participant the host cannot
+                // address. Same fallback chain as groups.js.
+                id: attrs.jid || (attrs.phone_number ? jidNormalizedUser(attrs.phone_number.includes('@') ? attrs.phone_number : attrs.phone_number + '@s.whatsapp.net') : attrs.lid) || undefined,
                 admin: (attrs.type || null)
             };
         }),

package/lib/Socket/messages-recv.js

@@ -965,7 +965,24 @@ export const makeMessagesRecvSocket = (config) => {
                 logger.warn({ msgId: key.id }, 'aunu: cannot request placeholder resend before pairing completes; skipping');
             }
             else {
-                response = await requestPlaceholderResend(key);
+                // AunuBaileys (1.0.88, HB-260): this was the ONLY
+                // requestPlaceholderResend call site awaited WITHOUT
+                // a handler (the other two are fire-and-forget with
+                // catches). A transport failure inside it (the PDO
+                // send throws 'Not authenticated' / 'Connection
+                // Closed' / a timeout) escaped to the caller's
+                // logger — and since the ack above had already gone
+                // out, the placeholder vanished silently: no
+                // redelivery will ever come, and the main decrypt
+                // path below (which upserts the placeholder stub)
+                // never ran. Log the failure and fall through to
+                // that path, like the decode guard above does.
+                try {
+                    response = await requestPlaceholderResend(key);
+                }
+                catch (resendErr) {
+                    logger.warn({ err: resendErr, msgId: key.id }, 'aunu: placeholder resend request failed; continuing to the main message path');
+                }
             }
             if (response === 'RESOLVED') {
                 return;
@@ -1771,7 +1788,14 @@ export const makeMessagesRecvSocket = (config) => {
         }
         const operation = data?.operation;
         const updates = data?.updates;
-        if (!updates || !operation) {
+        // AunuBaileys (1.0.87, HB-121): this guard used to be a
+        // truthiness check only — a MEX payload whose `updates`
+        // is a non-array (object/number/boolean) passed it, and
+        // the for...of loops in every switch branch below threw a
+        // TypeError, silently dropping the whole notification
+        // (handleNotification acks the stanza in its finally
+        // either way, so nothing ever retried it).
+        if (!Array.isArray(updates) || !operation) {
             logger.warn({ data }, 'Invalid mex newsletter notification content');
             return;
         }

