@oxidezap/baileyrs 0.1.3 → 0.2.0

package/lib/Utils/event-buffer.js

@@ -143,7 +143,14 @@ const append = (data, historyCache, event, eventData, logger) => {
         case 'chats.upsert': {
             for (const chat of eventData) {
                 const id = chat.id || '';
-                let existing = data.chatUpserts[id] || data.historySets.chats[id];
+                // The history set is only consulted for a chat that *has* an id.
+                // Upstream guards the lookup with `id &&`, and this port had dropped
+                // it: an id-less chat then folded into whatever id-less entry a
+                // buffered history set happened to carry, summing their unread counts,
+                // where upstream releases it as its own `chats.upsert`. Found by the
+                // buffer differential once history rows started drawing from the same
+                // identity pool as live traffic.
+                let existing = data.chatUpserts[id] || (id ? data.historySets.chats[id] : undefined);
                 if (existing)
                     concatChats(existing, chat);
                 else {
@@ -185,14 +192,37 @@ const append = (data, historyCache, event, eventData, logger) => {
         case 'contacts.upsert': {
             for (const contact of eventData) {
                 const existing = data.contactUpserts[contact.id] || data.historySets.contacts[contact.id];
-                if (existing)
-                    Object.assign(existing, trimUndefined(contact));
-                else
-                    data.contactUpserts[contact.id] = contact;
+                // A `contacts.update` already buffered for this id arrived *before*
+                // this upsert, so it is folded in first and the upsert's own values
+                // win where the two carry the same field. Folding it last — which is
+                // what this did — let a stale name overwrite the one that came after
+                // it, and the buffer released the older of the two. Fields only the
+                // update carried still survive, which upstream drops.
                 const pending = data.contactUpdates[contact.id];
-                if (pending) {
-                    Object.assign(existing || contact, pending);
+                if (pending)
                     delete data.contactUpdates[contact.id];
+                if (existing) {
+                    if (pending)
+                        Object.assign(existing, pending);
+                    Object.assign(existing, trimUndefined(contact));
+                }
+                else {
+                    // Filling the gaps in `contact` rather than merging onto `pending`
+                    // and storing that: `pending` was grown from `{}` by the update
+                    // branch, and accumulating into it — or into a fresh literal —
+                    // measured about twice the cost of writing into the contact the
+                    // caller handed us, which arrives with a settled shape. An
+                    // explicitly-`undefined` field counts as absent, which is what
+                    // `trimUndefined` would decide and costs no second pass.
+                    if (pending) {
+                        const target = contact;
+                        const source = pending;
+                        for (const field in source) {
+                            if (target[field] === undefined)
+                                target[field] = source[field];
+                        }
+                    }
+                    data.contactUpserts[contact.id] = contact;
                 }
             }
             break;
@@ -326,17 +356,21 @@ const consolidateEvents = (data) => {
         if (Array.isArray(values) && values.length > 0)
             events[event] = values;
     };
+    // The order of these writes is the contract, not an implementation detail.
+    // A flush walks `Object.keys()` of this map, so insertion order decides both
+    // the key order a `process()` handler iterates and the order the individual
+    // events are re-dispatched to `.on()` listeners. Handlers that assume
+    // upstream's sequence — messages before the contacts they reference — see a
+    // different interleaving if these move. Keep them aligned with upstream's
+    // `consolidateEvents`.
     assignArray('chats.upsert', Object.values(data.chatUpserts));
     assignArray('chats.update', Object.values(data.chatUpdates));
     assignArray('chats.delete', [...data.chatDeletes]);
-    assignArray('contacts.upsert', Object.values(data.contactUpserts));
-    assignArray('contacts.update', Object.values(data.contactUpdates));
-    assignArray('messages.update', Object.values(data.messageUpdates));
-    assignArray('groups.update', Object.values(data.groupUpdates));
     const upserts = Object.values(data.messageUpserts);
     if (upserts.length) {
         events['messages.upsert'] = { messages: upserts.map(item => item.message), type: upserts[0].type };
     }
+    assignArray('messages.update', Object.values(data.messageUpdates));
     const deleted = Object.values(data.messageDeletes);
     if (deleted.length)
         events['messages.delete'] = { keys: deleted };
@@ -346,6 +380,9 @@ const consolidateEvents = (data) => {
     const receipts = Object.values(data.messageReceipts).flatMap(({ key, userReceipt }) => userReceipt.map(receipt => ({ key, receipt })));
     if (receipts.length)
         events['message-receipt.update'] = receipts;
+    assignArray('contacts.upsert', Object.values(data.contactUpserts));
+    assignArray('contacts.update', Object.values(data.contactUpdates));
+    assignArray('groups.update', Object.values(data.groupUpdates));
     return events;
 };
 /**

