@violetix/baileys 0.3.18 → 0.5.0

package/lib/Utils/ignore-key.js

@@ -0,0 +1,176 @@
+import { areJidsSameUser, jidDecode, jidEncode } from '../WABinary/index.js';
+/**
+ * Stanza tags a filter may drop. Stream control, `iq` replies and the auth-critical
+ * `success` / `failure` tags are deliberately absent so the connection flow stays intact.
+ */
+export const IGNORE_KEY_KINDS = ['message', 'receipt', 'notification', 'presence', 'chatstate', 'call'];
+const IGNORE_KEY_KIND_SET = new Set(IGNORE_KEY_KINDS);
+/**
+ * Kinds the server re-delivers until acked. Dropping one without an ack makes the server
+ * retry it forever, so the filter acks on the handler's behalf. Presence and chat-state are
+ * fire-and-forget and must not be acked.
+ */
+const ACKED_KINDS = new Set(['message', 'receipt', 'notification', 'call']);
+/**
+ * A JID arrives in whichever namespace the sender used, and the alt attributes carry the other
+ * form. Matching every one of these lets a filter written with a phone number also catch the
+ * LID-addressed copy of the same stanza (and vice versa).
+ */
+const REMOTE_JID_ATTRS = ['from', 'sender_pn', 'sender_lid'];
+const PARTICIPANT_ATTRS = ['participant', 'participant_pn', 'participant_lid'];
+const DESCRIPTOR_FIELDS = ['remoteJid', 'fromMe', 'id', 'participant'];
+/** Deviceless user-form JID. Userless values (e.g. `s.whatsapp.net`) are kept verbatim. */
+const stripDevice = (jid) => {
+    if (!jid) {
+        return null;
+    }
+    const decoded = jidDecode(jid);
+    if (!decoded?.user) {
+        return jid;
+    }
+    return jidEncode(decoded.user, decoded.server);
+};
+/**
+ * Compares deviceless JIDs as whole strings rather than by user part. `areJidsSameUser` ignores
+ * the server, so it reports `5551234@s.whatsapp.net` and `5551234@lid` as the same user — two
+ * unrelated accounts that would then share a filter. Server equality is required here; the
+ * PN/LID crossover is handled by the alt attributes instead.
+ */
+const sameJid = (a, b) => {
+    if (!a || !b) {
+        return false;
+    }
+    return stripDevice(a) === stripDevice(b);
+};
+export const isIgnorableKind = (tag) => IGNORE_KEY_KIND_SET.has(tag);
+/** Validates a descriptor or predicate and freezes it into an internal entry. */
+export const normalizeIgnoreKey = (input) => {
+    if (typeof input === 'function') {
+        return { predicate: input };
+    }
+    if (!input || typeof input !== 'object' || Array.isArray(input)) {
+        throw new Error('ignoreKey expects a descriptor object or a predicate function');
+    }
+    if (!DESCRIPTOR_FIELDS.some(field => input[field] !== undefined)) {
+        throw new Error('ignoreKey descriptor needs at least one of remoteJid, fromMe, id, participant');
+    }
+    const entry = {};
+    if (input.remoteJid !== undefined) {
+        const jids = (Array.isArray(input.remoteJid) ? input.remoteJid : [input.remoteJid]).filter(Boolean);
+        if (!jids.length) {
+            throw new Error('ignoreKey remoteJid cannot be empty');
+        }
+        entry.remoteJid = jids;
+    }
+    if (input.participant !== undefined) {
+        if (typeof input.participant !== 'string' || !input.participant) {
+            throw new Error('ignoreKey participant must be a non-empty jid');
+        }
+        entry.participant = input.participant;
+    }
+    if (input.fromMe !== undefined) {
+        entry.fromMe = !!input.fromMe;
+    }
+    if (input.id !== undefined) {
+        if (typeof input.id !== 'string' || !input.id) {
+            throw new Error('ignoreKey id must be a non-empty string');
+        }
+        entry.id = input.id;
+    }
+    if (input.only !== undefined) {
+        const only = Array.isArray(input.only) ? input.only : [input.only];
+        if (!only.length) {
+            throw new Error('ignoreKey only cannot be empty');
+        }
+        const unknown = only.filter(kind => !IGNORE_KEY_KIND_SET.has(kind));
