@oxidezap/baileyrs 0.2.11 → 0.2.13

package/lib/Bridge/index.d.ts

@@ -8,5 +8,5 @@
  */
 export { adaptBridgeEvent, adaptBridgeMessageWire, KNOWN_BRIDGE_EVENT_TYPES } from './adapt.js';
 export * from './types.js';
-export { asBool, asBoolOr, asJidString, asNumber, asString, bridgeJidToString, isBridgeJid, isObject, normalizeDiscriminator, toUnixSeconds } from './primitives.js';
+export { asBool, asBoolOr, asJidString, asNumber, asString, asUnixSeconds, bridgeJidToString, isBridgeJid, isObject, normalizeDiscriminator, toUnixSeconds } from './primitives.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/Bridge/index.js

@@ -8,5 +8,5 @@
  */
 export { adaptBridgeEvent, adaptBridgeMessageWire, KNOWN_BRIDGE_EVENT_TYPES } from './adapt.js';
 export * from './types.js';
-export { asBool, asBoolOr, asJidString, asNumber, asString, bridgeJidToString, isBridgeJid, isObject, normalizeDiscriminator, toUnixSeconds } from './primitives.js';
+export { asBool, asBoolOr, asJidString, asNumber, asString, asUnixSeconds, bridgeJidToString, isBridgeJid, isObject, normalizeDiscriminator, toUnixSeconds } from './primitives.js';
 //# sourceMappingURL=index.js.map

package/lib/Bridge/primitives.d.ts

@@ -50,16 +50,28 @@ export declare const asJidAddressString: (x: unknown) => string | undefined;
  * strings — the bridge serializes `DateTime<Utc>` as a string unless the field
  * names one of chrono's `ts_*` modules, so being lenient about which of the two
  * arrives insulates us from drift.
+ *
+ * Absence and unparseable input stay absent (`undefined`): a missing,
+ * malformed, or non-finite timestamp must never become the epoch, which
+ * would place the event at 1970 and corrupt timeline ordering. Callers
+ * apply the per-field policy explicitly — required timestamps (message,
+ * receipt, call, group action) drop the event, optional ones (presence
+ * `last_seen`, server-ack time, pin/mute time) omit the field.
  */
-export declare const toUnixSeconds: (raw: unknown) => number;
+export declare const asUnixSeconds: (raw: unknown) => number | undefined;
 /**
- * Same as `toUnixSeconds`, but absence stays absent.
+ * Validated coercion to unix seconds for external consumers that need a
+ * plain number (no `undefined` branch).
  *
- * The optional timestamps — `last_seen`, a server ack's `t`, an app-state
- * mutation's own time — mean "the server did not say" when missing, which is
- * not the same claim as the epoch.
+ * Accepts the same inputs as `asUnixSeconds` — a finite number or an RFC
+ * 3339 string — and rejects everything else by throwing `RangeError`
+ * instead of fabricating the epoch: a missing, malformed, or non-finite
+ * timestamp must never become 1970-01-01 and corrupt timeline ordering.
+ * Internal adapters do not use this; they take `asUnixSeconds` with an
+ * explicit per-field policy (required timestamps drop the event, optional
+ * ones omit the field).
  */
-export declare const asUnixSeconds: (raw: unknown) => number | undefined;
+export declare const toUnixSeconds: (raw: unknown) => number;
 /**
  * A 64-bit proto field, however the bridge chose to carry it.
  *

