@oxidezap/baileyrs 0.2.11 → 0.2.12

package/lib/Bridge/index.d.ts

@@ -8,5 +8,5 @@
  */
 export { adaptBridgeEvent, adaptBridgeMessageWire, KNOWN_BRIDGE_EVENT_TYPES } from './adapt.js';
 export * from './types.js';
-export { asBool, asBoolOr, asJidString, asNumber, asString, bridgeJidToString, isBridgeJid, isObject, normalizeDiscriminator, toUnixSeconds } from './primitives.js';
+export { asBool, asBoolOr, asJidString, asNumber, asString, asUnixSeconds, bridgeJidToString, isBridgeJid, isObject, normalizeDiscriminator, toUnixSeconds } from './primitives.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/Bridge/index.js

@@ -8,5 +8,5 @@
  */
 export { adaptBridgeEvent, adaptBridgeMessageWire, KNOWN_BRIDGE_EVENT_TYPES } from './adapt.js';
 export * from './types.js';
-export { asBool, asBoolOr, asJidString, asNumber, asString, bridgeJidToString, isBridgeJid, isObject, normalizeDiscriminator, toUnixSeconds } from './primitives.js';
+export { asBool, asBoolOr, asJidString, asNumber, asString, asUnixSeconds, bridgeJidToString, isBridgeJid, isObject, normalizeDiscriminator, toUnixSeconds } from './primitives.js';
 //# sourceMappingURL=index.js.map

package/lib/Bridge/primitives.d.ts

@@ -50,16 +50,28 @@ export declare const asJidAddressString: (x: unknown) => string | undefined;
  * strings — the bridge serializes `DateTime<Utc>` as a string unless the field
  * names one of chrono's `ts_*` modules, so being lenient about which of the two
  * arrives insulates us from drift.
+ *
+ * Absence and unparseable input stay absent (`undefined`): a missing,
+ * malformed, or non-finite timestamp must never become the epoch, which
+ * would place the event at 1970 and corrupt timeline ordering. Callers
+ * apply the per-field policy explicitly — required timestamps (message,
+ * receipt, call, group action) drop the event, optional ones (presence
+ * `last_seen`, server-ack time, pin/mute time) omit the field.
  */
-export declare const toUnixSeconds: (raw: unknown) => number;
+export declare const asUnixSeconds: (raw: unknown) => number | undefined;
 /**
- * Same as `toUnixSeconds`, but absence stays absent.
+ * Validated coercion to unix seconds for external consumers that need a
+ * plain number (no `undefined` branch).
  *
- * The optional timestamps — `last_seen`, a server ack's `t`, an app-state
- * mutation's own time — mean "the server did not say" when missing, which is
- * not the same claim as the epoch.
+ * Accepts the same inputs as `asUnixSeconds` — a finite number or an RFC
+ * 3339 string — and rejects everything else by throwing `RangeError`
+ * instead of fabricating the epoch: a missing, malformed, or non-finite
+ * timestamp must never become 1970-01-01 and corrupt timeline ordering.
+ * Internal adapters do not use this; they take `asUnixSeconds` with an
+ * explicit per-field policy (required timestamps drop the event, optional
+ * ones omit the field).
  */
-export declare const asUnixSeconds: (raw: unknown) => number | undefined;
+export declare const toUnixSeconds: (raw: unknown) => number;
 /**
  * A 64-bit proto field, however the bridge chose to carry it.
  *