package/lib/Socket/messages-send.js

@@ -142,9 +142,26 @@ export const makeMessagesSocket = (config) => {
     };
     /** Bulk read messages. Keys can be from different chats & participants */
     const readMessages = async (keys) => {
-        const privacySettings = await fetchPrivacySettings();
+        // AunuBaileys (1.0.88, HB-261): the privacy fetch was awaited
+        // bare — on a COLD cache it runs a real IQ, and when that IQ
+        // failed (error stanza, timeout, closing socket)
+        // readMessages rejected BEFORE sendReceipts ran: zero
+        // receipts sent, the messages stayed unread, and the host
+        // could not tell "partially sent" from "nothing sent" (it
+        // was always nothing). The fetch is best-effort now: a warm
+        // cache answers without an IQ anyway, and on failure we fall
+        // back to the default 'read' type rather than dropping the
+        // receipts entirely. (Not HB-163: that was the SET-then-
+        // refetch path in chats.js; this is the read-side consumer.)
+        let privacySettings;
+        try {
+            privacySettings = await fetchPrivacySettings();
+        }
+        catch (err) {
+            logger.warn({ err }, 'aunu: privacy settings fetch failed in readMessages; sending plain read receipts');
+        }
         // based on privacy settings, we have to change the read type
-        const readType = privacySettings.readreceipts === 'all' ? 'read' : 'read-self';
+        const readType = !privacySettings || privacySettings.readreceipts === 'all' ? 'read' : 'read-self';
         await sendReceipts(keys, readType);
     };
     /** Fetch all the devices we've to send a message to */
@@ -268,6 +285,21 @@ export const makeMessagesSocket = (config) => {
     };
     const createParticipantNodes = async (jids, message, extraAttrs) => {
         let patched = await patchMessageBeforeSending(message, jids);
+        // AunuBaileys (1.0.88, HB-267): a patch hook returning an
+        // EMPTY ARRAY used to slip past the 'All encryptions failed'
+        // guard below (its condition requires patched.length), so
+        // the send produced zero nodes and relayMessage resolved —
+        // a stanza with no content went out as a success (the
+        // silent-empty class of HB-253; HB-136 closed the
+        // missing-recipientJid sibling in 1.0.86, HB-212 the
+        // newsletter-branch array). An empty patch for a NON-empty
+        // jid list is a host bug: fail loudly. (An empty JID list is
+        // the one legitimate empty case — a participant-targeted
+        // relay calls this for the side that has no recipients —
+        // and still returns zero nodes.)
+        if (Array.isArray(patched) && !patched.length && jids?.length) {
+            throw new Boom('patchMessageBeforeSending returned an empty array; refusing to send an empty message', { statusCode: 400 });
+        }
         if (!Array.isArray(patched)) {
             patched = jids ? jids.map(jid => ({ recipientJid: jid, ...patched })) : [patched];
         }
@@ -530,6 +562,19 @@ export const makeMessagesSocket = (config) => {
                     }
                     const additionalDevices = await getUSyncDevices(participantsList, !!useUserDevicesCache, false);
                     devices.push(...additionalDevices);
+                    // AunuBaileys (1.0.88, HB-266): ZERO resolved
+                    // devices used to fall through — the stanza
+                    // went out carrying only the sender-key
+                    // ciphertext (an empty participants list adds
+                    // no <participants> node below), nobody received
+                    // the sender key, nobody could decrypt, and
+                    // relayMessage still resolved with a message id
+                    // as if delivered. Mirror the HB-147 call-path
+                    // guard: an undeliverable group/status/broadcast
+                    // send fails loudly instead.
+                    if (!devices.length) {
+                        throw new Boom('relayMessage: no recipient devices resolved for this group/status message (empty participant list or empty status audience); refusing to send an undeliverable message', { statusCode: 400 });
+                    }
                 }
                 const patched = await patchMessageBeforeSending(message);
                 if (Array.isArray(patched)) {

package/lib/Socket/mex.js

@@ -22,11 +22,29 @@ export const executeWMexQuery = async (variables, queryId, dataPath, query, gene
     const result = await wMexQuery(variables, queryId, query, generateMessageTag);
     const child = getBinaryNodeChild(result, 'result');
     if (child?.content) {
-        const data = JSON.parse(child.content.toString());
+        // AunuBaileys (1.0.87, HB-211): a <result> that is not JSON
+        // (including a child-node array body, which stringifies to
+        // "[object Object]") used to reject with a raw SyntaxError
+        // the host could not classify.
+        let data;
+        try {
+            data = JSON.parse(child.content.toString());
+        }
+        catch (err) {
+            throw new Boom('GraphQL server error: unparseable response', { statusCode: 400, data: result });
+        }
         if (data.errors && data.errors.length > 0) {
             const errorMessages = data.errors.map((err) => err.message || 'Unknown error').join(', ');
             const firstError = data.errors[0];
-            const errorCode = firstError.extensions?.error_code || 400;
+            // AunuBaileys (1.0.87, HB-211): the server's error_code
+            // went into the Boom constructor unsanitised — a string
+            // code ('RATE_LIMITED') or an out-of-range one (200)
+            // made `new Boom` itself throw a non-Boom TypeError,
+            // and the server's actual error message was lost with
+            // it. Same sanitation as HB-42: only a numeric HTTP
+            // error code survives, everything else becomes 400.
+            const rawErrorCode = firstError.extensions?.error_code;
+            const errorCode = typeof rawErrorCode === 'number' && rawErrorCode >= 400 && rawErrorCode <= 599 ? rawErrorCode : 400;
             throw new Boom(`GraphQL server error: ${errorMessages}`, { statusCode: errorCode, data: firstError });
         }
         const response = dataPath ? data?.data?.[dataPath] : data?.data;