package/lib/Utils/messages.js

@@ -228,22 +228,45 @@ export const generateForwardMessageContent = (message, forceForward) => {
         throw new Boom('no content in message', { statusCode: 400 });
     }
     content = normalizeMessageContent(content);
-    // Shallow clone — only the inner message object gets modified (contextInfo)
+    // Shallow clone of the outer map — one entry on it is rewritten below.
     content = { ...content };
     let key = Object.keys(content)[0];
     let score = content?.[key]?.contextInfo?.forwardingScore || 0;
     score += message.key.fromMe && !forceForward ? 0 : 1;
+    const contextInfo = score > 0 ? { forwardingScore: score, isForwarded: true } : {};
+    // The nested message object is the *caller's*, reached through the shallow
+    // clone above, so writing `contextInfo` onto it wrote into their argument.
+    // And it replaces rather than merges: a caller who forwarded a quoted message
+    // found `stanzaId` and `participant` gone from their own object afterwards.
+    // Upstream leaves the argument untouched.
+    //
+    // Rebuilt rather than deep-copied, and only the one object being written.
+    // Upstream's copy is `proto.Message.decode(proto.Message.encode(content))` —
+    // a full serialise/parse round trip on a hot send path — which is not worth
+    // paying to fix an aliasing bug.
     if (key === 'conversation') {
-        content.extendedTextMessage = { text: content[key] };
+        // This object is created here, so nothing of the caller's is aliased and
+        // the `contextInfo` goes straight in. Same allocation count as before.
+        content.extendedTextMessage = { text: content[key], contextInfo };
         delete content.conversation;
         key = 'extendedTextMessage';
-    }
-    const key_ = content?.[key];
-    if (score > 0) {
-        key_.contextInfo = { forwardingScore: score, isForwarded: true };
+        return content;
+    }
+    const nested = content[key];
+    // A plain object is the only thing worth copying, and the only thing that can
+    // be the caller's to damage. Anything else — an absent slot on an empty
+    // message, a primitive, an array — keeps the original assignment, which
+    // throws for exactly the inputs it threw for before and that upstream throws
+    // for too. Spreading those instead invented a property named `"undefined"`
+    // where upstream raised a TypeError.
+    if (typeof nested === 'object' && nested !== null && !Array.isArray(nested)) {
+        // One shallow spread, of exactly the object being modified. This is the
+        // whole cost of the fix, and it is unavoidable: not writing into the
+        // caller's object means writing into a different one.
+        content[key] = { ...nested, contextInfo };
     }
     else {
-        key_.contextInfo = {};
+        nested.contextInfo = contextInfo;
     }
     return content;
 };

package/lib/Utils/process-history-message.d.ts

@@ -36,6 +36,15 @@ export declare const processHistoryMessage: (item: proto.IHistorySync, logger?:
 export declare const downloadHistory: (msg: proto.Message.IHistorySyncNotification, options: RequestInit) => Promise<proto.HistorySync>;
 /** Resolve inline or external history-sync content and normalize its public payload. */
 export declare const downloadAndProcessHistorySyncNotification: (msg: proto.Message.IHistorySyncNotification, options: RequestInit, logger?: ILogger) => Promise<ProcessedHistorySync>;
-/** Extract a history-sync notification through the same wrapper normalization as upstream. */
-export declare const getHistoryMsg: (message: proto.IMessage) => proto.Message.IHistorySyncNotification;
+/**
+ * Extract a history-sync notification through the same wrapper normalization as
+ * upstream.
+ *
+ * Returns `undefined` when the message carries none. It used to throw a Boom
+ * 400, which breaks the shape every caller writes against a drop-in API —
+ * `const h = getHistoryMsg(msg); if (!h) return` crashed instead of returning.
+ * "Absent" is the ordinary case here, not an error: any message that is not a
+ * history sync takes this path.
+ */
+export declare const getHistoryMsg: (message: proto.IMessage) => proto.Message.IHistorySyncNotification | undefined;
 //# sourceMappingURL=process-history-message.d.ts.map