package/lib/Bridge/primitives.js

@@ -82,20 +82,13 @@ const parseRfc3339Seconds = (raw) => {
  * strings — the bridge serializes `DateTime<Utc>` as a string unless the field
  * names one of chrono's `ts_*` modules, so being lenient about which of the two
  * arrives insulates us from drift.
- */
-export const toUnixSeconds = (raw) => {
-    if (typeof raw === 'number' && Number.isFinite(raw))
-        return raw;
-    if (typeof raw === 'string')
-        return parseRfc3339Seconds(raw) ?? 0;
-    return 0;
-};
-/**
- * Same as `toUnixSeconds`, but absence stays absent.
  *
- * The optional timestamps — `last_seen`, a server ack's `t`, an app-state
- * mutation's own time — mean "the server did not say" when missing, which is
- * not the same claim as the epoch.
+ * Absence and unparseable input stay absent (`undefined`): a missing,
+ * malformed, or non-finite timestamp must never become the epoch, which
+ * would place the event at 1970 and corrupt timeline ordering. Callers
+ * apply the per-field policy explicitly — required timestamps (message,
+ * receipt, call, group action) drop the event, optional ones (presence
+ * `last_seen`, server-ack time, pin/mute time) omit the field.
  */
 export const asUnixSeconds = (raw) => {
     if (typeof raw === 'number' && Number.isFinite(raw))
@@ -104,6 +97,26 @@ export const asUnixSeconds = (raw) => {
         return parseRfc3339Seconds(raw);
     return undefined;
 };
+/**
+ * Validated coercion to unix seconds for external consumers that need a
+ * plain number (no `undefined` branch).
+ *
+ * Accepts the same inputs as `asUnixSeconds` — a finite number or an RFC
+ * 3339 string — and rejects everything else by throwing `RangeError`
+ * instead of fabricating the epoch: a missing, malformed, or non-finite
+ * timestamp must never become 1970-01-01 and corrupt timeline ordering.
+ * Internal adapters do not use this; they take `asUnixSeconds` with an
+ * explicit per-field policy (required timestamps drop the event, optional
+ * ones omit the field).
+ */
+export const toUnixSeconds = (raw) => {
+    const parsed = asUnixSeconds(raw);
+    if (parsed === undefined) {
+        const preview = typeof raw === 'string' ? `: ${raw.slice(0, 80)}` : '';
+        throw new RangeError(`toUnixSeconds: cannot coerce ${typeof raw}${preview} to unix seconds`);
+    }
+    return parsed;
+};
 /**
  * A 64-bit proto field, however the bridge chose to carry it.
  *

