fix(WEBJS): phantom AUTHENTICATED/READY on logout and onNewMessageId binding race - fix #2222

- Update proto
- Fix disable whole store - fix #2207

.env.example

@@ -21,6 +21,8 @@ WHATSAPP_SWAGGER_ENABLED=True
 # ==================
 # WhatsApp engine (WEBJS is default, GOWS or NOWEB for better performance)
 WHATSAPP_DEFAULT_ENGINE=WEBJS
+# So you don't have to create sessions/apps when switching between engines
+WAHA_NAMESPACE=all
 
 # "Firefox (YourApp)" in Linked Devices
 # WAHA_CLIENT_DEVICE_NAME=YourApp

.env.yarn

@@ -0,0 +1 @@
+SHARP_IGNORE_GLOBAL_LIBVIPS=1

.github/workflows/build.yaml

@@ -12,10 +12,11 @@ jobs:
       ${{ matrix.engine }} - ${{ matrix.browser }} - ${{ matrix.platform }} -
       ${{ matrix.tag }}
     strategy:
+      fail-fast: false
       matrix:
         include:
           # Chromium - x86
-          - runner: 'buildjet-4vcpu-ubuntu-2204'
+          - runner: 'ubuntu-latest'
             tag: 'latest'
             platform: 'amd64'
             browser: 'chromium'
@@ -23,7 +24,7 @@ jobs:
             goss: 'goss-linux-amd64'
 
           # Chromium - ARM
-          - runner: 'buildjet-4vcpu-ubuntu-2204-arm'
+          - runner: 'ubuntu-24.04-arm'
             tag: 'arm'
             platform: 'linux/arm64'
             browser: 'chromium'
@@ -31,7 +32,7 @@ jobs:
             goss: 'goss-linux-arm'
 
           # Chrome - x86
-          - runner: 'buildjet-4vcpu-ubuntu-2204'
+          - runner: 'ubuntu-latest'
             tag: 'chrome'
             platform: 'amd64'
             browser: 'chrome'
@@ -39,14 +40,14 @@ jobs:
             goss: 'goss-linux-amd64'
 
           # Chrome - ARM (Chrome is not available for ARM)
-          #- runner: "buildjet-4vcpu-ubuntu-2204-arm"
+          #- runner: "ubuntu-24.04-arm"
           #  tag: "chrome-arm"
           #  platform: "linux/arm64"
           #  browser: "chrome"
           #  goss: 'goss-linux-arm'
 
           # NOWEB - x86
-          - runner: 'buildjet-4vcpu-ubuntu-2204'
+          - runner: 'ubuntu-latest'
             tag: 'noweb'
             platform: 'amd64'
             browser: 'none'
@@ -54,7 +55,7 @@ jobs:
             goss: 'goss-linux-amd64'
 
           # NOWEB - ARM
-          - runner: 'buildjet-4vcpu-ubuntu-2204-arm'
+          - runner: 'ubuntu-24.04-arm'
             tag: 'noweb-arm'
             platform: 'linux/arm64'
             browser: 'none'
@@ -62,7 +63,7 @@ jobs:
             goss: 'goss-linux-arm'
 
           # GOWS - x86
-          - runner: 'buildjet-4vcpu-ubuntu-2204'
+          - runner: 'ubuntu-latest'
             tag: 'gows'
             platform: 'amd64'
             browser: 'none'
@@ -70,7 +71,7 @@ jobs:
             goss: 'goss-linux-amd64'
 
           # No browser - ARM
-          - runner: 'buildjet-4vcpu-ubuntu-2204-arm'
+          - runner: 'ubuntu-24.04-arm'
             tag: 'gows-arm'
             platform: 'linux/arm64'
             browser: 'none'

.github/workflows/dev.yaml

@@ -6,46 +6,47 @@ on:
   workflow_dispatch:
 
 jobs:
-  unit-tests:
-    if: github.repository == 'devlikeapro/waha-plus'
-    runs-on: ubuntu-22.04
-    name: Unit tests
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Enable Corepack
-        run: |
-          corepack enable
-          corepack prepare yarn@4.9.2 --activate
-
-      - name: Install dependencies
-        run: |
-          unset GIT_CONFIG_PARAMETERS
-          yarn install --immutable
-
-      - name: Run unit tests
-        run: yarn test:unit
+  #  unit-tests:
+  #    if: github.repository == 'devlikeapro/waha-plus'
+  #    runs-on: ubuntu-22.04
+  #    name: Unit tests
+  #    steps:
+  #      - name: Checkout
+  #        uses: actions/checkout@v4
+  #        with:
+  #          fetch-depth: 0
+  #
+  #      - name: Set up Node
+  #        uses: actions/setup-node@v4
+  #        with:
+  #          node-version: 22
+  #
+  #      - name: Enable Corepack
+  #        run: |
+  #          corepack enable
+  #          corepack prepare yarn@4.9.2 --activate
+  #
+  #      - name: Install dependencies
+  #        run: |
+  #          unset GIT_CONFIG_PARAMETERS
+  #          yarn install --immutable
+  #
+  #      - name: Run unit tests
+  #        run: yarn test:unit
 
   docker-build:
-    if: github.repository == 'devlikeapro/waha-plus'
-    needs: unit-tests
+    if: github.repository == 'devlikeapro/waha'
+    #    needs: unit-tests
     runs-on: ${{ matrix.runner }}
     name:
       ${{ matrix.engine }} - ${{ matrix.browser }} - ${{ matrix.platform }} -
       ${{ matrix.tag }}
     strategy:
+      fail-fast: false
       matrix:
         include:
           # Chromium - x86
-          - runner: 'buildjet-4vcpu-ubuntu-2204'
+          - runner: 'ubuntu-latest'
             tag: 'dev'
             platform: 'amd64'
             browser: 'chromium'
@@ -53,7 +54,7 @@ jobs:
             goss: 'goss-linux-amd64'
 
           # Chrome - x86
-          - runner: 'buildjet-4vcpu-ubuntu-2204'
+          - runner: 'ubuntu-latest'
             tag: 'dev-chrome'
             platform: 'amd64'
             browser: 'chrome'
@@ -61,7 +62,7 @@ jobs:
             goss: 'goss-linux-amd64'
 
           # Chromium - ARM
-          - runner: 'buildjet-4vcpu-ubuntu-2204-arm'
+          - runner: 'ubuntu-24.04-arm'
             tag: 'dev-arm'
             platform: 'linux/arm64'
             browser: 'chromium'
@@ -72,6 +73,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         with:
+          ref: dev
           fetch-depth: 0
 
       - name: Check recent changes

.gitignore

@@ -1,3 +1,4 @@
+openapi.json
 tmp/*
 src/core/engines/gows/proto
 .env

.yarnrc.yml

@@ -1,5 +1,32 @@
+approvedGitRepositories:
+  - '**'
+
 compressionLevel: mixed
 
 enableGlobalCache: false
 
+enableScripts: true
+
 nodeLinker: node-modules
+
+npmMinimalAgeGate: 0
+
+supportedArchitectures:
+  cpu:
+    - arm
+    - arm64
+    - ia32
+    - loong64
+    - mips
+    - mipsel
+    - ppc64
+    - riscv64
+    - s390
+    - s390x
+    - x64
+    - wasm32
+  os:
+    - current
+    - darwin
+    - linux
+    - win32

AGENTS.md

@@ -3,137 +3,129 @@
 This guide summarizes how to explore, modify, and validate the WhatsApp HTTP API
 (WAHA) codebase when assisting as an automation or coding agent.
 
-- When you asked to refactor or "apply new lib" instead of current one - do not
-  change the behavior, make a minimum amount of changes possible. If you see
-  some edge case during that process that haven't been covered - tell it,
-  suggest fix, but don't change the code.
-
 ## Product & Variants
 
-- WAHA ships in **Core** and **Plus** editions. Core lives under `src/core` and
-  only supports the default session plus minimal media features. Plus extends
-  core via `src/plus` to add multi-session orchestration, richer media handling,
-  and external storage integrations.
-- Core code must remain free from Plus-only references. A pre-commit hook
-  rejects the word `plus` inside core files; reuse abstractions exposed through
-  `@waha/core/**` instead of importing Plus modules from Core.
-- Commit subjects are validated: changes that touch `src/plus` require a
-  `[PLUS] …` prefix and must not include non-Plus files; everything else must
-  use `[core] …`. Verify against `./.precommit/validate_commit_message.py` if
-  unsure.
+- WAHA ships in **Core** and **Plus** editions
+- Core lives under `src/core` and supports the default session with minimal
+  media features
+- Plus extends core via `src/plus` to add multi-session orchestration, richer
+  media handling, and external storage integrations
+- Core code must remain free from Plus-only references (pre-commit hook rejects
+  "plus" in core files)
+- Commit subjects: changes that touch `src/plus` require `[PLUS] …` prefix;
+  everything else uses `[core] …`
 
-## Tech Stack Snapshot
+## Tech Stack
 
-- **Runtime**: Node.js 22.x, Yarn 3.6 (Berry). Always install packages and run
-  scripts with Yarn.
-- **Framework**: NestJS v11 with dependency injection, modular controllers in
-  `src/api`, and Pino-based logging via `nestjs-pino`.
-- **Engines**: WhatsApp engines are abstracted (`WEBJS`, `GOWS`, `NOWEB`). Core
-  uses `SessionManagerCore`; Plus swaps to `SessionManagerPlus` with extra
-  storage backends (Mongo/Postgres/SQLite).
+- **Runtime**: Node.js 22.x, Yarn 3.6 (Berry)
+- **Framework**: NestJS v11 with dependency injection and modular controllers in
+  `src/api`
+- **Engines**: WhatsApp engines are abstracted (`WEBJS`, `GOWS`, `NOWEB`,
+  `WPP`). Core uses `SessionManagerCore`; Plus swaps to `SessionManagerPlus`
+  with extra storage backends (Mongo/Postgres/SQLite)
 - **ESM Bridge**: ESM-only dependencies (Baileys) load through
-  `src/vendor/esm.ts`. Add new ESM modules there to ensure they load exactly
-  once.
-- **Utilities**: RxJS streams (`SwitchObservable`, `DefaultMap`) drive webhook
-  event fan-out. Prefer existing helpers in `src/utils` and `src/core/utils`
-  before adding bespoke logic.
+  `src/vendor/esm.ts`
+- **Utilities**: RxJS streams drive webhook event fan-out. Prefer existing
+  helpers in `src/utils` and `src/core/utils`
 
-## Repository Landmarks
+## Key Paths
 
-- `src/main.ts`: runtime entry point; dynamically loads the correct AppModule
-  (Core vs Plus) and configures global interceptors/filters.
-- `src/api/**`: REST controllers and WebSocket gateway. Keep handlers thin;
-  delegate to managers/services. HTTP routes follow `/api/{sessionName}/…`;
-  always thread the session name through request DTOs and guards instead of
-  hardcoding `default`.
+- `src/main.ts`: runtime entry point; dynamically loads AppModule (Core vs Plus)
+- `src/api/**`: REST controllers and WebSocket gateway
 - `src/core/**`: shared abstractions (config services, engine bootstrap,
-  storage, session management). Core only allows the `default` session and
-  cleans up storage on boot.
+  storage, session management)
 - `src/plus/**`: multi-session orchestration, advanced media services, and
-  external persistence layers (Mongo, Postgres). Reuse this layer when adding
-  Plus-only capabilities.
-- `src/apps/**`: integrations (e.g., ChatWoot) and application-specific
-  services.
+  external persistence layers
 - `src/structures/**` and `src/utils/**`: DTOs, enums (event names follow
-  `domain.action`), helper utilities. Maintain naming consistency when
-  introducing new events.
-- `tests/**`: Jest-based suites; do not add new tests unless explicitly asked,
-  but keep existing tests working.
+  `domain.action`), helper utilities
 
 ## Coding Expectations
 
-- Favor composable, long-lived solutions. If a helper already exists (e.g.,
-  `parseBool`, `DefaultMap`, media factories), extend it instead of reinventing
-  logic. Lodash ships with the project—prefer its utilities over hand-rolled
-  helpers. Import lodash as a namespace (`import * as lodash from 'lodash';`) so
-  helpers like `lodash.camelCase` stay consistent across files. When a new
-  third-party library seems necessary, confirm with the user, especially if the
-  package looks stale.
+- Favor composability and long-lived solutions
+- Reuse existing helpers (`parseBool`, `DefaultMap`, media factories) instead of
+  reinventing logic
 - Stick to NestJS patterns: inject dependencies through constructors, expose
-  provider tokens from modules, and keep controllers free from business logic.
+  provider tokens from modules
 - Logging goes through injected `PinoLogger` or helpers in
-  `src/utils/logging.ts`. `console.log` is blocked by pre-commit.
-- Respect path aliases (`@waha/...`) defined in `tsconfig.json`; keep imports
-  consistent (use absolute aliases, not relative `../../../`).
-- Prefer named function declarations over `const` arrow functions when possible.
-- Avoid naming unused variables with a leading underscore; if a parameter is
-  required by a signature, explicitly `void` it instead.
-- For configs, prefer runtime configurability over constants. Environment keys
-  follow `WAHA_*` for global values and `WAHA_SESSION_CONFIG_*` /
-  `session.config.*` for per-session overrides. If both env and config are
-  supported, honor both (`WAHA_WEBJS_CONFIG_*` vs. `session.webjs.config.*`).
+  `src/utils/logging.ts`
+- Respect path aliases (`@waha/...`) defined in `tsconfig.json`
+- Prefer named function declarations over `const` arrow functions
+- Avoid naming unused variables with a leading underscore
+- Always use explicit property names in object literals — never shorthand: write
+  `{ key: value }`, not `{ value }` (even when the variable name matches the
+  key)
+- Do not write verbose ternaries; use idiomatic helpers like `??` (nullish
+  coalescing)
+- Do not place `await` or other async calls inside ternary expressions (`?:`) or
+  nullish-coalescing expressions (`??`); use explicit `if/else` blocks or assign
+  the awaited value to a variable first
+- For configs, prefer runtime configurability over constants (environment keys
+  follow `WAHA_*` and `WAHA_SESSION_CONFIG_*`)
+- Do not use decorative comment blocks (lines of dashes/underscores with a
+  label) such as `// ─────────── NAME ───────────`; use plain inline comments or
+  no comment at all
 
-## Language & Localization
+## How to Run API
 
-- Keep identifiers (classes, methods, variables) and code comments in English so
-  the codebase stays consistent for the global team.
-- Route user-visible strings through the existing i18n structure rather than
-  hardcoding text. ChatWoot copy belongs in `src/apps/chatwoot/i18n` with
-  English as the source locale before adding translations.
+```bash
+export DEBUG=1
+export WAHA_API_KEY=666
+export WAHA_DASHBOARD_PASSWORD=666
+export WAHA_DASHBOARD_USERNAME=admin
+export WWHATSAPP_SWAGGER_USERNAME=admin
+export WHATSAPP_SWAGGER_PASSWORD=666
+export WHATSAPP_DEFAULT_ENGINE={WEBJS|WPP|NOWEB|GOWS}
+export WAHA_DEBUG_MODE=True
+export WAHA_HTTP_STRICT_MODE=1
+export WAHA_MEDIA_STORAGE=LOCAL
+export WHATSAPP_FILES_FOLDER=./.media
 
-## ChatWoot Integration Notes
+npm run start
+```
 
-- Avoid introducing synthetic events; map onto existing webhook or engine events
-  whenever plausible. Always use the official ChatWoot API client located in
-  `src/apps/chatwoot/client`.
-- When adding events, align consumer names with webhook/event identifiers (e.g.,
-  `message.any`).
+## Code Guidelines
 
-## Workflow Checklist
+- Add `@Activity()` (from `src/core/abc/activity.ts`) to every engine method
+  that makes a network call to WhatsApp servers
+- It triggers `maintainPresenceOnline()` before the method runs, keeping the
+  session ONLINE during API activity and scheduling an OFFLINE transition after
+  an idle period
+- Skip it on methods that only throw `NotImplementedByEngineError` /
+  `AvailableInPlusVersion`
 
-1. Identify whether work targets Core, Plus, or shared layers. If Plus-only,
-   isolate changes to `src/plus` and ensure the commit prefix matches.
-2. Lean on existing services/managers; extend the appropriate session manager
-   rather than branching logic inline.
-3. After edits run:
-   - `pre-commit run --all-files`
-   - `yarn build`
-   - `yarn test` Use Node 22. Address lint or formatting issues before
-     proceeding.
-4. Do **not** start the application yourself; ask the user to run it if runtime
-   validation is required.
-5. Capture any assumptions or open questions for the user, especially when
-   touching configs, introducing dependencies, or modifying public APIs.
+## MCP Tools
 
-## Additional Tips
+MCP tools live in `src/apps/mcp/tools/` and expose the HTTP API to AI clients.
+Each tool file mirrors an API domain (e.g. `chats.tools.ts` → chats endpoints).
 
