@pontalabs/baileys 1.0.2 → 1.0.4

package/lib/Socket/messages-send.js

@@ -360,11 +360,17 @@ const makeMessagesSocket = (config) => {
         if (force) {
             jidsRequiringFetch = jids;
         } else {
-            const addrs = jids.map(jid => (signalRepository.jidToSignalProtocolAddress(jid)));
-            const sessions = await authState.keys.get('session', addrs);
+            // FIX: sebelumnya cuma ngecek "ada record tersimpan atau enggak"
+            // (truthy check di authState.keys.get('session', ...)). Record
+            // yang kosong/stale/rusak (misal device grup yang session-nya
+            // kebentuk tapi gak pernah kepakai/keisi ratchet) tetep truthy,
+            // jadi dianggap "udah punya sesi" padahal libsignal-nya beneran
+            // kosong -> pas encrypt muncul "SessionError: No sessions".
+            // validateSession ngecek session-nya beneran ada & "open" enggak,
+            // bukan cuma record-nya ada.
             for (const jid of jids) {
-                const signalId = signalRepository.jidToSignalProtocolAddress(jid);
-                if (!sessions[signalId]) {
+                const sessionValidation = await signalRepository.validateSession(jid);
+                if (!sessionValidation.exists) {
                     jidsRequiringFetch.push(jid);
                 }
             }

package/lib/Socket/socket.js

@@ -197,6 +197,12 @@ const makeSocket = (config) => {
     let lastDateRecv
     let epoch = 1
     let keepAliveReq
+    // FIX: sebelumnya uploadPreKeysToServerIfRequired() cuma dipanggil SEKALI pas
+    // 'CB:success' (baru connect/reconnect). Kalau proses bot jalan lama (berhari-hari)
+    // tanpa reconnect, prekey yang kepakai server gak pernah dicek ulang sampai jumlahnya
+    // abis - baru ketahuan pas sudah kejadian error decrypt di penerima. Interval ini
+    // bikin prekey selalu "terupdate", dicek ulang berkala tanpa perlu nunggu reconnect.
+    let preKeyCheckInterval
     let qrTimer
     let closed = false
 
@@ -516,6 +522,7 @@ const makeSocket = (config) => {
             trace: error?.stack
         }, error ? 'connection errored' : 'connection closed')
         clearInterval(keepAliveReq)
+        clearInterval(preKeyCheckInterval)
         clearTimeout(qrTimer)
         ws.removeAllListeners('close')
         ws.removeAllListeners('open')
@@ -822,6 +829,16 @@ const makeSocket = (config) => {
     ws.on('CB:success', async (node) => {
         try {
             await uploadPreKeysToServerIfRequired()
+            // Jalankan ulang pengecekan prekey tiap 6 jam selama koneksi hidup, bukan
+            // cuma sekali pas connect. uploadPreKeysToServerIfRequired() sendiri sudah
+            // pintar (cuma benar-benar upload kalau count di server rendah/ada yang
+            // hilang), jadi interval ini murah dan aman dijalankan berkala.
+            clearInterval(preKeyCheckInterval)
+            preKeyCheckInterval = setInterval(() => {
+                uploadPreKeysToServerIfRequired().catch((err) => {
+                    logger.warn({ err }, 'periodic pre-key check failed')
+                })
+            }, 6 * 60 * 60 * 1000)
             await sendPassiveIq('active')
         } catch (err) {
             logger.warn({

package/lib/Utils/auth-utils.js

@@ -81,92 +81,96 @@ function makeCacheableSignalKeyStore(store, logger, _cache) {
     }
 }
 