package/lib/Bridge/primitives.js

@@ -82,20 +82,13 @@ const parseRfc3339Seconds = (raw) => {
  * strings — the bridge serializes `DateTime<Utc>` as a string unless the field
  * names one of chrono's `ts_*` modules, so being lenient about which of the two
  * arrives insulates us from drift.
- */
-export const toUnixSeconds = (raw) => {
-    if (typeof raw === 'number' && Number.isFinite(raw))
-        return raw;
-    if (typeof raw === 'string')
-        return parseRfc3339Seconds(raw) ?? 0;
-    return 0;
-};
-/**
- * Same as `toUnixSeconds`, but absence stays absent.
  *
- * The optional timestamps — `last_seen`, a server ack's `t`, an app-state
- * mutation's own time — mean "the server did not say" when missing, which is
- * not the same claim as the epoch.
+ * Absence and unparseable input stay absent (`undefined`): a missing,
+ * malformed, or non-finite timestamp must never become the epoch, which
+ * would place the event at 1970 and corrupt timeline ordering. Callers
+ * apply the per-field policy explicitly — required timestamps (message,
+ * receipt, call, group action) drop the event, optional ones (presence
+ * `last_seen`, server-ack time, pin/mute time) omit the field.
  */
 export const asUnixSeconds = (raw) => {
     if (typeof raw === 'number' && Number.isFinite(raw))
@@ -104,6 +97,26 @@ export const asUnixSeconds = (raw) => {
         return parseRfc3339Seconds(raw);
     return undefined;
 };
+/**
+ * Validated coercion to unix seconds for external consumers that need a
+ * plain number (no `undefined` branch).
+ *
+ * Accepts the same inputs as `asUnixSeconds` — a finite number or an RFC
+ * 3339 string — and rejects everything else by throwing `RangeError`
+ * instead of fabricating the epoch: a missing, malformed, or non-finite
+ * timestamp must never become 1970-01-01 and corrupt timeline ordering.
+ * Internal adapters do not use this; they take `asUnixSeconds` with an
+ * explicit per-field policy (required timestamps drop the event, optional
+ * ones omit the field).
+ */
+export const toUnixSeconds = (raw) => {
+    const parsed = asUnixSeconds(raw);
+    if (parsed === undefined) {
+        const preview = typeof raw === 'string' ? `: ${raw.slice(0, 80)}` : '';
+        throw new RangeError(`toUnixSeconds: cannot coerce ${typeof raw}${preview} to unix seconds`);
+    }
+    return parsed;
+};
 /**
  * A 64-bit proto field, however the bridge chose to carry it.
  *