+        if (unknown.length) {
+            throw new Error(`ignoreKey only has unknown kinds: ${unknown.join(', ')}`);
+        }
+        entry.only = only;
+    }
+    return entry;
+};
+/**
+ * Parses the wire node into the shape filters match on, so a predicate never has to walk a
+ * BinaryNode. `remoteJid` and `participant` are device-stripped to line up with the
+ * `event.key.remoteJid` a handler would see.
+ */
+export const buildIgnoreContext = (node, meId, meLid) => {
+    const attrs = node.attrs || {};
+    const author = attrs.participant || attrs.participant_pn || attrs.participant_lid || attrs.from;
+    const fromMe = !!author && ((!!meId && areJidsSameUser(author, meId)) || (!!meLid && areJidsSameUser(author, meLid)));
+    return {
+        kind: node.tag,
+        // a 1:1 message sent from another of our devices arrives from us, with the chat in `recipient`
+        remoteJid: stripDevice(fromMe && attrs.recipient ? attrs.recipient : attrs.from),
+        fromMe,
+        id: attrs.id,
+        participant: stripDevice(attrs.participant || attrs.participant_pn || attrs.participant_lid)
+    };
+};
+export const matchesIgnoreKey = (entry, ctx, node) => {
+    if (entry.predicate) {
+        return !!entry.predicate(ctx);
+    }
+    if (entry.only && !entry.only.includes(ctx.kind)) {
+        return false;
+    }
+    if (entry.id !== undefined && entry.id !== ctx.id) {
+        return false;
+    }
+    if (entry.fromMe !== undefined && entry.fromMe !== ctx.fromMe) {
+        return false;
+    }
+    const attrs = node.attrs || {};
+    const remoteAttrs = ctx.fromMe && attrs.recipient ? ['recipient', ...REMOTE_JID_ATTRS] : REMOTE_JID_ATTRS;
+    if (entry.remoteJid && !entry.remoteJid.some(wanted => remoteAttrs.some(attr => sameJid(attrs[attr], wanted)))) {
+        return false;
+    }
+    if (entry.participant && !PARTICIPANT_ATTRS.some(attr => sameJid(attrs[attr], entry.participant))) {
+        return false;
+    }
+    return true;
+};
+export const ignoredStanzaNeedsAck = (tag) => ACKED_KINDS.has(tag);
+/**
+ * Holds the registered filters and answers the one question the socket asks per stanza.
+ *
+ * `category='peer'` traffic from this account's own devices is never dropped: those stanzas
+ * carry app-state key shares, history sync and PDO responses between the account's devices, so
+ * the common `{ fromMe: true }` filter would otherwise swallow the app-state key share and leave
+ * the collections blocked on a key they re-request on every sync. The exemption only applies
+ * when the sender really is this account — resolved against both `meJid` and `meLid` — so a
+ * foreign stanza cannot dodge a filter by stamping the attribute.
+ */
+export const makeIgnoreKeyRegistry = ({ getMeId, getMeLid, logger }) => {
+    const entries = new Set();
+    const register = (input) => {
+        const entry = normalizeIgnoreKey(input);
+        entries.add(entry);
+        return () => {
+            entries.delete(entry);
+        };
+    };
+    const shouldDrop = (node) => {
+        if (!entries.size || !isIgnorableKind(node.tag)) {
+            return false;
+        }
+        const ctx = buildIgnoreContext(node, getMeId(), getMeLid());
+        if (ctx.fromMe && node.attrs?.category === 'peer') {
+            return false;
+        }
+        for (const entry of entries) {
+            try {
+                if (matchesIgnoreKey(entry, ctx, node)) {
+                    return true;
+                }
+            }
+            catch (err) {
+                // A throwing predicate must not take the stanza with it; the stanza stays.
+                logger?.error({ err, kind: ctx.kind, id: ctx.id }, 'ignoreKey filter threw, keeping stanza');
+            }
+        }
+        return false;
+    };
+    return { register, shouldDrop, get size() { return entries.size; } };
+};

