sauruspro-bail 5.0.1 → 5.0.2

package/docs/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 5.0.2
+### Added (dari zapo-js, MIT)
+- **Greeting Card `/buss`**: `sock.sendGreetingCard(jid, { text, title, greeting, imageUrl, contactUrl, thumbnail?, sourceApp?, ref?, mentions?, adReply? }, sendOptions?)` dan `sock.buildGreetingCard(opts)`.
+  Pesan `extendedTextMessage` + `contextInfo.externalAdReply`; `sourceId`, `ctwaClid`, `ctaPayload` diacak tiap kirim. Kartu hanya tampil di WhatsApp Business; user biasa hanya melihat teks.
+  Contoh:
+  ```js
+  await sock.sendGreetingCard(jid, {
+    text: 'wow', title: 'Megumin Dominada BUSI', greeting: 'Hi Business',
+    imageUrl: 'https://.../img.jpg', contactUrl: 'https://wa.me/NOMOR'
+  }, { quoted: null })
+  ```
+- **Group History Bundle** (`sock.GroupHistory`, juga export `Utils`): `encodeGroupHistoryBundle`, `decodeGroupHistoryBundle`, `streamGroupHistoryBundle` (baca per pesan, hemat memori).
+- **Meta AI Bot helpers** (`sock.MetaAIBot`, juga `Utils.MetaAIBot`): `BOT_KNOWN_JIDS`, `genBotMsgSecret`, `deriveBotChunkKey`, `decryptBotChunk`, `attachBotMetadata`, `attachBotThread`, `extractInvokedBotJid`, `buildBotInvokeProtoCopy`.
+- **Plugin system** (dari zapo-js): `sock.use(plugin)`, `sock.removePlugin(id)`, `sock.hasPlugin(id)`, `sock.listPlugins()`, helper `definePlugin({ id, exposeAs?, setup(ctx), dispose? })`.
+  `ctx` berisi `sock`, `config`, `logger`, `ev`, `on/off`, `registerDispose`, `extend({...})` (member yang ditambah otomatis dicabut saat plugin dihapus). Opsi socket: `plugins: [...]`, `disablePlugins: ['spr', ...]`.
+  Fitur bawaan sekarang berupa plugin: `spr`, `greeting-card`, `group-history`, `meta-ai-bot`, `presence`, `profile` (API tetap sama; bisa dimatikan lewat `disablePlugins`).
+  ```js
+  const myPlugin = definePlugin({ id: 'halo', setup: ({ extend }) => extend({ halo: () => 'hai' }) })
+  sock.use(myPlugin)
+  ```
+- **Presence & Profile API**: `sock.presence` (`setOnline`, `setOffline`, `typing`, `recording`, `paused`, `subscribe`, `typeFor(jid, ms)`, `withTyping(jid, fn)`) dan `sock.profile` (`getPicture`, `setPicture`, `removePicture`, `getStatus`, `setStatus`, `setName`, `username.{get,set,delete,check,recommendations,setPin,find}`). Pembungkus dari fungsi socket yang sudah ada.
+- **Akselerator kripto native opsional**: jika `@zapo-js/native` terpasang, X25519 dan XEdDSA (sign/verify) dipakai lewat native (NAPI lalu WASM); tanpa paket itu otomatis tetap JS (libsignal). Env `SAURUS_NATIVE_BACKEND` = `auto|napi|wasm|js|none`. Util: `isNativeCryptoActive()`.
+
+### Fixed
+- `requestPairingCode`: kode pairing tanpa custom kini acak tiap request (sebelumnya selalu `VINXSYNC`).
+
+### Changed
+- `lib/Utils/dinonic-spr.js` ditulis ulang dari nol (engine baru, sender key sekali pakai). API `sPR` / `selectiveRelay` tetap kompatibel.
+
+### Added (diadaptasi dari plugin zapo-js, MIT)
+- Opsi `personal` pada `sPR`: pesan khusus per orang.
+- `sPRPrivate`, `sPRBroadcast` (`{name}` + mention + foto profil), `getSPRTargets`, `loadSPRAvatars`.
+- Batas target 100 + hitung overflow, cache foto, budget/timeout, konkurensi.
+- Reporting token memakai util resmi, tctoken memakai pengecekan expired.
+
 ## 5.0.1
 **Owner: Saurus / Dinonic**
 

package/docs/SPR.md

@@ -1,51 +1,88 @@
-# 🎯 SPR (Selective Relay)
+# 🎯 SPR (Selective & Private Relay)
 
