aunubaileys 1.0.50 → 1.0.52

package/README.md

@@ -64,6 +64,14 @@ Everything else is pure upstream. When upstream moves, we rebase the patch layer
 
 
 
+### 🧪 What's new in 1.0.52 / Baru di 1.0.52 — EXPERIMENTAL
+
+- 👍 **`aunuCard` gains like/dislike buttons.** The new `likeDislike: true` option appends two quick-reply buttons under the card — **👍 Suka** (id `aunu_like`) and **👎 Tidak Suka** (id `aunu_dislike`) — after any custom buttons. The ids are overridable via `likeId`/`dislikeId`; taps return to the bot as button replies carrying those ids, so votes can be counted. Without the option, card behaviour is exactly as in 1.0.50.
+
+### 🩹 What's new in 1.0.51 / Baru di 1.0.51
+
+- 🔐 **Three audited gaps, closed.** (1) **Key-store commit failures are no longer swallowed** (`auth-utils.js`): transaction commits still retry as before, but when every retry fails the error is now **thrown** — previously the mutations were silently discarded while the in-memory ratchet had already advanced, so every later message failed against the stale on-disk record. (2) **Hosted device :99 guard** (`signal.js`): `extractDeviceJids` now skips device 99 — hosted / Cloud-API companion devices are not E2E targets and libsignal rejects them when the device list is built. (3) **PN → LID session migration** (`libsignal.js`, `Socket/index.js`): the new repository method `migrateSession(fromJid, toJid)` moves the raw session record onto the LID address when the target has none (never overwrites). It fires automatically and best-effort when live traffic teaches a new PN↔LID pair, and for the account's own session when the connection opens with both `me.id` and `me.lid` known. The 1.0.14–1.0.48 decrypt heals remain the safety net.
+
 ### 🧪 What's new in 1.0.50 / Baru di 1.0.50 — EXPERIMENTAL
 
 - 🃏 **Six more experimental features.** (1) `sock.aunuCard(jid, options)` — an interactive photo card: the header photo **does not open as a normal photo** when tapped, a title/name and text sit fused below it in the same bubble, and divider-separated buttons (`reply`/`url`/`copy`/`call`) sit underneath; the photo is uploaded from a Buffer/URL and embedded as the header, or supplied prebuilt as `imageMessage`. (2) `sock.aunuFakeQuote(jid, content, quote)` — send a message carrying a fabricated quote, as if replying to someone. (3) `sock.aunuTypewriter(jid, text, options)` — a typing effect: the message is sent in growing pieces by editing it on an interval until the full text stands. (4) `sock.aunuReactSequence(jid, key, emojis, options)` — cycle reactions on one message. (5) `sock.aunuPostStatus(text, options)` — a styled text status (background colour + font) in one call. (6) `sock.aunuPersonalCard(jid, targetJid, options)` — the one-person form of 1.0.49's personalised tag-all: an own-profile-picture + name card for a single target, into a chat or as a DM. All experimental, like the features of 1.0.47/1.0.49.

package/lib/Signal/libsignal.js

@@ -74,6 +74,27 @@ export function makeLibSignalRepository(auth) {
             const addr = jidToSignalProtocolAddress(jid).toString();
             await auth.keys.set({ session: { [addr]: null } });
         },
+        async migrateSession(fromJid, toJid) {
+            // AunuBaileys: move a stored session record to another address
+            // form of the same identity (PN -> LID). The raw record is
+            // moved untouched; an existing target record is never
+            // overwritten. Returns true when a record was moved.
+            const fromAddr = jidToSignalProtocolAddress(fromJid).toString();
+            const toAddr = jidToSignalProtocolAddress(toJid).toString();
+            if (fromAddr === toAddr) {
+                return false;
+            }
+            const { [fromAddr]: record } = await auth.keys.get('session', [fromAddr]);
+            if (!record) {
+                return false;
+            }
+            const { [toAddr]: existing } = await auth.keys.get('session', [toAddr]);
+            if (existing) {
+                return false;
+            }
+            await auth.keys.set({ session: { [toAddr]: record, [fromAddr]: null } });
+            return true;
+        },
         async injectE2ESession({ jid, session }) {
             const cipher = new libsignal.SessionBuilder(storage, jidToSignalProtocolAddress(jid));
             await cipher.initOutgoing(session);

package/lib/Socket/aunu-experimental.d.ts

@@ -61,6 +61,10 @@ export interface AunuCardOptions {
     /** Prebuilt imageMessage object, used as-is when provided. */
     imageMessage?: Record<string, unknown>;
     buttons?: AunuCardButton[];
+    /** Append 👍 Suka / 👎 Tidak Suka quick-reply buttons under the card. Taps return as button replies with the like/dislike ids. */
+    likeDislike?: boolean;
+    likeId?: string;
+    dislikeId?: string;
     messageOptions?: MiscMessageGenerationOptions;
 }
 export interface AunuFakeQuoteOptions {