-// Module-level specialized mutexes for pre-key operations
-const preKeyMutex = new mutex_1.Mutex()
-const signedPreKeyMutex = new mutex_1.Mutex()
-
-/**
- * Get the appropriate mutex for the key type
- */
-const getPreKeyMutex = (keyType) => {
-    return keyType === 'signed-pre-key' ? signedPreKeyMutex : preKeyMutex
-}
-
 /**
- * Handles pre-key operations with mutex protection
+ * Handles pre-key operations.
+ *
+ * IMPORTANT: locking for this function is provided by the CALLER via the
+ * session-scoped `getKeyTypeMutex(keyType)` mutex (the same one used by
+ * get()/set() for that key type). We intentionally do NOT acquire our own
+ * mutex here anymore.
+ *
+ * Previously this used module-level singleton mutexes (`preKeyMutex`,
+ * `signedPreKeyMutex`) declared OUTSIDE `addTransactionCapability`. Because
+ * those were created once per process (not once per auth state / socket),
+ * every session running in the same Node process shared the exact same
+ * lock. That caused two problems:
+ *   1. Unrelated sessions serialized on each other's pre-key writes
+ *      (needless contention/latency when running multiple accounts).
+ *   2. The lock domain didn't match the one used by get()/withMutexes()
+ *      (`getKeyTypeMutex`), so reads/writes and deletion-validation could
+ *      interleave without real mutual exclusion (TOCTOU race on the
+ *      "does this key still exist" check), which is what let pre-key /
+ *      signed-pre-key state get corrupted under concurrent access.
  */
 async function handlePreKeyOperations(data, keyType, transactionCache, mutations, logger, isInTransaction, state) {
-    const mutex = getPreKeyMutex(keyType)
-    await mutex.runExclusive(async () => {
-        const keyData = data[keyType]
-        if (!keyData)
-            return
-            
-        // Ensure structures exist
-        transactionCache[keyType] = transactionCache[keyType] || {}
-        mutations[keyType] = mutations[keyType] || {}
-        
-        // Separate deletions from updates for batch processing
-        const deletionKeys = []
-        const updateKeys = []
-        
-        for (const keyId in keyData) {
-            if (keyData[keyId] === null) {
-                deletionKeys.push(keyId)
-            }
-            else {
-                updateKeys.push(keyId)
-            }
+    const keyData = data[keyType]
+    if (!keyData)
+        return
+
+    // Ensure structures exist
+    transactionCache[keyType] = transactionCache[keyType] || {}
+    mutations[keyType] = mutations[keyType] || {}
+
+    // Separate deletions from updates for batch processing
+    const deletionKeys = []
+    const updateKeys = []
+
+    for (const keyId in keyData) {
+        if (keyData[keyId] === null) {
+            deletionKeys.push(keyId)
         }
-        
-        // Process updates first (no validation needed)
-        for (const keyId of updateKeys) {
-            if (transactionCache[keyType]) {
-                transactionCache[keyType][keyId] = keyData[keyId]
-            }
-            if (mutations[keyType]) {
-                mutations[keyType][keyId] = keyData[keyId]
-            }
+        else {
+            updateKeys.push(keyId)
         }
-        
-        // Process deletions with validation
-        if (deletionKeys.length === 0)
-            return
-            
-        if (isInTransaction) {
-            // In transaction, only allow deletion if key exists in cache
-            for (const keyId of deletionKeys) {
-                if (transactionCache[keyType]) {
-                    transactionCache[keyType][keyId] = null
-                    if (mutations[keyType]) {
-                        // Mark for deletion in mutations
-                        mutations[keyType][keyId] = null
-                    }
-                }
-                else {
-                    logger.warn(`Skipping deletion of non-existent ${keyType} in transaction: ${keyId}`)
-                }
-            }
-            return
+    }
+
+    // Process updates first (no validation needed)
+    for (const keyId of updateKeys) {
+        if (transactionCache[keyType]) {
+            transactionCache[keyType][keyId] = keyData[keyId]
         }
-        
-        // Outside transaction, batch validate all deletions
-        if (!state)
-            return
-            
-        const existingKeys = await state.get(keyType, deletionKeys)
+        if (mutations[keyType]) {
+            mutations[keyType][keyId] = keyData[keyId]
+        }
+    }
+
+    // Process deletions with validation
+    if (deletionKeys.length === 0)
+        return
+
+    if (isInTransaction) {
+        // In transaction, only allow deletion if key exists in cache
         for (const keyId of deletionKeys) {
-            if (existingKeys[keyId]) {
-                if (transactionCache[keyType])
-                    transactionCache[keyType][keyId] = null
-                if (mutations[keyType])
+            if (transactionCache[keyType]) {
+                transactionCache[keyType][keyId] = null
+                if (mutations[keyType]) {
+                    // Mark for deletion in mutations
                     mutations[keyType][keyId] = null
+                }
             }
             else {
-                logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`)
+                logger.warn(`Skipping deletion of non-existent ${keyType} in transaction: ${keyId}`)
             }
         }
-    })
+        return
+    }
+
+    // Outside transaction, batch validate all deletions
+    if (!state)
+        return
+
+    const existingKeys = await state.get(keyType, deletionKeys)
+    for (const keyId of deletionKeys) {
+        if (existingKeys[keyId]) {
+            if (transactionCache[keyType])
+                transactionCache[keyType][keyId] = null
+            if (mutations[keyType])
+                mutations[keyType][keyId] = null
+        }
+        else {
+            logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`)
+        }
+    }
 }
 