package/lib/Bridge/schema.js

@@ -24,7 +24,7 @@
  */
 import { processHistoryMessage } from '../Utils/process-history-message.js';
 import { isJidGroup } from '../WABinary/jid-utils.js';
-import { absoluteFromDuration, asBool, asBoolOr, asStringArray, asDurationSeconds, asInt64, asJidAddressString, asJidString, asNumber, asString, asUnixSeconds, isObject, normalizeDiscriminator, toUnixSeconds } from './primitives.js';
+import { absoluteFromDuration, asBool, asBoolOr, asStringArray, asDurationSeconds, asInt64, asJidAddressString, asJidString, asNumber, asString, asUnixSeconds, isObject, normalizeDiscriminator } from './primitives.js';
 /**
  * Bridge sync-action events (`pin_update`, `mute_update`, etc.) carry the
  * proto action under `data.action`, but the bridge `.d.ts` types it as
@@ -39,6 +39,17 @@ const extractAction = (data) => isObject(data?.action) ? data.action : undefined
 const resolveIsGroup = (wireValue, chatJid) => asBoolOr(wireValue, false) || isJidGroup(chatJid) === true;
 const resolveParticipantAlt = (senderAlt, isGroup) => isGroup ? senderAlt : undefined;
 const resolveRemoteJidAlt = (senderAlt, recipientAlt, isGroup, isFromMe) => (isGroup ? undefined : isFromMe ? recipientAlt : senderAlt);
+/**
+ * Rejection diagnostic for a required timestamp that is missing or
+ * unparseable. Metadata only — never the payload: these objects can carry
+ * message bodies and JIDs.
+ */
+const invalidTimestampDetail = (event, raw) => ({
+    event,
+    field: 'timestamp',
+    reason: raw === undefined || raw === null ? 'missing' : 'invalid',
+    receivedType: typeof raw
+});
 const parseEditAttribute = (value) => {
     switch (value) {
         case '1':
@@ -141,7 +152,7 @@ const ADAPTERS = {
             error: asString(data?.error)
         };
     },
-    undecryptable_message: data => {
+    undecryptable_message: (data, logger) => {
         // Bridge ships `{ info: MessageInfo, is_unavailable, unavailable_type,
         // decrypt_fail_mode }` — same MessageInfo shape as the regular
         // `message` event. Extract the chat / sender / id so the dispatcher
@@ -161,12 +172,17 @@ const ADAPTERS = {
         const isFromMe = asBoolOr(src.is_from_me, false);
         const senderAlt = asJidString(src.sender_alt);
         const recipientAlt = asJidString(src.recipient_alt);
+        const timestamp = asUnixSeconds(info.timestamp);
+        if (timestamp === undefined) {
+            logger?.debug(invalidTimestampDetail('undecryptable_message', info.timestamp), 'undecryptable_message adapter: missing or invalid timestamp');
+            return null;
+        }
         return {
             type: 'undecryptableMessage',
             chatJid: chat,
             senderJid: isGroup ? asJidString(src.sender) : undefined,
             id,
-            timestamp: toUnixSeconds(info.timestamp),
+            timestamp,
             isFromMe,
             isGroup,
             pushName: asString(info.push_name),
@@ -386,28 +402,38 @@ const ADAPTERS = {
     call_log_sync: () => ({ type: 'noop', bridgeType: 'call_log_sync' }),
     // ── Calls ──
     incoming_call: (data, logger) => adaptIncomingCall(data, logger),
-    missed_call: data => {
+    missed_call: (data, logger) => {
         const from = asJidString(data?.from);
         const callId = asString(data?.call_id);
         if (!from || !callId)
             return null;
+        const timestamp = asUnixSeconds(data?.timestamp);
+        if (timestamp === undefined) {
+            logger?.debug(invalidTimestampDetail('missed_call', data?.timestamp), 'missed_call adapter: missing or invalid timestamp');
+            return null;
+        }
         return {
             type: 'incomingCall',
             from,
-            timestamp: toUnixSeconds(data?.timestamp),
+            timestamp,
             offline: data?.reason === 'offline',
             action: { type: 'timeout', callId }
         };
     },
-    call_ended_elsewhere: data => {
+    call_ended_elsewhere: (data, logger) => {
         const from = asJidString(data?.from);
         const callId = asString(data?.call_id);
         if (!from || !callId)
             return null;
+        const timestamp = asUnixSeconds(data?.timestamp);
+        if (timestamp === undefined) {
+            logger?.debug(invalidTimestampDetail('call_ended_elsewhere', data?.timestamp), 'call_ended_elsewhere adapter: missing or invalid timestamp');
+            return null;
+        }
         return {
             type: 'incomingCall',
             from,
-            timestamp: toUnixSeconds(data?.timestamp),
+            timestamp,
             offline: false,
             action: { type: data?.outcome === 'accepted' ? 'accept' : 'reject', callId }
         };
@@ -680,6 +706,15 @@ export const adaptBridgeMessageWire = (messageProto, info, logger) => {
     const isFromMe = asBoolOr(info.isFromMe, false);
     const senderAlt = asString(info.senderAlt);
     const recipientAlt = asString(info.recipientAlt);
+    // The packed envelope carries the timestamp as a numeric record, so the
+    // only invalid shapes here are a missing or non-finite value. Like the
+    // object route below, those drop the message rather than dating it at
+    // the epoch.
+    const timestamp = asNumber(info.timestamp);
+    if (timestamp === undefined) {
+        logger?.debug(invalidTimestampDetail('message_wire', info.timestamp), 'message wire adapter: missing or invalid timestamp');
+        return null;
+    }
     return {
         type: 'message',
         chatJid: chat,
@@ -687,7 +722,7 @@ export const adaptBridgeMessageWire = (messageProto, info, logger) => {
         isGroup,
         isFromMe,
         id,
-        timestamp: asNumber(info.timestamp) ?? 0,
+        timestamp,
         pushName: asString(info.pushName),
         participantAlt: resolveParticipantAlt(senderAlt, isGroup),
         remoteJidAlt: resolveRemoteJidAlt(senderAlt, recipientAlt, isGroup, isFromMe),
@@ -712,6 +747,11 @@ const adaptMessageParts = (info, messageProto, logger) => {
     const senderJid = isGroup ? asJidString(senderRaw) : undefined;
     const senderAlt = asJidString(src.sender_alt);
     const recipientAlt = asJidString(src.recipient_alt);
+    const timestamp = asUnixSeconds(info.timestamp);