package/lib/Utils/index.d.ts

@@ -22,5 +22,8 @@ export * from "./browser-utils.js";
 export * from "./companion-reg-client-utils.js";
 export * from "./identity-change-handler.js";
 export * from "./stanza-ack.js";
+export * from "./ignore-key.js";
+export * from "./anchor-guard.js";
+export * from "./a2ui.js";
 export * from "./meta-ai-msmsg.js";
 //# sourceMappingURL=index.d.ts.map

package/lib/Utils/index.js

@@ -22,5 +22,8 @@ export * from './browser-utils.js';
 export * from './companion-reg-client-utils.js';
 export * from './identity-change-handler.js';
 export * from './stanza-ack.js';
+export * from './ignore-key.js';
+export * from './anchor-guard.js';
+export * from './a2ui.js';
 export * from './meta-ai-msmsg.js';
 //# sourceMappingURL=index.js.map

package/lib/Utils/messages-media.d.ts

@@ -57,6 +57,8 @@ export interface MediaEncryptionOptions {
     };
     saveOriginalFileIfRequired?: boolean;
     opts?: MediaFetchOptions;
+    /** Reuse an existing 32-byte media key instead of generating one (e.g. sticker-pack thumbnails). */
+    mediaKey?: Uint8Array;
 }
 export interface MediaDownloadOptions {
     startByte?: number;

package/lib/Utils/messages-media.js

@@ -303,9 +303,31 @@ export const getStream = async (item, opts) => {
     if (Buffer.isBuffer(item)) {
         return { stream: toReadable(item), type: 'buffer' };
     }
+    // A bare path or URL string is accepted, and the reason is the error it used to produce. The
+    // contract below is `Buffer | { stream } | { url }`, so `'stream' in item` throws on a string —
+    // and it throws with the path interpolated:
+    //
+    //   TypeError: Cannot use 'in' operator to search for 'stream' in /tmp/8cktb7o7x.webp
+    //
+    // Measured on a production fleet, 2026-10-10: five of those under [SEND_STICKER]. The message
+    // names a file, so it reads as a missing or unreadable one, while the real fault is the SHAPE of
+    // the argument — and the file was perfectly readable: `createReadStream(item.url)` at the end of
+    // this function handles exactly that string. Widening here costs nothing and removes the whole
+    // class, for every caller rather than the one that was caught.
+    if (typeof item === 'string') {
+        item = { url: item };
+    }
+    if (!item || typeof item !== 'object') {
+        throw new Boom(`media source must be a Buffer, a string, { stream } or { url }, got ${item === null ? 'null' : typeof item}`);
+    }
     if ('stream' in item) {
         return { stream: item.stream, type: 'readable' };
     }
+    // Named rather than left to throw "Cannot read properties of undefined (reading 'toString')",
+    // which says nothing about which field is missing.
+    if (item.url === undefined || item.url === null) {
+        throw new Boom('media source object has neither `stream` nor `url`');
+    }
     const urlStr = item.url.toString();
     if (urlStr.startsWith('data:')) {
         const buffer = Buffer.from(urlStr.split(',')[1], 'base64');
@@ -459,10 +481,11 @@ class SidecarAccumulator {
         this.windowOffset = SIDECAR_IV_SIZE;
     }
 }
-export const encryptedStream = async (media, mediaType, { logger, saveOriginalFileIfRequired, opts } = {}) => {
+export const encryptedStream = async (media, mediaType, { logger, saveOriginalFileIfRequired, opts, mediaKey: givenMediaKey } = {}) => {
     const { stream, type } = await getStream(media, opts);
     logger?.debug('fetched media stream');
-    const mediaKey = Crypto.randomBytes(32);
+    // sticker-pack thumbnails must reuse the pack's key, the message carries only that one
+    const mediaKey = givenMediaKey ?? Crypto.randomBytes(32);
     const { cipherKey, iv, macKey } = await getMediaKeys(mediaKey, mediaType);
     const encFilePath = join(getTmpFilesDirectory(), mediaType + generateMessageIDV2() + '-enc');
     const encFileWriteStream = createWriteStream(encFilePath);

package/lib/Utils/messages.d.ts

@@ -19,6 +19,7 @@ export function getAggregateResponsesInEventMessage({ eventResponses }: {
 }, meId: any): any[];
 export function extractUrlFromText(text: any): any;
 export function generateLinkPreviewIfRequired(text: any, getUrlInfo: any, logger: any): Promise<any>;
+export function hashImagePollOption(optionName: any, fileSha256?: Uint8Array | null): string;
 export function prepareWAMessageMedia(message: any, options: any): Promise<proto.Message>;
 export function prepareDisappearingMessageSettingContent(ephemeralExpiration: any): proto.Message;
 export function generateForwardMessageContent(message: any, forceForward: any): any;