package/lib/Socket/socket.js

@@ -194,7 +194,28 @@ export const makeSocket = (config) => {
             node.attrs.id = generateMessageTag();
         }
         const msgId = node.attrs.id;
-        const [result] = await Promise.all([waitForMessage(msgId, timeoutMs), sendNode(node)]);
+        // AunuBaileys (1.0.88, HB-123): sendNode encodes SYNCHRONOUSLY
+        // — when encodeBinaryNode throws (a malformed node from any
+        // caller), the old Promise.all([...]) expression evaluated
+        // waitForMessage FIRST and sendNode second, so the throw
+        // escaped before Promise.all was ever invoked: the wait
+        // promise kept its ws listeners and rejected 'Timed Out'
+        // after the query timeout with no handler attached — an
+        // unhandled rejection crashing the process long after the
+        // caller had handled the real (encode) error. Detach the
+        // wait when the send throws synchronously; an ASYNC send
+        // rejection is already safe (Promise.all subscribes to both
+        // promises).
+        const waitPromise = waitForMessage(msgId, timeoutMs);
+        let sendPromise;
+        try {
+            sendPromise = sendNode(node);
+        }
+        catch (err) {
+            waitPromise.catch(() => { });
+            throw err;
+        }
+        const [result] = await Promise.all([waitPromise, sendPromise]);
         if ('tag' in result) {
             assertNodeErrorFree(result);
         }
@@ -268,7 +289,26 @@ export const makeSocket = (config) => {
         // transaction, so a crash between the send and the commit left
         // the server holding pre-key IDs whose private halves were
         // never persisted ("key used already or never filled").
-        const { update, node } = await keys.transaction(async () => await getNextPreKeysNode({ creds, keys }, count));
+        // AunuBaileys (1.0.88, HB-235 + addendum): the counters
+        // advance INSIDE the transaction, and the creds.update emit
+        // fires BEFORE the upload IQ — not after it. The old order
+        // (commit the keys, await the IQ for up to 30s, only then
+        // emit/advance) let a second upload starting during the
+        // first IQ read the STALE counters and regenerate the SAME
+        // ids with NEW material, overwriting batch 1's private keys
+        // in the store; if IQ 2 (or IQ 1 itself, on a plain timeout
+        // — the addendum facet) then failed, the server held batch 1
+        // publics over batch 2 privates and the range was never
+        // regenerated. Advancing under the transaction mutex makes
+        // concurrent uploads take disjoint ranges; a failed or
+        // timed-out IQ now only wastes an id range (the server-count
+        // check uploads a fresh range next time).
+        const { update, node } = await keys.transaction(async () => {
+            const result = await getNextPreKeysNode({ creds, keys }, count);
+            Object.assign(creds, result.update);
+            return result;
+        });
+        ev.emit('creds.update', update);
         // AunuBaileys: timeout upload pre-keys agar koneksi tidak menggantung (dari MichelleBot/baileys)
         await promiseTimeout(30000, async (resolve, reject) => {
             try {
@@ -278,7 +318,6 @@ export const makeSocket = (config) => {
                 reject(error);
             }
         });
-        ev.emit('creds.update', update);
         logger.info({ count }, 'uploaded pre-keys');
     };
     const uploadPreKeysToServerIfRequired = async () => {
@@ -640,7 +679,17 @@ export const makeSocket = (config) => {
             id: jidEncode(phoneNumber, 's.whatsapp.net'),
             name: '~'
         };
-        ev.emit('creds.update', authState.creds);
+        // AunuBaileys (1.0.88, HB-262): deliberately NO creds.update
+        // emit here. The HB-191 fix rolls the optimistic me back on
+        // an in-process rejection, but the built-in saver writes
+        // ATOMICALLY the moment the emit fires — a process death
+        // (kill, OOM, deploy restart) in the window between this
+        // emit and the IQ below persisted the fake `me` to disk, and
+        // the next boot took the LOGIN path into a 401 loggedOut
+        // loop that only wiping the auth state could end. The emit
+        // now happens after the IQ succeeds (below); the hello flow
+        // reads me/pairingCode from MEMORY, never from disk, so
+        // nothing needs the persisted values earlier.
         // AunuBaileys (1.0.77, HB-191): query(), not sendNode() — the
         // companion_hello result must be awaited and error-checked.
         // sendNode resolved when the bytes hit the wire, so a server
@@ -693,6 +742,11 @@ export const makeSocket = (config) => {
                 }
             ]
         });
+        // AunuBaileys (1.0.88, HB-262): the server accepted the
+        // pairing request — only NOW may the optimistic me /
+        // pairingCode be persisted (see the note at the assignment
+        // above).
+        ev.emit('creds.update', authState.creds);
         return authState.creds.pairingCode;
         }
         catch (err) {

