aunubaileys 1.0.34 → 1.0.36

package/LICENSE

@@ -1,7 +1,12 @@
 MIT License
 
+Copyright (c) 2026 AunuCore Creative Network
 Copyright (c) 2025 Rajeh Taher/WhiskeySockets
 
+AunuBaileys is developed and maintained by AunuCore Creative Network and is
+based on Baileys by WhiskeySockets. The original copyright notice above is
+retained as required by the MIT License.
+
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
 in the Software without restriction, including without limitation the rights

package/README.md

@@ -64,6 +64,14 @@ Everything else is pure upstream. When upstream moves, we rebase the patch layer
 
 
 
+### 🆕 What's new in 1.0.36 / Baru di 1.0.36
+
+- 📜 **The license now carries the AunuCore Creative Network copyright** — the LICENSE file previously listed only the upstream (WhiskeySockets) copyright, even though AunuBaileys is developed and maintained by AunuCore Creative Network. The primary copyright line is now AunuCore Creative Network, with the upstream attribution retained directly below it exactly as the MIT License requires, plus one line explaining the package's origin. The license itself is unchanged: still MIT, the package.json `license` field is still "MIT", and package users' rights are exactly as before. No code changes in this release.
+
+### 🆕 What's new in 1.0.35 / Baru di 1.0.35
+
+- 📡 **Decrypt failures now emit a structured signal instead of a log flood** — one rotten session can fail hundreds of messages in minutes (B-01), and every failure was logged at ERROR level, drowning the logs while the bot had no programmatic way to know a Bad MAC flood was happening. Now: (1) the decrypt error log is throttled per sender address — first line immediately, then at most one line per minute per sender carrying the suppressed-failure count; (2) a new `messages.decrypt-failure` event carries the chat, sender, signal address, consecutive failure count, and whether this failure tripped the session/sender-key reset — consumers can alert and aggregate without parsing logs. The failure handling itself is unchanged. Closing release of the 1.0.14–1.0.35 fix train.
+
 ### 🆕 What's new in 1.0.34 / Baru di 1.0.34
 
 - 🗳️ **One person no longer counts as two poll voters across the LID/PN split** — poll aggregation keyed voters by their raw message-key identity, so someone voting first as a phone number and later as a LID (or the reverse) counted as two different voters, and a poll update arriving in the other identity form piled up as a second entry instead of replacing the old one. `getAggregateVotesInPollMessage` and `updateMessageWithPollUpdate` now accept an optional `{ lidStore }` option: voters are canonicalized to their phone-number JID and deduped per option. Without a store, legacy behaviour is unchanged.

package/lib/Socket/messages-recv.js

@@ -751,6 +751,19 @@ export const makeMessagesRecvSocket = (config) => {
                                         else {
                                             decryptFailCounts.set(failKey, fails);
                                         }
+                                        // AunuBaileys: structured decrypt-failure event so
+                                        // consumers can alert and aggregate on Bad MAC
+                                        // floods (B-01) instead of parsing log lines.
+                                        ev.emit('messages.decrypt-failure', {
+                                            remoteJid: msg.key.remoteJid,
+                                            author,
+                                            address: addr,
+                                            isGroup: isGroupMsg,
+                                            failures: fails,
+                                            healed: fails >= DECRYPT_FAIL_SESSION_RESET_LIMIT,
+                                            messageId: node.attrs.id,
+                                            timestamp: Date.now()
+                                        });
                                     }
                                     catch (healErr) {
                                         logger.debug({ err: healErr }, 'aunu: session self-heal step failed, continuing with normal retry');

package/lib/Types/Events.d.ts

@@ -43,6 +43,21 @@ export type BaileysEventMap = {
     };
     'contacts.upsert': Contact[];
     'contacts.update': Partial<Contact>[];
+    'messages.decrypt-failure': {
+        /** the chat the failed message arrived in */
+        remoteJid: string;
+        /** sender JID (participant in groups) */
+        author: string;
+        /** signal-protocol address the failure was counted against */
+        address: string;
+        isGroup: boolean;
+        /** consecutive failures for this address, including this one */
+        failures: number;
+        /** true when this failure tripped the session/sender-key reset */
+        healed: boolean;
+        messageId: string;
+        timestamp: number;
+    };
     'messages.delete': {
         keys: WAMessageKey[];
     } | {

package/lib/Utils/decode-wa-message.js

@@ -109,6 +109,26 @@ export function decodeMessageNode(stanza, meId, meLid) {
         sender: msgType === 'chat' ? author : chatId
     };
 }
+// AunuBaileys: per-address throttle for the per-message decrypt error log.
+// One rotten session can fail hundreds of messages in minutes (B-01: every
+// failure from a single LID address flooded the logs at ERROR level); the
+// first failure per address logs immediately, then at most one line per
+// minute, carrying how many failures were suppressed in between. Nothing
+// about the failure handling itself changes — only the log volume.
+const DECRYPT_ERROR_LOG_INTERVAL_MS = 60_000;
+const decryptErrorLogState = new Map();
+const logDecryptErrorThrottled = (logger, address, key, err) => {
+    const now = Date.now();
+    const state = decryptErrorLogState.get(address) || { lastLoggedAt: 0, suppressed: 0 };
+    if (now - state.lastLoggedAt >= DECRYPT_ERROR_LOG_INTERVAL_MS) {
+        logger.error({ key, err, suppressedFailures: state.suppressed }, 'failed to decrypt message');
+        decryptErrorLogState.set(address, { lastLoggedAt: now, suppressed: 0 });
+    }
+    else {
+        decryptErrorLogState.set(address, { ...state, suppressed: state.suppressed + 1 });
+    }
+};
+
 export const decryptMessageNode = (stanza, meId, meLid, repository, logger) => {
     const { fullMessage, author, sender } = decodeMessageNode(stanza, meId, meLid);
     return {
@@ -171,7 +191,7 @@ export const decryptMessageNode = (stanza, meId, meLid, repository, logger) => {
                                 });
                             }
                             catch (err) {
-                                logger.error({ key: fullMessage.key, err }, 'failed to decrypt message');
+                                logDecryptErrorThrottled(logger, author, fullMessage.key, err);
                             }
                         }
                         if (fullMessage.message) {
@@ -182,7 +202,7 @@ export const decryptMessageNode = (stanza, meId, meLid, repository, logger) => {
                         }
                     }
                     catch (err) {
-                        logger.error({ key: fullMessage.key, err }, 'failed to decrypt message');
+                        logDecryptErrorThrottled(logger, author, fullMessage.key, err);
                         fullMessage.messageStubType = proto.WebMessageInfo.StubType.CIPHERTEXT;
                         fullMessage.messageStubParameters = [err.message];
                     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aunubaileys",
   "type": "module",
-  "version": "1.0.34",
+  "version": "1.0.36",
   "description": "AunuBaileys \u2014 a WhatsApp Web API for bots that never sleep. Full upstream power with the beloved in-memory store restored and pairing that just works. Forged by AunuCore.",
   "keywords": [
     "whatsapp",