package/lib/Utils/messages.js

@@ -6,6 +6,7 @@ import { proto } from '../../WAProto/index.js';
 import { CALL_AUDIO_PREFIX, CALL_VIDEO_PREFIX, DONATE_URL, LIBRARY_NAME, MEDIA_KEYS, URL_REGEX, WA_DEFAULT_EPHEMERAL } from '../Defaults/index.js';
 import { AssociationType, ButtonHeaderType, ButtonType, CarouselCardType, ListType, ProtocolType, WAMessageStatus, WAProto } from '../Types/index.js';
 import { isLidUser, isPnUser, isJidGroup, isJidNewsletter, isJidStatusBroadcast, jidNormalizedUser } from '../WABinary/index.js';
+import { buildA2UIWidget } from './a2ui.js';
 import { sha256 } from './crypto.js';
 import { generateMessageIDV2, getKeyAuthor, unixTimestampSeconds } from './generics.js';
 import { downloadContentFromMessage, encryptedStream, generateThumbnail, getAudioDuration, getAudioWaveform, getImageProcessingLibrary, getRawMediaUploadData, getStream, toBuffer } from './messages-media.js';
@@ -60,6 +61,16 @@ const assertColor = async (color) => {
     }
     return assertedColor;
 };
+/**
+ * Option identifier for an image poll: WhatsApp hashes the option name, appends the base64
+ * media hash, and hashes that — `sha256(hex(sha256(name)) + base64(fileSha256))`. A vote carries
+ * this hash, not the name, so it has to match byte for byte.
+ */
+export const hashImagePollOption = (optionName, fileSha256) => {
+    const nameHash = sha256(Buffer.from(String(optionName), 'utf-8')).toString('hex');
+    const mediaHashB64 = fileSha256 ? Buffer.from(fileSha256).toString('base64') : '';
+    return sha256(Buffer.from(nameHash + mediaHashB64, 'utf-8')).toString('hex');
+};
 export const prepareWAMessageMedia = async (message, options) => {
     const logger = options.logger;
     let mediaType;
@@ -94,7 +105,8 @@ export const prepareWAMessageMedia = async (message, options) => {
         if (mediaBuff) {
             logger?.debug({ cacheableKey }, 'got media cache hit');
             const obj = proto.Message.decode(mediaBuff);
-            const key = `${mediaType}Message`;
+            // ptv entries are cached after videoMessage was renamed to ptvMessage
+            const key = obj.ptvMessage ? 'ptvMessage' : `${mediaType}Message`;
             Object.assign(obj[key], { ...uploadData, media: undefined });
             return obj;
         }
@@ -891,6 +903,36 @@ export const generateWAMessageContent = async (message, options) => {
             messageSecret: message.poll.messageSecret || randomBytes(32)
         };
     }
+    // Image poll: the parent carries only the option names and their hashes. The images
+    // themselves travel as separate pollCreationOptionImageMessage children, associated back
+    // to this message by MEDIA_POLL — sendMessage sends those after the parent.
+    else if (hasNonNullishProperty(message, 'imagePoll')) {
+        if (!Array.isArray(message.imagePoll.options) || !message.imagePoll.options.length) {
+            throw new Boom('Invalid imagePoll options', { statusCode: 400 });
+        }
+        const selectableOptionsCount = message.imagePoll.selectableCount ?? 1;
+        if (selectableOptionsCount < 0 || selectableOptionsCount > message.imagePoll.options.length) {
+            throw new Boom(`imagePoll.selectableCount should be >= 0 and <= ${message.imagePoll.options.length}`, {
+                statusCode: 400
+            });
+        }
+        const missingHash = message.imagePoll.options.find(option => !option.optionHash);
+        if (missingHash) {
+            throw new Boom('imagePoll options must be prepared with hashImagePollOption; send via sendMessage instead of building the content by hand', { statusCode: 400 });
+        }
+        m.pollCreationMessageV3 = {
+            name: message.imagePoll.name,
+            selectableOptionsCount,
+            options: message.imagePoll.options.map(option => ({
+                optionName: option.optionName,
+                optionHash: option.optionHash
+            })),
+            pollContentType: proto.Message.PollContentType.IMAGE
+        };
+        m.messageContextInfo = {
+            messageSecret: message.imagePoll.messageSecret || randomBytes(32)
+        };
+    }
     // Lia@Changes 08-02-26 --- Add poll result snapshot message
     else if (hasNonNullishProperty(message, 'pollResult')) {
         const pollResultSnapshotMessage = {
@@ -994,6 +1036,12 @@ export const generateWAMessageContent = async (message, options) => {
             }
         };
     }
+    // An A2UI widget has no base content of its own — the interactive chain below replaces `m`
+    // wholesale. Without this it falls through to the media branch and is rejected as a media
+    // message, so a widget would need a dummy `text` to send at all.
+    else if (hasNonNullishProperty(message, 'a2ui')) {
+        m = {};
+    }
     else {
         m = await prepareWAMessageMedia(message, options);
     }
@@ -1117,6 +1165,31 @@ export const generateWAMessageContent = async (message, options) => {
             }
         };
     }
+    // A2UI widget. `nativeFlowMessage` is always set, even empty: it is what the client keys the
+    // interactive render off, and it is also what makes the socket attach the <biz> node.
+    else if (hasNonNullishProperty(message, 'a2ui')) {
+        const interactiveMessage = {
+            bloksWidget: buildA2UIWidget(message.a2ui, {
+                type: message.a2uiType,
+                wrapped: message.a2uiWrapped !== false
+            }),
+            nativeFlowMessage: hasNonNullishProperty(message, 'nativeFlow')
+                ? prepareNativeFlowButtons(message)
+                : { messageParamsJson: '' }
+        };
+        // singleScreen drops the surrounding bubble so the widget is the whole message
+        if (!message.singleScreen) {
+            interactiveMessage.header = { hasMediaAttachment: false };
+            interactiveMessage.body = { text: message.text || '' };
+            interactiveMessage.footer = { text: message.footer || '' };
+        }
+        m = {
+            interactiveMessage,
+            messageContextInfo: {
+                messageSecret: message.messageSecret || randomBytes(32)
+            }
+        };
+    }
     else if (hasNonNullishProperty(message, 'nativeFlow')) {
         const interactiveMessage = {
             nativeFlowMessage: prepareNativeFlowButtons(message)