package/lib/Bridge/schema.js

@@ -24,7 +24,7 @@
  */
 import { processHistoryMessage } from '../Utils/process-history-message.js';
 import { isJidGroup } from '../WABinary/jid-utils.js';
-import { absoluteFromDuration, asBool, asBoolOr, asStringArray, asDurationSeconds, asInt64, asJidAddressString, asJidString, asNumber, asString, asUnixSeconds, isObject, normalizeDiscriminator, toUnixSeconds } from './primitives.js';
+import { absoluteFromDuration, asBool, asBoolOr, asStringArray, asDurationSeconds, asInt64, asJidAddressString, asJidString, asNumber, asString, asUnixSeconds, isObject, normalizeDiscriminator } from './primitives.js';
 /**
  * Bridge sync-action events (`pin_update`, `mute_update`, etc.) carry the
  * proto action under `data.action`, but the bridge `.d.ts` types it as
@@ -39,6 +39,17 @@ const extractAction = (data) => isObject(data?.action) ? data.action : undefined
 const resolveIsGroup = (wireValue, chatJid) => asBoolOr(wireValue, false) || isJidGroup(chatJid) === true;
 const resolveParticipantAlt = (senderAlt, isGroup) => isGroup ? senderAlt : undefined;
 const resolveRemoteJidAlt = (senderAlt, recipientAlt, isGroup, isFromMe) => (isGroup ? undefined : isFromMe ? recipientAlt : senderAlt);
+/**
+ * Rejection diagnostic for a required timestamp that is missing or
+ * unparseable. Metadata only — never the payload: these objects can carry
+ * message bodies and JIDs.
+ */
+const invalidTimestampDetail = (event, raw) => ({
+    event,
+    field: 'timestamp',
+    reason: raw === undefined || raw === null ? 'missing' : 'invalid',
+    receivedType: typeof raw
+});
 const parseEditAttribute = (value) => {
     switch (value) {
         case '1':
@@ -141,7 +152,7 @@ const ADAPTERS = {
             error: asString(data?.error)
         };
     },
-    undecryptable_message: data => {
+    undecryptable_message: (data, logger) => {
         // Bridge ships `{ info: MessageInfo, is_unavailable, unavailable_type,
         // decrypt_fail_mode }` — same MessageInfo shape as the regular
         // `message` event. Extract the chat / sender / id so the dispatcher
@@ -161,12 +172,17 @@ const ADAPTERS = {
         const isFromMe = asBoolOr(src.is_from_me, false);
         const senderAlt = asJidString(src.sender_alt);
         const recipientAlt = asJidString(src.recipient_alt);
+        const timestamp = asUnixSeconds(info.timestamp);
+        if (timestamp === undefined) {
+            logger?.debug(invalidTimestampDetail('undecryptable_message', info.timestamp), 'undecryptable_message adapter: missing or invalid timestamp');
+            return null;
+        }
         return {
             type: 'undecryptableMessage',
             chatJid: chat,
             senderJid: isGroup ? asJidString(src.sender) : undefined,
             id,
-            timestamp: toUnixSeconds(info.timestamp),
+            timestamp,
             isFromMe,
             isGroup,
             pushName: asString(info.push_name),
@@ -386,28 +402,38 @@ const ADAPTERS = {
     call_log_sync: () => ({ type: 'noop', bridgeType: 'call_log_sync' }),
     // ── Calls ──
     incoming_call: (data, logger) => adaptIncomingCall(data, logger),
-    missed_call: data => {
+    missed_call: (data, logger) => {
         const from = asJidString(data?.from);
         const callId = asString(data?.call_id);
         if (!from || !callId)
             return null;
+        const timestamp = asUnixSeconds(data?.timestamp);
+        if (timestamp === undefined) {
+            logger?.debug(invalidTimestampDetail('missed_call', data?.timestamp), 'missed_call adapter: missing or invalid timestamp');
+            return null;
+        }
         return {
             type: 'incomingCall',
             from,
-            timestamp: toUnixSeconds(data?.timestamp),
+            timestamp,
             offline: data?.reason === 'offline',
             action: { type: 'timeout', callId }
         };
     },
-    call_ended_elsewhere: data => {
+    call_ended_elsewhere: (data, logger) => {
         const from = asJidString(data?.from);
         const callId = asString(data?.call_id);
         if (!from || !callId)
             return null;
+        const timestamp = asUnixSeconds(data?.timestamp);
+        if (timestamp === undefined) {
+            logger?.debug(invalidTimestampDetail('call_ended_elsewhere', data?.timestamp), 'call_ended_elsewhere adapter: missing or invalid timestamp');
+            return null;
+        }
         return {
             type: 'incomingCall',
             from,
-            timestamp: toUnixSeconds(data?.timestamp),
+            timestamp,
             offline: false,
             action: { type: data?.outcome === 'accepted' ? 'accept' : 'reject', callId }
         };
@@ -680,6 +706,15 @@ export const adaptBridgeMessageWire = (messageProto, info, logger) => {
     const isFromMe = asBoolOr(info.isFromMe, false);
     const senderAlt = asString(info.senderAlt);
     const recipientAlt = asString(info.recipientAlt);
+    // The packed envelope carries the timestamp as a numeric record, so the
+    // only invalid shapes here are a missing or non-finite value. Like the
+    // object route below, those drop the message rather than dating it at
+    // the epoch.
+    const timestamp = asNumber(info.timestamp);
+    if (timestamp === undefined) {
+        logger?.debug(invalidTimestampDetail('message_wire', info.timestamp), 'message wire adapter: missing or invalid timestamp');
+        return null;
+    }
     return {
         type: 'message',
         chatJid: chat,
@@ -687,7 +722,7 @@ export const adaptBridgeMessageWire = (messageProto, info, logger) => {
         isGroup,
         isFromMe,
         id,
-        timestamp: asNumber(info.timestamp) ?? 0,
+        timestamp,
         pushName: asString(info.pushName),
         participantAlt: resolveParticipantAlt(senderAlt, isGroup),
         remoteJidAlt: resolveRemoteJidAlt(senderAlt, recipientAlt, isGroup, isFromMe),
@@ -712,6 +747,11 @@ const adaptMessageParts = (info, messageProto, logger) => {
     const senderJid = isGroup ? asJidString(senderRaw) : undefined;
     const senderAlt = asJidString(src.sender_alt);
     const recipientAlt = asJidString(src.recipient_alt);
+    const timestamp = asUnixSeconds(info.timestamp);
