aunubaileys 1.0.49 → 1.0.51

package/README.md

@@ -64,6 +64,14 @@ Everything else is pure upstream. When upstream moves, we rebase the patch layer
 
 
 
+### 🩹 What's new in 1.0.51 / Baru di 1.0.51
+
+- 🔐 **Three audited gaps, closed.** (1) **Key-store commit failures are no longer swallowed** (`auth-utils.js`): transaction commits still retry as before, but when every retry fails the error is now **thrown** — previously the mutations were silently discarded while the in-memory ratchet had already advanced, so every later message failed against the stale on-disk record. (2) **Hosted device :99 guard** (`signal.js`): `extractDeviceJids` now skips device 99 — hosted / Cloud-API companion devices are not E2E targets and libsignal rejects them when the device list is built. (3) **PN → LID session migration** (`libsignal.js`, `Socket/index.js`): the new repository method `migrateSession(fromJid, toJid)` moves the raw session record onto the LID address when the target has none (never overwrites). It fires automatically and best-effort when live traffic teaches a new PN↔LID pair, and for the account's own session when the connection opens with both `me.id` and `me.lid` known. The 1.0.14–1.0.48 decrypt heals remain the safety net.
+
+### 🧪 What's new in 1.0.50 / Baru di 1.0.50 — EXPERIMENTAL
+
+- 🃏 **Six more experimental features.** (1) `sock.aunuCard(jid, options)` — an interactive photo card: the header photo **does not open as a normal photo** when tapped, a title/name and text sit fused below it in the same bubble, and divider-separated buttons (`reply`/`url`/`copy`/`call`) sit underneath; the photo is uploaded from a Buffer/URL and embedded as the header, or supplied prebuilt as `imageMessage`. (2) `sock.aunuFakeQuote(jid, content, quote)` — send a message carrying a fabricated quote, as if replying to someone. (3) `sock.aunuTypewriter(jid, text, options)` — a typing effect: the message is sent in growing pieces by editing it on an interval until the full text stands. (4) `sock.aunuReactSequence(jid, key, emojis, options)` — cycle reactions on one message. (5) `sock.aunuPostStatus(text, options)` — a styled text status (background colour + font) in one call. (6) `sock.aunuPersonalCard(jid, targetJid, options)` — the one-person form of 1.0.49's personalised tag-all: an own-profile-picture + name card for a single target, into a chat or as a DM. All experimental, like the features of 1.0.47/1.0.49.
+
 ### 🧪 What's new in 1.0.49 / Baru di 1.0.49 — EXPERIMENTAL
 
 - 🪪 **Personalised tag-all: every member sees themselves.** New socket method `sock.aunuPersonalTagAll(groupJid, options)`: for EVERY group member the bot sends one card carrying **that member's own profile picture** and their own name, mentioning exactly them — not one generic tag-all message. Pictures come from `profilePictureUrl` (the PN form is used when a member is LID-addressed and the LID store knows the pair); the caption is built from a template with `{name}`, `{number}`, `{mention}`, `{jid}` placeholders; names come from a consumer-supplied `getName` resolver when provided, falling back to the number. Members without a profile picture get a text card, or the `fallbackImage` when set. Built-in anti-spam pacing: a delay between sends (`delayMs`, default 1500) and a member cap (`maxMembers`, default 30); `dm: true` delivers each card to the member's private chat instead. Returns a `{ total, sent, failed, skipped }` summary. Experimental, like the five features of 1.0.47.

