@oxidezap/baileyrs 0.2.8 → 0.2.10

package/README.md

@@ -243,6 +243,19 @@ A few behaviors that differ from upstream — almost always to your advantage:
   `connectTimeoutMs`, `qrTimeout`, `printQRInTerminal`, `ignoreOfflineMessages`,
   `downloadHistory`, `agent`, `fetchAgent`, `mobile`, `mediaCache`,
   `userDevicesCache`, `callOfferCache` and `placeholderResendCache`.
+- **A sender's resend reaches you once, not once per delivery.** When a
+  sender's network is bad, their client re-runs its own outbox and sends the
+  same message again — same `key.id`, re-encrypted. Upstream Baileys emits a
+  `messages.upsert` for each of those deliveries, so an auto-reply bot answers
+  the same message two or three times; the engine now recognises the repeat and
+  emits one. It is a short-lived, in-memory window (five minutes), so the one
+  case still open is a sender whose retry spans a restart of your process. If
+  your handler has side effects, keying them on the whole `key` — `remoteJid`,
+  `id`, `fromMe` and `participant` — remains the thing that makes it safe. Not
+  on `id` alone: the id is the sending client's to choose, so two participants
+  of one group can pick the same one, and a handler that keys on it would drop
+  the second person's message rather than a duplicate. That is why the engine's
+  own check carries the sender too.
 - **`Boom` ships in the box.** baileyrs exports its own
   `@hapi/boom`-compatible `Boom`, so the existing
   `(err as Boom).output.statusCode` pattern works unchanged. If your

package/lib/Compatibility/legacy-store/codecs/basic.js

@@ -102,11 +102,18 @@ function tcTokenCodec() {
         },
         toLegacy(_key, value) {
             const native = fromJsonBytes(value);
-            return {
+            // Added rather than set to `undefined`, matching upstream, which
+            // only carries the field when it has a value. An undefined-valued
+            // key survives in memory but not through a store, and the mirror
+            // fingerprint is taken on both sides of that boundary — see the
+            // note in `canonicalize`.
+            const legacy = {
                 token: Buffer.from(requireByteArray(native.token, 'native TC token')),
-                timestamp: (native.token_timestamp ?? TimeValue.UNKNOWN_SECONDS).toString(),
-                senderTimestamp: native.sender_timestamp == null ? undefined : native.sender_timestamp.toString()
+                timestamp: (native.token_timestamp ?? TimeValue.UNKNOWN_SECONDS).toString()
             };
+            if (native.sender_timestamp != null)
+                legacy.senderTimestamp = native.sender_timestamp.toString();
+            return legacy;
         }
     };
 }

package/lib/Compatibility/legacy-store/codecs/signal.js

@@ -177,7 +177,16 @@ function coreEntryToLegacy(session) {
             messageKeys: messageKeysToLegacy(chain.messageKeys)
         };
     }
-    return {
+    // Both optional parts are *added* rather than set to `undefined`, which is
+    // what upstream does (`session_record.js` guards `if (this.pendingPreKey)`,
+    // `session_builder.js` guards `if (device.preKey)`). The distinction is
+    // invisible once the value reaches a store — JSON drops an undefined-valued
+    // key — but it is visible to the mirror fingerprint, which is taken from
+    // the live object on write and from the reloaded one on read. Emitting the
+    // key made those two disagree for every session without a pending pre-key,
+    // so the mirror was rejected on the next read and the record rebuilt from
+    // the projection, discarding the counter lease the rebuild cannot express.
+    const entry = {
         registrationId: session.registrationId,
         currentRatchet: {
             ephemeralKeyPair: {
@@ -196,15 +205,18 @@ function coreEntryToLegacy(session) {
             created: session.index.createdAtMs,
             remoteIdentityKey: toBase64(session.index.remoteIdentityKey)
         },
-        _chains: chains,
-        pendingPreKey: session.pendingPreKey
-            ? {
-                preKeyId: session.pendingPreKey.preKeyId,
-                signedKeyId: session.pendingPreKey.signedPreKeyId,
-                baseKey: toBase64(session.pendingPreKey.baseKey)
-            }
-            : undefined
+        _chains: chains
     };
+    if (session.pendingPreKey) {
+        entry.pendingPreKey = {
+            signedKeyId: session.pendingPreKey.signedPreKeyId,
+            baseKey: toBase64(session.pendingPreKey.baseKey)
+        };
+        if (session.pendingPreKey.preKeyId !== undefined) {
+            entry.pendingPreKey.preKeyId = session.pendingPreKey.preKeyId;
+        }
+    }
+    return entry;
 }
 function sessionToLegacy(nativeBytes) {
     const projection = projectLegacySessionRecordV1(nativeBytes);