+    if (timestamp === undefined) {
+        logger?.debug(invalidTimestampDetail('message', info.timestamp), 'message adapter: missing or invalid timestamp');
+        return null;
+    }
     return {
         type: 'message',
         chatJid: chat,
@@ -719,7 +759,7 @@ const adaptMessageParts = (info, messageProto, logger) => {
         isGroup,
         isFromMe,
         id,
-        timestamp: toUnixSeconds(info.timestamp),
+        timestamp,
         pushName: asString(info.push_name),
         participantAlt: resolveParticipantAlt(senderAlt, isGroup),
         remoteJidAlt: resolveRemoteJidAlt(senderAlt, recipientAlt, isGroup, isFromMe),
@@ -743,6 +783,16 @@ const adaptReceipt = (data, logger) => {
         return null;
     }
     const isGroup = resolveIsGroup(src.is_group, chat);
+    // A receipt without a trustworthy timestamp cannot be placed on any
+    // timeline slot (`readTimestamp` / `playedTimestamp` /
+    // `receiptTimestamp`), so the event is dropped rather than dated at the
+    // epoch. Optional timestamps elsewhere stay absent via `asUnixSeconds`.
+    const timestamp = asUnixSeconds(data.timestamp);
+    if (timestamp === undefined) {
+        logger?.debug(invalidTimestampDetail('receipt', data.timestamp), 'receipt adapter: missing or invalid timestamp');
+        return null;
+    }
+    const { receiptType, raw: receiptTypeRaw } = parseReceiptType(data.type);
     return {
         type: 'receipt',
         chatJid: chat,
@@ -750,8 +800,9 @@ const adaptReceipt = (data, logger) => {
         isGroup,
         isFromMe: asBoolOr(src.is_from_me, false),
         messageIds: ids,
-        timestamp: toUnixSeconds(data.timestamp),
-        receiptType: parseReceiptType(data.type)
+        timestamp,
+        receiptType,
+        ...(receiptTypeRaw !== undefined ? { receiptTypeRaw } : {})
     };
 };
 const adaptContactUpdate = (data) => {
@@ -772,7 +823,8 @@ const adaptContactUpdate = (data) => {
     };
 };
 /**
- * Bridge wire `ReceiptType` → canonical kebab-cased variant.
+ * Bridge wire `ReceiptType` → canonical kebab-cased variant, preserving the
+ * original value when it matches nothing known.
  *
  * The bridge's generated `.d.ts` advertises `ReceiptType` as
  * `{type: "delivered"} | …`, but `#[serde(from = "String")]` on the rust
@@ -780,6 +832,12 @@ const adaptContactUpdate = (data) => {
  * bare PascalCase variant name (`"Delivered"`, `"Read"`, `"PeerMsg"`).
  * Keep both spellings here so a future bridge bump that re-introduces
  * the snake_case wire form keeps working.
+ *
+ * Unrecognized wire values arrive wrapped as `{ Other: value }` (the packed
+ * `ReceiptWireData.type` contract) or, defensively, as a future bare
+ * string. Those map to `'other'` with the original value in `raw`. The
+ * wrapper is trusted over spelling: `{ Other: 'Read' }` is `other`, not
+ * `read` (see `parseReceiptType`).
  */
 const RECEIPT_TYPE_MAP = {
     Delivered: 'delivered',
@@ -810,10 +868,22 @@ const RECEIPT_TYPE_MAP = {
     server_error: 'server-error'
 };
 const parseReceiptType = (raw) => {
+    // The `Other` wrapper is authoritative: the packed codec round-trips
+    // `{ Other: value }` verbatim and never synthesizes it for a known
+    // variant, so even a payload whose spelling collides with a known
+    // variant name (e.g. `{ Other: 'Read' }`) stays category `other` with
+    // its exact payload preserved. Only bare strings and `{ type }` go
+    // through the known-variant lookup.
+    if (isObject(raw) && typeof raw.Other === 'string')
+        return { receiptType: 'other', raw: raw.Other };
     const norm = typeof raw === 'string' ? raw : isObject(raw) && typeof raw.type === 'string' ? raw.type : undefined;
     if (norm == null)
-        return undefined;
-    return RECEIPT_TYPE_MAP[norm] ?? 'other';
+        return { receiptType: undefined };
+    // Own-property lookup: the table is an ordinary object, so indexing an
+    // unknown bare name like 'constructor' or '__proto__' would otherwise
+    // return an inherited value instead of falling through to 'other'.
+    const mapped = Object.hasOwn(RECEIPT_TYPE_MAP, norm) ? RECEIPT_TYPE_MAP[norm] : undefined;
+    return mapped ? { receiptType: mapped } : { receiptType: 'other', raw: norm };
 };
 const adaptStarUpdate = (data) => {
     if (!isObject(data))
@@ -854,6 +924,13 @@ const adaptIncomingCall = (data, logger) => {
         logger?.debug({ data }, 'incoming_call adapter: missing action.type/call_id');
         return null;
     }
+    // The call offer is timeline-ordered by its timestamp downstream; an
+    // unparseable one drops the event rather than dating it at the epoch.
+    const timestamp = asUnixSeconds(data.timestamp);
+    if (timestamp === undefined) {
+        logger?.debug(invalidTimestampDetail('incoming_call', data.timestamp), 'incoming_call adapter: missing or invalid timestamp');
+        return null;
+    }
     const canonicalAction = {
         type: actionType,
         callId,
@@ -876,7 +953,7 @@ const adaptIncomingCall = (data, logger) => {
     return {
         type: 'incomingCall',
         from: asJidAddressString(data.from) ?? from,
-        timestamp: toUnixSeconds(data.timestamp),
+        timestamp,
         offline: asBoolOr(data.offline, false),
         stanzaId: asString(data.stanza_id),
         notify: asString(data.notify),
@@ -1108,6 +1185,11 @@ const adaptGroupUpdate = (data, logger) => {
         logger?.warn({ data }, 'group_update adapter: action shape rejected');
         return null;
     }
+    const timestamp = asUnixSeconds(data.timestamp);
+    if (timestamp === undefined) {
+        logger?.debug(invalidTimestampDetail('group_update', data.timestamp), 'group_update adapter: missing or invalid timestamp');
+        return null;
+    }
     return {
         type: 'groupUpdate',
         groupJid,
@@ -1117,7 +1199,7 @@ const adaptGroupUpdate = (data, logger) => {
         authorPn: asJidString(data.participant_pn),
         authorUsername: asString(data.participant_username),
         authorCountryCode: asString(data.participant_country_code),
-        timestamp: toUnixSeconds(data.timestamp),
+        timestamp,
         isLidAddressingMode: asBoolOr(data.is_lid_addressing_mode, false),
         action
     };