package/lib/Signal/libsignal.js

@@ -74,6 +74,27 @@ export function makeLibSignalRepository(auth) {
             const addr = jidToSignalProtocolAddress(jid).toString();
             await auth.keys.set({ session: { [addr]: null } });
         },
+        async migrateSession(fromJid, toJid) {
+            // AunuBaileys: move a stored session record to another address
+            // form of the same identity (PN -> LID). The raw record is
+            // moved untouched; an existing target record is never
+            // overwritten. Returns true when a record was moved.
+            const fromAddr = jidToSignalProtocolAddress(fromJid).toString();
+            const toAddr = jidToSignalProtocolAddress(toJid).toString();
+            if (fromAddr === toAddr) {
+                return false;
+            }
+            const { [fromAddr]: record } = await auth.keys.get('session', [fromAddr]);
+            if (!record) {
+                return false;
+            }
+            const { [toAddr]: existing } = await auth.keys.get('session', [toAddr]);
+            if (existing) {
+                return false;
+            }
+            await auth.keys.set({ session: { [toAddr]: record, [fromAddr]: null } });
+            return true;
+        },
         async injectE2ESession({ jid, session }) {
             const cipher = new libsignal.SessionBuilder(storage, jidToSignalProtocolAddress(jid));
             await cipher.initOutgoing(session);

package/lib/Socket/aunu-experimental.d.ts

@@ -38,6 +38,39 @@ export interface AunuPersonalTagAllResult {
     failed: { jid: string; error: string }[];
     skipped: number;
 }
+export interface AunuCardButton {
+    type?: 'reply' | 'url' | 'copy' | 'call';
+    displayText?: string;
+    text?: string;
+    id?: string;
+    url?: string;
+    copyCode?: string;
+    phoneNumber?: string;
+    /** Raw native-flow passthrough. */
+    name?: string;
+    buttonParamsJson?: string | Record<string, unknown>;
+}
+export interface AunuCardOptions {
+    title?: string;
+    subtitle?: string;
+    /** Body text fused under the photo in the same bubble. */
+    text?: string;
+    footer?: string;
+    /** Header photo (Buffer or { url }); uploaded and embedded as the card header — it does not open as a normal photo. */
+    image?: Buffer | { url: string };
+    /** Prebuilt imageMessage object, used as-is when provided. */
+    imageMessage?: Record<string, unknown>;
+    buttons?: AunuCardButton[];
+    messageOptions?: MiscMessageGenerationOptions;
+}
+export interface AunuFakeQuoteOptions {
+    /** JID the fabricated quote pretends to come from. Defaults to the chat JID. */
+    from?: string;
+    /** Text of the fabricated quoted message. */
+    text?: string;
+    id?: string;
+    quotedMessage?: Record<string, unknown>;
+}
 export interface AunuExperimentalAPI {
     aunuWatermark: (text: string, tag: string) => string;
     aunuReadWatermark: (text: string) => string | null;
@@ -50,5 +83,11 @@ export interface AunuExperimentalAPI {
     aunuCancelSelfDestruct: (messageId: string) => boolean;
     aunuDoctor: () => AunuDoctorReport;
     aunuPersonalTagAll: (groupJid: string, options?: AunuPersonalTagAllOptions) => Promise<AunuPersonalTagAllResult>;
+    aunuCard: (jid: string, options?: AunuCardOptions) => Promise<any>;
+    aunuFakeQuote: (jid: string, content: Record<string, unknown>, quote?: AunuFakeQuoteOptions, options?: MiscMessageGenerationOptions) => Promise<any>;
+    aunuTypewriter: (jid: string, text: string, options?: { steps?: number; intervalMs?: number; messageOptions?: MiscMessageGenerationOptions }) => Promise<any>;
+    aunuReactSequence: (jid: string, key: Record<string, unknown>, emojis: string | string[], options?: { intervalMs?: number; messageOptions?: MiscMessageGenerationOptions }) => Promise<number>;
+    aunuPostStatus: (text: string, options?: { backgroundColor?: string; font?: number } & MiscMessageGenerationOptions) => Promise<any>;
+    aunuPersonalCard: (jid: string | null, targetJid: string, options?: AunuPersonalTagAllOptions) => Promise<any>;
 }
 export declare const attachAunuExperimental: <T>(sock: T) => T & AunuExperimentalAPI;