+    if (timestamp === undefined) {
+        logger?.debug(invalidTimestampDetail('message', info.timestamp), 'message adapter: missing or invalid timestamp');
+        return null;
+    }
     return {
         type: 'message',
         chatJid: chat,
@@ -719,7 +759,7 @@ const adaptMessageParts = (info, messageProto, logger) => {
         isGroup,
         isFromMe,
         id,
-        timestamp: toUnixSeconds(info.timestamp),
+        timestamp,
         pushName: asString(info.push_name),
         participantAlt: resolveParticipantAlt(senderAlt, isGroup),
         remoteJidAlt: resolveRemoteJidAlt(senderAlt, recipientAlt, isGroup, isFromMe),
@@ -743,6 +783,16 @@ const adaptReceipt = (data, logger) => {
         return null;
     }
     const isGroup = resolveIsGroup(src.is_group, chat);
+    // A receipt without a trustworthy timestamp cannot be placed on any
+    // timeline slot (`readTimestamp` / `playedTimestamp` /
+    // `receiptTimestamp`), so the event is dropped rather than dated at the
+    // epoch. Optional timestamps elsewhere stay absent via `asUnixSeconds`.
+    const timestamp = asUnixSeconds(data.timestamp);
+    if (timestamp === undefined) {
+        logger?.debug(invalidTimestampDetail('receipt', data.timestamp), 'receipt adapter: missing or invalid timestamp');
+        return null;
+    }
+    const { receiptType, raw: receiptTypeRaw } = parseReceiptType(data.type);
     return {
         type: 'receipt',
         chatJid: chat,
@@ -750,8 +800,9 @@ const adaptReceipt = (data, logger) => {
         isGroup,
         isFromMe: asBoolOr(src.is_from_me, false),
         messageIds: ids,
-        timestamp: toUnixSeconds(data.timestamp),
-        receiptType: parseReceiptType(data.type)
+        timestamp,
+        receiptType,
+        ...(receiptTypeRaw !== undefined ? { receiptTypeRaw } : {})
     };
 };
 const adaptContactUpdate = (data) => {
@@ -772,7 +823,8 @@ const adaptContactUpdate = (data) => {
     };
 };
 /**
- * Bridge wire `ReceiptType` → canonical kebab-cased variant.
+ * Bridge wire `ReceiptType` → canonical kebab-cased variant, preserving the
+ * original value when it matches nothing known.
  *
  * The bridge's generated `.d.ts` advertises `ReceiptType` as
  * `{type: "delivered"} | …`, but `#[serde(from = "String")]` on the rust
@@ -780,6 +832,12 @@ const adaptContactUpdate = (data) => {
  * bare PascalCase variant name (`"Delivered"`, `"Read"`, `"PeerMsg"`).
  * Keep both spellings here so a future bridge bump that re-introduces
  * the snake_case wire form keeps working.
+ *
+ * Unrecognized wire values arrive wrapped as `{ Other: value }` (the packed
+ * `ReceiptWireData.type` contract) or, defensively, as a future bare
+ * string. Those map to `'other'` with the original value in `raw`. The
+ * wrapper is trusted over spelling: `{ Other: 'Read' }` is `other`, not
+ * `read` (see `parseReceiptType`).
  */
 const RECEIPT_TYPE_MAP = {
     Delivered: 'delivered',
@@ -810,10 +868,22 @@ const RECEIPT_TYPE_MAP = {
     server_error: 'server-error'
 };
 const parseReceiptType = (raw) => {
+    // The `Other` wrapper is authoritative: the packed codec round-trips
+    // `{ Other: value }` verbatim and never synthesizes it for a known
+    // variant, so even a payload whose spelling collides with a known
+    // variant name (e.g. `{ Other: 'Read' }`) stays category `other` with
+    // its exact payload preserved. Only bare strings and `{ type }` go
+    // through the known-variant lookup.
+    if (isObject(raw) && typeof raw.Other === 'string')
+        return { receiptType: 'other', raw: raw.Other };
     const norm = typeof raw === 'string' ? raw : isObject(raw) && typeof raw.type === 'string' ? raw.type : undefined;
     if (norm == null)
-        return undefined;
-    return RECEIPT_TYPE_MAP[norm] ?? 'other';
+        return { receiptType: undefined };
+    // Own-property lookup: the table is an ordinary object, so indexing an
+    // unknown bare name like 'constructor' or '__proto__' would otherwise
+    // return an inherited value instead of falling through to 'other'.
+    const mapped = Object.hasOwn(RECEIPT_TYPE_MAP, norm) ? RECEIPT_TYPE_MAP[norm] : undefined;
+    return mapped ? { receiptType: mapped } : { receiptType: 'other', raw: norm };
 };
 const adaptStarUpdate = (data) => {
     if (!isObject(data))
@@ -854,6 +924,13 @@ const adaptIncomingCall = (data, logger) => {
         logger?.debug({ data }, 'incoming_call adapter: missing action.type/call_id');
         return null;
     }
+    // The call offer is timeline-ordered by its timestamp downstream; an
+    // unparseable one drops the event rather than dating it at the epoch.
+    const timestamp = asUnixSeconds(data.timestamp);
+    if (timestamp === undefined) {
+        logger?.debug(invalidTimestampDetail('incoming_call', data.timestamp), 'incoming_call adapter: missing or invalid timestamp');
+        return null;
+    }
     const canonicalAction = {
         type: actionType,
         callId,
@@ -876,7 +953,7 @@ const adaptIncomingCall = (data, logger) => {
     return {
         type: 'incomingCall',
         from: asJidAddressString(data.from) ?? from,
-        timestamp: toUnixSeconds(data.timestamp),
+        timestamp,
         offline: asBoolOr(data.offline, false),
         stanzaId: asString(data.stanza_id),
         notify: asString(data.notify),
@@ -1108,6 +1185,11 @@ const adaptGroupUpdate = (data, logger) => {
         logger?.warn({ data }, 'group_update adapter: action shape rejected');
         return null;
     }
+    const timestamp = asUnixSeconds(data.timestamp);
+    if (timestamp === undefined) {
+        logger?.debug(invalidTimestampDetail('group_update', data.timestamp), 'group_update adapter: missing or invalid timestamp');
+        return null;
+    }
     return {
         type: 'groupUpdate',
         groupJid,
@@ -1117,7 +1199,7 @@ const adaptGroupUpdate = (data, logger) => {
         authorPn: asJidString(data.participant_pn),
         authorUsername: asString(data.participant_username),
         authorCountryCode: asString(data.participant_country_code),
-        timestamp: toUnixSeconds(data.timestamp),
+        timestamp,
         isLidAddressingMode: asBoolOr(data.is_lid_addressing_mode, false),
         action
     };