-- Concurrency-sensitive sections (session start/stop) rely on `async-lock`. When
-  adding async flows, reuse `SessionManager.withLock` or existing retry
-  utilities (`promiseTimeout`, `waitUntil`).
-- Media features centralize through `MediaManager` and `MediaStorageFactory`.
-  When altering media behavior, update both Core and Plus variants where
-  applicable.
-- Keep docs and code ASCII unless a file already uses other characters. When
-  updating documentation, mirror the concise, actionable tone used here.
+**When you change an existing API endpoint:**
 
-## Related Sources Code
+- Check the corresponding `*.tools.ts` file and update the tool's `inputSchema`,
+  description, or behavior if the API signature changed.
 
-You can find related source code in the following paths:
+**When you add a new API endpoint:**
+
+- Ask the user whether an MCP tool is needed for the new endpoint before
+  creating one.
+- If yes, add the tool to the matching `*.tools.ts` file (or create a new file
+  for a new domain).
+- Every `@Tool` decorator must include an `annotations` block with all three
+  fields:
+  ```typescript
+  annotations: {
+    readOnlyHint: true | false,   // true = no side effects (GET-style)
+    destructiveHint: true | false, // true = irreversible deletion/logout
+    idempotentHint: true | false,  // true = safe to repeat with same args
+  }
+  ```
+- Input schemas live in the matching `*.zod.ts` file.
+- Tools call the API via `this.textRequest({ method, url, ... })` inherited from
+  `McpController`.
+
+## Related Sources
 
 - WEBJS: `../whatsapp-web.js`
-- NOWEB: `../WhiskeySockets-Baileys`
-- GOWS: `../gows` + `../whatsmeow`
+- NOWEB: `../WhiskeySockets-Baileys` and `../whatsapp-rust-bridge`
+- GOWS: `../gows` and `../whatsmeow`
+- WPP: `../wa-js`, `../wppconnect`, `../wppconnect-server`
 - ChatWoot: `../chatwoot`
-
-Following this playbook keeps contributions aligned with WAHA’s structure,
-automation hooks, and release process.

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

Dockerfile

@@ -8,16 +8,18 @@ FROM node:${NODE_IMAGE_TAG} AS build
 ENV PUPPETEER_SKIP_DOWNLOAD=True
 
 # git + build toolchain for git deps
-RUN apt-get update && apt-get install -y git python3 build-essential && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends git python3 build-essential curl ca-certificates unzip && \
+    rm -rf /var/lib/apt/lists/*
 
 # npm packages
 WORKDIR /git
 COPY package.json .
 COPY yarn.lock .
+COPY .yarnrc.yml .
 ENV YARN_CHECKSUM_BEHAVIOR=update
 
 RUN npm install -g corepack && corepack enable
-RUN yarn set version 4.9.2
 RUN yarn install
 
 # App
@@ -26,6 +28,21 @@ ADD . /git
 RUN yarn install
 RUN yarn build && find ./dist -name "*.d.ts" -delete
 
+# Rebuild sharp from source on x86-64 so it runs on pre-v2 CPUs (no SSE4.2 requirement).
+# The prebuilt @img/sharp-linux-x64 binary requires x86-64-v2; -march=x86-64 limits
+# code generation to baseline x86-64 (SSE2 only). ARM64 prebuilts have no such
+# constraint, so no rebuild is needed there.
+# We call sharp's own install/build.js (not npm rebuild) so it first generates config.gypi
+# with include/lib paths pointing to its bundled @img/sharp-libvips-linux-x64 package,
+# then invokes node-gyp with those paths. Without this step node-gyp cannot find vips headers.
+RUN if [ "$(uname -m)" = "x86_64" ]; then \
+        LIBVIPS_DEV_VER=$(node -e "require('/git/node_modules/sharp/package.json').devDependencies['@img/sharp-libvips-dev']" | tr -d '^') && \
+        npm install --prefix /tmp/sharp-dev --no-package-lock "@img/sharp-libvips-dev@${LIBVIPS_DEV_VER}" && \
+        cp -r /tmp/sharp-dev/node_modules/@img/sharp-libvips-dev /git/node_modules/@img/ && \
+        cd /git/node_modules/sharp && \
+        PATH="/git/node_modules/.bin:$PATH" CFLAGS="-march=x86-64" CXXFLAGS="-march=x86-64" node install/build.js; \
+    fi
+
 #
 # Dashboard
 #
@@ -162,7 +179,7 @@ RUN if [ "$USE_BROWSER" = "chromium" ]; then \
 # Install Chrome
 # Available versions:
 # https://www.ubuntuupdates.org/package/google_chrome/stable/main/base/google-chrome-stable
-ARG CHROME_VERSION="140.0.7339.80-1"
+ARG CHROME_VERSION="142.0.7444.134-1"
 ARG OPUSTAGS_VERSION="1.10.1"
 RUN if [ "$USE_BROWSER" = "chrome" ]; then \
         wget --no-verbose -O /tmp/chrome.deb https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${CHROME_VERSION}_amd64.deb \
@@ -230,7 +247,7 @@ ENV CHOKIDAR_INTERVAL=5000
 ENV WAHA_ZIPPER=ZIPUNZIP
 
 # GOWS - use libc DNS resolver
-ENV GODEBUG netdns=cgo
+ENV GODEBUG=netdns=cgo
 
 # Run command, etc
 EXPOSE 3000

Makefile

@@ -32,16 +32,23 @@ push:
 	docker push devlikeapro/waha
 
 for-swagger:
-	WHATSAPP_SWAGGER_CONFIG_ADVANCED=true WHATSAPP_SWAGGER_PASSWORD=666 nvm exec yarn start
+	export WHATSAPP_SWAGGER_CONFIG_ADVANCED=true && export WHATSAPP_SWAGGER_PASSWORD=666 && yarn start
 
 up-noweb:
-	yarn up @adiwajshing/baileys@github:devlikeapro/Baileys#fork-master-2026-01-25
+	yarn up @adiwajshing/baileys@github:devlikeapro/Baileys#fork-master-2026-04-28
 
 up-noweb-libsignal:
 	yarn up libsignal@github:devlikeapro/libsignal-node#fork-master
 
 up-webjs:
-	yarn up whatsapp-web.js@github:devlikeapro/whatsapp-web.js#fork-main-2025-12-17
+	yarn up whatsapp-web.js@github:devlikeapro/whatsapp-web.js#fork-main-2026-06-26
+
+up-wpp:
+	SHARP_IGNORE_GLOBAL_LIBVIPS=1 yarn up @wppconnect-team/wppconnect@github:wppconnect-team/wppconnect#master
+	SHARP_IGNORE_GLOBAL_LIBVIPS=1 yarn up @wppconnect/wa-js@github:wppconnect-team/wa-js#main
+
+up-rust-bridge:
+	yarn up -R whatsapp-rust-bridge
 
 start-proxy:
 	docker run --rm -d --name squid-container -e TZ=UTC -p 3128:3128 ubuntu/squid:5.2-22.04_beta
@@ -51,10 +58,23 @@ proto-gows:
 
 gows:
 	cd ../gows && \
-	export PATH=${HOME}/go/bin:${PATH} && \
+	(export PATH=${HOME}/go/bin:${PATH} || echo failed) && \
 	make all
 
+ORIGIN ?= waha-plus
+CORE_REMOTE ?= waha
+
+release:
+	node scripts/release.js
+
+release-push: release
+	git push $(ORIGIN) core plus
+	git push --force-with-lease $(ORIGIN) dev
+	git push $(CORE_REMOTE) core
+
+up-dashboard:
+	node scripts/up-dashboard.js
+
 copy-dashboard:
 	cd ../waha-hub/ui && \
 	make copy-waha
-

README.md

@@ -147,7 +147,18 @@ curl -d "{\"chatId\": \"${PHONE}@c.us\", \"text\": \"Hello from WhatsApp HTTP AP
 ## Start the project
 1. Clone the repository
 2. Make sure you're using node>=22 (check [.nvmrc](/.nvmrc) to get the version)
-3. Run the following commands:
+3. Install the **whatsapp-rust-bridge prerequisites**:
+ ```bash
+# Bun runtime used by whatsapp-rust-bridge prepare scripts
+curl -fsSL https://bun.sh/install | bash -s -- bun-v1.3.9
+
+# Rust nightly toolchain used for whatsapp-rust-bridge
+curl -fsSL https://sh.rustup.rs | bash -s -- -y --default-toolchain nightly-2026-01-30
+rustup target add wasm32-unknown-unknown
+cargo install wasm-pack --vers 0.14.0 --locked
+```
+
+4. Run the following commands:
 ```bash
 # Install dependencies
 yarn install

docker-compose/chatwoot/docker-compose.yaml

@@ -24,7 +24,7 @@ services:
       - 8.8.8.8
 
   base: &base
-    image: chatwoot/chatwoot:v4.7.0
+    image: chatwoot/chatwoot:v4.12.1
     env_file: .chatwoot.env ## Change this file for customized env variables
     volumes:
       - chatwoot_storage:/app/storage

nest-cli.json

@@ -4,12 +4,12 @@
   "compilerOptions": {
     "plugins": ["@nestjs/swagger"],
     "assets": [
-      "dashboard/**",
-      "core/engines/webjs/*",
-      "plus/engines/webjs/*",
-      "apps/chatwoot/i18n/locales/*.yaml",
-      "apps/chatwoot/i18n/locales/*.yml"
+      { "include": "dashboard/**", "watchAssets": false },
+      { "include": "core/engines/webjs/*", "watchAssets": true },
+      { "include": "plus/engines/webjs/*", "watchAssets": true },
+      { "include": "apps/chatwoot/i18n/locales/*.yaml", "watchAssets": true },
+      { "include": "apps/chatwoot/i18n/locales/*.yml", "watchAssets": true }
     ],
-    "watchAssets": true
+    "watchAssets": false
   }
 }

package.json

@@ -29,7 +29,7 @@
     "gows:proto": "yarn gows:proto:fetch && yarn gows:proto:build"
   },
   "dependencies": {
-    "@adiwajshing/baileys": "github:devlikeapro/Baileys#fork-master-2026-01-25",
+    "@adiwajshing/baileys": "github:devlikeapro/Baileys#fork-master-2026-04-28",
     "@adiwajshing/keyed-db": "^0.2.4",
     "@aws-sdk/client-s3": "^3.633.0",
     "@aws-sdk/s3-request-presigner": "^3.633.0",
@@ -39,6 +39,9 @@
     "@casl/ability": "^6.8.0",
     "@figuro/chatwoot-sdk": "^1.1.17",
     "@liaoliaots/nestjs-redis": "^9",
+    "@lottiefiles/dotlottie-web": "^0.72.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@napi-rs/canvas": "^1.0.0",
     "@nestjs/axios": "^3.0.2",
     "@nestjs/bullmq": "^11.0.2",
     "@nestjs/common": "^11.0.0",
@@ -57,6 +60,8 @@
     "@types/passport": "^1.0.17",
     "@types/sqlite3": "^5.1.0",
     "@types/ws": "^8.5.4",
+    "@wppconnect-team/wppconnect": "github:wppconnect-team/wppconnect#master",
+    "@wppconnect/wa-js": "github:wppconnect-team/wa-js#main",
     "adm-zip": "0.5.10",
     "agentkeepalive": "^4.5.0",
     "async-lock": "^1.4.1",
@@ -91,9 +96,11 @@
     "mustache": "^4.2.0",
     "nestjs-pino": "^4.1.0",
     "node-cache": "5.1.2",
+    "node-webpmux": "^3.2.1",
     "passport": "^0.7.0",
     "passport-headerapikey": "^1.2.2",
     "pg": "^8.13.1",
+    "pg-copy-streams": "^6.0.0",
     "pino-http": "^10.2.0",
     "pino-pretty": "^11.2.1",
     "pretty-bytes": "5.6.0",
@@ -104,16 +111,18 @@
     "reflect-metadata": "^0.1.13",
     "rimraf": "^4.3.0",
     "rxjs": "^7.8.1",
-    "sharp": "^0.33.4",
+    "sharp": "^0.34.5",
     "shell-quote": "^1.8.3",
     "sqlite3": "^5.1.7",
     "swagger-ui-express": "^4.1.4",
     "ulid": "^2.3.0",
     "undici": "^7.16.0",
     "uniqid": "^5.4.0",
-    "whatsapp-web.js": "github:devlikeapro/whatsapp-web.js#fork-main-2025-12-17",
+    "user-agents": "^1.1.669",
+    "whatsapp-web.js": "github:devlikeapro/whatsapp-web.js#fork-main-2026-06-26",
     "write-file-atomic": "^6.0.0",
-    "yaml": "^2.7.1"
+    "yaml": "^2.7.1",
+    "zod": "^4.3.6"
   },
   "optionalDependencies": {
     "bufferutil": "^4.0.8"
@@ -124,7 +133,8 @@
     "ws": "^8.18.0",
     "puppeteer": "^24.31.0",
     "whatwg-url": "13.0.0",
-    "axios": "^1.9.0"
+    "axios": "^1.9.0",
+    "whatsapp-rust-bridge": "npm:@devlikeapro/whatsapp-rust-bridge@0.5.2"
   },
   "devDependencies": {
     "@grpc/grpc-js": "^1.14.1",
@@ -138,6 +148,7 @@
     "@types/node-fetch": "^2.6.13",
     "@types/semver": "^7.7.0",
     "@types/supertest": "^2.0.8",
+    "@types/user-agents": "^1",
     "dotenv": "^17.2.3",
     "grpc-tools": "^1.13.0",
     "jest": "^29.7.0",
@@ -194,5 +205,5 @@
       }
     ]
   },
-  "packageManager": "yarn@4.9.2"
+  "packageManager": "yarn@4.17.1"
 }

scripts/init-waha.js

@@ -76,17 +76,31 @@ const updatedContent = exampleContent
 
 fs.writeFileSync(targetPath, updatedContent, { encoding: 'utf8' });
 