package/lib/Utils/aunu-message-inspect.js

@@ -37,31 +37,37 @@ import { jidDecode } from '../WABinary/index.js';
 import { getKeyAuthor } from './generics.js';
 import { getAggregateVotesInPollMessage, normalizeMessageContent } from './messages.js';
 
+// AunuBaileys (1.0.87, HB-218): every operand is optional-chained,
+// exactly like the base getFutureProofMessage in messages.js. A
+// wrapper whose `message` field is absent decodes with message ===
+// null; the bare derefs used to throw a raw TypeError on the next
+// loop iteration of normalizeAunuMessageContentExtended (and in
+// getAggregateVotesInPollMessageExtended downstream of it).
 const getFutureProofMessageExtended = (message) => (
-    message.ephemeralMessage ||
-    message.viewOnceMessage ||
-    message.documentWithCaptionMessage ||
-    message.viewOnceMessageV2 ||
-    message.viewOnceMessageV2Extension ||
-    message.editedMessage ||
-    message.groupMentionedMessage ||
-    message.botInvokeMessage ||
-    message.lottieStickerMessage ||
-    message.eventCoverImage ||
-    message.statusMentionMessage ||
-    message.pollCreationOptionImageMessage ||
-    message.associatedChildMessage ||
-    message.groupStatusMentionMessage ||
-    message.pollCreationMessageV4 ||
-    message.pollCreationMessageV5 ||
-    message.statusAddYours ||
-    message.groupStatusMessage ||
-    message.limitSharingMessage ||
-    message.botTaskMessage ||
-    message.questionMessage ||
-    message.groupStatusMessageV2 ||
-    message.botForwardedMessage ||
-    message.spoilerMessage
+    message?.ephemeralMessage ||
+    message?.viewOnceMessage ||
+    message?.documentWithCaptionMessage ||
+    message?.viewOnceMessageV2 ||
+    message?.viewOnceMessageV2Extension ||
+    message?.editedMessage ||
+    message?.groupMentionedMessage ||
+    message?.botInvokeMessage ||
+    message?.lottieStickerMessage ||
+    message?.eventCoverImage ||
+    message?.statusMentionMessage ||
+    message?.pollCreationOptionImageMessage ||
+    message?.associatedChildMessage ||
+    message?.groupStatusMentionMessage ||
+    message?.pollCreationMessageV4 ||
+    message?.pollCreationMessageV5 ||
+    message?.statusAddYours ||
+    message?.groupStatusMessage ||
+    message?.limitSharingMessage ||
+    message?.botTaskMessage ||
+    message?.questionMessage ||
+    message?.groupStatusMessageV2 ||
+    message?.botForwardedMessage ||
+    message?.spoilerMessage
 );
 