package/lib/Utils/process-message.js

@@ -114,7 +114,10 @@ export const isRealMessage = (message) => {
         hasSomeContent &&
         !normalizedContent?.protocolMessage &&
         !normalizedContent?.reactionMessage &&
-        !normalizedContent?.pollUpdateMessage);
+        !normalizedContent?.pollUpdateMessage &&
+        // edit envelopes and event responses are not new chat messages (unread/timestamp bump)
+        !normalizedContent?.secretEncryptedMessage &&
+        !normalizedContent?.encEventResponseMessage);
 };
 export const shouldIncrementChatUnread = (message) => !message.key.fromMe && !message.messageStubType;
 /**

package/lib/Utils/rich-message-utils.js

@@ -236,7 +236,7 @@ export const prepareRichResponseMessage = (content) => {
             submessages.push({
                 messageType: RichSubMessageType.LATEX,
                 latexMetadata: {
-                    text,
+                    text: contentText,
                     expressions: latex
                 }
             });

package/lib/Utils/use-multi-file-auth-state.d.ts

@@ -1,4 +1,4 @@
-export function useMultiFileAuthState(folder: any): Promise<{
+export function useMultiFileAuthState(folder: any, logger?: any): Promise<{
     state: {
         creds: any;
         keys: {
@@ -8,5 +8,6 @@ export function useMultiFileAuthState(folder: any): Promise<{
     };
     saveCreds: () => void;
     _flushCreds: () => Promise<void>;
+    _destroy: () => void;
 }>;
 //# sourceMappingURL=use-multi-file-auth-state.d.ts.map

package/lib/Utils/use-multi-file-auth-state.js

@@ -51,7 +51,11 @@ const makeDebouncedSaver = (filePath, getData, logger, delayMs = 500) => {
             clearTimeout(timer);
             try {
                 writeFileSync(filePath, JSON.stringify(getData(), BufferJSON.replacer));
-            } catch { }
+            } catch (err) {
+                // Last-chance save on the way out. Nothing left to retry with, but a silent
+                // failure here loses the session and looks like a random logout next boot.
+                logger?.error?.({ err, filePath }, 'Failed to save credentials on exit');
+            }
         }
     };
 
@@ -82,7 +86,7 @@ const makeDebouncedSaver = (filePath, getData, logger, delayMs = 500) => {
     return { save, flush: flushNow, destroy };
 };
 