package/lib/Bridge/types.d.ts

@@ -172,6 +172,17 @@ export interface CanonicalReceipt {
      * `readTimestamp` / `playedTimestamp` slot in the emitted update.
      */
     receiptType?: 'delivered' | 'sent' | 'sender' | 'retry' | 'enc-rekey-retry' | 'read' | 'read-self' | 'played' | 'played-self' | 'inactive' | 'peer-msg' | 'history-sync' | 'server-error' | 'other';
+    /**
+     * Original wire value when `receiptType` is `'other'` — the bridge sends
+     * unrecognized variants as `{ Other: value }` (or a future bare string),
+     * and the category alone would lose which one it was. Always set for an
+     * `Other`-wrapped payload, even when its spelling collides with a known
+     * variant name: the wrapper means the producer did not recognize it.
+     * Absent whenever the value matched a known variant through a bare
+     * string or `{ type }` shape, and whenever `receiptType` itself is
+     * absent.
+     */
+    receiptTypeRaw?: string;
 }
 export interface CanonicalContactUpdate {
     type: 'contactUpdate';

package/lib/Socket/index.js

@@ -454,7 +454,13 @@ const makeWASocket = (config) => {
         }
         if (useNativeMemory)
             logger.debug('auth: using socket-local native memory backend');
-        const created = await createWhatsAppClient(makeTransport(fullConfig), makeHttpClient(fullConfig), eventHandlers, bridgeStore, fullConfig.cache ?? null, fullConfig.version, fullConfig.wantedPreKeyCount ?? null);
+        const created = await createWhatsAppClient(makeTransport(fullConfig), makeHttpClient(fullConfig), eventHandlers, bridgeStore, fullConfig.cache ?? null, fullConfig.version, fullConfig.wantedPreKeyCount ?? null, 
+        // Passed through exactly as configured, never normalized by truthiness:
+        // the bridge only honours a literal `true` here and rejects any
+        // other truthy value at construction, so a `!!`/ternary-style
+        // coercion could promote a malformed opt-out into an opt-in.
+        // Absent stays strict.
+        fullConfig.dangerSkipCertChainVerify);
         // `end()` can land while the client is still being built — a `sock.end()`
         // or `await using` right after `makeWASocket()` does exactly that. When
         // it has, `adopt` frees this client and tells us to stop: nothing else