 /**

package/lib/Utils/chat-utils.js

@@ -286,6 +286,22 @@ export const decodePatches = async (name, syncds, initial, getAppStateSyncKey, o
     };
     const mutationMap = {};
     for (const syncd of syncds) {
+      // AunuBaileys (1.0.87, HB-141 + HB-149): snapshot the state
+      // before this patch. The version assignment inside the try
+      // runs BEFORE the patch is decoded, so a patch that failed
+      // (bad content HMAC, missing key, snapshot-MAC mismatch)
+      // still advanced the persisted version past itself — its
+      // mutations were never re-sent by the server, and the LT
+      // hash diverged from the true state permanently: every
+      // later snapshot-MAC check failed while the log claimed the
+      // patch had merely been "skipped". decodeSyncdPatch never
+      // mutates newState in place (the LT-hash generator copies
+      // the index map and returns fresh state), so restoring
+      // these three references in the catch is an exact rollback.
+      const prevVersion = newState.version;
+      const prevHash = newState.hash;
+      const prevIndexValueMap = newState.indexValueMap;
+      const appliedMutations = [];
       try {
         const { version, keyId, snapshotMac } = syncd;
         if (syncd.externalMutations) {
@@ -300,6 +316,11 @@ export const decodePatches = async (name, syncds, initial, getAppStateSyncKey, o
         const decodeResult = await decodeSyncdPatch(syncd, name, newState, getAppStateSyncKey, shouldMutate
             ? mutation => {
                 const index = mutation.syncAction.index?.toString();
+                // (HB-141 + HB-149) record for rollback: a patch
+                // whose snapshot-MAC check fails below has already
+                // delivered its mutations here — they must not
+                // survive being "skipped" either.
+                appliedMutations.push({ index, had: index in mutationMap, prev: mutationMap[index] });
                 mutationMap[index] = mutation;
             }
             : () => { }, true);
@@ -324,6 +345,28 @@ export const decodePatches = async (name, syncds, initial, getAppStateSyncKey, o
         // AunuBaileys: satu patch rusak tidak membunuh seluruh sinkronisasi
         logger?.warn({ err, name, version: syncd.version }, 'skipping undecodable app state patch');
         syncd.mutations = [];
+        // AunuBaileys (1.0.87, HB-141 + HB-149): roll the failed
+        // patch back completely, then stop this batch — later
+        // patches build on this one's state, and letting one of
+        // them advance the persisted version past the hole would
+        // cement the loss. The version stays at the last good
+        // patch, so the next resync re-requests the failed patch
+        // instead of reporting a version that silently skips it;
+        // a transient cause (failed external download, a sync key
+        // that had not arrived yet) now self-heals.
+        newState.version = prevVersion;
+        newState.hash = prevHash;
+        newState.indexValueMap = prevIndexValueMap;
+        for (let i = appliedMutations.length - 1; i >= 0; i--) {
+            const { index, had, prev } = appliedMutations[i];
+            if (had) {
+                mutationMap[index] = prev;
+            }
+            else {
+                delete mutationMap[index];
+            }
+        }
+        break;
       }
     }
     return { state: newState, mutationMap };

package/lib/Utils/messages-media.js

@@ -671,7 +671,20 @@ export const getUrlFromDirectPath = (directPath, fallbackHost) => `https://${fal
 // the canonical media host (the path is globally valid there); without
 // one the download is refused.
 const WA_MEDIA_HOST_SUFFIXES = ['.whatsapp.net', '.fbcdn.net'];
+// Farm delta (itsliaaa 0.5.6, adopted 1.0.88): some media messages
+// (stickers, voice notes, images) carry their url on the host
+// 'a.whatsapp.net' — a PLACEHOLDER that does not resolve in DNS
+// (verified live, twice: name_not_resolved), while their directPath
+// is perfectly valid on the real media host. Treating the
+// placeholder as a WA host built https://a.whatsapp.net<directPath>
+// and the download died on DNS with no fallback. The exact host is
+// excluded from the allowlist below, so host extraction yields no
+// host and the download falls back to mmg.whatsapp.net — every
+// OTHER *.whatsapp.net / *.fbcdn.net host keeps passing exactly as
+// before (the HB-114 SSRF allowlist is unchanged for real hosts).
+const PLACEHOLDER_MEDIA_HOST = 'a.whatsapp.net';
 const isWAMediaHost = (hostname) => !!hostname &&
+    hostname !== PLACEHOLDER_MEDIA_HOST &&
     (hostname === 'whatsapp.net' || hostname === 'fbcdn.net' ||
         WA_MEDIA_HOST_SUFFIXES.some((suffix) => hostname.endsWith(suffix)));
 export const downloadContentFromMessage = async ({ mediaKey, directPath, url }, type, opts = {}) => {