-Kirim pesan dengan kontrol **device/JID mana yang menerima kunci asli**, sisanya menerima kunci palsu sehingga tidak bisa membuka pesan.
+Kirim pesan dengan kontrol **siapa membaca apa**. Tiap device penerima masuk salah satu peran:
 
-> Modul SPR dibuat oleh **Nixel**. Watermark di `lib/Utils/dinonic-spr.js` wajib dipertahankan. Lisensi aslinya melarang reupload/resell sebagai produk mandiri dan mengaku sebagai karya sendiri.
+| Peran | Yang diterima |
+|---|---|
+| `public` | pesan umum (menerima sender key sekali pakai) |
+| `personal` | pesan khusus miliknya (enkripsi 1-lawan-1), tanpa pesan umum |
+| `hidden` | tidak menerima apa-apa |
+
+Sender key dibuat baru untuk setiap pesan dan tidak disimpan, jadi device yang tidak diberi kunci tidak bisa membuka pesan meski pernah menerima pesan lain dari bot.
+
+## API
 
 ```js
-await sock.sPR(jid, message, options)
-// alias
-await sock.relayMessageSelective(jid, message, options)
+await sock.sPR(jid, message, options)          // alias: sock.relayMessageSelective
+await sock.sPRPrivate(groupJid, targetJid, { publicText, privateText })
+await sock.sPRBroadcast(groupJid, { template })
+await sock.getSPRTargets(groupJid, { limit })
 ```
 
-Juga bisa di-import: `import { sPR, selectiveRelay } from 'sauruspro-bail'`
-(`sPR(conn, jid, message, options)`, parameter pertama adalah socket).
+Bisa juga di-import: `import { sPR, sPRPrivate, sPRBroadcast } from 'sauruspro-bail'` (parameter pertama adalah socket).
 
-## Options
+## sPR options
 
 | Option | Default | Keterangan |
 |---|---|---|
-| `mode` | `"exclude"` | `exclude`: target **tidak** menerima. `include`: **hanya** target yang menerima |
-| `target` | `[]` | Daftar JID (PN atau LID) |
+| `mode` | `"exclude"` | `exclude`: target **tidak** menerima pesan publik. `include`: **hanya** target |
+| `target` | `[]` | Daftar JID (PN atau LID, alias dicocokkan otomatis) |
+| `personal` | - | Pesan khusus per orang: `{ jid: message }`, `Map`, atau `({jid,user}) => message` |
 | `targetMe` | - | `true/false` memaksa device milik sendiri menerima/tidak |
-| `deviceMode` | `"all"` | `all` / `primary` (device 0) / `secondary` (device lain) |
+| `deviceMode` | `"all"` | `all` / `primary` (device 0) / `secondary` |
 | `hideDecryptFail` | `true` | Sembunyikan placeholder gagal-dekripsi |
 | `messageId` | auto | ID pesan kustom |
 | `additionalAttributes` / `additionalNodes` | - | Atribut/node tambahan pada stanza |
 | `useUserDevicesCache` / `useCachedGroupMetadata` | - | Pakai cache |
 | `statusJidList` | - | Untuk status broadcast |
 