+const generatedEnvValues = [
+  `WAHA_API_KEY=${apiKey}`,
+  `WAHA_API_KEY_PLAIN=${apiKey}`,
+  'WAHA_DASHBOARD_USERNAME=admin',
+  `WAHA_DASHBOARD_PASSWORD=${adminPassword}`,
+  'WHATSAPP_SWAGGER_USERNAME=admin',
+  `WHATSAPP_SWAGGER_PASSWORD=${adminPassword}`,
+];
+
 const lines = [
   'Credentials generated.',
   '',
-  'Dashboard and Swagger:',
+  'Generated env values:',
+  ...generatedEnvValues.map((line) => `  - ${line}`),
+  '',
+  'Use these credentials to login in Dashboard or Swagger:',
   '  - Username: admin',
   `  - Password: ${adminPassword}`,
   '',
-  'API key: ',
+  'Use this API key in the x-api-key header:',
   `  - ${apiKey}`,
   '',
-  'Use it in the Dashboard connection flow: https://waha.devlike.pro/docs/how-to/dashboard/#api-key',
+  'Read more:',
+  '  - https://waha.devlike.pro/docs/how-to/dashboard/#api-key',
+  '  - https://waha.devlike.pro/docs/how-to/security/',
 ];
 
 console.log(lines.join('\n'));

scripts/release.js

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+'use strict';
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { execFileSync } = require('child_process');
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const readline = require('readline');
+
+const DEV_BRANCH = process.env.WAHA_DEV_BRANCH || 'dev';
+const CORE_BRANCH = process.env.WAHA_CORE_BRANCH || 'core';
+const PLUS_BRANCH = process.env.WAHA_PLUS_BRANCH || 'plus';
+
+const CORE_PREFIX = '[core]';
+const PLUS_PREFIX = '[PLUS]';
+
+const args = process.argv.slice(2);
+const dryRun = args.includes('--dry-run');
+const assumeYes = args.includes('--yes') || args.includes('-y');
+
+function git(gitArgs, options) {
+  const opts = options || {};
+  return execFileSync('git', gitArgs, {
+    encoding: 'utf8',
+    stdio: opts.inherit ? 'inherit' : ['ignore', 'pipe', 'pipe'],
+  });
+}
+
+function gitOut(gitArgs) {
+  return git(gitArgs, { inherit: false }).trim();
+}
+
+function log(message) {
+  console.log(message);
+}
+
+function fail(message) {
+  console.error(`\n✗ ${message}`);
+  process.exit(1);
+}
+
+function ensureCleanTree() {
+  const status = gitOut(['status', '--porcelain']);
+  if (status) {
+    fail(
+      'Working tree is not clean. Commit or stash your changes before releasing.',
+    );
+  }
+}
+
+function ensureBranchExists(branch) {
+  try {
+    git(['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`]);
+  } catch {
+    fail(`Branch "${branch}" does not exist locally.`);
+  }
+}
+
+// Non-merge commits in `boundary..head`, oldest first, whose subject starts
+// with prefix. The boundary is the last-released plus tip: dev is rebased onto
+// plus every release, so `plus..dev` is exactly the new, unreleased work.
+// We intentionally do not use `git cherry` (patch-id matching) because core is
+// a rewritten history whose old commits share no patch-ids with dev.
+function commitsToCherryPick(boundary, head, prefix) {
+  const format = '%H%x09%s';
+  const output = gitOut([
+    'rev-list',
+    '--reverse',
+    '--no-merges',
+    `--format=${format}`,
+    `${boundary}..${head}`,
+  ]);
+  if (!output) {
+    return [];
+  }
+  const picks = [];
+  for (const line of output.split('\n')) {
+    // rev-list --format prefixes each entry with a "commit <sha>" header line.
+    if (!line || line.startsWith('commit ')) {
+      continue;
+    }
+    const tab = line.indexOf('\t');
+    const sha = line.slice(0, tab);
+    const subject = line.slice(tab + 1);
+    if (subject.startsWith(prefix)) {
+      picks.push({ sha: sha, subject: subject });
+    }
+  }
+  return picks;
+}
+
+function cherryPickAll(picks) {
+  for (const pick of picks) {
+    log(`  cherry-pick ${pick.sha.slice(0, 9)} ${pick.subject}`);
+    if (dryRun) {
+      continue;
+    }
+    try {
+      git(['cherry-pick', pick.sha], { inherit: true });
+    } catch {
+      git(['cherry-pick', '--abort'], { inherit: true });
+      fail(
+        `Cherry-pick of ${pick.sha.slice(0, 9)} failed (conflict). ` +
+          `Aborted the cherry-pick — resolve manually and re-run.`,
+      );
+    }
+  }
+}
+
+function checkout(branch) {
+  log(`\n→ checkout ${branch}`);
+  if (!dryRun) {
+    git(['checkout', branch], { inherit: true });
+  }
+}
+
+function confirm(question) {
+  if (assumeYes || dryRun) {
+    return Promise.resolve(true);
+  }
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+  return new Promise(function resolver(resolve) {
+    rl.question(`${question} [y/N] `, function onAnswer(answer) {
+      rl.close();
+      resolve(/^y(es)?$/i.test(answer.trim()));
+    });
+  });
+}
+
+async function main() {
+  ensureCleanTree();
+  [DEV_BRANCH, CORE_BRANCH, PLUS_BRANCH].forEach(ensureBranchExists);
+
+  const startBranch = gitOut(['rev-parse', '--abbrev-ref', 'HEAD']);
+
+  if (dryRun) {
+    log('Running in --dry-run mode: no branches will be modified.\n');
+  }
+
+  // Capture the last-released plus tip before we touch anything. Step 3 merges
+  // core into plus and moves the branch, so both pick sets must be computed
+  // against this saved boundary, not the live plus ref.
+  const boundary = gitOut(['rev-parse', PLUS_BRANCH]);
+  log(`Boundary (last released ${PLUS_BRANCH}): ${boundary.slice(0, 9)}\n`);
+
+  const corePicks = commitsToCherryPick(boundary, DEV_BRANCH, CORE_PREFIX);
+  log(
+    `Found ${corePicks.length} "${CORE_PREFIX}" commit(s) in ` +
+      `${DEV_BRANCH} since last ${PLUS_BRANCH} release.`,
+  );
+
+  // Step 1 + 2: bring missing [core] commits onto core.
+  checkout(CORE_BRANCH);
+  cherryPickAll(corePicks);
+
+  // Step 3: merge the freshly updated core into plus.
+  checkout(PLUS_BRANCH);
+  log(`\n→ merge ${CORE_BRANCH} into ${PLUS_BRANCH}`);
+  if (!dryRun) {
+    try {
+      git(['merge', '--no-edit', CORE_BRANCH], { inherit: true });
+    } catch {
+      git(['merge', '--abort'], { inherit: true });
+      fail(
+        `Merge of ${CORE_BRANCH} into ${PLUS_BRANCH} failed (conflict). ` +
+          `Aborted the merge — resolve manually and re-run.`,
+      );
+    }
+  }
+
+  // Step 4: bring missing [PLUS] commits onto plus (same saved boundary).
+  const plusPicks = commitsToCherryPick(boundary, DEV_BRANCH, PLUS_PREFIX);
+  log(
+    `\nFound ${plusPicks.length} "${PLUS_PREFIX}" commit(s) in ` +
+      `${DEV_BRANCH} since last ${PLUS_BRANCH} release.`,
+  );
+  cherryPickAll(plusPicks);
+
+  // Step 5: rebase dev onto the freshly built plus.
+  log(`\n→ rebase ${DEV_BRANCH} onto ${PLUS_BRANCH} (rewrites ${DEV_BRANCH})`);
+  const proceed = await confirm(
+    `This will force-rewrite "${DEV_BRANCH}". Continue?`,
+  );
+  if (!proceed) {
+    fail('Aborted before rebasing dev. core/plus changes are kept.');
+  }
+  checkout(DEV_BRANCH);
+  if (!dryRun) {
+    try {
+      git(['rebase', PLUS_BRANCH], { inherit: true });
+    } catch {
+      git(['rebase', '--abort'], { inherit: true });
+      fail(
+        `Rebase of ${DEV_BRANCH} onto ${PLUS_BRANCH} failed (conflict). ` +
+          `Aborted the rebase — resolve manually and re-run.`,
+      );
+    }
+  }
+
+  if (dryRun) {
+    checkout(startBranch);
+    log('\nDry run complete. Re-run without --dry-run to apply.');
+  } else {
+    log(
+      `\n✓ Release complete. ${DEV_BRANCH} now sits on top of ${PLUS_BRANCH}.`,
+    );
+    log(
+      `  Push when ready: git push origin ${CORE_BRANCH} ${PLUS_BRANCH} ` +
+        `&& git push --force-with-lease origin ${DEV_BRANCH}`,
+    );
+  }
+}
+
+main().catch(function onError(error) {
+  fail(error.message || String(error));
+});

scripts/up-dashboard.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+'use strict';
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const fs = require('fs');
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { execSync } = require('child_process');
+
+const CONFIG_FILE = 'waha.config.json';
+
+const config = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8'));
+const { repo } = config.waha.dashboard;
+if (!repo) {
+  console.error(`Missing dashboard.repo in ${CONFIG_FILE}`);
+  process.exit(1);
+}
+
+const branch = 'gh-pages';
+console.log(`Fetching latest commit for ${repo}@${branch}...`);
+
+const output = execSync(
+  `git ls-remote https://github.com/${repo} refs/heads/${branch}`,
+  { encoding: 'utf8' },
+);
+
+const sha = output.split('\t')[0].trim();
+if (!sha) {
+  console.error(`Could not resolve ref ${branch} for ${repo}`);
+  process.exit(1);
+}
+
+config.waha.dashboard.ref = sha;
+fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + '\n', 'utf8');
+console.log(`Updated ${CONFIG_FILE}: dashboard.ref = ${sha}`);

src/api/apikeys.controller.ts

@@ -3,24 +3,25 @@ import {
   Controller,
   Delete,
   Get,
-  NotFoundException,
   Param,
   Post,
   Put,
-  UnprocessableEntityException,
   UseGuards,
   UsePipes,
 } from '@nestjs/common';
 import { ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
 import { SessionManager } from '@waha/core/abc/manager.abc';
 import { Action } from '@waha/core/auth/casl.types';
-import { CanServer } from '@waha/core/auth/policies';
+import { CanServer, CanSession, FromBody } from '@waha/core/auth/policies';
 import { CheckPolicies } from '@waha/core/auth/policies.decorator';
 import { PoliciesGuard } from '@waha/core/auth/policies.guard';
-import { ApiKey, CheckInvariant } from '@waha/core/storage/IApiKeyRepository';
+import { ApiKeyService } from '@waha/core/services/ApiKeyService';
 import { WAHAValidationPipe } from '@waha/nestjs/pipes/WAHAValidationPipe';
-import { ApiKeyDTO, ApiKeyRequest } from '@waha/structures/apikeys.dto';
-import { generatePrefixedId, generateSecret } from '@waha/utils/ids';
+import {
+  ApiKeyDTO,
+  ApiKeyRequest,
+  ScopedApiKeyRequest,
+} from '@waha/structures/apikeys.dto';
 
 @ApiSecurity('api_key')
 @Controller('api/keys')
@@ -30,57 +31,41 @@ import { generatePrefixedId, generateSecret } from '@waha/utils/ids';
 export class ApiKeysController {
   constructor(private manager: SessionManager) {}
 
+  private get service(): ApiKeyService {
+    return new ApiKeyService(this.manager);
+  }
+
   @Post('/')
   @ApiOperation({ summary: 'Create a new API key' })
   @UsePipes(new WAHAValidationPipe())
   async create(@Body() body: ApiKeyRequest): Promise<ApiKeyDTO> {
-    CheckInvariant(body);
-    if (body.session) {
-      const exists = await this.manager.exists(body.session);
-      if (!exists) {
-        throw new UnprocessableEntityException(
-          `Session "${body.session}" does not exist`,
-        );
-      }
-    }
-    let apikey: ApiKey | null = null;
-    // Try 5 times to check there's no conflict on id and key
-    for (let i = 0; i < 5; i++) {
-      apikey = {
-        id: generatePrefixedId('key_id'),
-        key: `key_${generateSecret(32)}`,
-        isActive: body.isActive,
-        isAdmin: body.isAdmin,
-        session: body.session,
-        rules: null,
-      };
-      const idExists = await this.manager.apiKeyRepository.getById(apikey.id);
-      if (idExists) {
-        continue;
-      }
-      const keyExists = await this.manager.apiKeyRepository.getByKey(
-        apikey.key,
-      );
-      if (keyExists) {
-        continue;
-      }
-      break;
-    }
-    if (!apikey) {
-      throw new UnprocessableEntityException(
-        `Failed to generate API key, try again`,
-      );
-    }
-    CheckInvariant(apikey);
-    await this.manager.apiKeyRepository.upsert(apikey);
-    return ApiKeyToDTO(apikey);
+    return this.service.create(body);
   }
 
   @Get('/')
   @ApiOperation({ summary: 'Get all API keys' })
   async list(): Promise<ApiKeyDTO[]> {
-    const keys = await this.manager.apiKeyRepository.list();
-    return keys.map((key) => ApiKeyToDTO(key));
+    return this.service.list();
+  }
+
+  @Post('/media')
+  @ApiOperation({
+    summary: 'Create or get a media-download-only API key for a session',
+  })
+  @CheckPolicies(CanSession(Action.Read, FromBody('session')))
+  @UsePipes(new WAHAValidationPipe())
+  async media(@Body() body: ScopedApiKeyRequest): Promise<ApiKeyDTO> {
+    return this.service.createOrGetMediaKey(body.session);
+  }
+
+  @Post('/control')
+  @ApiOperation({
+    summary: 'Create or get a control-only API key for a session',
+  })
+  @CheckPolicies(CanSession(Action.Control, FromBody('session')))
+  @UsePipes(new WAHAValidationPipe())
+  async control(@Body() body: ScopedApiKeyRequest): Promise<ApiKeyDTO> {
+    return this.service.createOrGetControlKey(body.session);
   }
 
   @Put('/:id')
@@ -90,50 +75,12 @@ export class ApiKeysController {
     @Param('id') id: string,
     @Body() body: ApiKeyRequest,
   ): Promise<ApiKeyDTO> {
-    const existing = await this.manager.apiKeyRepository.getById(id);
-    if (!existing) {
-      throw new NotFoundException('API key not found');
-    }
-
-    const apikey: ApiKey = {
-      ...existing,
-      isActive: body.isActive,
-      isAdmin: body.isAdmin,
-      session: body.session,
-    };
-    CheckInvariant(apikey);
-    if (apikey.session) {
-      const exists = await this.manager.exists(apikey.session);
-      if (!exists) {
-        throw new UnprocessableEntityException(
-          `Session "${apikey.session}" does not exist`,
-        );
-      }
-    }
-
-    CheckInvariant(apikey);
-    await this.manager.apiKeyRepository.upsert(apikey);
-    return ApiKeyToDTO(apikey);
+    return this.service.update(id, body);
   }
 
   @Delete('/:id')
   @ApiOperation({ summary: 'Delete an API key' })
   async delete(@Param('id') id: string): Promise<{ result: true }> {
-    const existing = await this.manager.apiKeyRepository.getById(id);
-    if (!existing) {
-      throw new NotFoundException('API key not found');
-    }
-    await this.manager.apiKeyRepository.deleteById(id);
-    return { result: true };
+    return this.service.delete(id);
   }
 }
-
-function ApiKeyToDTO(apikey: ApiKey): ApiKeyDTO {
-  return {
-    id: apikey.id,
-    key: apikey.key,
-    isActive: apikey.isActive,
-    isAdmin: apikey.isAdmin,
-    session: apikey.session,
-  };
-}

src/api/auth.controller.ts

@@ -7,7 +7,12 @@ import {
   UseInterceptors,
   UseGuards,
 } from '@nestjs/common';
-import { ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
+import {
+  ApiOkResponse,
+  ApiOperation,
+  ApiSecurity,
+  ApiTags,
+} from '@nestjs/swagger';
 import { ApiFileAcceptHeader } from '@waha/nestjs/ApiFileAcceptHeader';
 import {
   QRCodeSessionParam,
@@ -19,6 +24,9 @@ import { SessionManager } from '../core/abc/manager.abc';
 import { WhatsappSession } from '../core/abc/session.abc';
 import { BufferResponseInterceptor } from '../nestjs/BufferResponseInterceptor';
 import {
+  PasskeyAssertionRequest,
+  PasskeyChallenge,
+  PasskeyConfirmationResponse,
   QRCodeFormat,
   QRCodeQuery,
   QRCodeValue,
@@ -35,7 +43,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/auth')
 @ApiTags('📱 Pairing')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
+@CheckPolicies(CanSession(Action.Control, FromParam('session')))
 class AuthController {
   constructor(private manager: SessionManager) {}
 