package/lib/Compatibility/legacy-store/common.js

@@ -16,15 +16,29 @@ export const toBytes = (value) => {
     return null;
 };
 export const bytesToNumbers = (value) => Array.from(value);
+/**
+ * Marks a value JSON would not have kept, so the object and array branches can
+ * each drop it the way `JSON.stringify` does. A plain `undefined` return could
+ * not be told apart from a property that is genuinely absent.
+ */
+const ABSENT = Symbol('absent');
 /**
  * Stable, runtime-independent representation used only to notice legacy-side
  * ownership changes. Buffer and Uint8Array intentionally share one shape.
+ *
+ * `undefined` follows `JSON.stringify`, and that is deliberately asymmetric: an
+ * object property is dropped, an array element becomes `null`. The fingerprint
+ * is taken from the live projection when the mirror is written and from the
+ * reloaded one when it is read, so any distinction a store cannot carry makes
+ * the two disagree forever. Tagging `undefined` as its own value was such a
+ * distinction — no persisted store can express it, and the mirror it invalidated
+ * is the only copy of the record fields the projection has no room for.
  */
 function canonicalize(value, seen) {
     if (value === null)
         return null;
     if (value === undefined)
-        return { [CanonicalTag.UNDEFINED]: true };
+        return ABSENT;
     if (typeof value === 'string' || typeof value === 'boolean')
         return value;
     if (typeof value === 'number') {
@@ -51,11 +65,17 @@ function canonicalize(value, seen) {
         throw new TypeError('cannot fingerprint a cyclic legacy store value');
     seen.add(value);
     try {
-        if (Array.isArray(value))
-            return value.map(item => canonicalize(item, seen));
+        if (Array.isArray(value)) {
+            return value.map(item => {
+                const canonical = canonicalize(item, seen);
+                return canonical === ABSENT ? null : canonical;
+            });
+        }
         const out = {};
         for (const key of Object.keys(value).toSorted()) {
-            out[key] = canonicalize(value[key], seen);
+            const canonical = canonicalize(value[key], seen);
+            if (canonical !== ABSENT)
+                out[key] = canonical;
         }
         return out;
     }
@@ -64,8 +84,13 @@ function canonicalize(value, seen) {
     }
 }
 function fingerprintLegacy(value) {
-    const canonical = JSON.stringify(canonicalize(value, new Set()));
-    return createHash(MirrorEnvelope.HASH).update(canonical).digest();
+    // A top-level absent value hashes as `null`: a store reports a row it does
+    // not hold as either, and the two have to agree for the same reason the
+    // property case does.
+    const canonical = canonicalize(value, new Set());
+    return createHash(MirrorEnvelope.HASH)
+        .update(JSON.stringify(canonical === ABSENT ? null : canonical))
+        .digest();
 }
 /** Persist exact native bytes together with the projection generation. */
 export function encodeNativeEnvelope(payload, legacyValue) {

package/lib/Compatibility/legacy-store/constants.d.ts

@@ -101,7 +101,6 @@ export declare const CanonicalTag: Readonly<{
     readonly BYTES: '$bytes';
     readonly DATE: '$date';
     readonly NUMBER: '$number';
-    readonly UNDEFINED: '$undefined';
     readonly UNSUPPORTED: '$unsupported';
 }>;
 export declare const NumericEncoding: Readonly<{

package/lib/Compatibility/legacy-store/constants.js

@@ -99,7 +99,6 @@ export const CanonicalTag = Object.freeze({
     BYTES: '$bytes',
     DATE: '$date',
     NUMBER: '$number',
-    UNDEFINED: '$undefined',
     UNSUPPORTED: '$unsupported'
 });
 export const NumericEncoding = Object.freeze({