+`message` boleh `null` bila semua penerima punya pesan `personal`.
+
 ## Contoh
 
 ```js
-// Kirim ke grup, tapi sembunyikan dari 1 orang
+// Sembunyikan dari 1 orang
 await sock.sPR(groupJid, { conversation: 'rahasia' }, {
-  mode: 'exclude',
-  target: ['6281234567890@s.whatsapp.net']
+  mode: 'exclude', target: ['6281234567890@s.whatsapp.net']
+})
+
+// Pesan umum untuk semua, pesan lain khusus untuk A
+await sock.sPR(groupJid, { conversation: 'info umum' }, {
+  personal: { '6281234567890@s.whatsapp.net': { conversation: 'info khusus kamu' } }
+})
+```
+
+## sPRPrivate (setara `!spr publik | privat`)
+
+Anggota lain melihat `publicText`, `targetJid` melihat `privateText` dengan foto profilnya sendiri.
+
+```js
+await sock.sPRPrivate(groupJid, targetJid, {
+  publicText: 'Pesan ini memiliki isi khusus untuk beberapa penerima.',
+  privateText: 'rahasia buat kamu',
+  avatar: true
 })
+// -> { id, avatar }
+```
 
-// Hanya kirim ke 1 orang di grup
-await sock.sPR(groupJid, { conversation: 'khusus kamu' }, {
-  mode: 'include',
-  target: ['6281234567890@s.whatsapp.net']
+## sPRBroadcast (setara `!sbpr` / `!sbrp`)
+
+Tiap anggota menerima pesan sendiri: `{name}` menjadi @mention orang itu, plus foto profilnya.
+Anggota di luar `limit` (default 100) melihat `publicText`. Bot tidak dihitung, admin didahulukan.
+
+```js
+await sock.sPRBroadcast(groupJid, {
+  template: 'Halo {name}, ada pesan untukmu.',
+  limit: 100,
+  avatar: true
 })
+// -> { id, targets, total, overflow, withAvatar }
 ```
 
-## Perubahan v5.0.0
+Foto profil diambil konkuren (10 sekaligus) dengan budget 10 dtk dan batas keras 14 dtk; gagal/lambat otomatis jatuh ke pesan teks. Hasil di-cache (200 entri).
+
+## Catatan
 
-- `lib/Utils/dinonic-spr.js` diganti dengan port ESM langsung dari SPR referensi. Logika **identik**; yang berubah hanya sintaks modul (CJS → ESM).
-- Termasuk fallback `me.id` / `me.lid` ke `conn.user` (tidak crash saat `authState.creds.me` kosong).
-- `sPR` & `selectiveRelay` diexport dari entry utama.
-- `encodeSignedDeviceIdentity` diimpor dari `validate-connection.js` (sebelumnya salah dari `generics.js` sehingga paket gagal load).
+- Penerima `personal` hanya melihat pesan personalnya; pesan umum tidak dikirim ke mereka.
+- Fitur privat/broadcast diadaptasi dari plugin zapo-js (MIT).
+- Perubahan v5.0.2: engine ditulis ulang (kode baru), tambah `personal`, `sPRPrivate`, `sPRBroadcast`, `getSPRTargets`, `loadSPRAvatars`. API `sPR`/`selectiveRelay` lama tetap kompatibel.

package/lib/Socket/index.js

@@ -5,7 +5,12 @@ import { makeInteropSocket } from './interop.js'
 import { makePrivacySocket } from './privacy.js'
 import { makeGraphQLSocket } from './graphql.js'
 import { makeMessageBuilderSocket } from './message-builder.js'
-import { sPR } from '../Utils/dinonic-spr.js'
+import { sPR, sPRPrivate, sPRBroadcast, getSPRTargets } from '../Utils/dinonic-spr.js'
+import { sendGreetingCard, buildGreetingCardContent } from '../Utils/greeting-card.js'
+import * as GroupHistory from '../Utils/group-history.js'
+import * as MetaAIBot from '../Utils/meta-ai-bot.js'
+import { definePlugin, makePluginHost } from '../Utils/plugins.js'
+import { makePresence, makeProfile } from '../Utils/presence-profile.js'
 import * as DinonicBuilder from '../Utils/MessageBuilder.js'
 import {
     makeNewsletterStatusSender,
@@ -36,9 +41,38 @@ const makeWASocket = (config) => {
     // Builder by Saurus (A2UI, AIRich, Button, ButtonV2, Carousel, Toolkit)
     clientWithBuilder.DinonicBuilder = DinonicBuilder;
 