@@ -68,6 +76,54 @@ class AuthController {
   ) {
     return session.requestCode(request.phoneNumber, request.method, request);
   }
+
+  @Get('passkey/challenge')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Get the pending passkey (WebAuthn) challenge.',
+    description:
+      'Available while the session is in PASSKEY_REQUIRED status. ' +
+      'Pass the challenge to navigator.credentials.get({ publicKey: challenge }) ' +
+      'on the https://web.whatsapp.com origin.',
+  })
+  @ApiOkResponse({ type: PasskeyChallenge })
+  getPasskeyChallenge(@SessionParam session: WhatsappSession) {
+    return session.getPasskeyChallenge();
+  }
+
+  @Post('passkey')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Submit a WebAuthn passkey assertion to finish pairing.',
+  })
+  submitPasskey(
+    @SessionParam session: WhatsappSession,
+    @Body() request: PasskeyAssertionRequest,
+  ) {
+    return session.sendPasskeyResponse(JSON.stringify(request));
+  }
+
+  @Get('passkey/confirmation')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Get the pending passkey confirmation code.',
+    description:
+      'Available while the session is in PASSKEY_CONFIRMATION_REQUIRED status. ' +
+      'Most pairings skip this step - WhatsApp confirms them right after the assertion.',
+  })
+  @ApiOkResponse({ type: PasskeyConfirmationResponse })
+  getPasskeyConfirmation(@SessionParam session: WhatsappSession) {
+    return session.getPasskeyConfirmation();
+  }
+
+  @Post('passkey/confirm')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Confirm passkey pairing (only needed for the manual code case).',
+  })
+  confirmPasskey(@SessionParam session: WhatsappSession) {
+    return session.confirmPasskey();
+  }
 }
 
 export { AuthController };

src/api/calls.controller.ts

@@ -25,7 +25,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/calls')
 @ApiTags('📞 Calls')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
+@CheckPolicies(CanSession(Action.Send, FromParam('session')))
 export class CallsController {
   constructor(private manager: SessionManager) {}
 

src/api/channels.controller.ts

@@ -50,7 +50,6 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/channels')
 @ApiTags('📢 Channels')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class ChannelsController {
   constructor(
     private manager: SessionManager,
@@ -59,6 +58,7 @@ export class ChannelsController {
 
   @Get('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get list of know channels' })
   async list(
     @WorkingSessionParam session: WhatsappSession,
@@ -69,6 +69,7 @@ export class ChannelsController {
 
   @Post('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Create a new channel.' })
   create(
     @WorkingSessionParam session: WhatsappSession,
@@ -80,6 +81,7 @@ export class ChannelsController {
   @Delete(':id')
   @SessionApiParam
   @NewsletterIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Delete the channel.' })
   delete(
     @WorkingSessionParam session: WhatsappSession,
@@ -91,6 +93,7 @@ export class ChannelsController {
   @Get(':id')
   @SessionApiParam
   @NewsletterIdOrInviteCodeApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary: 'Get the channel info',
     description:
@@ -111,6 +114,7 @@ export class ChannelsController {
 
   @Get(':id/messages/preview')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   @ApiParam({
     name: 'id',
@@ -131,20 +135,22 @@ export class ChannelsController {
   })
   async previewChannelMessages(
     @WorkingSessionParam session: WhatsappSession,
-    @Param('id') code: string,
+    @Param('id') codeOrId: string,
     @Query() query: PreviewChannelMessages,
   ): Promise<ChannelMessage[]> {
-    if (isJidNewsletter(code)) {
-      const channel = await session.channelsGetChannel(code);
+    let code = null;
+    if (isJidNewsletter(codeOrId)) {
+      const channel = await session.channelsGetChannel(codeOrId);
       code = parseChannelInviteLink(channel.invite);
     }
-    const inviteCode = parseChannelInviteLink(code);
+    const inviteCode = parseChannelInviteLink(code || codeOrId);
     return session.previewChannelMessages(inviteCode, query);
   }
 
   @Post(':id/follow')
   @SessionApiParam
   @NewsletterIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Follow the channel.' })
   follow(
     @WorkingSessionParam session: WhatsappSession,
@@ -156,6 +162,7 @@ export class ChannelsController {
   @Post(':id/unfollow')
   @SessionApiParam
   @NewsletterIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Unfollow the channel.' })
   unfollow(
     @WorkingSessionParam session: WhatsappSession,
@@ -167,6 +174,7 @@ export class ChannelsController {
   @Post(':id/mute')
   @SessionApiParam
   @NewsletterIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Mute the channel.' })
   mute(
     @WorkingSessionParam session: WhatsappSession,
@@ -178,6 +186,7 @@ export class ChannelsController {
   @Post(':id/unmute')
   @SessionApiParam
   @NewsletterIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Unmute the channel.' })
   unmute(
     @WorkingSessionParam session: WhatsappSession,
@@ -189,6 +198,7 @@ export class ChannelsController {
   @Post('/search/by-view')
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   @ApiOperation({ summary: 'Search for channels (by view)' })
   async searchByView(
@@ -201,6 +211,7 @@ export class ChannelsController {
   @Post('/search/by-text')
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   @ApiOperation({ summary: 'Search for channels (by text)' })
   async searchByText(
@@ -212,6 +223,7 @@ export class ChannelsController {
 
   @Get('/search/views')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get list of views for channel search' })
   getSearchViews(): Promise<ChannelView[]> {
     return this.channelsInfoService.getViews();
@@ -219,6 +231,7 @@ export class ChannelsController {
 
   @Get('/search/countries')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get list of countries for channel search' })
   getSearchCountries(): Promise<ChannelCountry[]> {
     return this.channelsInfoService.getCountries();
@@ -226,6 +239,7 @@ export class ChannelsController {
 
   @Get('/search/categories')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get list of categories for channel search' })
   getSearchCategories(): Promise<ChannelCategory[]> {
     return this.channelsInfoService.getCategories();

src/api/chats.controller.ts

@@ -25,15 +25,15 @@ import { WhatsappSession } from '../core/abc/session.abc';
 import {
   ChatPictureQuery,
   ChatPictureResponse,
-  ChatsPaginationParams,
   ChatSummary,
   GetChatMessageQuery,
   GetChatMessagesFilter,
   GetChatMessagesQuery,
+  GetChatsOverviewParams,
+  GetChatsParams,
   MessageSortField,
   OverviewBodyRequest,
   OverviewFilter,
-  OverviewPaginationParams,
   PinMessageRequest,
   ReadChatMessagesQuery,
   ReadChatMessagesResponse,
@@ -52,22 +52,23 @@ import { Action } from '@waha/core/auth/casl.types';
 @ApiTags('💬 Chats')
 @UsePipes(new ValidationPipe({ transform: true }))
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 class ChatsController {
   constructor(private manager: SessionManager) {}
 
   @Get('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get chats' })
   getChats(
     @WorkingSessionParam session: WhatsappSession,
-    @Query() pagination: ChatsPaginationParams,
+    @Query() pagination: GetChatsParams,
   ) {
     return session.getChats(pagination);
   }
 
   @Get('overview')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary:
       'Get chats overview. Includes all necessary things to build UI "your chats overview" page - chat id, name, picture, last message. Sorting by last message timestamp',
@@ -75,7 +76,7 @@ class ChatsController {
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   getChatsOverview(
     @WorkingSessionParam session: WhatsappSession,
-    @Query() pagination: OverviewPaginationParams,
+    @Query() pagination: GetChatsOverviewParams,
     @Query() filter: OverviewFilter,
   ): Promise<ChatSummary[]> {
     return session.getChatsOverview(pagination, filter);
@@ -83,6 +84,7 @@ class ChatsController {
 
   @Post('overview')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary:
       'Get chats overview. Use POST if you have too many "ids" params - GET can limit it',
@@ -97,6 +99,7 @@ class ChatsController {
 
   @Delete(':chatId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Deletes the chat' })
   @ChatIdApiParam
   deleteChat(
@@ -108,6 +111,7 @@ class ChatsController {
 
   @Get(':chatId/picture')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Gets chat picture' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getChatPicture(
@@ -121,6 +125,7 @@ class ChatsController {
 
   @Get(':chatId/messages')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Gets messages in the chat' })
   @ChatIdApiParam
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
@@ -141,6 +146,7 @@ class ChatsController {
 
   @Post(':chatId/messages/read')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Read unread messages in the chat' })
   @ChatIdApiParam
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
@@ -154,6 +160,7 @@ class ChatsController {
 
   @Get(':chatId/messages/:messageId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Gets message by id' })
   @ChatIdApiParam
   async getChatMessage(
@@ -171,6 +178,7 @@ class ChatsController {
 
   @Post(':chatId/messages/:messageId/pin')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Pins a message in the chat' })
   @ChatIdApiParam
   async pinMessage(
@@ -185,6 +193,7 @@ class ChatsController {
 
   @Post(':chatId/messages/:messageId/unpin')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Unpins a message in the chat' })
   @ChatIdApiParam
   async unpinMessage(
@@ -198,6 +207,7 @@ class ChatsController {
 
   @Delete(':chatId/messages')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Clears all messages from the chat' })
   @ChatIdApiParam
   clearMessages(
@@ -209,6 +219,7 @@ class ChatsController {
 
   @Delete(':chatId/messages/:messageId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ChatIdApiParam
   @MessageIdApiParam
   @ApiOperation({ summary: 'Deletes a message from the chat' })
@@ -222,6 +233,7 @@ class ChatsController {
 
   @Put(':chatId/messages/:messageId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ChatIdApiParam
   @MessageIdApiParam
   @ApiOperation({ summary: 'Edits a message in the chat' })
@@ -236,6 +248,7 @@ class ChatsController {
 
   @Post(':chatId/archive')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ChatIdApiParam
   @ApiOperation({ summary: 'Archive the chat' })
   archiveChat(
@@ -247,6 +260,7 @@ class ChatsController {
 
   @Post(':chatId/unarchive')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ChatIdApiParam
   @ApiOperation({ summary: 'Unarchive the chat' })
   unarchiveChat(
@@ -258,6 +272,7 @@ class ChatsController {
 
   @Post(':chatId/unread')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ChatIdApiParam
   @ApiOperation({ summary: 'Unread the chat' })
   unreadChat(

src/api/chatting.controller.ts

@@ -41,6 +41,7 @@ import {
   MessageTextRequest,
   MessageVideoRequest,
   MessageVoiceRequest,
+  NewMessageIDResponse,
   SendSeenRequest,
   WANumberExistResult,
 } from '../structures/chatting.dto';
@@ -49,9 +50,19 @@ import {
   mentionsAll,
   validateRequestMentions,
 } from '@waha/core/utils/mentions.all';
+import {
+  SessionApiParam,
+  WorkingSessionParam,
+} from '@waha/nestjs/params/SessionApiParam';
+import { WhatsappSession } from '@waha/core/abc/session.abc';
 import { PoliciesGuard } from '@waha/core/auth/policies.guard';
 import { CheckPolicies } from '@waha/core/auth/policies.decorator';
-import { CanSession, FromBody, FromQuery } from '@waha/core/auth/policies';
+import {
+  CanSession,
+  FromBody,
+  FromParam,
+  FromQuery,
+} from '@waha/core/auth/policies';
 
 import { Action } from '@waha/core/auth/casl.types';
 
@@ -64,7 +75,7 @@ export class ChattingController {
 
   @Post('/sendText')
   @ApiOperation({ summary: 'Send a text message' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendText(@Body() request: MessageTextRequest): Promise<WAMessage> {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     if (mentionsAll(request)) {
@@ -80,7 +91,7 @@ export class ChattingController {
     description:
       'Either from an URL or base64 data - look at the request schemas for details.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendImage(@Body() request: MessageImageRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     if (mentionsAll(request)) {
@@ -96,7 +107,7 @@ export class ChattingController {
     description:
       'Either from an URL or base64 data - look at the request schemas for details.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendFile(@Body() request: MessageFileRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     if (mentionsAll(request)) {
@@ -112,7 +123,7 @@ export class ChattingController {
     description:
       'Either from an URL or base64 data - look at the request schemas for details.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendVoice(@Body() request: MessageVoiceRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.sendVoice(request);
@@ -124,7 +135,7 @@ export class ChattingController {
     description:
       'Either from an URL or base64 data - look at the request schemas for details.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendVideo(@Body() request: MessageVideoRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     if (mentionsAll(request)) {
@@ -140,7 +151,7 @@ export class ChattingController {
     description:
       'You can use regular /api/sendText if you wanna send auto-generated link preview.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   @UsePipes(new WAHAValidationPipe())
   async sendLinkCustomPreview(
     @Body() request: MessageLinkCustomPreviewRequest,
@@ -160,7 +171,7 @@ export class ChattingController {
     description: 'Send Buttons',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   @UsePipes(new WAHAValidationPipe())
   async sendButtons(@Body() request: SendButtonsRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
@@ -172,7 +183,7 @@ export class ChattingController {
     summary: 'Send a list message (interactive)',
     description: 'Send a List message with sections and rows',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   @UsePipes(new WAHAValidationPipe())
   async sendList(@Body() request: SendListRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
@@ -180,7 +191,7 @@ export class ChattingController {
   }
 
   @Post('/forwardMessage')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async forwardMessage(
     @Body() request: MessageForwardRequest,
   ): Promise<WAMessage> {
@@ -189,7 +200,7 @@ export class ChattingController {
   }
 
   @Post('/sendSeen')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendSeen(@Body() chat: SendSeenRequest) {
     const hasMessageId = chat.messageIds?.length > 0 || Boolean(chat.messageId);
     if (!hasMessageId) {
@@ -205,7 +216,7 @@ export class ChattingController {
   }
 
   @Post('/startTyping')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async startTyping(@Body() chat: ChatRequest) {
     // It's infinitive action
     const whatsapp = await this.manager.getWorkingSession(chat.session);
@@ -214,7 +225,7 @@ export class ChattingController {
   }
 
   @Post('/stopTyping')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async stopTyping(@Body() chat: ChatRequest) {
     const whatsapp = await this.manager.getWorkingSession(chat.session);
     await whatsapp.stopTyping(chat);
@@ -223,7 +234,7 @@ export class ChattingController {
 
   @Put('/reaction')
   @ApiOperation({ summary: 'React to a message with an emoji' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async setReaction(@Body() request: MessageReactionRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.setReaction(request);
@@ -231,7 +242,7 @@ export class ChattingController {
 
   @Put('/star')
   @ApiOperation({ summary: 'Star or unstar a message' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async setStar(@Body() request: MessageStarRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     await whatsapp.setStar(request);
@@ -243,7 +254,7 @@ export class ChattingController {
     summary: 'Send a poll with options',
     description: 'You can use it as buttons or list replacement',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendPoll(@Body() request: MessagePollRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.sendPoll(request);
@@ -254,7 +265,7 @@ export class ChattingController {
     summary: 'Vote on a poll',
     description: 'Cast vote(s) on an existing poll message',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   @UsePipes(new WAHAValidationPipe())
   async sendPollVote(@Body() request: MessagePollVoteRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
@@ -262,14 +273,14 @@ export class ChattingController {
   }
 
   @Post('/sendLocation')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendLocation(@Body() request: MessageLocationRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.sendLocation(request);
   }
 
   @Post('/sendContactVcard')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendContactVcard(@Body() request: MessageContactVcardRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.sendContactVCard(request);
@@ -279,7 +290,7 @@ export class ChattingController {
   @ApiOperation({
     summary: 'Reply on a button message',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async sendButtonsReply(@Body() request: MessageButtonReply) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
@@ -288,7 +299,7 @@ export class ChattingController {
 