package/lib/Bridge/types.d.ts

@@ -172,6 +172,17 @@ export interface CanonicalReceipt {
      * `readTimestamp` / `playedTimestamp` slot in the emitted update.
      */
     receiptType?: 'delivered' | 'sent' | 'sender' | 'retry' | 'enc-rekey-retry' | 'read' | 'read-self' | 'played' | 'played-self' | 'inactive' | 'peer-msg' | 'history-sync' | 'server-error' | 'other';
+    /**
+     * Original wire value when `receiptType` is `'other'` — the bridge sends
+     * unrecognized variants as `{ Other: value }` (or a future bare string),
+     * and the category alone would lose which one it was. Always set for an
+     * `Other`-wrapped payload, even when its spelling collides with a known
+     * variant name: the wrapper means the producer did not recognize it.
+     * Absent whenever the value matched a known variant through a bare
+     * string or `{ type }` shape, and whenever `receiptType` itself is
+     * absent.
+     */
+    receiptTypeRaw?: string;
 }
 export interface CanonicalContactUpdate {
     type: 'contactUpdate';

package/lib/Compatibility/encode-proto.d.ts

@@ -1,12 +1,16 @@
 /**
- * `encodeProto`, with the two inputs the bridge codec stopped accepting put back.
+ * `encodeProto`, with the three inputs the bridge codec refuses put back.
  *
  * From 0.8.0 the codec refuses an empty string where the schema declares a
  * 64-bit integer, and an unpaired surrogate in a text field. Both were written
  * before — as `0` and as U+FFFD — and upstream Baileys still encodes both, so a
  * message that used to reach the server would now throw in the caller's face.
- * This is where that is absorbed, so the strict contract stays true of the
- * bridge and the tolerant one stays true of this library.
+ * The codec also refuses enum names where the schema declares an enum
+ * (issue #109: `"NONE"` where an int32 goes on the wire), which upstream's
+ * `fromObject` resolves and its direct `encode` coerces — that repair lives in
+ * `repairProtoMessage`, next to the other two. This is where all three are
+ * absorbed, so the strict contract stays true of the bridge and the tolerant
+ * one stays true of this library.
  *
  * Repair on failure rather than check on write: the ordinary encode is exactly
  * the call it was before, with no scan of any field, and the repair runs only

