aunubaileys 1.0.47 → 1.0.49

package/README.md

@@ -64,6 +64,14 @@ Everything else is pure upstream. When upstream moves, we rebase the patch layer
 
 
 
+### 🧪 What's new in 1.0.49 / Baru di 1.0.49 — EXPERIMENTAL
+
+- 🪪 **Personalised tag-all: every member sees themselves.** New socket method `sock.aunuPersonalTagAll(groupJid, options)`: for EVERY group member the bot sends one card carrying **that member's own profile picture** and their own name, mentioning exactly them — not one generic tag-all message. Pictures come from `profilePictureUrl` (the PN form is used when a member is LID-addressed and the LID store knows the pair); the caption is built from a template with `{name}`, `{number}`, `{mention}`, `{jid}` placeholders; names come from a consumer-supplied `getName` resolver when provided, falling back to the number. Members without a profile picture get a text card, or the `fallbackImage` when set. Built-in anti-spam pacing: a delay between sends (`delayMs`, default 1500) and a member cap (`maxMembers`, default 30); `dm: true` delivers each card to the member's private chat instead. Returns a `{ total, sent, failed, skipped }` summary. Experimental, like the five features of 1.0.47.
+
+### 🆕 What's new in 1.0.48 / Baru di 1.0.48
+
+- 🩹 **Group Bad MAC now heals both layers.** The "Bad MAC" error (from Tenka's live log on 11 Nov 2026, the same LID address as the B-01 finding and the 1.0.46 flood) is thrown by `SessionCipher` — the whisper/E2E session layer — and in groups it can equally come from the sender-key layer. The old strike-limit path (1.0.14) for groups deleted only the sender key, so a rotten E2E session of the author was never touched and the failures repeated forever: the same wrong-layer class that 1.0.46 closed for session failures, now closed on the strike path. At the 3-failure limit, groups now reset the author's E2E session (including the alternate PN↔LID address record) AND drop the sender key, with the retry receipt carrying fresh keys. DM behaviour and the 3-strike threshold are unchanged. The `messages.decrypt-failure` event now distinguishes `errorClass: 'bad-mac'` from `'session'`/`'other'` (new exported predicate: `isBadMacError(text)`).
+
 ### 🧪 What's new in 1.0.47 / Baru di 1.0.47 — EXPERIMENTAL
 
 - 🧪 **Five experimental features that exist only in AunuBaileys**, in a single version. All are attached automatically to the socket returned by `makeWASocket` and are explicitly experimental — semantics may change in any release: (1) **Invisible text watermark** — `sock.aunuWatermark(text, tag)` hides a short tag (bot name, campaign, build) inside message text as zero-width characters for leak tracing and fingerprinting; the visible text is unchanged; companions `aunuReadWatermark(text)` and `aunuStripWatermark(text)`, plus root utils `encodeWatermark`/`appendWatermark`/`extractWatermark`/`stripWatermark`. (2) **Human send** — `sock.aunuHumanSend(jid, content)`: shows "composing" for a plausible typing duration derived from the text length (util `computeTypingDuration`, clamped 700–8000 ms, ±20% jitter), then sends. (3) **Scheduled send** — `sock.aunuSchedule(jid, content, when)` (ms delay or Date) with `aunuCancelScheduled(id)` and `aunuListScheduled()`; in-memory, lost on restart. (4) **Self-destruct** — `sock.aunuSelfDestruct(jid, content, seconds)`: sends, then revokes the message for everyone after N seconds; `aunuCancelSelfDestruct(messageId)` cancels. (5) **Connection doctor** — `sock.aunuDoctor()`: one structured health snapshot (bundled WA version, registration state, open transport, known LID pair count, pending experimental timers).

package/lib/Socket/aunu-experimental.d.ts

@@ -17,6 +17,27 @@ export interface AunuScheduledSend {
     at: number;
     cancel: () => boolean;
 }
+export interface AunuPersonalTagAllOptions {
+    /** Caption template; placeholders {name}, {number}, {mention}, {jid}. Default 'Hai {mention} 👋'. */
+    text?: string;
+    /** Pause between per-member sends in ms. Default 1500. */
+    delayMs?: number;
+    /** Maximum members processed. Default 30. */
+    maxMembers?: number;
+    /** Send each card as a DM to the member instead of into the group. Default false. */
+    dm?: boolean;
+    /** Image (Buffer or URL) used when a member has no profile picture. Without it, that member gets a text card. */
+    fallbackImage?: Buffer | string;
+    /** Resolve a display name for a participant JID; falls back to the number. */
+    getName?: (jid: string) => string | undefined | Promise<string | undefined>;
+    messageOptions?: MiscMessageGenerationOptions;
+}
+export interface AunuPersonalTagAllResult {
+    total: number;
+    sent: number;
+    failed: { jid: string; error: string }[];
+    skipped: number;
+}
 export interface AunuExperimentalAPI {
     aunuWatermark: (text: string, tag: string) => string;
     aunuReadWatermark: (text: string) => string | null;
@@ -28,5 +49,6 @@ export interface AunuExperimentalAPI {
     aunuSelfDestruct: (jid: string, content: AnyMessageContent, seconds: number, options?: MiscMessageGenerationOptions) => Promise<WAMessage | undefined>;
     aunuCancelSelfDestruct: (messageId: string) => boolean;
     aunuDoctor: () => AunuDoctorReport;
+    aunuPersonalTagAll: (groupJid: string, options?: AunuPersonalTagAllOptions) => Promise<AunuPersonalTagAllResult>;
 }
 export declare const attachAunuExperimental: <T>(sock: T) => T & AunuExperimentalAPI;