package/lib/Socket/aunu-experimental.js

@@ -1,6 +1,8 @@
 import baileysVersion from '../Defaults/baileys-version.json' with { type: 'json' };
 import { appendWatermark, computeTypingDuration, extractWatermark, stripWatermark } from '../Utils/aunu-experimental.js';
 import { isLidUser } from '../WABinary/jid-utils.js';
+import { prepareWAMessageMedia } from '../Utils/messages.js';
+import { randomBytes } from 'crypto';
 const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
  * AunuBaileys EXPERIMENTAL socket features — these exist only in
@@ -25,6 +27,21 @@ const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
  *    mentioning exactly them — each member sees themselves, not a
  *    generic tag-all. Paced sends + a member cap guard against spam
  *    limits.
+ * 7. Photo card — `aunuCard`: an interactive card whose header photo does
+ *    NOT open as a normal photo when tapped; a title/name and text sit
+ *    fused below it in the same bubble, with divider-separated buttons
+ *    (reply/url/copy/call) underneath.
+ * 8. Fabricated quote — `aunuFakeQuote`: send any content carrying a
+ *    made-up quoted message, as if replying to someone.
+ * 9. Typewriter — `aunuTypewriter`: send a message in growing pieces by
+ *    editing it on an interval until the full text stands.
+ * 10. Reaction sequence — `aunuReactSequence`: cycle reactions on one
+ *     message (an animation effect).
+ * 11. Styled status — `aunuPostStatus`: post a text status with a
+ *     background colour and font in one call.
+ * 12. Personal card — `aunuPersonalCard`: the one-person form of
+ *     aunuPersonalTagAll (own profile picture + name card for one target,
+ *     into a chat or as a DM).
  */
 export const attachAunuExperimental = (sock) => {
     const scheduled = new Map();
@@ -144,6 +161,115 @@ export const attachAunuExperimental = (sock) => {
         }
         return results;
     };
+    const mapCardButton = (b) => {
+        if (!b) {
+            return null;
+        }
+        if (b.name) {
+            return { name: b.name, buttonParamsJson: typeof b.buttonParamsJson === 'string' ? b.buttonParamsJson : JSON.stringify(b.buttonParamsJson ?? {}) };
+        }
+        const display_text = b.displayText || b.text || '';
+        switch (b.type) {
+            case 'url':
+                return { name: 'cta_url', buttonParamsJson: JSON.stringify({ display_text, url: b.url || '', merchant_url: b.url || '' }) };
+            case 'copy':
+                return { name: 'cta_copy', buttonParamsJson: JSON.stringify({ display_text, id: b.id || 'copy', copy_code: b.copyCode || '' }) };
+            case 'call':
+                return { name: 'cta_call', buttonParamsJson: JSON.stringify({ display_text, id: b.phoneNumber || '' }) };
+            case 'reply':
+            default:
+                return { name: 'quick_reply', buttonParamsJson: JSON.stringify({ display_text, id: b.id || display_text }) };
+        }
+    };
+    sock.aunuCard = async (jid, options = {}) => {
+        let imageMessage = options.imageMessage;
+        if (!imageMessage && options.image) {
+            const prepared = await prepareWAMessageMedia({ image: options.image }, { upload: sock.waUploadToServer });
+            imageMessage = prepared.imageMessage;
+        }
+        const interactive = {
+            header: (options.title || options.subtitle || imageMessage)
+                ? { title: options.title || '', subtitle: options.subtitle, hasMediaAttachment: !!imageMessage, imageMessage }
+                : undefined,
+            body: { text: options.text || '' },
+            footer: options.footer ? { text: options.footer } : undefined,
+            buttons: (options.buttons || []).map(mapCardButton).filter(Boolean)