package/lib/Compatibility/encode-proto.js

@@ -1,14 +1,18 @@
 import { encodeProto } from '@oxidezap/whatsapp-rust-bridge';
 import { repairProtoMessage } from './proto-runtime.js';
 /**
- * `encodeProto`, with the two inputs the bridge codec stopped accepting put back.
+ * `encodeProto`, with the three inputs the bridge codec refuses put back.
  *
  * From 0.8.0 the codec refuses an empty string where the schema declares a
  * 64-bit integer, and an unpaired surrogate in a text field. Both were written
  * before — as `0` and as U+FFFD — and upstream Baileys still encodes both, so a
  * message that used to reach the server would now throw in the caller's face.
- * This is where that is absorbed, so the strict contract stays true of the
- * bridge and the tolerant one stays true of this library.
+ * The codec also refuses enum names where the schema declares an enum
+ * (issue #109: `"NONE"` where an int32 goes on the wire), which upstream's
+ * `fromObject` resolves and its direct `encode` coerces — that repair lives in
+ * `repairProtoMessage`, next to the other two. This is where all three are
+ * absorbed, so the strict contract stays true of the bridge and the tolerant
+ * one stays true of this library.
  *
  * Repair on failure rather than check on write: the ordinary encode is exactly
  * the call it was before, with no scan of any field, and the repair runs only
@@ -22,8 +26,9 @@ export const encodeProtoCompat = (path, message) => {
     catch (error) {
         const repaired = repairProtoMessage(path, message);
         // Reference equality: nothing was coerced, so the failure is something this
-        // does not explain — an unmodelled type, a number no int64 can hold — and
-        // it has to keep propagating rather than be retried into a second throw.
+        // does not explain — an unmodelled type, a number no int64 can hold, an
+        // unknown enum name — and it has to keep propagating rather than be
+        // retried into a second throw.
         if (repaired === message)
             throw error;
         return encodeProto(path, repaired);