package/lib/Utils/messages.js

@@ -1019,12 +1019,33 @@ export const generateWAMessageContent = async (message, options) => {
     }
     else if ('pollResult' in message) {
         // AunuBaileys: poll result snapshot (dari @itsliaaa/baileys)
+        // AunuBaileys (1.0.88, HB-250): this branch validated NOTHING
+        // while its siblings ('poll', 'imagePoll', 'contacts') all
+        // Boom 400 on bad input — a missing/non-array votes died as
+        // a raw TypeError, and a missing/non-numeric voteCount was
+        // parseInt'd to NaN, which protobufjs silently coerces to 0
+        // on the wire: the snapshot sent to the peer CLAIMED zero
+        // votes for an option that actually had some. Mirror the
+        // 'poll' branch: votes must be an array and every count a
+        // finite integer (numeric strings stay accepted, as before).
+        if (!Array.isArray(message.pollResult.votes)) {
+            throw new Boom('pollResult.votes must be an array', { statusCode: 400 });
+        }
         const pollResultSnapshotMessage = {
             name: message.pollResult.name,
-            pollVotes: message.pollResult.votes.map(vote => ({
-                optionName: vote.name,
-                optionVoteCount: parseInt(vote.voteCount)
-            }))
+            pollVotes: message.pollResult.votes.map(vote => {
+                if (!vote || typeof vote !== 'object') {
+                    throw new Boom('pollResult.votes entries must be objects', { statusCode: 400 });
+                }
+                const count = typeof vote.voteCount === 'string' ? parseInt(vote.voteCount, 10) : vote.voteCount;
+                if (!Number.isInteger(count)) {
+                    throw new Boom('pollResult voteCount must be a finite integer', { statusCode: 400 });
+                }
+                return {
+                    optionName: vote.name,
+                    optionVoteCount: count
+                };
+            })
         };
         if (message.pollResult.pollType === 1) {
             pollResultSnapshotMessage.pollType = proto.Message.PollCreationMessage.PollType.QUIZ;

package/lib/Utils/process-message.js

@@ -206,14 +206,39 @@ const processMessage = async (message, { shouldProcessHistoryMsg, placeholderRes
                     await keyStore.transaction(async () => {
                         const newKeys = [];
                         for (const { keyData, keyId } of keys) {
-                            const strKeyId = Buffer.from(keyId.keyId).toString('base64');
+                            // AunuBaileys (1.0.88, HB-135 + keyData
+                            // facet): an entry whose keyId message is
+                            // absent decodes as keyId: null — the bare
+                            // Buffer.from(keyId.keyId) below threw,
+                            // and every key AFTER the bad entry in the
+                            // same share was never injected. Worse,
+                            // an entry with a keyId but NO keyData
+                            // stored null AND was adopted as
+                            // myAppStateKeyId, so getAppStateSyncKey
+                            // returned null downstream and the
+                            // collection stopped syncing after its
+                            // retries. Skip a malformed entry per-item
+                            // (the HB-1/HB-3 pattern); the rest of the
+                            // share still injects.
+                            const rawKeyId = keyId?.keyId;
+                            if (!rawKeyId || !rawKeyId.length || !keyData || !keyData.length) {
+                                logger?.warn({ keyId: keyId ?? null }, 'aunu: skipping a malformed app-state sync key in the share (missing keyId or keyData); the remaining keys still inject');
+                                continue;
+                            }
+                            const strKeyId = Buffer.from(rawKeyId).toString('base64');
                             newKeys.push(strKeyId);
                             await keyStore.set({ 'app-state-sync-key': { [strKeyId]: keyData } });
                             newAppStateSyncKeyId = strKeyId;
                         }
                         logger?.info({ newAppStateSyncKeyId, newKeys }, 'injecting new app state sync keys');
                     });
-                    ev.emit('creds.update', { myAppStateKeyId: newAppStateSyncKeyId });
+                    // AunuBaileys (1.0.88, HB-135): adopt a new
+                    // myAppStateKeyId only when a valid key was
+                    // actually injected — an all-malformed share
+                    // used to emit the empty initial value here.
+                    if (newAppStateSyncKeyId) {
+                        ev.emit('creds.update', { myAppStateKeyId: newAppStateSyncKeyId });
+                    }
                 }
                 else {
                     logger?.info({ protocolMsg }, 'recv app state sync with 0 keys');