+        };
+        return sock.sendMessage(jid, { interactive }, options.messageOptions || {});
+    };
+    sock.aunuFakeQuote = async (jid, content, quote = {}, options = {}) => {
+        const contextInfo = {
+            ...(content?.contextInfo || {}),
+            stanzaId: quote.id || ('AUNU' + randomBytes(6).toString('hex').toUpperCase()),
+            participant: quote.from || jid,
+            quotedMessage: quote.quotedMessage || { conversation: quote.text || '' }
+        };
+        return sock.sendMessage(jid, { ...content, contextInfo }, options);
+    };
+    sock.aunuTypewriter = async (jid, text, options = {}) => {
+        const full = String(text ?? '');
+        const steps = Math.max(1, options.steps ?? 6);
+        const intervalMs = options.intervalMs ?? 700;
+        const chunk = Math.max(1, Math.ceil(full.length / steps));
+        const sentMsg = await sock.sendMessage(jid, { text: full.slice(0, chunk) }, options.messageOptions || {});
+        for (let upto = chunk * 2; upto < full.length + chunk; upto += chunk) {
+            if (intervalMs > 0) {
+                await delay(intervalMs);
+            }
+            await sock.sendMessage(jid, { text: full.slice(0, upto), edit: sentMsg.key }, options.messageOptions || {});
+            if (upto >= full.length) {
+                break;
+            }
+        }
+        return sentMsg;
+    };
+    sock.aunuReactSequence = async (jid, key, emojis, options = {}) => {
+        const intervalMs = options.intervalMs ?? 800;
+        const list = Array.isArray(emojis) ? emojis : [emojis];
+        let n = 0;
+        for (const emoji of list) {
+            if (n > 0 && intervalMs > 0) {
+                await delay(intervalMs);
+            }
+            await sock.sendMessage(jid, { react: { text: emoji, key } }, options.messageOptions || {});
+            n += 1;
+        }
+        return n;
+    };
+    sock.aunuPostStatus = async (text, options = {}) => {
+        const { backgroundColor = '#000000', font = 0, ...rest } = options;
+        return sock.sendMessage('status@broadcast', { text: String(text ?? '') }, { backgroundColor, font, ...rest });
+    };
+    sock.aunuPersonalCard = async (jid, targetJid, options = {}) => {
+        const pn = isLidUser(targetJid) ? (sock.aunuLid?.getPNForLID?.(targetJid) || targetJid) : targetJid;
+        const number = pn.split('@')[0].split(':')[0];
+        let name = number;
+        if (typeof options.getName === 'function') {
+            name = (await options.getName(targetJid)) || number;
+        }
+        const template = options.text || 'Hai {mention} 👋';
+        let caption = template
+            .replaceAll('{name}', name)
+            .replaceAll('{number}', number)
+            .replaceAll('{mention}', '@' + number)
+            .replaceAll('{jid}', targetJid);
+        if (!caption.includes('@' + number)) {
+            caption += ' @' + number;
+        }
+        let ppUrl;
+        try {
+            ppUrl = await sock.profilePictureUrl(pn, 'image');
+        }
+        catch {
+            ppUrl = undefined;
+        }
+        const content = ppUrl
+            ? { image: { url: ppUrl }, caption, mentions: [targetJid] }
+            : options.fallbackImage
+                ? { image: Buffer.isBuffer(options.fallbackImage) ? options.fallbackImage : { url: options.fallbackImage }, caption, mentions: [targetJid] }
+                : { text: caption, mentions: [targetJid] };
+        return sock.sendMessage(jid || pn, content, options.messageOptions || {});
+    };
     sock.aunuDoctor = () => ({
         experimental: true,
         bundledWaVersion: Array.isArray(baileysVersion.version) ? baileysVersion.version.join('.') : null,