package/lib/Types/Message.d.ts

@@ -112,6 +112,8 @@ export type PollMessageOptions = {
     name: string;
     selectableCount?: number;
     values: string[];
+    /** 32 byte message secret to encrypt poll selections */
+    messageSecret?: Uint8Array;
     toAnnouncementGroup?: boolean;
 };
 export type EventMessageOptions = {

package/lib/Utils/messages.js

@@ -8,6 +8,7 @@ import { proto } from '../WAProto/runtime.js';
 import { isJidGroup, isJidNewsletter, isJidStatusBroadcast, jidNormalizedUser } from '../WABinary/index.js';
 import { assertArgumentDomain } from './argument-domain.js';
 import { Boom } from './boom.js';
+import { randomBytes } from 'node:crypto';
 import { sha256 } from './crypto.js';
 import { getKeyAuthor, toNumber, unixTimestampSeconds } from './generics.js';
 import { generateThumbnail, getAudioDuration, getAudioWaveform, getStream, toBuffer } from './messages-media.js';
@@ -434,6 +435,31 @@ export const generateWAMessageContent = async (message, options) => {
         m.eventMessage.extraGuestsAllowed = message.event.extraGuestsAllowed;
         m.eventMessage.isScheduleCall = message.event.isScheduleCall ?? false;
         m.eventMessage.location = message.event.location;
+        // The sender's copy of the key that encrypts responses to this event;
+        // `decryptEventResponse` takes it as `eventEncKey`. WhatsApp Web writes it
+        // on the sender at creation (`WAWebSendEventCreationMsgAction`) and refuses
+        // to build an event edit without it (`WAWebCreateEncryptedEventEditMsgData`
+        // throws `EventCreationValidationError`).
+        //
+        // The core settles `messageSecret` on relay for messages that reach it
+        // without one — see the comment in `Socket/messages.ts` — but it settles it
+        // on the wire, where the caller never sees it. That is right for the
+        // reporting token and wrong for a key the caller has to keep.
+        //
+        // Written after `m.eventMessage`, for the reason spelled out on the poll
+        // branch below: the blocks that attach `contextInfo` take `Object.keys(m)[0]`
+        // as the content key. `event` is not `Mentionable` or `Contextable` today,
+        // so this is ordering that stays correct rather than ordering that is
+        // currently load-bearing — but it costs nothing and the poll branch shows
+        // what getting it wrong looks like.
+        //
+        // Spread rather than upstream's wholesale assignment: nothing else writes
+        // `messageContextInfo` on this branch today, so the two cannot differ, and
+        // this cannot silently drop a field a later change puts there.
+        m.messageContextInfo = {
+            ...m.messageContextInfo,
+            messageSecret: message.event.messageSecret || randomBytes(32)
+        };
     }
     else if (hasNonNullishProperty(message, 'poll')) {
         (_a = message.poll).selectableCount || (_a.selectableCount = 0);
@@ -465,6 +491,29 @@ export const generateWAMessageContent = async (message, options) => {
                 m.pollCreationMessage = pollCreationMessage;
             }
         }
+        // The key that encrypts the votes. `decryptPollVote` takes it as
+        // `pollEncKey`, and without it here the poll goes out fine but its own
+        // sender can never read the votes: the copy they store — the message
+        // `sendMessage` returns and emits as `messages.upsert` — is this object,
+        // and only `key.id` is patched from the relay result. WhatsApp Web writes it
+        // on the sender at creation too (`WAWebPollsSendPollCreationMsgAction`) and
+        // reuses the stored one for poll edits
+        // (`WAWebPollsGeneratePollEditMessageProto`).
+        //
+        // After the payload, not before, and that ordering is load-bearing: the
+        // `mentions` and `contextInfo` blocks below pick their target with
+        // `Object.keys(m)[0]`, so a `messageContextInfo` written first becomes the
+        // content key they attach to. `contextInfo` is not a field of
+        // `IMessageContextInfo`, so the encoder drops it and a poll sent with
+        // mentions loses them silently. `poll` is `Mentionable & Contextable`, so
+        // that is a combination callers can and do write. Upstream assigns it
+        // before the payload and has exactly that bug; measured on
+        // `{poll, mentions:['x@s.whatsapp.net']}`, its output carries no
+        // `mentionedJid` at all.
+        m.messageContextInfo = {
+            ...m.messageContextInfo,
+            messageSecret: message.poll.messageSecret || randomBytes(32)
+        };
     }
     else if (hasNonNullishProperty(message, 'sharePhoneNumber')) {
         m.protocolMessage = {