package/lib/Utils/signal.js

@@ -111,8 +111,26 @@ export const parseRetryReceiptSession = (node) => {
         if (!value) {
             return undefined;
         }
+        // AunuBaileys (1.0.88, HB-263 + addendum): the <id> child
+        // was never validated — a bundle whose <id> is missing
+        // (keyId undefined) or shorter than 3 bytes (bufferToUInt
+        // reads past the end -> NaN) produced a key with a
+        // non-finite keyId, and SessionBuilder.initOutgoing does
+        // NOT throw on it: a poisoned session was stored, the
+        // server fetch was skipped as "already injected", and
+        // pkmsg went out with preKeyId/signedPreKeyId 0 until the
+        // peer's 'Missing SignedPreKey' errors piled up. A
+        // non-finite keyId makes the key unusable — skip it like a
+        // missing <value>; when the SIGNED key drops out, the
+        // bundle counts as absent and the caller falls back to a
+        // server fetch (whose initOutgoing DOES throw on a fully
+        // missing signed key, landing in the same fallback).
+        const keyId = getBinaryNodeChildUInt(key, 'id', 3);
+        if (!Number.isFinite(keyId)) {
+            return undefined;
+        }
         return {
-            keyId: getBinaryNodeChildUInt(key, 'id', 3),
+            keyId,
             publicKey: generateSignalPubKey(value),
             signature: getBinaryNodeChildBuffer(key, 'signature')
         };
@@ -138,8 +156,26 @@ export const parseAndInjectE2ESessions = async (node, repository, logger) => {
         if (!value) {
             return undefined;
         }
+        // AunuBaileys (1.0.88, HB-263 + addendum): the <id> child
+        // was never validated — a bundle whose <id> is missing
+        // (keyId undefined) or shorter than 3 bytes (bufferToUInt
+        // reads past the end -> NaN) produced a key with a
+        // non-finite keyId, and SessionBuilder.initOutgoing does
+        // NOT throw on it: a poisoned session was stored, the
+        // server fetch was skipped as "already injected", and
+        // pkmsg went out with preKeyId/signedPreKeyId 0 until the
+        // peer's 'Missing SignedPreKey' errors piled up. A
+        // non-finite keyId makes the key unusable — skip it like a
+        // missing <value>; when the SIGNED key drops out, the
+        // bundle counts as absent and the caller falls back to a
+        // server fetch (whose initOutgoing DOES throw on a fully
+        // missing signed key, landing in the same fallback).
+        const keyId = getBinaryNodeChildUInt(key, 'id', 3);
+        if (!Number.isFinite(keyId)) {
+            return undefined;
+        }
         return {
-            keyId: getBinaryNodeChildUInt(key, 'id', 3),
+            keyId,
             publicKey: generateSignalPubKey(value),
             signature: getBinaryNodeChildBuffer(key, 'signature')
         };