   @Get('/sendText')
   @ApiOperation({ summary: 'Send a text message', deprecated: true })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Send, FromQuery('session')))
   async sendTextGet(@Query() query: MessageTextQuery) {
     const whatsapp = await this.manager.getWorkingSession(query.session);
     const msg = new MessageTextRequest();
@@ -303,7 +314,7 @@ export class ChattingController {
     description: 'DEPRECATED. Use "GET /api/chats/{id}/messages" instead',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getMessages(
     @Query() query: GetMessageQuery,
@@ -320,7 +331,7 @@ export class ChattingController {
     description: 'DEPRECATED. Use "POST /contacts/check-exists" instead',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   async DEPRECATED_checkNumberStatus(
     @Query() request: CheckNumberStatusQuery,
   ): Promise<WANumberExistResult> {
@@ -334,7 +345,7 @@ export class ChattingController {
       'DEPRECATED - you can set "reply_to" field when sending text, image, etc',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async reply(@Body() request: MessageReplyRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.reply(request);
@@ -342,9 +353,20 @@ export class ChattingController {
 
   @Post('/sendLinkPreview')
   @ApiOperation({ deprecated: true })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendLinkPreview_DEPRECATED(@Body() request: MessageLinkPreviewRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.sendLinkPreview(request);
   }
+
+  @Get('/:session/new-message-id')
+  @SessionApiParam
+  @ApiOperation({ summary: 'Generate a new message ID' })
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  async getNewMessageId(
+    @WorkingSessionParam session: WhatsappSession,
+  ): Promise<NewMessageIDResponse> {
+    const id = await session.generateNewMessageId();
+    return { id: id };
+  }
 }

src/api/contacts.controller.ts

@@ -37,7 +37,7 @@ export class ContactsController {
 
   @Get('/all')
   @ApiOperation({ summary: 'Get all contacts' })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getAll(
     @Query() query: SessionQuery,
@@ -53,7 +53,7 @@ export class ContactsController {
     description:
       'The method always return result, even if the phone number is not registered in WhatsApp. For that - use /contacts/check-exists endpoint below.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   async get(@Query() query: ContactQuery) {
     const whatsapp = await this.manager.getWorkingSession(query.session);
     return whatsapp.getContact(query);
@@ -61,7 +61,7 @@ export class ContactsController {
 
   @Get('/check-exists')
   @ApiOperation({ summary: 'Check phone number is registered in WhatsApp.' })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   async checkExists(
     @Query() request: CheckNumberStatusQuery,
   ): Promise<WANumberExistResult> {
@@ -75,7 +75,7 @@ export class ContactsController {
     description:
       'Returns null if you do not have permission to read their status.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   async getAbout(@Query() query: ContactQuery) {
     const whatsapp = await this.manager.getWorkingSession(query.session);
     return whatsapp.getContactAbout(query);
@@ -87,7 +87,7 @@ export class ContactsController {
     description:
       'If privacy settings do not allow to get the picture, the method will return null.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getProfilePicture(@Query() query: ContactProfilePictureQuery) {
     const whatsapp = await this.manager.getWorkingSession(query.session);
@@ -100,7 +100,7 @@ export class ContactsController {
 
   @Post('/block')
   @ApiOperation({ summary: 'Block contact' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async block(@Body() request: ContactRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.blockContact(request);
@@ -108,7 +108,7 @@ export class ContactsController {
 
   @Post('/unblock')
   @ApiOperation({ summary: 'Unblock contact' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async unblock(@Body() request: ContactRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.unblockContact(request);

src/api/contacts.session.controller.ts

@@ -1,12 +1,13 @@
 import {
   Body,
   Controller,
+  Get,
   Param,
   Put,
   UseGuards,
   UsePipes,
 } from '@nestjs/common';
-import { ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
+import { ApiOperation, ApiParam, ApiSecurity, ApiTags } from '@nestjs/swagger';
 import { PoliciesGuard } from '@waha/core/auth/policies.guard';
 import { CheckPolicies } from '@waha/core/auth/policies.decorator';
 import { CanSession, FromParam } from '@waha/core/auth/policies';
@@ -27,13 +28,35 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/contacts')
 @ApiTags('👤 Contacts')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class ContactsSessionController {
   constructor(private manager: SessionManager) {}
 
+  @Get('/:id')
+  @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  @ApiParam({
+    name: 'id',
+    required: true,
+    type: 'string',
+    description: 'Contact ID',
+    example: '123456789@c.us',
+  })
+  @ApiOperation({
+    summary: 'Get contact basic info',
+    description:
+      'The method always return result, even if the phone number is not registered in WhatsApp. For that - use /contacts/check-exists endpoint below.',
+  })
+  async get(
+    @WorkingSessionParam session: WhatsappSession,
+    @Param('id') id: string,
+  ) {
+    return session.getContact({ session: session.name, contactId: id });
+  }
+
   @Put('/:chatId')
   @SessionApiParam
   @ChatIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Create or update contact',
     description:

src/api/events.controller.ts

@@ -30,7 +30,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/events')
 @ApiTags('📅 Events')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
+@CheckPolicies(CanSession(Action.Send, FromParam('session')))
 export class EventsController {
   constructor(private manager: SessionManager) {}
 

src/api/groups.controller.ts

@@ -38,6 +38,7 @@ import {
   JoinGroupRequest,
   JoinGroupResponse,
   ParticipantsRequest,
+  SettingsMemberAddMode,
   SettingsSecurityChangeInfo,
   SubjectRequest,
 } from '../structures/groups.dto';
@@ -51,12 +52,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/groups')
 @ApiTags('👥 Groups')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class GroupsController {
   constructor(private manager: SessionManager) {}
 
   @Post('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Create a new group.' })
   createGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -67,6 +68,7 @@ export class GroupsController {
 
   @Get('join-info')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get info about the group before joining.' })
   async joinInfoGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -79,6 +81,7 @@ export class GroupsController {
   @Post('join')
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Join group via code' })
   async joinGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -91,6 +94,7 @@ export class GroupsController {
 
   @Get('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get all groups.' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getGroups(
@@ -105,6 +109,7 @@ export class GroupsController {
 
   @Get('/count')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get the number of groups.' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getGroupsCount(
@@ -120,6 +125,7 @@ export class GroupsController {
   @Post('refresh')
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Refresh groups from the server.' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async refreshGroups(@WorkingSessionParam session: WhatsappSession) {
@@ -129,6 +135,7 @@ export class GroupsController {
   @Get(':id')
   @GroupIdApiParam
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get the group.' })
   getGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -140,6 +147,7 @@ export class GroupsController {
   @Delete(':id')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Delete the group.' })
   deleteGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -152,6 +160,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Leave the group.' })
   leaveGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -163,6 +172,7 @@ export class GroupsController {
   @Get(':id/picture')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get group picture' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getChatPicture(
@@ -177,6 +187,7 @@ export class GroupsController {
   @Put(':id/picture')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Set group picture' })
   async setPicture(
     @Param('id') id: string,
@@ -190,6 +201,7 @@ export class GroupsController {
   @Delete(':id/picture')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Delete group picture' })
   async deletePicture(
     @Param('id') id: string,
@@ -207,6 +219,7 @@ export class GroupsController {
   })
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   setDescription(
     @WorkingSessionParam session: WhatsappSession,
     @Param('id') id: string,
@@ -218,6 +231,7 @@ export class GroupsController {
   @Put(':id/subject')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Updates the group subject',
     description:
@@ -234,6 +248,7 @@ export class GroupsController {
   @Put(':id/settings/security/info-admin-only')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Updates the group "info admin only" settings.',
     description:
@@ -250,6 +265,7 @@ export class GroupsController {
   @Get(':id/settings/security/info-admin-only')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary: "Get the group's 'info admin only' settings.",
     description:
@@ -265,6 +281,7 @@ export class GroupsController {
   @Put(':id/settings/security/messages-admin-only')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Update settings - who can send messages',
     description:
@@ -281,6 +298,7 @@ export class GroupsController {
   @Get(':id/settings/security/messages-admin-only')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary: 'Get settings - who can send messages',
     description: 'The group settings to only allow admins to send messages.',
@@ -292,9 +310,43 @@ export class GroupsController {
     return session.getMessagesAdminsOnly(id);
   }
 
+  @Put(':id/settings/security/member-add-mode')
+  @SessionApiParam
+  @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
+  @ApiOperation({
+    summary: 'Update settings - who can add new members',
+    description:
+      'Updates the group settings for who can add new members to the group - all members or admins only.',
+  })
+  setMemberAddMode(
+    @WorkingSessionParam session: WhatsappSession,
+    @Param('id') id: string,
+    @Body() request: SettingsMemberAddMode,
+  ) {
+    return session.setMemberAddMode(id, request.membersCanAddNewMember);
+  }
+
+  @Get(':id/settings/security/member-add-mode')
+  @SessionApiParam
+  @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  @ApiOperation({
+    summary: 'Get settings - who can add new members',
+    description:
+      'The group settings for who can add new members to the group - all members or admins only.',
+  })
+  getMemberAddMode(
+    @WorkingSessionParam session: WhatsappSession,
+    @Param('id') id: string,
+  ): Promise<SettingsMemberAddMode> {
+    return session.getMemberAddMode(id);
+  }
+
   @Get(':id/invite-code')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Gets the invite code for the group.' })
   getInviteCode(
     @WorkingSessionParam session: WhatsappSession,
@@ -307,6 +359,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary:
       'Invalidates the current group invite code and generates a new one.',
@@ -321,6 +374,7 @@ export class GroupsController {
   @Get(':id/participants/')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get participants' })
   getParticipants(
     @WorkingSessionParam session: WhatsappSession,
@@ -332,6 +386,7 @@ export class GroupsController {
   @Get(':id/participants/v2')
   @GroupIdApiParam
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get group participants.' })
   getGroupParticipants(
     @WorkingSessionParam session: WhatsappSession,
@@ -344,6 +399,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Add participants' })
   addParticipants(
     @WorkingSessionParam session: WhatsappSession,
@@ -357,6 +413,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Remove participants',
   })
@@ -372,6 +429,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Promote participants to admin users.' })
   promoteToAdmin(
     @WorkingSessionParam session: WhatsappSession,
@@ -385,6 +443,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Demotes participants to regular users.' })
   demoteToAdmin(
     @WorkingSessionParam session: WhatsappSession,

src/api/labels.controller.ts

@@ -37,12 +37,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/labels')
 @ApiTags('🏷️ Labels')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class LabelsController {
   constructor(private manager: SessionManager) {}
 
   @Get('/')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get all labels' })
   getAll(@WorkingSessionParam session: WhatsappSession): Promise<Label[]> {
     return session.getLabels();
@@ -50,6 +50,7 @@ export class LabelsController {
 
   @Post('/')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Create a new label' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async create(
@@ -75,6 +76,7 @@ export class LabelsController {
 
   @Put('/:labelId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Update a label' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async update(
@@ -106,6 +108,7 @@ export class LabelsController {
 
   @Delete('/:labelId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Delete a label' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async delete(
@@ -123,6 +126,7 @@ export class LabelsController {
   @Get('/chats/:chatId')
   @SessionApiParam
   @ChatIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get labels for the chat' })
   getChatLabels(
     @WorkingSessionParam session: WhatsappSession,
@@ -134,6 +138,7 @@ export class LabelsController {
   @Put('/chats/:chatId')
   @SessionApiParam
   @ChatIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Save labels for the chat' })
   putChatLabels(
     @WorkingSessionParam session: WhatsappSession,
@@ -145,6 +150,7 @@ export class LabelsController {
 
   @Get('/:labelId/chats')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get chats by label' })
   getChatsByLabel(
     @WorkingSessionParam session: WhatsappSession,

src/api/lids.controller.ts

@@ -33,7 +33,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/lids')
 @ApiTags('👤 Contacts')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
+@CheckPolicies(CanSession(Action.Read, FromParam('session')))
 export class LidsController {
   constructor(private manager: SessionManager) {}
 

src/api/media.controller.ts

@@ -32,7 +32,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/media')
 @ApiTags('🖼️ Media')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
+@CheckPolicies(CanSession(Action.Read, FromParam('session')))
 class MediaController {
   constructor(private manager: SessionManager) {}
 

src/api/presence.controller.ts

@@ -31,12 +31,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/presence')
 @ApiTags('✅ Presence')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class PresenceController {
   constructor(private manager: SessionManager) {}
 
   @Post('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Set session presence' })
   setPresence(
     @WorkingSessionParam session: WhatsappSession,
@@ -67,6 +67,7 @@ export class PresenceController {
 
   @Get('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get all subscribed presence information.' })
   getPresenceAll(
     @WorkingSessionParam session: WhatsappSession,
@@ -77,6 +78,7 @@ export class PresenceController {
   @Get(':chatId')
   @SessionApiParam
   @ChatIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary:
       "Get the presence for the chat id. If it hasn't been subscribed - it also subscribes to it.",
@@ -91,6 +93,7 @@ export class PresenceController {
   @Post(':chatId/subscribe')
   @SessionApiParam
   @ChatIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Subscribe to presence events for the chat.',
   })

src/api/profile.controller.ts

@@ -33,12 +33,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/profile')
 @ApiTags('🆔 Profile')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class ProfileController {
   constructor(private manager: SessionManager) {}
 
   @Get('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get my profile' })
   async getMyProfile(
     @WorkingSessionParam session: WhatsappSession,
@@ -57,6 +57,7 @@ export class ProfileController {
 
   @Put('/name')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   @ApiOperation({ summary: 'Set my profile name' })
   async setProfileName(
@@ -69,6 +70,7 @@ export class ProfileController {
 
   @Put('/status')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   @ApiOperation({ summary: 'Set profile status (About)' })
   async setProfileStatus(
@@ -81,6 +83,7 @@ export class ProfileController {
 
   @Put('/picture')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Set profile picture' })
   async setProfilePicture(
     @WorkingSessionParam session: WhatsappSession,
@@ -92,6 +95,7 @@ export class ProfileController {
 
   @Delete('/picture')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Delete profile picture' })
   async deleteProfilePicture(
     @WorkingSessionParam session: WhatsappSession,

src/api/screenshot.controller.ts

@@ -24,14 +24,14 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api')
 @ApiTags('📱 Pairing')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+@CheckPolicies(CanSession(Action.Control, FromQuery('session')))
 export class ScreenshotController {
   constructor(private manager: SessionManager) {}
 
   @Get('/screenshot')
   @ApiOperation({
     summary:
-      'Get a screenshot of the current WhatsApp session (**WEBJS** only)',
+      'Get a screenshot of the current WhatsApp session (**WEBJS/WPP** only)',
   })
   @UseInterceptors(new BufferResponseInterceptor('image/jpeg'))
   @ApiFileAcceptHeader('image/jpeg')

src/api/server.controller.ts

@@ -42,7 +42,7 @@ export class ServerController {
 
   @Get('version')
   @ApiOperation({ summary: 'Get the version of the server' })
-  @CheckPolicies(CanServer(Action.Read))
+  @CheckPolicies(CanServer(Action.Retrieve))
   get(): WAHAEnvironment {
     return VERSION;
   }
@@ -76,7 +76,7 @@ export class ServerController {
 
   @Get('status')
   @ApiOperation({ summary: 'Get the server status' })
-  @CheckPolicies(CanServer(Action.Read))
+  @CheckPolicies(CanServer(Action.Retrieve))
   async status(): Promise<ServerStatusResponse> {
     const now = Date.now();
     const uptime = Math.floor(process.uptime() * 1000);

src/api/sessions.controller.ts

@@ -3,8 +3,6 @@ import {
   Controller,
   Delete,
   Get,
-  Inject,
-  NotFoundException,
   Param,
   Post,
   Put,
@@ -26,22 +24,18 @@ import {
   SessionParam,
 } from '@waha/nestjs/params/SessionApiParam';
 import { WAHAValidationPipe } from '@waha/nestjs/pipes/WAHAValidationPipe';
-import {
-  AppsService,
-  IAppsService,
-} from '@waha/apps/app_sdk/services/IAppsService';
 import {
   SessionLogoutDeprecatedRequest,
   SessionStartDeprecatedRequest,
   SessionStopDeprecatedRequest,
 } from '@waha/structures/sessions.deprecated.dto';
-import { generatePrefixedId } from '@waha/utils/ids';
 