-    // SPR (Selective Relay)
-    clientWithBuilder.sPR = (jid, message, options) => sPR(clientWithBuilder, jid, message, options);
-    clientWithBuilder.relayMessageSelective = clientWithBuilder.sPR;
+    // Plugin system (sock.use) + fitur bawaan sebagai plugin (bisa dimatikan lewat config.disablePlugins)
+    const host = makePluginHost(clientWithBuilder, newConfig);
+    clientWithBuilder.use = host.use;
+    clientWithBuilder.removePlugin = host.removePlugin;
+    clientWithBuilder.hasPlugin = host.hasPlugin;
+    clientWithBuilder.listPlugins = host.listPlugins;
+    const sock = clientWithBuilder;
+    const builtinPlugins = [
+        definePlugin({
+            id: 'spr',
+            setup: ({ extend }) => extend({
+                sPR: (jid, message, options) => sPR(sock, jid, message, options),
+                relayMessageSelective: (jid, message, options) => sPR(sock, jid, message, options),
+                sPRPrivate: (groupJid, targetJid, options) => sPRPrivate(sock, groupJid, targetJid, options),
+                sPRBroadcast: (groupJid, options) => sPRBroadcast(sock, groupJid, options),
+                getSPRTargets: (groupJid, options) => getSPRTargets(sock, groupJid, options)
+            })
+        }),
+        definePlugin({
+            id: 'greeting-card',
+            setup: ({ extend }) => extend({
+                sendGreetingCard: (jid, opts, sendOptions) => sendGreetingCard(sock, jid, opts, sendOptions),
+                buildGreetingCard: buildGreetingCardContent
+            })
+        }),
+        definePlugin({ id: 'group-history', setup: ({ extend }) => extend({ GroupHistory }) }),
+        definePlugin({ id: 'meta-ai-bot', setup: ({ extend }) => extend({ MetaAIBot }) }),
+        definePlugin({ id: 'presence', exposeAs: 'presence', setup: ({ sock: s }) => makePresence(s) }),
+        definePlugin({ id: 'profile', exposeAs: 'profile', setup: ({ sock: s }) => makeProfile(s) })
+    ];
+    for (const plugin of builtinPlugins) host.use(plugin);
+    for (const plugin of newConfig.plugins ?? []) host.use(plugin);
 
     // Newsletter Status (Channel Status)
     if (!clientWithBuilder.sendNewsletterStatus) {

package/lib/Socket/socket.js

@@ -735,10 +735,11 @@ export const makeSocket = (config) => {
         void end(new Boom(msg || 'Intentional Logout', { statusCode: DisconnectReason.loggedOut }));
     };
     const requestPairingCode = async (phoneNumber, customPairingCode) => {
-        const pairingCode = customPairingCode ?? 'VINXSYNC';
-        if (customPairingCode && customPairingCode?.length !== 8) {
+        if (customPairingCode && customPairingCode.length !== 8) {
             throw new Error('Custom pairing code must be exactly 8 chars');
         }
+        // Tanpa kode custom: generate acak (Crockford base32) tiap request, bukan konstanta tetap.
+        const pairingCode = customPairingCode ?? bytesToCrockford(randomBytes(5));
         authState.creds.pairingCode = pairingCode;
         authState.creds.me = {
             id: jidEncode(phoneNumber, 's.whatsapp.net'),

package/lib/Utils/crypto.js

@@ -1,6 +1,7 @@
 import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'crypto';
 import * as curve from 'libsignal/src/curve.js';
 import { KEY_BUNDLE_TYPE } from '../Defaults/index.js';
+import { getNativeCrypto } from './native-backend.js';
 export { md5, hkdf } from 'whatsapp-rust-bridge';
 // insure browser & node compatibility
 const { subtle } = globalThis.crypto;
@@ -16,11 +17,34 @@ export const Curve = {
         };
     },
     sharedKey: (privateKey, publicKey) => {
+        const native = getNativeCrypto().x25519;
+        if (native) {
+            try {
+                return Buffer.from(native(privateKey, publicKey.length === 33 ? publicKey.subarray(1) : publicKey));
+            }
+            catch { /* fallback ke JS */ }
+        }
         const shared = curve.calculateAgreement(generateSignalPubKey(publicKey), privateKey);
         return Buffer.from(shared);
     },
-    sign: (privateKey, buf) => curve.calculateSignature(privateKey, buf),
+    sign: (privateKey, buf) => {
+        const native = getNativeCrypto().xeddsaSign;
+        if (native) {
+            try {
+                return Buffer.from(native(privateKey, buf));
+            }
+            catch { /* fallback ke JS */ }
+        }
+        return curve.calculateSignature(privateKey, buf);
+    },
     verify: (pubKey, message, signature) => {
+        const native = getNativeCrypto().xeddsaVerify;
+        if (native) {
+            try {
+                return !!native(pubKey.length === 33 ? pubKey.subarray(1) : pubKey, message, signature);
+            }
+            catch { /* fallback ke JS */ }
+        }
         try {
             curve.verifySignature(generateSignalPubKey(pubKey), message, signature);
             return true;