package/lib/Socket/terminal-close-reporter.d.ts

@@ -1,6 +1,13 @@
 /**
- * Reports the terminal `connection.update { close }` — exactly once, after
- * teardown, and never silently not at all.
+ * Reports the terminal `connection.update { close }` — exactly once, and
+ * never silently not at all.
+ *
+ * The accepted claim publishes after its teardown settles, so a consumer that
+ * answers the close with a replacement socket does not overlap the old one's
+ * release. The watchdog is the deliberate exception: past the timeout the
+ * close goes out with teardown still running (and logged), because losing the
+ * event entirely is the worse failure. Nothing here promises that every close
+ * lands after every resource is released — only that at most one close lands.
  *
  * That sentence is the whole contract this branch sells, and getting it wrong
  * has two opposite failure modes, both bad:
@@ -8,9 +15,8 @@
  *  - **Not reported.** The consumer's handler never runs, so it never builds a
  *    replacement socket. A bot offline with nothing in its logs — the original
  *    bug this branch exists to fix.
- *  - **Reported early, or twice.** The replacement socket overlaps the old
- *    one's auth-store flush and `free()`, or every listener sees two terminal
- *    notifications for one socket and a handler that cleans up on close loops.
+ *  - **Reported twice.** Every listener sees two terminal notifications for
+ *    one socket and a handler that cleans up on close loops.
  *
  * Keeping both away used to be inline logic split across the dispatcher hook
  * and `logout()`, sharing a counter and a promise. Nine separate bugs came out
@@ -41,13 +47,26 @@ export interface TerminalCloseReporter {
      *
      * Never rejects and never leaves `publish` uncalled: teardown failures are
      * logged, a throwing listener is contained, and a teardown that hangs is
-     * cut short by the watchdog.
+     * reported past by the watchdog.
+     *
+     * Idempotent per socket: the first claim wins and every later call is
+     * ignored entirely — neither its teardown nor its publish is invoked. A
+     * socket never gets a second generation — a terminal close means "build a
+     * new socket" — so a second terminal event (a logout racing a dispatcher
+     * close, a late duplicate dispatch) must not publish again.
+     *
+     * The watchdog bounds how long `published()` waits, not the teardown
+     * itself: it neither cancels nor settles the underlying teardown, and a
+     * teardown that finishes late publishes nothing further.
      */
     reportAfter: (teardown: () => Promise<void>, publish: () => void) => void;
     /**
      * Publish immediately, for a close nothing else will announce — a `logout()`
      * with no live client, or one whose `logout()` threw before the bridge
      * dispatched anything.
+     *
+     * Part of the same single claim as `reportAfter`: a no-op when a close
+     * was already claimed.
      */
     reportNow: (publish: () => void) => void;
     /**
@@ -63,11 +82,13 @@ export interface TerminalCloseReporter {
      */
     hasReported: () => boolean;
     /**
-     * Settles once the most recent report has been published — the moment the
+     * Settles once the single report has been published — the moment the
      * consumer sees it, not the moment teardown finishes, so a waiter is not
      * left hanging when the watchdog is what released the event.
      *
-     * Resolves immediately when nothing has been reported.
+     * Resolves immediately when nothing has been reported. Every waiter
+     * observes the same promise, so concurrent `logout()` and dispatcher
+     * paths cannot split across generations.
      */
     published: () => Promise<void>;
 }