package/lib/Socket/aunu-experimental.js

@@ -1,5 +1,6 @@
 import baileysVersion from '../Defaults/baileys-version.json' with { type: 'json' };
 import { appendWatermark, computeTypingDuration, extractWatermark, stripWatermark } from '../Utils/aunu-experimental.js';
+import { isLidUser } from '../WABinary/jid-utils.js';
 const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
  * AunuBaileys EXPERIMENTAL socket features — these exist only in
@@ -19,6 +20,11 @@ const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
  * 5. Connection doctor — `aunuDoctor`: one structured health snapshot
  *    (registration, transport, bundled WA version, known LID pairs,
  *    pending experimental timers).
+ * 6. Personalised tag-all — `aunuPersonalTagAll`: for EVERY group member,
+ *    one message carrying that member's OWN profile picture and name,
+ *    mentioning exactly them — each member sees themselves, not a
+ *    generic tag-all. Paced sends + a member cap guard against spam
+ *    limits.
  */
 export const attachAunuExperimental = (sock) => {
     const scheduled = new Map();
@@ -88,6 +94,56 @@ export const attachAunuExperimental = (sock) => {
         destructs.delete(messageId);
         return true;
     };
+    sock.aunuPersonalTagAll = async (groupJid, options = {}) => {
+        const metadata = await sock.groupMetadata(groupJid);
+        const all = metadata?.participants || [];
+        const participants = all.slice(0, options.maxMembers ?? 30);
+        const template = options.text || 'Hai {mention} 👋';
+        const delayMs = options.delayMs ?? 1500;
+        const results = { total: all.length, sent: 0, failed: [], skipped: all.length - participants.length };
+        let first = true;
+        for (const participant of participants) {
+            const pid = participant.id;
+            if (!first && delayMs > 0) {
+                await delay(delayMs);
+            }
+            first = false;
+            try {
+                const pn = isLidUser(pid) ? (sock.aunuLid?.getPNForLID?.(pid) || pid) : pid;
+                const number = pn.split('@')[0].split(':')[0];
+                let name = number;
+                if (typeof options.getName === 'function') {
+                    name = (await options.getName(pid)) || number;
+                }
+                let caption = template
+                    .replaceAll('{name}', name)
+                    .replaceAll('{number}', number)
+                    .replaceAll('{mention}', '@' + number)
+                    .replaceAll('{jid}', pid);
+                if (!caption.includes('@' + number)) {
+                    caption += ' @' + number;
+                }
+                let ppUrl;
+                try {
+                    ppUrl = await sock.profilePictureUrl(pn, 'image');
+                }
+                catch {
+                    ppUrl = undefined;
+                }
+                const content = ppUrl
+                    ? { image: { url: ppUrl }, caption, mentions: [pid] }
+                    : options.fallbackImage
+                        ? { image: Buffer.isBuffer(options.fallbackImage) ? options.fallbackImage : { url: options.fallbackImage }, caption, mentions: [pid] }
+                        : { text: caption, mentions: [pid] };
+                await sock.sendMessage(options.dm ? pn : groupJid, content, options.messageOptions || {});
+                results.sent += 1;
+            }
+            catch (err) {
+                results.failed.push({ jid: pid, error: String(err?.message || err) });
+            }
+        }
+        return results;
+    };
     sock.aunuDoctor = () => ({
         experimental: true,
         bundledWaVersion: Array.isArray(baileysVersion.version) ? baileysVersion.version.join('.') : null,