-import { SessionManager } from '../core/abc/manager.abc';
 import { WhatsappSession } from '../core/abc/session.abc';
 import {
   ListSessionsQuery,
   MeInfo,
+  MessageCappingData,
+  ReachoutTimelockData,
   SessionCreateRequest,
   SessionDTO,
   SessionExpand,
@@ -55,39 +49,29 @@ import { CheckPolicies } from '../core/auth/policies.decorator';
 import { PoliciesGuard } from '../core/auth/policies.guard';
 import { CanSession, FromBody, FromParam } from '../core/auth/policies';
 import { Action } from '@waha/core/auth/casl.types';
+import { SessionService } from '@waha/core/services/SessionService';
 
 @ApiSecurity('api_key')
 @Controller('api/sessions')
 @ApiTags('🖥️ Sessions')
 @UseGuards(PoliciesGuard)
 class SessionsController {
-  constructor(
-    private manager: SessionManager,
-    @Inject(AppsService) private appsService: IAppsService,
-  ) {}
-
-  private withLock(name: string, fn: () => any) {
-    return this.manager.withLock(name, fn);
-  }
+  constructor(private readonly sessionService: SessionService) {}
 
   @Get('/')
-  @ApiOperation({
-    summary: 'List all sessions',
-  })
+  @ApiOperation({ summary: 'List all sessions' })
   @CheckPolicies(CanSession(Action.List))
   @ApiOAuth2(['read:items'])
   async list(
     @Query(new WAHAValidationPipe()) query: ListSessionsQuery,
     @Req() req,
   ): Promise<SessionInfo[]> {
-    let sessions = await this.manager.getSessions(query.all);
-    if (!req.user.isAdmin) {
-      sessions = FilterSessions(req.ability, Action.Read, sessions);
+    let sessions = await this.sessionService.getSessions(query.all);
+    if (!req.user?.isAdmin) {
+      sessions = FilterSessions(req.ability, Action.Retrieve, sessions);
     }
     if (query.expand?.includes(SessionExpand.apps)) {
-      for (const session of sessions) {
-        session.apps = await this.appsService.list(this.manager, session.name);
-      }
+      await this.sessionService.expandSessionApps(sessions);
     }
     return sessions;
   }
@@ -95,18 +79,15 @@ class SessionsController {
   @Get('/:session')
   @ApiOperation({ summary: 'Get session information' })
   @SessionApiParam
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async get(
     @Param('session') name: string,
     @Query() query: SessionInfoQuery,
   ): Promise<SessionInfo> {
-    const session = await this.manager.getSessionInfo(name);
-    if (session === null) {
-      throw new NotFoundException('Session not found');
-    }
+    const session = await this.sessionService.getSession(name);
     if (query.expand?.includes(SessionExpand.apps)) {
-      session.apps = await this.appsService.list(this.manager, name);
+      await this.sessionService.expandSessionApps([session]);
     }
     return session;
   }
@@ -114,9 +95,42 @@ class SessionsController {
   @Get(':session/me')
   @SessionApiParam
   @ApiOperation({ summary: 'Get information about the authenticated account' })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   getMe(@SessionParam session: WhatsappSession): MeInfo | null {
-    return session.getSessionMeInfo();
+    return this.sessionService.getSessionMe(session);
+  }
+
+  @Get(':session/capping')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Fetch the account new-chat message capping (per-cycle quota)',
+    description:
+      'Fetch a fresh new-chat message capping (quota) state from WhatsApp. ' +
+      'The same value is also available under me.messageCapping in the session ' +
+      'info, and changes are pushed through the session.status event.',
+  })
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  fetchMessageCapping(
+    @SessionParam session: WhatsappSession,
+  ): Promise<MessageCappingData> {
+    return session.fetchMessageCapping();
+  }
+
+  @Get(':session/timelock')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Fetch the account reachout timelock state',
+    description:
+      'Fetch a fresh reachout timelock state from WhatsApp - the restriction ' +
+      'behind "server returned error 463" when messaging new contacts. ' +
+      'The same value is also available under me.reachoutTimelock in the session ' +
+      'info, and changes are pushed through the session.status event.',
+  })
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  fetchReachoutTimelock(
+    @SessionParam session: WhatsappSession,
+  ): Promise<ReachoutTimelockData> {
+    return session.fetchReachoutTimelock();
   }
 
   @Post('')
@@ -129,71 +143,20 @@ class SessionsController {
   @CheckPolicies(CanSession(Action.Create))
   @UsePipes(new WAHAValidationPipe())
   async create(@Body() request: SessionCreateRequest): Promise<SessionDTO> {
-    const name = request.name || generatePrefixedId('session');
-    await this.withLock(name, async () => {
-      if (await this.manager.exists(name)) {
-        const msg = `Session '${name}' already exists. Use PUT to update it.`;
-        throw new UnprocessableEntityException(msg);
-      }
-      const config = request.config;
-      const start = request.start || false;
-      await this.manager.upsert(name, config);
-      if (request.apps) {
-        await this.appsService.syncSessionApps(
-          this.manager,
-          name,
-          request.apps,
-        );
-      }
-      if (start) {
-        await this.manager.assign(name);
-        await this.manager.start(name);
-      }
-    });
-    const session = await this.manager.getSessionInfo(name);
-    if (request.apps) {
-      session.apps = await this.appsService.list(this.manager, name);
-    }
-    return session;
+    return this.sessionService.createSession(request);
   }
 
   @Put(':session')
-  @ApiOperation({
-    summary: 'Update a session',
-    description: '',
-  })
+  @ApiOperation({ summary: 'Update a session' })
   @SessionApiParam
   @ApiBody({ type: SessionUpdateRequest, examples: SessionExamples })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Setting, FromParam('session')))
   @UsePipes(new WAHAValidationPipe({ forbidNonWhitelisted: false }))
   async update(
     @Param('session') name: string,
     @Body() request: SessionUpdateRequest,
   ): Promise<SessionDTO> {
-    await this.withLock(name, async () => {
-      if (!(await this.manager.exists(name))) {
-        throw new NotFoundException('Session not found');
-      }
-      const config = request.config;
-      const isRunning = this.manager.isRunning(name);
-      await this.manager.stop(name, true);
-      await this.manager.upsert(name, config);
-      if (request.apps) {
-        await this.appsService.syncSessionApps(
-          this.manager,
-          name,
-          request.apps,
-        );
-      }
-      if (isRunning) {
-        await this.manager.start(name);
-      }
-    });
-    const session = await this.manager.getSessionInfo(name);
-    if (request.apps) {
-      session.apps = await this.appsService.list(this.manager, name);
-    }
-    return session;
+    return this.sessionService.updateSession(name, request);
   }
 
   @Delete(':session')
@@ -206,13 +169,7 @@ class SessionsController {
   @CheckPolicies(CanSession(Action.Delete, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async delete(@Param('session') name: string): Promise<void> {
-    await this.withLock(name, async () => {
-      await this.manager.unassign(name);
-      await this.manager.unpair(name);
-      await this.manager.stop(name, true);
-      await this.manager.logout(name);
-      await this.manager.delete(name);
-    });
+    return this.sessionService.deleteSession(name);
   }
 
   @Post(':session/start')
@@ -222,18 +179,10 @@ class SessionsController {
     description:
       'Start the session with the given name. The session must exist. Idempotent operation.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Control, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async start(@Param('session') name: string): Promise<SessionDTO> {
-    await this.withLock(name, async () => {
-      const exists = await this.manager.exists(name);
-      if (!exists) {
-        throw new NotFoundException('Session not found');
-      }
-      await this.manager.assign(name);
-      await this.manager.start(name);
-    });
-    return await this.manager.getSessionInfo(name);
+    return this.sessionService.startSession(name);
   }
 
   @Post(':session/stop')
@@ -242,14 +191,10 @@ class SessionsController {
     summary: 'Stop the session',
     description: 'Stop the session with the given name. Idempotent operation.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Control, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async stop(@Param('session') name: string): Promise<SessionDTO> {
-    await this.withLock(name, async () => {
-      await this.manager.unassign(name);
-      await this.manager.stop(name, false);
-    });
-    return await this.manager.getSessionInfo(name);
+    return this.sessionService.stopSession(name);
   }
 
   @Post(':session/logout')
@@ -258,23 +203,10 @@ class SessionsController {
     summary: 'Logout from the session',
     description: 'Logout the session, restart a session if it was not STOPPED',
   })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Control, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async logout(@Param('session') name: string): Promise<SessionDTO> {
-    await this.withLock(name, async () => {
-      const exists = await this.manager.exists(name);
-      if (!exists) {
-        throw new NotFoundException('Session not found');
-      }
-      const isRunning = this.manager.isRunning(name);
-      await this.manager.unpair(name);
-      await this.manager.stop(name, true);
-      await this.manager.logout(name);
-      if (isRunning) {
-        await this.manager.start(name);
-      }
-    });
-    return await this.manager.getSessionInfo(name);
+    return this.sessionService.logoutSession(name);
   }
 
   @Post(':session/restart')
@@ -283,11 +215,10 @@ class SessionsController {
     summary: 'Restart the session',
     description: 'Restart the session with the given name.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Control, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async restart(@Param('session') name: string): Promise<SessionDTO> {
-    await this.manager.restart(name);
-    return await this.manager.getSessionInfo(name);
+    return this.sessionService.restartSession(name);
   }
 
   @Post('/start/')
@@ -297,25 +228,22 @@ class SessionsController {
       'Create session (if not exists) or update a config (if exists) and start it.',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('name')))
+  @CheckPolicies(CanSession(Action.Control, FromBody('name')))
   async DEPRACATED_start(
     @Body() request: SessionStartDeprecatedRequest,
   ): Promise<SessionDTO> {
-    const name = request.name;
     if (!request.name) {
       throw new UnprocessableEntityException('Session name is required');
     }
-    if (this.manager.isRunning(name)) {
-      const msg = `Session '${name}' is already started.`;
-      throw new UnprocessableEntityException(msg);
+    if (this.sessionService.isSessionRunning(request.name)) {
+      throw new UnprocessableEntityException(
+        `Session '${request.name}' is already started.`,
+      );
     }
-
-    return await this.withLock(name, async () => {
-      const config = request.config;
-      await this.manager.upsert(name, config);
-      await this.manager.assign(name);
-      return await this.manager.start(name);
-    });
+    return this.sessionService.upsertAndStartSession(
+      request.name,
+      request.config,
+    );
   }
 
   @Post('/stop/')
@@ -324,30 +252,18 @@ class SessionsController {
     description: 'Stop session and Logout by default.',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('name')))
+  @CheckPolicies(CanSession(Action.Control, FromBody('name')))
   async DEPRECATED_stop(
     @Body() request: SessionStopDeprecatedRequest,
   ): Promise<void> {
     if (!request.name) {
       throw new UnprocessableEntityException('Session name is required');
     }
-    const name = request.name;
     if (request.logout) {
-      // Old API did remove the session complete
-      await this.withLock(name, async () => {
-        await this.manager.unassign(name);
-        await this.manager.unpair(name);
-        await this.manager.stop(name, true);
-        await this.manager.logout(name);
-        await this.manager.delete(name);
-      });
+      await this.sessionService.deleteSession(request.name);
     } else {
-      await this.withLock(name, async () => {
-        await this.manager.unassign(name);
-        await this.manager.stop(name, false);
-      });
+      await this.sessionService.stopSession(request.name);
     }
-    return;
   }
 
   @Post('/logout/')
@@ -356,22 +272,14 @@ class SessionsController {
     description: 'Stop, Logout and Delete session.',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('name')))
+  @CheckPolicies(CanSession(Action.Control, FromBody('name')))
   async DEPRECATED_logout(
     @Body() request: SessionLogoutDeprecatedRequest,
   ): Promise<void> {
     if (!request.name) {
       throw new UnprocessableEntityException('Session name is required');
     }
-    const name = request.name;
-    await this.withLock(name, async () => {
-      await this.manager.unassign(name);
-      await this.manager.unpair(name);
-      await this.manager.stop(name, true);
-      await this.manager.logout(name);
-      await this.manager.delete(name);
-    });
-    return;
+    await this.sessionService.deleteSession(request.name);
   }
 }
 

src/api/status.controller.ts

@@ -25,12 +25,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/status')
 @ApiTags('🟢 Status')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 class StatusController {
   constructor(private manager: SessionManager) {}
 
   @Post('text')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Send text status' })
   sendTextStatus(
     @WorkingSessionParam session: WhatsappSession,
@@ -41,6 +41,7 @@ class StatusController {
 
   @Post('image')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Send image status' })
   sendImageStatus(
     @WorkingSessionParam session: WhatsappSession,
@@ -51,6 +52,7 @@ class StatusController {
 
   @Post('voice')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Send voice status' })
   sendVoiceStatus(
     @WorkingSessionParam session: WhatsappSession,
@@ -61,6 +63,7 @@ class StatusController {
 
   @Post('video')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Send video status' })
   sendVideoStatus(
     @WorkingSessionParam session: WhatsappSession,
@@ -71,6 +74,7 @@ class StatusController {
 
   @Post('delete')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'DELETE sent status' })
   deleteStatus(
     @WorkingSessionParam session: WhatsappSession,
@@ -81,6 +85,7 @@ class StatusController {
 
   @Get('new-message-id')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Generate message ID you can use to batch contacts',
   })

src/api/version.controller.ts

@@ -13,7 +13,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/version')
 @ApiTags('🔍 Observability')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanServer(Action.Read))
+@CheckPolicies(CanServer(Action.Retrieve))
 export class VersionController {
   @Get('')
   @ApiOperation({

src/api/websocket.gateway.core.ts

@@ -86,13 +86,14 @@ export class WebsocketGatewayCore
     const params = this.getParams(request);
     let session: string = params.session;
     const ability = this.casl.createForUser(user);
-    if (session == '*' && !ability.can(Action.Use, 'all')) {
+    if (session == '*' && !ability.can(Action.Manage, 'all')) {
       // Limit user to listen only the session events
       session = user.session;
     }
 
-    if (!ability.can(Action.Use, new SessionName(session))) {
+    if (!ability.can(Action.Read, new SessionName(session))) {
       socket.close(WebSocketCloseCode.POLICY_VIOLATION, 'Forbidden');
+      return;
     }
 
     this.logger.debug(`New client connected: ${request.url} - ${socket.id}`);

src/apps/app_sdk/api/apps.controller.ts

@@ -22,10 +22,16 @@ import {
 import { SessionManager } from '@waha/core/abc/manager.abc';
 import { CheckPolicies } from '@waha/core/auth/policies.decorator';
 import { PoliciesGuard } from '@waha/core/auth/policies.guard';
-import { CanSession, FromBody, FromQuery } from '@waha/core/auth/policies';
+import {
+  CanServer,
+  CanSession,
+  FromBody,
+  FromQuery,
+} from '@waha/core/auth/policies';
 import { Action, session as SessionName } from '@waha/core/auth/casl.types';
 import { WAHAValidationPipe } from '@waha/nestjs/pipes/WAHAValidationPipe';
 
+import { APPS } from '../apps/definition';
 import { App } from '../dto/app.dto';
 import { ListAppsQuery } from '../dto/query.dto';
 
@@ -42,7 +48,7 @@ export class AppsController {
 
   @Get('/')
   @ApiOperation({ summary: 'List all apps for a session' })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.App, FromQuery('session')))
   @UsePipes(new WAHAValidationPipe())
   async list(
     @Query(new WAHAValidationPipe()) query: ListAppsQuery,
@@ -52,12 +58,12 @@ export class AppsController {
 