package/lib/Socket/index.js

@@ -27,6 +27,45 @@ const makeWASocket = (config) => {
         catch {
             // identity learning must never break message handling
         }
+        // AunuBaileys: when live traffic teaches us a PN <-> LID pair, move
+        // any stored PN session onto the LID address (best-effort; the
+        // decrypt heals remain the fallback).
+        try {
+            for (const msg of upsert?.messages ?? []) {
+                const key = msg?.key ?? {};
+                const pairs = [];
+                if (key.senderPn && key.senderLid) {
+                    pairs.push([key.senderPn, key.senderLid]);
+                }
+                if (key.participantPn && key.participantLid) {
+                    pairs.push([key.participantPn, key.participantLid]);
+                }
+                if (key.remoteJid && key.senderLid && !key.fromMe) {
+                    pairs.push([key.remoteJid, key.senderLid]);
+                }
+                for (const [pn, lid] of pairs) {
+                    sock.signalRepository?.migrateSession?.(pn, lid)?.catch?.(() => { });
+                }
+            }
+        }
+        catch {
+            // session migration must never break message handling
+        }
+    });
+    sock.ev.on('connection.update', (update) => {
+        // AunuBaileys: migrate the account's OWN session to its LID
+        // address once the connection opens with both identities known.
+        try {
+            if (update.connection === 'open') {
+                const me = sock.authState?.creds?.me;
+                if (me?.id && me?.lid) {
+                    sock.signalRepository?.migrateSession?.(me.id, me.lid)?.catch?.(() => { });
+                }
+            }
+        }
+        catch {
+            // session migration must never break connection handling
+        }
     });
     return sock;
 };

package/lib/Types/Signal.d.ts

@@ -54,6 +54,7 @@ export type SignalRepository = {
     injectE2ESession(opts: E2ESessionOpts): Promise<void>;
     /** AunuBaileys: delete the stored E2E session for a JID (used by the Bad MAC self-heal). */
     deleteSession(jid: string): Promise<void>;
+    migrateSession(fromJid: string, toJid: string): Promise<boolean>;
     /** AunuBaileys: delete the stored sender-key record for a group author (stale group session heal). */
     deleteSenderKey(group: string, authorJid: string): Promise<void>;
     jidToSignalProtocolAddress(jid: string): string;

package/lib/Utils/auth-utils.js

@@ -143,19 +143,32 @@ export const addTransactionCapability = (state, logger, { maxCommitRetries, dela
                         // retry mechanism to ensure we've some recovery
                         // in case a transaction fails in the first attempt
                         let tries = maxCommitRetries;
+                        let committed = false;
+                        let lastCommitError;
                         while (tries) {
                             tries -= 1;
                             //eslint-disable-next-line max-depth
                             try {
                                 await state.set(mutations);
                                 logger.trace({ dbQueriesInTransaction }, 'committed transaction');
+                                committed = true;
                                 break;
                             }
                             catch (error) {
+                                lastCommitError = error;
                                 logger.warn(`failed to commit ${Object.keys(mutations).length} mutations, tries left=${tries}`);
                                 await delay(delayBetweenTriesMs);
                             }
                         }
+                        if (!committed) {
+                            // AunuBaileys: a commit that fails through every retry
+                            // must NOT be swallowed — the in-memory ratchet has
+                            // advanced while the persisted state has not, and
+                            // every later message would fail against the stale
+                            // record. Throw so the caller learns its state was
+                            // never persisted.
+                            throw lastCommitError ?? new Error('failed to commit transaction mutations');
+                        }
                     }
                     else {
                         logger.trace('no mutations in transaction');

package/lib/Utils/signal.js

@@ -135,6 +135,7 @@ export const extractDeviceJids = (result, myJid, excludeZeroDevices) => {
             for (const { id: device, keyIndex } of deviceList) {
                 if ((!excludeZeroDevices || device !== 0) && // if zero devices are not-excluded, or device is non zero
                     (myUser !== user || myDevice !== device) && // either different user or if me user, not this device
+                    device !== 99 && // AunuBaileys: hosted / Cloud-API companion devices (:99) are not E2E targets — libsignal rejects them ("Unexpected non-hosted device JID with device 99"); skip them when building the device list
                     (device === 0 || !!keyIndex) // ensure that "key-index" is specified for "non-zero" devices, produces a bad req otherwise
                 ) {
                     extracted.push({ user, device });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aunubaileys",
   "type": "module",
-  "version": "1.0.49",
+  "version": "1.0.51",
   "description": "AunuBaileys \u2014 a WhatsApp Web API for bots that never sleep. Full upstream power with the beloved in-memory store restored and pairing that just works. Forged by AunuCore.",
   "keywords": [
     "whatsapp",