package/lib/Utils/process-history-message.js

@@ -14,7 +14,6 @@ import { inflateZlib } from '@oxidezap/whatsapp-rust-bridge';
 import { proto } from '../WAProto/runtime.js';
 import { WAProto } from '../Types/index.js';
 import { isHostedLidUser, isHostedPnUser, isLidUser, isPnUser } from '../WABinary/jid-utils.js';
-import { Boom } from './boom.js';
 import { toNumber } from './generics.js';
 import { downloadContentFromMessage, normalizeMessageContent } from './messages.js';
 import { createSparseArray } from './sparse-array.js';
@@ -199,13 +198,18 @@ export const downloadAndProcessHistorySyncNotification = async (msg, options, lo
         : await downloadHistory(msg, options);
     return processHistoryMessage(historyMsg, logger);
 };
-/** Extract a history-sync notification through the same wrapper normalization as upstream. */
+/**
+ * Extract a history-sync notification through the same wrapper normalization as
+ * upstream.
+ *
+ * Returns `undefined` when the message carries none. It used to throw a Boom
+ * 400, which breaks the shape every caller writes against a drop-in API —
+ * `const h = getHistoryMsg(msg); if (!h) return` crashed instead of returning.
+ * "Absent" is the ordinary case here, not an error: any message that is not a
+ * history sync takes this path.
+ */
 export const getHistoryMsg = (message) => {
     const normalizedContent = message ? normalizeMessageContent(message) : undefined;
-    const historySyncNotification = normalizedContent?.protocolMessage?.historySyncNotification;
-    if (!historySyncNotification) {
-        throw new Boom('Message does not contain a history sync notification', { statusCode: 400 });
-    }
-    return historySyncNotification;
+    return normalizedContent?.protocolMessage?.historySyncNotification ?? undefined;
 };
 //# sourceMappingURL=process-history-message.js.map