package/lib/Utils/process-message.js

@@ -24,19 +24,53 @@ export const isRealMessage = (message) => {
         !normalizedContent?.pollUpdateMessage);
 };
 export const shouldIncrementChatUnread = (message) => !message.key.fromMe && !message.messageStubType;
+/**
+ * WhatsApp Web's rules, which upstream Baileys does not always follow.
+ *
+ * **A field with nothing to normalise stays absent.** `WAWebMsgKey` only assigns
+ * the participant it was given — `h !== void 0 && (this.participant = h)` — and
+ * builds the message's identity by joining the parts that are present, so an
+ * empty string there would change what the key serialises to. Upstream runs
+ * every field through `jidNormalizedUser`, which answers `''` for a jid it was
+ * not given, and so writes `participant: ''` onto every direct-message key.
+ * Matching that would mean copying a bug into the key handed back to callers.
+ *
+ * **A hosted jid is re-encoded onto its plain server**, and the fallback that
+ * used to keep `@hosted` when the user part was empty is gone. WA Web accepts
+ * hosted only as `<digits>:99@hosted` (`WAWebWidValidator`), and every jid that
+ * reached the old fallback is one it rejects outright — so there is no
+ * behaviour to preserve there, and agreeing with upstream costs nothing. Valid
+ * hosted jids already agreed.
+ */
 const normalizeMessageJid = (jid) => {
     if (!jid)
         return undefined;
     const hostedPn = isHostedPnUser(jid);
     if (!hostedPn && !isHostedLidUser(jid))
         return jidNormalizedUser(jid);
-    const user = jidDecode(jid)?.user;
-    return user ? jidEncode(user, hostedPn ? 's.whatsapp.net' : 'lid') : jidNormalizedUser(jid);
+    return jidEncode(jidDecode(jid)?.user ?? null, hostedPn ? 's.whatsapp.net' : 'lid');
 };
 /** Normalize device/hosted JIDs and nested reaction/poll keys in place. */
 export const cleanMessage = (message, meId, meLid) => {
-    message.key.remoteJid = normalizeMessageJid(message.key.remoteJid);
-    message.key.participant = normalizeMessageJid(message.key.participant);
+    // Normalise the fields that are there; do not add the ones that are not.
+    //
+    // Writing the result unconditionally put the property on the key even when
+    // there was nothing to normalise, so a direct-message key — which carries no
+    // participant — still gained one holding `undefined`, and `Object.keys` and a
+    // spread saw it. `WAWebMsgKey` assigns the participant it was given and
+    // leaves the key without one otherwise, and that absence is load-bearing
+    // there: it joins the parts that are present into the id the message is
+    // stored under.
+    //
+    // A field the caller did provide is normalised even when it comes back with
+    // nothing, which is the empty string upstream writes — they provided it, so
+    // it is theirs to have normalised, and leaving a `null` in place would only
+    // swap one falsy spelling for another.
+    for (const field of ['remoteJid', 'participant']) {
+        if (!Object.hasOwn(message.key, field) && message.key[field] == null)
+            continue;
+        message.key[field] = normalizeMessageJid(message.key[field]) ?? '';
+    }
     const content = normalizeMessageContent(message.message);
     if (content?.reactionMessage)
         normaliseKey(content.reactionMessage.key);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@oxidezap/baileyrs",
   "type": "module",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "A Rust-powered WhatsApp Web library for JavaScript, with a Baileys-compatible API",
   "keywords": [
     "whatsapp",
@@ -82,7 +82,7 @@
   },
   "dependencies": {
     "@hapi/boom": "^9.1.4",
-    "@oxidezap/whatsapp-rust-bridge": "0.18.0",
+    "@oxidezap/whatsapp-rust-bridge": "0.19.0",
     "long": "^5.3.2",
     "pino": "^10.3.1",
     "protobufjs": "^7.6.5"