package/lib/Socket/aunu-experimental.js

@@ -187,13 +187,18 @@ export const attachAunuExperimental = (sock) => {
             const prepared = await prepareWAMessageMedia({ image: options.image }, { upload: sock.waUploadToServer });
             imageMessage = prepared.imageMessage;
         }
+        const cardButtons = (options.buttons || []).map(mapCardButton).filter(Boolean);
+        if (options.likeDislike) {
+            cardButtons.push({ name: 'quick_reply', buttonParamsJson: JSON.stringify({ display_text: '👍 Suka', id: options.likeId || 'aunu_like' }) });
+            cardButtons.push({ name: 'quick_reply', buttonParamsJson: JSON.stringify({ display_text: '👎 Tidak Suka', id: options.dislikeId || 'aunu_dislike' }) });
+        }
         const interactive = {
             header: (options.title || options.subtitle || imageMessage)
                 ? { title: options.title || '', subtitle: options.subtitle, hasMediaAttachment: !!imageMessage, imageMessage }
                 : undefined,
             body: { text: options.text || '' },
             footer: options.footer ? { text: options.footer } : undefined,
-            buttons: (options.buttons || []).map(mapCardButton).filter(Boolean)
+            buttons: cardButtons
         };
         return sock.sendMessage(jid, { interactive }, options.messageOptions || {});
     };

package/lib/Socket/index.js

@@ -27,6 +27,45 @@ const makeWASocket = (config) => {
         catch {
             // identity learning must never break message handling
         }
+        // AunuBaileys: when live traffic teaches us a PN <-> LID pair, move
+        // any stored PN session onto the LID address (best-effort; the
+        // decrypt heals remain the fallback).
+        try {
+            for (const msg of upsert?.messages ?? []) {
+                const key = msg?.key ?? {};
+                const pairs = [];
+                if (key.senderPn && key.senderLid) {
+                    pairs.push([key.senderPn, key.senderLid]);
+                }
+                if (key.participantPn && key.participantLid) {
+                    pairs.push([key.participantPn, key.participantLid]);
+                }
+                if (key.remoteJid && key.senderLid && !key.fromMe) {
+                    pairs.push([key.remoteJid, key.senderLid]);
+                }
+                for (const [pn, lid] of pairs) {
+                    sock.signalRepository?.migrateSession?.(pn, lid)?.catch?.(() => { });
+                }
+            }
+        }
+        catch {
+            // session migration must never break message handling
+        }
+    });
+    sock.ev.on('connection.update', (update) => {
+        // AunuBaileys: migrate the account's OWN session to its LID
+        // address once the connection opens with both identities known.
+        try {
+            if (update.connection === 'open') {
+                const me = sock.authState?.creds?.me;
+                if (me?.id && me?.lid) {
+                    sock.signalRepository?.migrateSession?.(me.id, me.lid)?.catch?.(() => { });
+                }
+            }
+        }
+        catch {
+            // session migration must never break connection handling
+        }
     });
     return sock;
 };

package/lib/Types/Signal.d.ts

@@ -54,6 +54,7 @@ export type SignalRepository = {
     injectE2ESession(opts: E2ESessionOpts): Promise<void>;
     /** AunuBaileys: delete the stored E2E session for a JID (used by the Bad MAC self-heal). */
     deleteSession(jid: string): Promise<void>;
+    migrateSession(fromJid: string, toJid: string): Promise<boolean>;
     /** AunuBaileys: delete the stored sender-key record for a group author (stale group session heal). */
     deleteSenderKey(group: string, authorJid: string): Promise<void>;
     jidToSignalProtocolAddress(jid: string): string;

package/lib/Utils/auth-utils.js

@@ -143,19 +143,32 @@ export const addTransactionCapability = (state, logger, { maxCommitRetries, dela
                         // retry mechanism to ensure we've some recovery
                         // in case a transaction fails in the first attempt
                         let tries = maxCommitRetries;
+                        let committed = false;
+                        let lastCommitError;
                         while (tries) {
                             tries -= 1;
                             //eslint-disable-next-line max-depth
                             try {
                                 await state.set(mutations);
                                 logger.trace({ dbQueriesInTransaction }, 'committed transaction');
+                                committed = true;
                                 break;
                             }
                             catch (error) {
+                                lastCommitError = error;
                                 logger.warn(`failed to commit ${Object.keys(mutations).length} mutations, tries left=${tries}`);
                                 await delay(delayBetweenTriesMs);
                             }
                         }
+                        if (!committed) {
+                            // AunuBaileys: a commit that fails through every retry
+                            // must NOT be swallowed — the in-memory ratchet has
+                            // advanced while the persisted state has not, and
+                            // every later message would fail against the stale
+                            // record. Throw so the caller learns its state was
+                            // never persisted.
+                            throw lastCommitError ?? new Error('failed to commit transaction mutations');
+                        }
                     }
                     else {
                         logger.trace('no mutations in transaction');

package/lib/Utils/signal.js

@@ -135,6 +135,7 @@ export const extractDeviceJids = (result, myJid, excludeZeroDevices) => {
             for (const { id: device, keyIndex } of deviceList) {
                 if ((!excludeZeroDevices || device !== 0) && // if zero devices are not-excluded, or device is non zero
                     (myUser !== user || myDevice !== device) && // either different user or if me user, not this device
+                    device !== 99 && // AunuBaileys: hosted / Cloud-API companion devices (:99) are not E2E targets — libsignal rejects them ("Unexpected non-hosted device JID with device 99"); skip them when building the device list
                     (device === 0 || !!keyIndex) // ensure that "key-index" is specified for "non-zero" devices, produces a bad req otherwise
                 ) {
                     extracted.push({ user, device });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aunubaileys",
   "type": "module",
-  "version": "1.0.50",
+  "version": "1.0.52",
   "description": "AunuBaileys \u2014 a WhatsApp Web API for bots that never sleep. Full upstream power with the beloved in-memory store restored and pairing that just works. Forged by AunuCore.",
   "keywords": [
     "whatsapp",