package/lib/Utils/use-multi-file-auth-state.js

@@ -50,7 +50,17 @@ const isValidCredsShape = (creds) => !!creds &&
     isCredsKeyPair(creds.signedPreKey?.keyPair) &&
     (Buffer.isBuffer(creds.signedPreKey?.signature) || typeof creds.signedPreKey?.signature === 'string') &&
     Number.isFinite(creds.signedPreKey?.keyId) &&
-    Number.isFinite(creds.registrationId);
+    Number.isFinite(creds.registrationId) &&
+    // AunuBaileys (1.0.88, HB-80 addendum): the HB-151 shape check
+    // missed the two fields pairing itself dereferences —
+    // advSecretKey (genPairQR joins it into the QR payload; a
+    // missing one silently produced an EMPTY fourth QR segment
+    // instead of an error) and pairingEphemeralKeyPair
+    // (generatePairingKey encrypts with its public half).
+    // initAuthCreds always fills both, so a stored creds missing
+    // either is the same partial restore HB-151 exists to reject.
+    (typeof creds.advSecretKey === 'string' && creds.advSecretKey.length > 0) &&
+    isCredsKeyPair(creds.pairingEphemeralKeyPair);
 export const useMultiFileAuthState = async (folder, logger) => {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const writeData = async (data, file) => {
@@ -191,11 +201,38 @@ export const useMultiFileAuthState = async (folder, logger) => {
                 return credsWriteInFlight;
             }
             credsWriteInFlight = (async () => {
+                // AunuBaileys (1.0.88, HB-34 addendum): the HB-34
+                // design decision stands — a persist failure THROWS
+                // (a swallowed error lets the session rot silently).
+                // But the coalescing used to discard a write that was
+                // QUEUED during a FAILED write: callers arriving
+                // mid-write shared the in-flight promise and set the
+                // queued flag, the first write threw, and the queued
+                // latest state was never attempted — disk stayed
+                // stale (registered:false, counter 0) while memory
+                // ran ahead, until some unrelated saveCreds call
+                // happened by. A failure with a queued write behind
+                // it now attempts that latest state once more; the
+                // throw surfaces only when a write fails with nothing
+                // newer queued behind it.
+                let lastError;
                 try {
                     do {
                         credsWriteQueued = false;
-                        await writeData(creds, 'creds.json');
+                        try {
+                            await writeData(creds, 'creds.json');
+                            lastError = undefined;
+                        }
+                        catch (err) {
+                            lastError = err;
+                            if (!credsWriteQueued) {
+                                break;
+                            }
+                        }
                     } while (credsWriteQueued);
+                    if (lastError) {
+                        throw lastError;
+                    }
                 }
                 catch (err) {
                     // writeData already logged it; this log covers callers

package/lib/WAUSync/USyncQuery.js

@@ -110,7 +110,22 @@ export class USyncQuery {
                                 if (errCode === 401 || errCode === 403 || errCode === 405) {
                                     return ['isBlockedByContact', true];
                                 }
-                                throw err;
+                                // AunuBaileys (1.0.87, HB-175): any
+                                // OTHER per-user parser error — the
+                                // protocol node carried an <error>
+                                // child with e.g. a 404 — used to be
+                                // rethrown, aborting the parse of
+                                // the ENTIRE batch: one user's error
+                                // cost every other user's devices /
+                                // contacts, and downstream sends that
+                                // depend on the device list failed
+                                // outright. Treat it the way the
+                                // business parser treats an error
+                                // child: this user simply has no data
+                                // for this protocol (the null is
+                                // dropped by the filter below); the
+                                // rest of the batch continues.
+                                return [protocol, null];
                             }
                         }
                         else {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aunucore/baileys",
   "type": "module",
-  "version": "1.0.86",
+  "version": "1.0.88",
   "description": "AunuBaileys — the self-healing WhatsApp Web API for Node.js. Bad MAC and \"2000 messages into the future\" errors repair themselves, LID and phone-number identities stay in sync, anti-ban is built in, pairing codes are custom — plus 29 experimental features no other Baileys fork ships: invisible watermarks, per-person tag-all cards, side-profile text, ghost mentions and more. ESM, CJS and full TypeScript types.",
   "keywords": [
     "whatsapp",