 /**
@@ -179,27 +183,34 @@ function handleNormalKeyOperations(data, key, transactionCache, mutations) {
 }
 
 /**
- * Process pre-key deletions with validation
+ * Process pre-key / signed-pre-key deletions with validation.
+ *
+ * NOTE: this is only ever called from inside a `withMutexes([..., keyType, ...])`
+ * block in `set()` below, which already holds the session-scoped
+ * `getKeyTypeMutex(keyType)` lock for the duration of the call. It must NOT
+ * acquire its own mutex here - `async-mutex`'s Mutex is not reentrant, so
+ * doing so would either deadlock (if it tried to re-acquire the same lock)
+ * or - as in the previous version - silently acquire a *different*, global
+ * lock that gave no real protection at all.
  */
 async function processPreKeyDeletions(data, keyType, state, logger) {
-    const mutex = getPreKeyMutex(keyType)
-    await mutex.runExclusive(async () => {
-        const keyData = data[keyType]
-        if (!keyData)
-            return
-            
-        // Validate deletions
-        for (const keyId in keyData) {
-            if (keyData[keyId] === null) {
-                const existingKeys = await state.get(keyType, [keyId])
-                if (!existingKeys[keyId]) {
-                    logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`)
-                    if (data[keyType])
-                        delete data[keyType][keyId]
-                }
-            }
+    const keyData = data[keyType]
+    if (!keyData)
+        return
+
+    // Validate deletions
+    const deletionIds = Object.keys(keyData).filter(id => keyData[id] === null)
+    if (deletionIds.length === 0)
+        return
+
+    const existingKeys = await state.get(keyType, deletionIds)
+    for (const keyId of deletionIds) {
+        if (!existingKeys[keyId]) {
+            logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`)
+            if (data[keyType])
+                delete data[keyType][keyId]
         }
-    })
+    }
 }
 
 /**
@@ -403,9 +414,13 @@ const addTransactionCapability = (state, logger, { maxCommitRetries, delayBetwee
                 for (const key_ in data) {
                     const key = key_
                     transactionCache[key] = transactionCache[key] || {}
-                    // Special handling for pre-keys and signed-pre-keys
+                    // Special handling for pre-keys and signed-pre-keys.
+                    // Locked via the session-scoped getKeyTypeMutex(key) so this can't
+                    // interleave with a concurrent non-transactional get()/set() for the
+                    // same key type on this SAME auth state - no cross-session locking,
+                    // no lock-domain mismatch.
                     if (key === 'pre-key' || key === 'signed-pre-key') {
-                        await handlePreKeyOperations(data, key, transactionCache, mutations, logger, true)
+                        await getKeyTypeMutex(key).runExclusive(() => handlePreKeyOperations(data, key, transactionCache, mutations, logger, true))
                     }
                     else {
                         // Normal handling for other key types
@@ -442,7 +457,7 @@ const addTransactionCapability = (state, logger, { maxCommitRetries, delayBetwee
                             // Process pre-keys and signed-pre-keys separately with specialized mutexes
                             for (const key_ in nonSenderKeyData) {
                                 const keyType = key_
-                                if (keyType === 'pre-key') {
+                                if (keyType === 'pre-key' || keyType === 'signed-pre-key') {
                                     await processPreKeyDeletions(nonSenderKeyData, keyType, state, logger)
                                 }
                             }
@@ -457,7 +472,7 @@ const addTransactionCapability = (state, logger, { maxCommitRetries, delayBetwee
                         // Process pre-keys and signed-pre-keys separately with specialized mutexes
                         for (const key_ in data) {
                             const keyType = key_
-                            if (keyType === 'pre-key') {
+                            if (keyType === 'pre-key' || keyType === 'signed-pre-key') {
                                 await processPreKeyDeletions(data, keyType, state, logger)
                             }
                         }