package/lib/Socket/messages-recv.js

@@ -5,7 +5,7 @@ import Long from 'long';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_CACHE_TTLS, KEY_BUNDLE_TYPE, MIN_PREKEY_COUNT } from '../Defaults/index.js';
 import { WAMessageStatus, WAMessageStubType } from '../Types/index.js';
-import { aesDecryptCTR, aesEncryptGCM, cleanMessage, Curve, decodeMediaRetryNode, decodeMessageNode, decryptMessageNode, delay, derivePairingCodeKey, encodeBigEndian, encodeSignedDeviceIdentity, getCallStatusFromNode, getHistoryMsg, getNextPreKeys, getStatusFromReceiptType, hkdf, isUnrecoverableSessionError, MISSING_KEYS_ERROR_TEXT, NACK_REASONS, NO_MESSAGE_FOUND_ERROR_TEXT, buildCallControlStanza, parseRetryReceiptSession, unixTimestampSeconds, xmppPreKey, xmppSignedPreKey } from '../Utils/index.js';
+import { aesDecryptCTR, aesEncryptGCM, cleanMessage, Curve, decodeMediaRetryNode, decodeMessageNode, decryptMessageNode, delay, derivePairingCodeKey, encodeBigEndian, encodeSignedDeviceIdentity, getCallStatusFromNode, getHistoryMsg, getNextPreKeys, getStatusFromReceiptType, hkdf, isBadMacError, isUnrecoverableSessionError, MISSING_KEYS_ERROR_TEXT, NACK_REASONS, NO_MESSAGE_FOUND_ERROR_TEXT, buildCallControlStanza, parseRetryReceiptSession, unixTimestampSeconds, xmppPreKey, xmppSignedPreKey } from '../Utils/index.js';
 import { makeMutex } from '../Utils/make-mutex.js';
 import { sentMessageCacheFor } from '../Utils/sent-message-cache.js';
 import { areJidsSameUser, getAllBinaryNodeChildren, getBinaryNodeChild, getBinaryNodeChildBuffer, getBinaryNodeChildren, getBinaryNodeChildString, isJidGroup, isJidStatusBroadcast, isJidUser, isLidUser, jidDecode, jidNormalizedUser, S_WHATSAPP_NET } from '../WABinary/index.js';
@@ -789,8 +789,15 @@ export const makeMessagesRecvSocket = (config) => {
                                         }
                                         else if (fails >= DECRYPT_FAIL_SESSION_RESET_LIMIT) {
                                             if (isGroupMsg) {
+                                                // AunuBaileys (1.0.48): Bad MAC adalah error
+                                                // lapis whisper/sesi E2E (SessionCipher), dan
+                                                // di grup ia juga bisa datang dari lapis
+                                                // sender key — menghapus sender key SAJA
+                                                // (perilaku 1.0.14) tidak menyentuh sesi E2E
+                                                // penulis yang busuk. Bersihkan keduanya.
+                                                await resetE2ESession();
                                                 await signalRepository.deleteSenderKey(msg.key.remoteJid, author);
-                                                logger.warn({ author, group: msg.key.remoteJid }, 'aunu: deleted stale sender-key record after repeated group decrypt failures; retry request asks the author to resend with a fresh distribution message');
+                                                logger.warn({ author, group: msg.key.remoteJid }, 'aunu: reset E2E session and deleted stale sender-key record after repeated group decrypt failures; retry receipt carries fresh keys');
                                             }
                                             else {
                                                 await resetE2ESession();
@@ -813,7 +820,7 @@ export const makeMessagesRecvSocket = (config) => {
                                             isGroup: isGroupMsg,
                                             failures: fails,
                                             healed,
-                                            errorClass: sessionLayerFailure ? 'session' : 'other',
+                                            errorClass: sessionLayerFailure ? 'session' : (isBadMacError(msg?.messageStubParameters?.[0]) ? 'bad-mac' : 'other'),
                                             messageId: node.attrs.id,
                                             timestamp: Date.now()
                                         });

package/lib/Utils/decode-wa-message.d.ts

@@ -3,6 +3,7 @@ import { type BinaryNode } from '../WABinary/index.js';
 import type { ILogger } from './logger.js';
 export declare const NO_MESSAGE_FOUND_ERROR_TEXT = "Message absent from node";
 export declare const isUnrecoverableSessionError: (text: unknown) => boolean;
+export declare const isBadMacError: (text: unknown) => boolean;
 export declare const MISSING_KEYS_ERROR_TEXT = "Key used already or never filled";
 export declare const NACK_REASONS: {
     ParsingError: number;

package/lib/Utils/decode-wa-message.js

@@ -227,4 +227,11 @@ export const decryptMessageNode = (stanza, meId, meLid, repository, logger) => {
  */
 export const isUnrecoverableSessionError = (text) => typeof text === 'string' &&
     /no matching sessions found|no session record|no sessions available/i.test(text);
+/**
+ * AunuBaileys: true when a decrypt failure text is a MAC verification
+ * failure ("Bad MAC") — the stored session/sender-key state and the
+ * sender's state disagree about the message authentication code, the
+ * classic symptom of a desynchronised ratchet on either side.
+ */
+export const isBadMacError = (text) => typeof text === 'string' && /bad mac/i.test(text);
 //# sourceMappingURL=decode-wa-message.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aunubaileys",
   "type": "module",
-  "version": "1.0.47",
+  "version": "1.0.49",
   "description": "AunuBaileys \u2014 a WhatsApp Web API for bots that never sleep. Full upstream power with the beloved in-memory store restored and pairing that just works. Forged by AunuCore.",
   "keywords": [
     "whatsapp",