package/lib/Socket/terminal-close-reporter.js

@@ -1,6 +1,13 @@
 /**
- * Reports the terminal `connection.update { close }` — exactly once, after
- * teardown, and never silently not at all.
+ * Reports the terminal `connection.update { close }` — exactly once, and
+ * never silently not at all.
+ *
+ * The accepted claim publishes after its teardown settles, so a consumer that
+ * answers the close with a replacement socket does not overlap the old one's
+ * release. The watchdog is the deliberate exception: past the timeout the
+ * close goes out with teardown still running (and logged), because losing the
+ * event entirely is the worse failure. Nothing here promises that every close
+ * lands after every resource is released — only that at most one close lands.
  *
  * That sentence is the whole contract this branch sells, and getting it wrong
  * has two opposite failure modes, both bad:
@@ -8,9 +15,8 @@
  *  - **Not reported.** The consumer's handler never runs, so it never builds a
  *    replacement socket. A bot offline with nothing in its logs — the original
  *    bug this branch exists to fix.
- *  - **Reported early, or twice.** The replacement socket overlaps the old
- *    one's auth-store flush and `free()`, or every listener sees two terminal
- *    notifications for one socket and a handler that cleans up on close loops.
+ *  - **Reported twice.** Every listener sees two terminal notifications for
+ *    one socket and a handler that cleans up on close loops.
  *
  * Keeping both away used to be inline logic split across the dispatcher hook
  * and `logout()`, sharing a counter and a promise. Nine separate bugs came out
@@ -35,9 +41,24 @@ export const TERMINAL_CLOSE_PUBLISH_TIMEOUT_MS = 60000;
 export const makeTerminalCloseReporter = (opts) => {
     const { logger } = opts;
     const publishTimeoutMs = opts.publishTimeoutMs ?? TERMINAL_CLOSE_PUBLISH_TIMEOUT_MS;
-    /** Claims, not deliveries — see `hasReported`. */
+    /**
+     * Claims, not deliveries — see `hasReported`. At most one: a socket has a
+     * single terminal generation, so the first claim wins and later ones are
+     * ignored rather than published.
+     */
     let claimed = 0;
     let publishedPromise;
+    /**
+     * True once the single terminal generation has been claimed. Deliberately
+     * log-free: a duplicate arrives on a path whose logger is
+     * consumer-replaceable, and an ignored signal must never throw.
+     */
+    const claim = () => {
+        if (claimed > 0)
+            return false;
+        claimed++;
+        return true;
+    };
     /** One publish per claim, whatever gets there first, and never throwing. */
     const makeOnce = (publish, settle) => {
         let done = false;
@@ -59,7 +80,8 @@ export const makeTerminalCloseReporter = (opts) => {
     };
     return {
         reportAfter: (teardown, publish) => {
-            claimed++;
+            if (!claim())
+                return;
             let settle;
             publishedPromise = new Promise(resolve => {
                 settle = resolve;
@@ -94,7 +116,8 @@ export const makeTerminalCloseReporter = (opts) => {
             }
         },
         reportNow: publish => {
-            claimed++;
+            if (!claim())
+                return;
             let settle;
             publishedPromise = new Promise(resolve => {
                 settle = resolve;

package/lib/Socket/unsupported-config.d.ts

@@ -33,7 +33,7 @@ export declare const UNSUPPORTED_CONFIG_KEYS: readonly ["keepAliveIntervalMs", "
  * member of `SocketConfig` belongs to neither list — which is exactly how the
  * first version of the catalog shipped twelve keys short.
  */
-export declare const READ_CONFIG_KEYS: readonly ["waWebSocketUrl", "options", "logger", "version", "browser", "pushName", "auth", "cache", "deviceProps", "wantedPreKeyCount", "emitOwnEvents", "shouldIgnoreJid", "defaultQueryTimeoutMs", "transactionOpts", "makeSignalRepository"];
+export declare const READ_CONFIG_KEYS: readonly ["waWebSocketUrl", "options", "logger", "version", "browser", "pushName", "auth", "cache", "deviceProps", "wantedPreKeyCount", "dangerSkipCertChainVerify", "emitOwnEvents", "shouldIgnoreJid", "defaultQueryTimeoutMs", "transactionOpts", "makeSignalRepository"];
 /**
  * Which unsupported options this caller actually passed.
  *

package/lib/Socket/unsupported-config.js

@@ -98,6 +98,7 @@ export const READ_CONFIG_KEYS = [
     'cache',
     'deviceProps',
     'wantedPreKeyCount',
+    'dangerSkipCertChainVerify',
     'emitOwnEvents',
     'shouldIgnoreJid',
     'defaultQueryTimeoutMs',

package/lib/Types/Socket.d.ts

@@ -93,6 +93,14 @@ export type SocketConfig = {
      * generated and encoded in one shot). Must be set before connecting.
      */
     wantedPreKeyCount?: number;
+    /**
+     * Testing-only bypass for the Noise server-cert chain check, for mock
+     * servers that cannot sign a chain rooted in WhatsApp's issuer. Strict by
+     * default: absent, null and false all verify, and only a literal `true`
+     * opts in — the bridge rejects any other truthy value at construction
+     * rather than treating it as opt-in. Never set this outside tests.
+     */
+    dangerSkipCertChainVerify?: boolean;
     /** @deprecated QR timeout is handled by the bridge connection state machine. */
     qrTimeout?: number;
     /** Maximum retry count. */