package/lib/Utils/decode-wa-message.js

@@ -222,7 +222,24 @@ const decryptMessageNode = (stanza, meId, meLid, repository, logger) => {
         async decrypt() {
             let decryptables = 0
             if (Array.isArray(stanza.content)) {
-                for (const { tag, attrs, content } of stanza.content) {
+                // FIX: proses node non-skmsg (msg/pkmsg/plaintext) LEBIH DULU sebelum node
+                // skmsg. Root cause "bot diam/nunggu" pas ada member baru join grup lalu
+                // langsung kirim pesan: satu stanza berisi 2 node <enc> - satu tipe
+                // pkmsg/msg (isinya SenderKeyDistributionMessage buat kamu) dan satu lagi
+                // tipe skmsg (isi pesan asli, dienkripsi pakai sender-key grup). Urutan
+                // array stanza.content dari server TIDAK dijamin naruh pkmsg/msg duluan.
+                // Kalau skmsg kebetulan diproses duluan, sender-key belum ada di store ->
+                // decryptGroupMessage() gagal "No SenderKeyRecord found" -> pesan pertama
+                // dari member baru selalu gagal decrypt & jadi stub CIPHERTEXT, padahal
+                // SKDM-nya baru "sampai" sepersekian detik kemudian di iterasi berikutnya.
+                // Reorder di sini (stable, gak ubah urutan relatif node lain seperti
+                // verified_name/unavailable) supaya skmsg selalu diproses PALING TERAKHIR,
+                // setelah semua kemungkinan SKDM sudah didaftarkan ke sender-key store.
+                const orderedContent = [
+                    ...stanza.content.filter(({ tag, attrs }) => !(tag === 'enc' && attrs.type === 'skmsg')),
+                    ...stanza.content.filter(({ tag, attrs }) => tag === 'enc' && attrs.type === 'skmsg')
+                ]
+                for (const { tag, attrs, content } of orderedContent) {
                     if (tag === 'verified_name' && content instanceof Uint8Array) {
                         const cert = WAProto_1.proto.VerifiedNameCertificate.decode(content)
                         const details = WAProto_1.proto.VerifiedNameCertificate.Details.decode(cert.details)

package/lib/Utils/index.d.ts

@@ -17,4 +17,5 @@ export * from './use-single-file-auth-state'
 export * from './use-multi-file-auth-state'
 export * from './link-preview'
 export * from './event-buffer'
-export * from './process-message'
+export * from './process-message'
+export * from './signal-housekeeping'

package/lib/Utils/index.js

@@ -37,4 +37,5 @@ __exportStar(require("./use-single-file-auth-state"), exports)
 __exportStar(require("./use-multi-file-auth-state"), exports)
 __exportStar(require("./link-preview"), exports)
 __exportStar(require("./event-buffer"), exports)
-__exportStar(require("./process-message"), exports)
+__exportStar(require("./process-message"), exports)
+__exportStar(require("./signal-housekeeping"), exports)