package/lib/Utils/use-multi-file-auth-state.js

@@ -1,7 +1,44 @@
 import { mkdir, stat } from 'node:fs/promises';
+import { createDeviceProjection } from '../Compatibility/legacy-store/device.js';
 import { projectNativeStore } from '../Compatibility/legacy-store/native-projection.js';
 import { initAuthCreds } from './generics.js';
 import { useBridgeStore } from './use-bridge-store.js';
+/**
+ * The store namespace and keys the engine writes its own device under.
+ *
+ * `<folder>/device-device.bin` and `<folder>/device-account.bin` on disk.
+ */
+const DEVICE_STORE = 'device';
+const DEVICE_RECORDS = ['device', 'account'];
+/**
+ * Rebuild the credential mirror from the device the engine persisted.
+ *
+ * Without this the mirror is whatever `initAuthCreds()` just made up: every
+ * restart handed back `registered: false` and `me: undefined` for a session
+ * that was paired and working, because nothing on this path ever read the
+ * device back. The hydration itself already existed for `wrapLegacyStore`
+ * (`Compatibility/legacy-store/adapter.ts`), which only runs for callers that
+ * bring their own `{ creds, keys }`; a caller using this function goes straight
+ * to the bridge store and used to skip it entirely.
+ *
+ * A record that fails to decode is skipped rather than fatal: a mirror missing
+ * a field is worth less than a socket that will not start, and the engine reads
+ * its own device from the same bytes regardless of what this makes of them.
+ */
+const hydrateFromStore = async (store, creds) => {
+    const projection = createDeviceProjection(creds);
+    for (const record of DEVICE_RECORDS) {
+        const payload = await store.get(DEVICE_STORE, record);
+        if (!payload)
+            continue;
+        try {
+            projection.prepare(record, payload)();
+        }
+        catch {
+            /* a record we cannot read leaves that part of the mirror at its default */
+        }
+    }
+};
 /**
  * Creates a file-based authentication state for the Rust bridge.
  *
@@ -30,6 +67,14 @@ export const useMultiFileAuthState = async (folder) => {
     }
     const store = await useBridgeStore(folder);
     const creds = initAuthCreds();
+    // Before `projectNativeStore`, and that ordering is the whole point: the
+    // projection captures `signedIdentityKey.public` and `registrationId` off
+    // `creds` when it is called, and builds the Signal codecs around them.
+    // Hydrating afterwards would leave those codecs holding the identity of the
+    // throwaway `initAuthCreds()` rather than the device's, so a legacy session
+    // written through this store would be imported under the wrong local
+    // identity.
+    await hydrateFromStore(store, creds);
     const keys = projectNativeStore(store, creds);
     return {
         state: { creds, keys, store },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@oxidezap/baileyrs",
   "type": "module",
-  "version": "0.1.3",
+  "version": "0.2.0",
   "description": "A Rust-powered WhatsApp Web library for JavaScript, with a Baileys-compatible API",
   "keywords": [
     "whatsapp",
@@ -47,6 +47,7 @@
     "lib/**/*",
     "!lib/**/*.map",
     "!lib/**/__tests__/**",
+    "!lib/__fuzz__/**",
     "!lib/**/*.test.*",
     "!lib/**/*.test-e2e.*"
   ],
@@ -58,6 +59,7 @@
     "compat:audit:missing": "npm run build --silent && node scripts/compatibility/audit.ts --only-missing",
     "compat:audit:proto": "node scripts/compatibility/proto-runtime-audit.ts --details --strict",
     "compat:audit:wire": "node scripts/compatibility/wire-fidelity-audit.ts --details --strict",
+    "compat:audit:lifecycle": "node scripts/compatibility/lifecycle-contract-audit.ts --strict",
     "compat:audit:strict": "npm run build --silent && node scripts/compatibility/audit.ts --strict --only-missing",
     "compat:sync-waproto": "node scripts/compatibility/waproto-facade.ts --sync",
     "compat:check-waproto": "node scripts/compatibility/waproto-facade.ts --check",
@@ -70,13 +72,17 @@
     "prepack": "npm run build && node scripts/check-pack.ts",
     "prepare": "npm run build",
     "test": "node --test",
+    "fuzz": "node --test --test-timeout=600000 ./src/__fuzz__/**/*.test.ts",
+    "fuzz:deep": "FUZZ_MODE=deep node --expose-gc --test --test-timeout=1800000 ./src/__fuzz__/**/*.test.ts",
+    "fuzz:record": "FUZZ_RECORD=1 node --test --test-timeout=600000 ./src/__fuzz__/**/*.test.ts",
+    "fuzz:report": "node scripts/fuzz/report.ts",
     "test:compat-auditor": "node --test scripts/compatibility/__tests__/audit.test.ts",
     "typecheck:compat-auditor": "npm run build --silent && npm run compat:check-waproto --silent && npm run compat:layers --silent && tsc -p scripts/compatibility/tsconfig.json",
-    "test:e2e": "NODE_TLS_REJECT_UNAUTHORIZED=0 ADV_SECRET_KEY=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= node --expose-gc --test --test-concurrency=1 ./src/__tests__/e2e/*.test-e2e.ts"
+    "test:e2e": "NODE_TLS_REJECT_UNAUTHORIZED=0 ADV_SECRET_KEY=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= node --expose-gc --test --test-concurrency=1 ./src/__tests__/e2e/*.test-e2e.ts ./scripts/compatibility/__tests__/*.test-e2e.ts"
   },
   "dependencies": {
     "@hapi/boom": "^9.1.4",
-    "@oxidezap/whatsapp-rust-bridge": "0.7.1",
+    "@oxidezap/whatsapp-rust-bridge": "0.11.0",
     "long": "^5.3.2",
     "pino": "^10.3.1",
     "protobufjs": "^7.6.5"