package/lib/Utils/dinonic-spr.d.ts

@@ -1,26 +1,73 @@
-export function generateSigningKeyPair(): {
-    privateKey: Buffer;
-    publicKey: Buffer;
-};
-export function getMessageKey(seed: Buffer): {
-    iv: Buffer;
-    cipherKey: Buffer;
-};
-export function deriveReportingTag(message: any, msgId: string, remoteJid: string): Buffer;
-export function encryptGroupMessage(plaintext: Buffer | Uint8Array, chainSeed: Buffer, privateKeyObject: any, keyId: number): Buffer;
-export function createSKDM(keyId: number, iteration: number, chainSeed: Buffer, signingPubKey: Buffer): Buffer;
-export function sPR(conn: any, jid: string, message: any, options?: {
+type Jid = string;
+type PersonalInput =
+    | ((ctx: { jid: Jid; user: string }) => any | null)
+    | Map<Jid, any>
+    | Record<Jid, any>;
+
+export interface SPROptions {
     messageId?: string;
     additionalAttributes?: any;
+    additionalNodes?: any[];
     useUserDevicesCache?: boolean;
     useCachedGroupMetadata?: boolean;
     statusJidList?: string[];
-    additionalNodes?: any[];
     targetMe?: boolean;
+    /** Berlaku untuk pesan publik. */
     mode?: "include" | "exclude";
-    target?: string[];
-    hideDecryptFail?: boolean;
+    target?: Jid[];
     deviceMode?: "all" | "primary" | "secondary";
-}): Promise<string>;
+    hideDecryptFail?: boolean;
+    /** Pesan khusus per orang. Penerima personal tidak menerima pesan publik. */
+    personal?: PersonalInput;
+}
+
+export const SPR_LIMITS: Readonly<{
+    targets: number;
+    concurrency: number;
+    encryptConcurrency: number;
+    avatarBudgetMs: number;
+    avatarHardCapMs: number;
+    avatarFetchMs: number;
+    cacheSize: number;
+}>;
+export const SPR_TEXT: Readonly<Record<string, string>>;
+
+export function createOneShotSenderKey(): {
+    keyId: number;
+    distribution(): Buffer;
+    seal(plaintext: Buffer | Uint8Array): Buffer;
+};
+
+export function sPR(conn: any, jid: Jid, message: any | null, options?: SPROptions): Promise<string>;
 export const selectiveRelay: typeof sPR;
+
+export function getSPRTargets(conn: any, groupJid: Jid, options?: { limit?: number; exclude?: Jid[] }): Promise<{
+    meta: any;
+    targets: any[];
+    total: number;
+    overflow: number;
+}>;
+
+export function loadSPRAvatars(conn: any, people: any[], options?: {
+    concurrency?: number;
+    budgetMs?: number;
+    hardCapMs?: number;
+    fetchMs?: number;
+}): Promise<Map<string, any>>;
+
+export function sPRPrivate(conn: any, groupJid: Jid, targetJid: Jid, options: Omit<SPROptions, "personal"> & {
+    publicText?: string;
+    privateText: string;
+    avatar?: boolean;
+    mentionTarget?: boolean;
+}): Promise<{ id: string; avatar: boolean }>;
+
+export function sPRBroadcast(conn: any, groupJid: Jid, options?: Omit<SPROptions, "personal"> & {
+    template?: string;
+    publicText?: string;
+    limit?: number;
+    exclude?: Jid[];
+    avatar?: boolean;
+}): Promise<{ id: string; targets: number; total: number; overflow: number; withAvatar: number }>;
+
 export default sPR;