   @Post('/')
   @ApiOperation({ summary: 'Create a new app' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.App, FromBody('session')))
   @UsePipes(new WAHAValidationPipe())
   async create(@Body() app: App): Promise<App> {
     const result = await this.appsService.create(this.manager, app);
     const isRunning = this.manager.isRunning(app.session);
-    if (isRunning && app.enabled) {
+    if (isRunning && app.enabled && APPS[app.app].restartOnChange) {
       await this.manager.restart(app.session);
     }
     return result;
@@ -65,13 +71,14 @@ export class AppsController {
 
   @Get('/:id')
   @ApiOperation({ summary: 'Get app by ID' })
+  @CheckPolicies(CanServer(Action.Retrieve))
   @UsePipes(new WAHAValidationPipe())
   async get(@Param('id') id: string, @Req() req: any): Promise<App> {
     const app = await this.appsService.get(this.manager, id);
     if (!app) {
       throw new NotFoundException(`App '${id}' not found`);
     }
-    if (!req.ability?.can(Action.Use, new SessionName(app.session))) {
+    if (!req.ability?.can(Action.App, new SessionName(app.session))) {
       throw new ForbiddenException();
     }
     return app;
@@ -79,6 +86,7 @@ export class AppsController {
 
   @Put('/:id')
   @ApiOperation({ summary: 'Update an existing app' })
+  @CheckPolicies(CanServer(Action.Retrieve))
   @UsePipes(new WAHAValidationPipe())
   async update(
     @Param('id') id: string,
@@ -87,11 +95,11 @@ export class AppsController {
   ): Promise<App> {
     const existing = await this.appsService.get(this.manager, id);
     if (existing) {
-      if (!req.ability?.can(Action.Use, new SessionName(existing.session))) {
+      if (!req.ability?.can(Action.App, new SessionName(existing.session))) {
         throw new ForbiddenException();
       }
     } else {
-      if (!req.ability?.can(Action.Use, new SessionName(app.session))) {
+      if (!req.ability?.can(Action.App, new SessionName(app.session))) {
         throw new ForbiddenException();
       }
     }
@@ -105,27 +113,28 @@ export class AppsController {
     }
 
     const result = await this.appsService.upsert(this.manager, app);
-    const isRunning = this.manager.isRunning(app.session);
-    if (isRunning) {
-      await this.manager.restart(app.session);
+    const isRunning = this.manager.isRunning(result.session);
+    if (isRunning && APPS[result.app].restartOnChange) {
+      await this.manager.restart(result.session);
     }
     return result;
   }
 
   @Delete('/:id')
   @ApiOperation({ summary: 'Delete an app' })
+  @CheckPolicies(CanServer(Action.Retrieve))
   @UsePipes(new WAHAValidationPipe())
   async delete(@Param('id') id: string, @Req() req: any): Promise<void> {
     const existing = await this.appsService.get(this.manager, id);
     if (!existing) {
       throw new NotFoundException(`App '${id}' not found`);
     }
-    if (!req.ability?.can(Action.Use, new SessionName(existing.session))) {
+    if (!req.ability?.can(Action.App, new SessionName(existing.session))) {
       throw new ForbiddenException();
     }
     const app = await this.appsService.delete(this.manager, id);
     const isRunning = this.manager.isRunning(app.session);
-    if (isRunning) {
+    if (isRunning && APPS[app.app].restartOnChange) {
       await this.manager.restart(app.session);
     }
   }

src/apps/app_sdk/apps/definition.ts

@@ -9,6 +9,8 @@ export interface AppDefinition {
   queue: boolean;
   // If app has any migrations
   migrations: boolean;
+  // If adding, updating, or removing this app requires a session restart
+  restartOnChange: boolean;
 }
 
 // All Apps
@@ -18,11 +20,20 @@ export const APPS: Record<AppName, AppDefinition> = {
     plainkey: false,
     queue: false,
     migrations: false,
+    restartOnChange: true,
   },
   [AppName.chatwoot]: {
     name: AppName.chatwoot,
     plainkey: true,
     queue: true,
     migrations: true,
+    restartOnChange: true,
+  },
+  [AppName.mcp]: {
+    name: AppName.mcp,
+    plainkey: false,
+    queue: false,
+    migrations: false,
+    restartOnChange: false,
   },
 };

src/apps/app_sdk/apps/name.ts

@@ -1,4 +1,5 @@
 export enum AppName {
   chatwoot = 'chatwoot',
   calls = 'calls',
+  mcp = 'mcp',
 }

src/apps/app_sdk/dto/app.dto.ts

@@ -1,5 +1,6 @@
 import { ChatWootAppConfig } from '@waha/apps/chatwoot/dto/config.dto';
 import { CallsAppConfig } from '@waha/apps/calls/dto/config.dto';
+import { McpAppConfig } from '@waha/apps/mcp/dto/config.dto';
 import { Type } from 'class-transformer';
 import {
   IsBoolean,
@@ -11,9 +12,12 @@ import {
 import { ApiExtraModels, ApiProperty } from '@nestjs/swagger';
 import { AppName } from '@waha/apps/app_sdk/apps/name';
 
-export type AllowedAppConfig = ChatWootAppConfig | CallsAppConfig;
+export type AllowedAppConfig =
+  | ChatWootAppConfig
+  | CallsAppConfig
+  | McpAppConfig;
 
-@ApiExtraModels(ChatWootAppConfig, CallsAppConfig)
+@ApiExtraModels(ChatWootAppConfig, CallsAppConfig, McpAppConfig)
 export class App<T extends AllowedAppConfig = any> {
   @IsString()
   id: string;
@@ -43,6 +47,8 @@ export class App<T extends AllowedAppConfig = any> {
           return ChatWootAppConfig;
         case AppName.calls:
           return CallsAppConfig;
+        case AppName.mcp:
+          return McpAppConfig;
         default:
           return Object;
       }
@@ -62,4 +68,9 @@ export class CallsAppDto extends App<CallsAppConfig> {
   config: CallsAppConfig;
 }
 
-export type AppDto = ChatWootAppDto | CallsAppDto;
+export class McpAppDto extends App<McpAppConfig> {
+  @Type(() => McpAppConfig)
+  config: McpAppConfig;
+}
+
+export type AppDto = ChatWootAppDto | CallsAppDto | McpAppDto;

src/apps/app_sdk/env.ts

@@ -1,4 +1,10 @@
 import { parseBool } from '@waha/helpers';
+import { APPS } from '@waha/apps/app_sdk/apps/definition';
+
+// Apps that don't require queue (Redis) - derived from AppDefinition
+const IN_MEMORY_APPS = Object.values(APPS)
+  .filter((app) => !app.queue)
+  .map((app) => app.name);
 
 function parseCommaSeparatedList(value: string | undefined): string[] {
   if (!value) {
@@ -7,8 +13,30 @@ function parseCommaSeparatedList(value: string | undefined): string[] {
   return value.split(',').map((item) => item.trim());
 }
 
-export const AppEnv = {
-  enabled: parseBool(process.env.WAHA_APPS_ENABLED),
-  on: parseCommaSeparatedList(process.env.WAHA_APPS_ON),
-  off: parseCommaSeparatedList(process.env.WAHA_APPS_OFF),
-};
+function isMongoDB(): boolean {
+  return !!process.env.WHATSAPP_SESSIONS_MONGO_URL;
+}
+
+function buildAppEnv() {
+  const enabled = process.env.WAHA_APPS_ENABLED;
+  const on = process.env.WAHA_APPS_ON;
+  const off = process.env.WAHA_APPS_OFF;
+
+  // Default if not mongodb
+  const isUserConfigured = enabled !== undefined || on !== undefined;
+  if (!isUserConfigured && !isMongoDB()) {
+    return {
+      enabled: true,
+      on: IN_MEMORY_APPS,
+      off: parseCommaSeparatedList(off),
+    };
+  }
+
+  return {
+    enabled: parseBool(enabled),
+    on: parseCommaSeparatedList(on),
+    off: parseCommaSeparatedList(off),
+  };
+}
+
+export const AppEnv = buildAppEnv();

src/apps/app_sdk/services/AppsEnabledService.ts

@@ -9,6 +9,7 @@ import { IAppService } from '@waha/apps/app_sdk/services/IAppService';
 import { IAppsService } from '@waha/apps/app_sdk/services/IAppsService';
 import { ChatWootAppService } from '@waha/apps/chatwoot/services/ChatWootAppService';
 import { CallsAppService } from '@waha/apps/calls/services/CallsAppService';
+import { McpAppService } from '@waha/apps/mcp/services/McpAppService';
 import { DataStore } from '@waha/core/abc/DataStore';
 import { SessionManager } from '@waha/core/abc/manager.abc';
 import { WhatsappSession } from '@waha/core/abc/session.abc';
@@ -36,15 +37,18 @@ export class AppsEnabledService implements IAppsService {
     protected logger: PinoLogger,
     @Optional() protected readonly chatwootService: ChatWootAppService,
     @Optional() protected readonly callsAppService: CallsAppService,
+    @Optional() protected readonly mcpAppService: McpAppService,
   ) {}
 
   async list(manager: SessionManager, session: string): Promise<App[]> {
     const knex = manager.store.getWAHADatabase();
     const repo = new AppRepository(knex);
     const apps = await repo.getAllBySession(session);
-    apps.forEach((app) => {
+    for (const app of apps) {
       delete app.pk;
-    });
+      const service = this.getAppService(app);
+      await service?.enrich(manager, app);
+    }
     return apps;
   }
 
@@ -90,10 +94,10 @@ export class AppsEnabledService implements IAppsService {
     }
 
     const service = this.getAppService(app);
-    if (!service && !AppRuntimeConfig.HasApp(app.app)) {
+    if (app.enabled && !service && !AppRuntimeConfig.HasApp(app.app)) {
       throw new AppDisableError(app.app);
     }
-    service.validate(app);
+    service?.validate(app);
     // Only run beforeCreated when app is enabled (default true if omitted)
     if (app.enabled !== false) {
       await service.beforeCreated(app);
@@ -101,6 +105,9 @@ export class AppsEnabledService implements IAppsService {
 
     const result = await repo.save(app);
     delete result.pk;
+    if (app.enabled !== false) {
+      await service?.afterCreated(manager, result);
+    }
     return result;
   }
 
@@ -112,6 +119,8 @@ export class AppsEnabledService implements IAppsService {
       return null;
     }
     delete (app as any).pk;
+    const service = this.getAppService(app);
+    await service?.enrich(manager, app);
     return app;
   }
 
@@ -147,21 +156,21 @@ export class AppsEnabledService implements IAppsService {
     }
 
     const service = this.getAppService(app);
-    if (!service && !AppRuntimeConfig.HasApp(app.app)) {
+    if (app.enabled && !service && !AppRuntimeConfig.HasApp(app.app)) {
       throw new AppDisableError(app.app);
     }
-    service.validate(app);
+    service?.validate(app);
 
     const hasEnabledChange = savedApp.enabled !== app.enabled;
 
     if (hasEnabledChange) {
       if (app.enabled) {
-        await service.beforeEnabled(savedApp, app);
+        await service?.beforeEnabled(manager, savedApp, app);
       } else {
-        await service.beforeDisabled(savedApp, app);
+        await service?.beforeDisabled(manager, savedApp, app);
       }
     } else {
-      await service.beforeUpdated(savedApp, app);
+      await service?.beforeUpdated(manager, savedApp, app);
     }
     await repo.update(app.id, app);
     const updated = await repo.getById(app.id);
@@ -177,7 +186,7 @@ export class AppsEnabledService implements IAppsService {
       throw new NotFoundException(`App '${appId}' not found`);
     }
     const service = this.getAppService(app);
-    await service?.beforeDeleted(app);
+    await service?.beforeDeleted(manager, app);
     await repo.delete(app.id);
     delete app.pk;
     return app;
@@ -186,6 +195,11 @@ export class AppsEnabledService implements IAppsService {
   async removeBySession(manager: SessionManager, session: string) {
     const knex = manager.store.getWAHADatabase();
     const repo = new AppRepository(knex);
+    const apps = await repo.getAllBySession(session);
+    for (const app of apps) {
+      const service = this.getAppService(app);
+      await service?.beforeSessionDeleted(manager, app);
+    }
     await repo.deleteBySession(session);
   }
 
@@ -257,6 +271,8 @@ export class AppsEnabledService implements IAppsService {
         return this.chatwootService;
       case AppName.calls:
         return this.callsAppService;
+      case AppName.mcp:
+        return this.mcpAppService;
       default:
         throw new Error(`App '${app.app}' not supported`);
     }

src/apps/app_sdk/services/IAppService.ts

@@ -1,4 +1,5 @@
 import { App } from '@waha/apps/app_sdk/dto/app.dto';
+import { SessionManager } from '@waha/core/abc/manager.abc';
 import { WhatsappSession } from '@waha/core/abc/session.abc';
 
 /**
@@ -9,19 +10,49 @@ export interface IAppService {
 
   beforeCreated(app: App): Promise<void>;
 
+  /**
+   * Called after the app record is saved to the database during creation.
+   * Use this for side effects that must happen after the app exists in storage.
+   */
+  afterCreated(manager: SessionManager, app: App): Promise<void>;
+
   /**
    * Called only when the app transitions from disabled -> enabled.
    */
-  beforeEnabled(savedApp: App, newApp: App): Promise<void>;
+  beforeEnabled(
+    manager: SessionManager,
+    savedApp: App,
+    newApp: App,
+  ): Promise<void>;
 
   /**
    * Called only when the app transitions from enabled -> disabled.
    */
-  beforeDisabled(savedApp: App, newApp: App): Promise<void>;
+  beforeDisabled(
+    manager: SessionManager,
+    savedApp: App,
+    newApp: App,
+  ): Promise<void>;
 
-  beforeUpdated(savedApp: App, newApp: App): Promise<void>;
+  beforeUpdated(
+    manager: SessionManager,
+    savedApp: App,
+    newApp: App,
+  ): Promise<void>;
 
-  beforeDeleted(app: App): Promise<void>;
+  beforeDeleted(manager: SessionManager, app: App): Promise<void>;
+
+  /**
+   * Called for each app before a bulk session deletion removes all app records.
+   * Use this to clean up external resources tied to the app (e.g. API keys).
+   */
+  beforeSessionDeleted(manager: SessionManager, app: App): Promise<void>;
+
+  /**
+   * Called after reading an app from storage, before returning it to the caller.
+   * Use this to populate transient fields that are not persisted (e.g. secret values).
+   */
+  enrich(manager: SessionManager, app: App): Promise<void>;
 
   beforeSessionStart(app: App, session: WhatsappSession): void;
 

src/apps/app_sdk/waha/WAHASelf.ts

@@ -13,8 +13,7 @@ import {
   WANumberExistResult,
 } from '@waha/structures/chatting.dto';
 import { SessionInfo } from '@waha/structures/sessions.dto';
-import axios, { AxiosInstance } from 'axios';
-import { Auth } from '@waha/core/auth/config';
+import axios, { AxiosInstance, AxiosRequestConfig } from 'axios';
 import { ContactSortField } from '@waha/structures/contacts.dto';
 import { PaginationParams } from '@waha/structures/pagination.dto';
 
@@ -25,9 +24,7 @@ export interface RequestOptions {
 export class WAHASelf {
   public client: AxiosInstance;
 
-  constructor() {
-    // Set 'X-Api-Key'
-    const key = Auth.keyplain.value;
+  constructor(public key: string) {
     const port =
       parseInt(process.env.PORT) ||
       parseInt(process.env.WHATSAPP_API_PORT) ||
@@ -42,6 +39,10 @@ export class WAHASelf {
     });
   }
 