-export const useMultiFileAuthState = async (folder) => {
+export const useMultiFileAuthState = async (folder, logger) => {
     const writeData = async (data, file) => {
         const filePath = join(folder, fixFileName(file));
         const mutex = getFileLock(filePath);
@@ -107,7 +111,13 @@ export const useMultiFileAuthState = async (folder) => {
                     release();
                 }
             });
-        } catch {
+        } catch (err) {
+            // A missing file is the normal "no such key yet" answer. Anything else — corrupt
+            // JSON, bad permissions — also yields null, which silently starts a fresh pairing,
+            // so it is logged rather than swallowed.
+            if (err?.code !== 'ENOENT') {
+                logger?.warn?.({ err, file }, 'Failed to read auth state file');
+            }
             return null;
         }
     };
@@ -119,7 +129,12 @@ export const useMultiFileAuthState = async (folder) => {
             return mutex.acquire().then(async (release) => {
                 try {
                     await unlink(filePath);
-                } catch { }
+                } catch (err) {
+                    // Deleting a key that was never written is normal.
+                    if (err?.code !== 'ENOENT') {
+                        logger?.warn?.({ err, file }, 'Failed to remove auth state file');
+                    }
+                }
                 finally {
                     release();
                 }
@@ -139,7 +154,7 @@ export const useMultiFileAuthState = async (folder) => {
     const fixFileName = (file) => file?.replace(/\//g, '__')?.replace(/:/g, '-');
     const creds = (await readData('creds.json')) || initAuthCreds();
     const credsPath = join(folder, 'creds.json');
-    const debouncer = makeDebouncedSaver(credsPath, () => creds, null, 500);
+    const debouncer = makeDebouncedSaver(credsPath, () => creds, logger, 500);
 
     return {
         state: {
@@ -170,6 +185,12 @@ export const useMultiFileAuthState = async (folder) => {
             }
         },
         saveCreds: debouncer.save,
-        _flushCreds: debouncer.flush
+        _flushCreds: debouncer.flush,
+        /**
+         * Drops the process exit/SIGINT/SIGTERM listeners this auth state installed. A long-lived
+         * host that opens and closes many sessions leaks one set per call without it, and Node
+         * starts warning about listener counts after eleven.
+         */
+        _destroy: debouncer.destroy
     };
 };

package/lib/Utils/use-single-file-auth-state.d.ts

@@ -1,4 +1,4 @@
-export function useSingleFileAuthState(fileName: any): Promise<{
+export function useSingleFileAuthState(fileName: any, logger?: any): Promise<{
     state: {
         creds: any;
         keys: {

package/lib/Utils/use-single-file-auth-state.js

@@ -8,7 +8,7 @@ import { Mutex } from 'async-mutex';
 // Lia@Changes 25-03-26 --- Add useSingleFileAuthState with integrated cache
 const FLUSH_TIMEOUT_MS = 3000;
 // Lia@Changes 22-04-26 --- Enhanced useSingleFileAuthState with LRUCache
-export const useSingleFileAuthState = async (fileName) => {
+export const useSingleFileAuthState = async (fileName, logger) => {
     const cache = new LRUCache({
         max: 20000,
         ttl: 1000 * DEFAULT_CACHE_TTLS.SIGNAL_STORE,
@@ -32,7 +32,12 @@ export const useSingleFileAuthState = async (fileName) => {
                     cache.set(keyName, value);
                 }
             }
-            catch {
+            catch (err) {
+                // A missing file is a fresh session. Corrupt JSON or bad permissions also land
+                // here and silently discard a working session, so they are logged.
+                if (err?.code !== 'ENOENT') {
+                    logger?.warn?.({ err, fileName }, 'Failed to load auth state file, starting empty');
+                }
                 fileData = {};
             }
             isLoaded = true;
@@ -49,7 +54,11 @@ export const useSingleFileAuthState = async (fileName) => {
                     await writeFile(tempFile, JSON.stringify(fileData, BufferJSON.replacer));
                     await rename(tempFile, fileName);
                 }
-                catch { }
+                catch (err) {
+                    // Swallowing this lost every key written since the last successful flush with
+                    // no trace, which surfaces later as a session that cannot decrypt.
+                    logger?.error?.({ err, fileName }, 'Failed to flush auth state file');
+                }
             });
         }, FLUSH_TIMEOUT_MS);
     };

package/package.json

@@ -1,6 +1,6 @@
 {
    "name": "@violetix/baileys",
-   "version": "0.3.18",
+   "version": "0.5.0",
    "description": "Enhanced Baileys v7 with fixes for newsletter media uploads, plus support for interactive messages, albums, and additional message types.",
    "main": "lib/index.js",
    "types": "lib/index.d.ts",
@@ -67,7 +67,7 @@
       "better-sqlite3": "^11.0.0",
       "jimp": "^1.6.1",
       "link-preview-js": "^3.0.0",
-      "sharp": "^0.35.5"
+      "sharp": ">=0.33.0"
    },
    "peerDependenciesMeta": {
       "@napi-rs/image": {