package/lib/Utils/signal-housekeeping.d.ts

@@ -0,0 +1,19 @@
+import type { Logger } from 'pino'
+
+export interface CleanupSignalAuthFolderOptions {
+	/** File yang mtime-nya lebih tua dari ini (dalam hari) akan dihapus. Default 30. */
+	maxAgeDays?: number
+	/** Prefix nama file yang boleh dibersihkan. Default ['session-', 'sender-key-']. */
+	prefixes?: string[]
+	logger?: Logger
+}
+
+export interface CleanupSignalAuthFolderResult {
+	removed: string[]
+	scanned: number
+}
+
+export function cleanupSignalAuthFolder(
+	folder: string,
+	options?: CleanupSignalAuthFolderOptions
+): Promise<CleanupSignalAuthFolderResult>

package/lib/Utils/signal-housekeeping.js

@@ -0,0 +1,73 @@
+"use strict"
+
+Object.defineProperty(exports, "__esModule", { value: true })
+exports.cleanupSignalAuthFolder = cleanupSignalAuthFolder
+
+const fs = require("fs/promises")
+const path = require("path")
+
+/**
+ * Bersihkan file session/sender-key yang sudah usang di folder auth yang dipakai
+ * bareng useMultiFileAuthState(). Tujuannya supaya store signal tidak numpuk terus
+ * selama bot jalan berbulan-bulan dengan ribuan kontak/grup yang sudah gak aktif.
+ *
+ * Aman dipakai karena: mtime sebuah file session-*.json / sender-key-*.json selalu
+ * ke-update setiap kali ada pertukaran pesan dengan kontak/grup itu (storeSession /
+ * storeSenderKey menulis ulang filenya). Jadi kalau sebuah file gak pernah disentuh
+ * lagi lebih dari `maxAgeDays`, itu tandanya kontak/grup itu memang sudah gak aktif -
+ * hapus filenya aman, nanti kalau ada pesan baru sesi/sender-key otomatis dibuat ulang
+ * dari prekey bundle / SenderKeyDistributionMessage yang baru.
+ *
+ * creds.json, app-state-sync-key-*.json, dan pre-key-*.json SENGAJA tidak disentuh
+ * di sini secara default - itu bukan sumber "numpuk", dan prekey yang sudah dipakai
+ * memang sudah dihapus otomatis lewat removePreKey() di libsignal.js.
+ *
+ * @param {string} folder - folder yang sama dipakai di useMultiFileAuthState()
+ * @param {object} [options]
+ * @param {number} [options.maxAgeDays=30] - file yang mtime-nya lebih tua dari ini akan dihapus
+ * @param {string[]} [options.prefixes] - prefix nama file yang boleh dibersihkan
+ * @param {import('pino').Logger} [options.logger]
+ * @returns {Promise<{ removed: string[], scanned: number }>}
+ */
+async function cleanupSignalAuthFolder(folder, options = {}) {
+	const {
+		maxAgeDays = 30,
+		prefixes = ['session-', 'sender-key-'],
+		logger
+	} = options
+
+	const removed = []
+	let scanned = 0
+	const maxAgeMs = maxAgeDays * 24 * 60 * 60 * 1000
+	const now = Date.now()
+
+	let entries
+	try {
+		entries = await fs.readdir(folder)
+	} catch (err) {
+		logger?.warn?.({ err, folder }, '[cleanupSignalAuthFolder] gagal baca folder auth')
+		return { removed, scanned }
+	}
+
+	for (const name of entries) {
+		if (!prefixes.some((p) => name.startsWith(p))) {
+			continue
+		}
+		scanned++
+		const filePath = path.join(folder, name)
+		try {
+			const stat = await fs.stat(filePath)
+			if (now - stat.mtimeMs > maxAgeMs) {
+				await fs.unlink(filePath)
+				removed.push(name)
+			}
+		} catch {
+			// File mungkin sudah kehapus proses lain (race antar-worker), aman diabaikan.
+		}
+	}
+
+	logger?.info?.({ scanned, removedCount: removed.length, maxAgeDays }, '[cleanupSignalAuthFolder] selesai')
+	return { removed, scanned }
+}
+
+module.exports = { cleanupSignalAuthFolder }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pontalabs/baileys",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "PontaLabs Baileys is a lightweight, modern, and customizable WhatsApp Web API library built on Baileys.",
   "keywords": [
     "facebook",