package/lib/Compatibility/proto-runtime.js

@@ -53,7 +53,7 @@ const UNPAIRED_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBF
 /**
  * Puts back what the codec used to do with an input it now refuses.
  *
- * Two cases, both measured against upstream Baileys, which still encodes both:
+ * Three cases, all measured against upstream Baileys, which still encodes them:
  *
  * - An empty string where the schema declares a 64-bit integer. Every one of the
  *   134 send-path failures this addresses carried exactly `''`; a string that is
@@ -62,6 +62,13 @@ const UNPAIRED_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBF
  * - An unpaired surrogate in a text field, replaced with U+FFFD. That is the
  *   substitution `TextEncoder` used to make, so the bytes are unchanged from what
  *   this library sent before.
+ * - An enum name where the schema declares an enum (issue #109: `"NONE"` where
+ *   an int32 goes on the wire). Upstream's `fromObject` resolves names to numbers
+ *   and its direct `encode` coerces any string with `| 0`, so a caller passing a
+ *   name never sees a throw. The bridge codec accepts only numbers (numeric
+ *   strings aside) and throws `invalid int32: "NONE"`. An unknown name is left to
+ *   throw rather than silenced to `0`: upstream's direct encode would write `0`
+ *   for it, but that puts a value on the wire nobody sent.
  *
  * Returns `item` itself when it has nothing to do, so the caller can tell a
  * repair from a failure it does not understand.
@@ -77,6 +84,36 @@ const repairScalar = (kind, item) => {
     const replaced = item.replace(UNPAIRED_SURROGATE, '\uFFFD');
     return replaced === item ? item : replaced;
 };
+/**
+ * Enum name to wire number, built per enum on the first repair that needs it.
+ *
+ * Only the repair path reads this, and only for a field that actually holds a
+ * string — a message the codec accepts never reaches here, and a numeric enum
+ * never touches a map. Each table is built once from the generated entries and
+ * then reused; an importer that never sends a refused value allocates nothing.
+ * A `Map` (not a plain object) so names like `__proto__` are keys, not hazards.
+ */
+let enumTablesById;
+const enumValueFor = (enumId, name) => {
+    if (enumId < 0 || enumId >= PROTO_ENUM_SCHEMAS.length)
+        return undefined;
+    enumTablesById ?? (enumTablesById = []);
+    let byName = enumTablesById[enumId];
+    if (byName === undefined) {
+        const entries = PROTO_ENUM_SCHEMAS[enumId]?.[1];
+        if (!entries)
+            return undefined;
+        byName = new Map();
+        for (let index = 0; index < entries.length; index += 2) {
+            const entryName = entries[index];
+            const entryValue = entries[index + 1];
+            if (typeof entryName === 'string' && typeof entryValue === 'number')
+                byName.set(entryName, entryValue);
+        }
+        enumTablesById[enumId] = byName;
+    }
+    return byName.get(name);
+};
 const longFromWords = (low, high, unsigned) => LongRuntime.fromBits(low, high, unsigned);
 /**
  * Split a decoded 64-bit value into the low/high words `longFromWords` takes.
@@ -254,12 +291,13 @@ const schemaIdFor = (path) => {
     return schemaIdsByPath.get(path);
 };
 /**
- * Coerces the two inputs the bridge codec stopped accepting back to what it
- * used to write, and returns `value` itself when there was nothing to coerce.
+ * Coerces the three inputs the bridge codec refuses back to what upstream
+ * Baileys writes, and returns `value` itself when there was nothing to coerce.
  *
  * Reference equality is the signal: the caller only reaches here after an
  * encode threw, and an unchanged result means the failure was something else
- * — a genuinely invalid number, a missing codec — which must keep propagating.
+ * — a genuinely invalid number, an unknown enum name, a missing codec — which
+ * must keep propagating.
  *
  * Copy-on-write throughout, like `projectForEncode`: a branch with nothing to
  * fix is shared, not rebuilt.
@@ -286,7 +324,16 @@ const repairMessage = (schemaId, value, ancestors) => {
         const current = value[field[0]];
         if (current === null || current === undefined)
             continue;
-        const repair = (item) => field[1] === PROTO_FIELD_KIND.message ? repairMessage(field[2], item, seen) : repairScalar(field[1], item);
+        const repair = (item) => {
+            if (field[1] === PROTO_FIELD_KIND.message)
+                return repairMessage(field[2], item, seen);
+            // `?? item`, not `|| item`: 0 is a valid wire value (e.g. `"NONE"`).
+            // Unknown names stay strings, so the retry still throws and the
+            // original failure keeps propagating instead of becoming a silent 0.
+            if (field[1] === PROTO_FIELD_KIND.enum && typeof item === 'string')
+                return enumValueFor(field[2], item) ?? item;
+            return repairScalar(field[1], item);
+        };
         let converted = current;
         if (field[3] & PROTO_FIELD_FLAG.repeated) {
             if (Array.isArray(current)) {
@@ -457,8 +504,8 @@ class ProtoCompatibilityRuntime {
                 throw new Error(`protobuf codec unavailable for ${path}`);
             const projected = this.projectForEncode(schemaId, message);
             const encoded = sourceCodec.encode(projected);
-            // The bridge refuses two inputs it used to accept silently, and upstream
-            // Baileys still encodes both. Repairing on failure rather than checking
+            // The bridge refuses three inputs it used to accept silently, and upstream
+            // Baileys still encodes all three. Repairing on failure rather than checking
             // every field on the way in is what keeps the ordinary encode free: a
             // message the codec accepts never reaches the repair, and one that does
             // not was already going to throw.

package/lib/Socket/events.js

@@ -22,7 +22,7 @@ import { buildGroupCreateStubMessage, buildGroupJoinRequestEvents, buildGroupNot
 import { emitMessageUpsert } from '../Compatibility/message-upsert.js';
 import { extractMessageCappingPayload } from './message-capping.js';
 import { mapReachoutTimelock } from './reachout.js';
-import { isReconnectableConnectFailure } from './terminal-close.js';
+import { isReconnectableConnectFailure, mapConnectFailureToDisconnect } from './terminal-close.js';
 const CANONICAL_MESSAGE_EVENT = 'message';
 const MESSAGE_UPSERT_APPEND = 'append';
 const MESSAGE_UPSERT_NOTIFY = 'notify';
@@ -191,41 +191,6 @@ const emitRetrying = (ctx) => ctx.ev.emit('connection.update', {
  * dispatcher for why `badSession` was the wrong home.
  */
 const CLIENT_OUTDATED_STATUS = 405;
-/**
- * Map bridge `ConnectFailureReason` wire codes (per the bridge's
- * `.d.ts` annotation) onto upstream Baileys' `DisconnectReason`.
- * Unknown codes fall through to `connectionClosed` so existing
- * reconnect heuristics keep working.
- *
- * Several cases here are belt-and-braces: the engine dispatches its own event
- * for `is_logged_out()` reasons (401/403/406) and for 405, so those never
- * reach `connectFailure` in practice. Kept because they cost nothing and the
- * engine's routing is not ours to depend on.
- */
-const mapConnectFailureToDisconnect = (reason) => {
-    switch (reason) {
-        case 401: // LoggedOut
-        case 403: // MainDeviceGone
-        case 406: // UnknownLogout
-            return DisconnectReason.loggedOut;
-        case 402: // TempBanned
-            return DisconnectReason.forbidden;
-        case 405: // ClientOutdated
-            return CLIENT_OUTDATED_STATUS;
-        case 411: // MultideviceMismatch (legacy alias)
-            return DisconnectReason.multideviceMismatch;
-        case 503: // ServiceUnavailable
-        case 501: // Experimental
-            return DisconnectReason.unavailableService;
-        case 408: // Timed out
-            return DisconnectReason.timedOut;
-        case 515: // RestartRequired
-            return DisconnectReason.restartRequired;
-        // 400, 409, 413, 414, 415, 418, 500, undefined → generic close
-        default:
-            return DisconnectReason.connectionClosed;
-    }
-};
 const describeTempBan = (code) => {
     switch (code) {
         case 101:

package/lib/Socket/groups.js

@@ -20,6 +20,27 @@ export const JOIN_APPROVAL_MODES = ['on', 'off'];
 // exact as a double, and that shape carries no methods. The helper reads both
 // forms, and reconstructs the high word instead of dropping it.
 const inviteExpirationNumber = (value) => toNumber(value);
+// The core's V4 join parser only accepts a `<group>`, `<community>` or
+// `<membership_approval_request>` child, but the server also answers a
+// successful join with a bare `<iq type="result">` (WA Web's own
+// `AcceptGroupAddResponseSuccess` variant requires no child at all — only the
+// result envelope whose `from` echoes the request's `to`). The core reports
+// that shape as an `IqError::ParseError`, which the bridge surfaces as
+// `kind: 'internal'`. Error stanzas never reach the parser (they become
+// `kind: 'server'` one layer below), so this substring can only mean the join
+// was accepted and the JID carrier is missing — never a rejection.
+const BARE_JOIN_SUCCESS_FRAGMENT = 'expected <group>, <community>, or <membership_approval_request> in join response';
+// A bare `<iq type="result">` join success, as described above. Anything else
+// (server rejections, timeouts, transport loss, protocol violations) must keep
+// propagating.
+const isBareJoinSuccess = (error) => {
+    if (!(error instanceof Error) || error.name !== 'WhatsAppError')
+        return false;
+    const kind = error.kind;
+    if (kind !== 'internal')
+        return false;
+    return typeof error.message === 'string' && error.message.includes(BARE_JOIN_SUCCESS_FRAGMENT);
+};
 export const makeGroupMethods = (ctx) => {
     const groupMetadata = async (jid) => {
         const metadata = await (await ctx.getClient()).getGroupMetadata(jid);
@@ -34,10 +55,22 @@ export const makeGroupMethods = (ctx) => {
     // oxlint-disable-next-line typescript/no-explicit-any -- the established public contract returns Promise<any>.
     ) => {
         const messageKey = typeof key === 'string' ? { remoteJid: key } : key;
-        if (!inviteMessage.groupJid || !inviteMessage.inviteCode || !messageKey.remoteJid) {
+        const groupJid = inviteMessage.groupJid;
+        if (!groupJid || !inviteMessage.inviteCode || !messageKey.remoteJid) {
             throw new TypeError('groupAcceptInviteV4 requires groupJid, inviteCode and inviter JID');
         }
-        const joinedJid = await (await ctx.getClient()).groupAcceptInviteV4(inviteMessage.groupJid, inviteMessage.inviteCode, inviteExpirationNumber(inviteMessage.inviteExpiration), messageKey.remoteJid);
+        let joinedJid;
+        try {
+            joinedJid = await (await ctx.getClient()).groupAcceptInviteV4(groupJid, inviteMessage.inviteCode, inviteExpirationNumber(inviteMessage.inviteExpiration), messageKey.remoteJid);
+        }
+        catch (error) {
+            // The join was accepted but the response carried no JID node.
+            // Baileys returns the envelope's `from` here, which echoes the
+            // request's `to` — the group JID we already hold.
+            if (!isBareJoinSuccess(error))
+                throw error;
+            joinedJid = groupJid;
+        }
         if (messageKey.id) {
             const expiredInvite = proto.Message.GroupInviteMessage.fromObject(inviteMessage);
             expiredInvite.inviteExpiration = 0;