+  request(config: AxiosRequestConfig) {
+    return this.client.request(config);
+  }
+
   async fetch(url: string, opts?: RequestOptions): Promise<Buffer> {
     const response = await this.client.get(url, {
       responseType: 'arraybuffer',

src/apps/apps.module.enabled.ts

@@ -5,6 +5,7 @@ import { BullBoardModule } from '@bull-board/nestjs';
 import { ExpressAdapter } from '@bull-board/express';
 import { BullAuthMiddleware } from '@waha/apps/app_sdk/auth';
 import { ChatWootExports } from '@waha/apps/chatwoot/chatwoot.module';
+import { McpModuleExports } from '@waha/apps/mcp/mcp.module';
 import { AppsController } from '@waha/apps/app_sdk/api/apps.controller';
 import { CallsAppExports } from '@waha/apps/calls/calls.module';
 import { AppsService } from '@waha/apps/app_sdk/services/IAppsService';
@@ -83,6 +84,8 @@ function getAppModule(name: AppName) {
       return CallsAppExports;
     case AppName.chatwoot:
       return ChatWootExports;
+    case AppName.mcp:
+      return McpModuleExports;
     default:
       throw Error(`App module not found for ${name}`);
   }
@@ -91,11 +94,13 @@ function getAppModule(name: AppName) {
 export const AppsEnabled = {
   imports: [
     ...QUEUES_IMPORTS,
+    ...getAppModule(AppName.mcp).imports,
     ...getAppModule(AppName.chatwoot).imports,
     ...getAppModule(AppName.calls).imports,
   ],
   controllers: [
     AppsController,
+    ...getAppModule(AppName.mcp).controllers,
     ...getAppModule(AppName.chatwoot).controllers,
     ...getAppModule(AppName.calls).controllers,
   ],
@@ -104,6 +109,7 @@ export const AppsEnabled = {
       provide: AppsService,
       useClass: AppsEnabledService,
     },
+    ...getAppModule(AppName.mcp).providers,
     ...getAppModule(AppName.calls).providers,
     ...getAppModule(AppName.chatwoot).providers,
   ],

src/apps/calls/dto/config.dto.ts

@@ -2,8 +2,10 @@ import { ApiProperty } from '@nestjs/swagger';
 import { Type } from 'class-transformer';
 import {
   IsBoolean,
+  IsNumber,
   IsOptional,
   IsString,
+  Min,
   ValidateNested,
 } from 'class-validator';
 
@@ -23,6 +25,26 @@ export class CallsAppChannelConfig {
   @IsOptional()
   @IsString()
   message?: string;
+
+  @ApiProperty({
+    description:
+      'Seconds to wait before declining the call. If not set or undefined, the call is declined immediately (0 seconds).',
+    required: false,
+  })
+  @IsOptional()
+  @IsNumber()
+  @Min(0)
+  waitBeforeDecline?: number;
+
+  @ApiProperty({
+    description:
+      'Seconds to wait before sending the auto-reply message. If not set or undefined, the message is sent immediately (0 seconds).',
+    required: false,
+  })
+  @IsOptional()
+  @IsNumber()
+  @Min(0)
+  waitBeforeResponse?: number;
 }
 
 export class CallsAppConfig {

src/apps/calls/services/CallsAppService.ts

@@ -2,6 +2,7 @@ import { Injectable } from '@nestjs/common';
 import { App } from '@waha/apps/app_sdk/dto/app.dto';
 import { IAppService } from '@waha/apps/app_sdk/services/IAppService';
 import { CallsAppConfig } from '@waha/apps/calls/dto/config.dto';
+import { SessionManager } from '@waha/core/abc/manager.abc';
 import { WhatsappSession } from '@waha/core/abc/session.abc';
 import { InjectPinoLogger, PinoLogger } from 'nestjs-pino';
 import { CallsListener } from '@waha/apps/calls/services/CallsListener';
@@ -25,32 +26,64 @@ export class CallsAppService implements IAppService {
   }
 
   async beforeEnabled(
+    manager: SessionManager,
     savedApp: App<CallsAppConfig>,
     newApp: App<CallsAppConfig>,
   ): Promise<void> {
-    // Enabling behaves the same as creating for this lightweight app.
+    void manager;
     void savedApp;
     void newApp;
-    return;
   }
 
   async beforeDisabled(
+    manager: SessionManager,
     savedApp: App<CallsAppConfig>,
     newApp: App<CallsAppConfig>,
   ): Promise<void> {
-    void newApp;
+    void manager;
     void savedApp;
+    void newApp;
   }
 
   async beforeUpdated(
+    manager: SessionManager,
     savedApp: App<CallsAppConfig>,
     newApp: App<CallsAppConfig>,
   ): Promise<void> {
+    void manager;
     void savedApp;
     void newApp;
   }
 
-  async beforeDeleted(app: App<CallsAppConfig>): Promise<void> {
+  async beforeDeleted(
+    manager: SessionManager,
+    app: App<CallsAppConfig>,
+  ): Promise<void> {
+    void manager;
+    void app;
+  }
+
+  async afterCreated(
+    manager: SessionManager,
+    app: App<CallsAppConfig>,
+  ): Promise<void> {
+    void manager;
+    void app;
+  }
+
+  async beforeSessionDeleted(
+    manager: SessionManager,
+    app: App<CallsAppConfig>,
+  ): Promise<void> {
+    void manager;
+    void app;
+  }
+
+  async enrich(
+    manager: SessionManager,
+    app: App<CallsAppConfig>,
+  ): Promise<void> {
+    void manager;
     void app;
   }
 

src/apps/calls/services/CallsListener.ts

@@ -92,10 +92,14 @@ export class CallsListener {
     }
 
     if (shouldReject) {
+      const waitBeforeDeclineMs = (config.waitBeforeDecline ?? 0) * 1000;
+      await sleep(waitBeforeDeclineMs);
       await this.rejectCall(call);
     }
 
     if (shouldMessage) {
+      const waitBeforeResponseMs = (config.waitBeforeResponse ?? 0) * 1000;
+      await sleep(waitBeforeResponseMs);
       await this.replyWithTyping(call.from, message);
     }
   }

src/apps/chatwoot/chatwoot.module.ts

@@ -6,6 +6,7 @@ import {
   NoRetriesJobOptions,
 } from '@waha/apps/app_sdk/constants';
 import { MessageCleanupConsumer } from '@waha/apps/chatwoot/consumers/scheduled/message.cleanup';
+import { CheckTierConsumer } from '@waha/apps/chatwoot/consumers/scheduled/check.tier';
 import { ChatWootAppService } from '@waha/apps/chatwoot/services/ChatWootAppService';
 import * as lodash from 'lodash';
 
@@ -51,6 +52,10 @@ const IMPORTS = lodash.flatten([
     name: QueueName.SCHEDULED_CHECK_VERSION,
     defaultJobOptions: merge(NoRetriesJobOptions, JobRemoveOptions),
   }),
+  RegisterAppQueue({
+    name: QueueName.SCHEDULED_CHECK_TIER,
+    defaultJobOptions: merge(NoRetriesJobOptions, JobRemoveOptions),
+  }),
   RegisterAppQueue({
     name: QueueName.TASK_CONTACTS_PULL,
     defaultJobOptions: merge(ExponentialRetriesJobOptions, JobRemoveOptions),
@@ -145,6 +150,7 @@ const PROVIDERS = [
   // Scheduled
   MessageCleanupConsumer,
   CheckVersionConsumer,
+  CheckTierConsumer,
   // Services
   ChatWootWAHAQueueService,
   ChatWootQueueService,

src/apps/chatwoot/cli/cmd.queue.ts

@@ -20,8 +20,18 @@ export async function QueueStatus(ctx: QueueCommandContext, name: string) {
   for (const status of result) {
     status.name = QueueNameRepr(status.name);
   }
-  // locked: true - last
-  result = lodash.sortBy(result, [(x) => !!x.locked, 'name']);
+  const categoryOrder = ['inbox', 'whatsapp', 'task', 'scheduled'];
+  const categoryIndex = (name: string) => {
+    const category = name.split(' | ')[0];
+    const index = categoryOrder.indexOf(category);
+    return index === -1 ? categoryOrder.length : index;
+  };
+  // locked: true - last, then by category (inbox/whatsapp/task/scheduled), then by name
+  result = lodash.sortBy(result, [
+    (x) => !!x.locked,
+    (x) => categoryIndex(x.name),
+    'name',
+  ]);
   const msg = ctx.l.r('cli.cmd.queue.status.result', {
     queues: result,
   });

src/apps/chatwoot/cli/index.ts

@@ -17,6 +17,9 @@ export async function runText(
     .map((line) => line.trimStart()) // remove indentation
     .join(' ') // join with space
     .trim(); // final cleanup
+  // Strip WhatsApp/markdown formatting characters so shell-quote doesn't
+  // treat them as glob operators and return non-string tokens
+  text = text.replace(/[*_~`]/g, '');
   const output = new BufferedOutput();
   const program = BuildProgram(commands, ctx, output);
   const argv = parse(text);

src/apps/chatwoot/cli/utils/options.ts

@@ -6,7 +6,7 @@ import { Locale } from '@waha/apps/chatwoot/i18n/locale';
  * Parse human string into milliseconds
  */
 export function ParseMS(value: string) {
-  const duration = ms(value);
+  const duration = ms(value as ms.StringValue);
   if (duration == null) throw new Error(`Invalid duration: "${value}"`);
   if (duration < 0) throw new Error(`Duration cannot be negative: "${value}"`);
   return duration;

src/apps/chatwoot/client/ids.ts

@@ -2,7 +2,7 @@ import { AttributeKey, INBOX_CONTACT_CHAT_ID } from '@waha/apps/chatwoot/const';
 import * as lodash from 'lodash';
 import { WhatsAppMessage } from '@waha/apps/chatwoot/storage';
 import { buildMessageId } from '@waha/core/engines/noweb/session.noweb.core';
-import { isLidUser } from '@waha/core/utils/jids';
+import { isLidUser, normalizeJid } from '@waha/core/utils/jids';
 
 export function GetJID(contact: any): string | null {
   return contact?.custom_attributes?.[AttributeKey.WA_JID];
@@ -23,20 +23,13 @@ export function GetAllChatIDs(contact: any): Array<string> {
     attrs[AttributeKey.WA_JID],
     attrs[AttributeKey.WA_LID],
   ];
-  return lodash.uniq(ids.filter(Boolean));
+  return lodash.uniq(ids.filter(Boolean).map(normalizeJid));
 }
 
 export function FindChatID(contact: any): string | null {
-  if (GetChatID(contact)) {
-    return GetChatID(contact);
-  }
-  if (GetJID(contact)) {
-    return GetJID(contact);
-  }
-  if (GetLID(contact)) {
-    return GetLID(contact);
-  }
-  return null;
+  const chatId =
+    GetChatID(contact) ?? GetJID(contact) ?? GetLID(contact) ?? null;
+  return chatId ? normalizeJid(chatId) : null;
 }
 
 export function SerializeWhatsAppKey(message: WhatsAppMessage): string {

src/apps/chatwoot/consumers/QueueName.ts

@@ -4,6 +4,7 @@ export enum QueueName {
   //
   SCHEDULED_MESSAGE_CLEANUP = 'chatwoot.scheduled | message.cleanup',
   SCHEDULED_CHECK_VERSION = 'chatwoot.scheduled | check.version',
+  SCHEDULED_CHECK_TIER = 'chatwoot.scheduled | check.tier',
 
   //
   // Task

src/apps/chatwoot/consumers/inbox/message_created.ts

@@ -221,10 +221,23 @@ export class MessageHandler {
       mentions: mentions,
     };
     const session = this.session;
-    await session.readMessages(chatId);
-    await session.startTyping({ chatId: chatId, session: '' });
+    // Best effort - do not block sending on read-receipt failure
+    await session.readMessages(chatId).catch((err) => {
+      this.logger.warn(
+        `ChatWoot => WhatsApp: error reading messages in chat '${chatId}': ${err}`,
+      );
+    });
+    await session.startTyping({ chatId: chatId, session: '' }).catch((err) => {
+      this.logger.warn(
+        `ChatWoot => WhatsApp: error starting typing in chat '${chatId}': ${err}`,
+      );
+    });
     await sleep(2000);
-    await session.stopTyping({ chatId: chatId, session: '' });
+    await session.stopTyping({ chatId: chatId, session: '' }).catch((err) => {
+      this.logger.warn(
+        `ChatWoot => WhatsApp: error stopping typing in chat '${chatId}': ${err}`,
+      );
+    });
     const msg = await session.sendText(request);
     return msg;
   }

src/apps/chatwoot/consumers/scheduled/check.tier.ts

@@ -0,0 +1,42 @@
+import { Processor } from '@nestjs/bullmq';
+import { Injectable } from '@nestjs/common';
+import { JOB_CONCURRENCY } from '@waha/apps/app_sdk/constants';
+import { QueueName } from '@waha/apps/chatwoot/consumers/QueueName';
+import { DIContainer } from '@waha/apps/chatwoot/di/DIContainer';
+import { SessionManager } from '@waha/core/abc/manager.abc';
+import { SUPPORT_US_URL } from '@waha/core/constants';
+import { RMutexService } from '@waha/modules/rmutex/rmutex.service';
+import { VERSION, WAHAVersion } from '@waha/version';
+import { Job } from 'bullmq';
+import { PinoLogger } from 'nestjs-pino';
+
+import { TKey } from '@waha/apps/chatwoot/i18n/templates';
+import { ChatWootScheduledConsumer } from './base';
+
+@Processor(QueueName.SCHEDULED_CHECK_TIER, { concurrency: JOB_CONCURRENCY })
+export class CheckTierConsumer extends ChatWootScheduledConsumer {
+  constructor(manager: SessionManager, log: PinoLogger, rmutex: RMutexService) {
+    super(manager, log, rmutex, CheckTierConsumer.name);
+  }
+
+  protected ErrorHeaderKey(): TKey {
+    return TKey.JOB_SCHEDULED_ERROR_HEADER;
+  }
+
+  protected async Process(container: DIContainer, job: Job): Promise<any> {
+    const logger = container.Logger();
+    const locale = container.Locale();
+    const conversation = await container
+      .ContactConversationService()
+      .InboxNotifications();
+    if (VERSION.tier !== WAHAVersion.CORE) {
+      logger.info('WAHA is not using the CORE version');
+      return;
+    }
+    logger.info('WAHA is using the CORE version');
+    const supportMessage = locale.key(TKey.WAHA_CORE_VERSION_USED).render({
+      supportUrl: SUPPORT_US_URL,
+    });
+    await conversation.incoming(supportMessage);
+  }
+}

src/apps/chatwoot/consumers/scheduled/check.version.ts

@@ -1,24 +1,19 @@
 import { Processor } from '@nestjs/bullmq';
-import { Injectable } from '@nestjs/common';
 import { JOB_CONCURRENCY } from '@waha/apps/app_sdk/constants';
 import { ILogger } from '@waha/apps/app_sdk/ILogger';
 import { QueueName } from '@waha/apps/chatwoot/consumers/QueueName';
 import { DIContainer } from '@waha/apps/chatwoot/di/DIContainer';
 import { SessionManager } from '@waha/core/abc/manager.abc';
-import { CHANGELOG_URL, SUPPORT_US_URL } from '@waha/core/constants';
+import { CHANGELOG_URL } from '@waha/core/constants';
 import { RMutexService } from '@waha/modules/rmutex/rmutex.service';
-import { VERSION, WAHAVersion } from '@waha/version';
+import { VERSION } from '@waha/version';
 import axios from 'axios';
 import { Job } from 'bullmq';
 import { PinoLogger } from 'nestjs-pino';
 
-import { ChatWootScheduledConsumer } from './base';
 import { TKey } from '@waha/apps/chatwoot/i18n/templates';
+import { ChatWootScheduledConsumer } from './base';
 
-/**
- * Scheduled consumer for version checking
- * Periodically checks for new versions and notifies if updates are available
- */
 @Processor(QueueName.SCHEDULED_CHECK_VERSION, { concurrency: JOB_CONCURRENCY })
 export class CheckVersionConsumer extends ChatWootScheduledConsumer {
   constructor(manager: SessionManager, log: PinoLogger, rmutex: RMutexService) {
@@ -29,34 +24,7 @@ export class CheckVersionConsumer extends ChatWootScheduledConsumer {
     return TKey.JOB_SCHEDULED_ERROR_HEADER;
   }
 
-  /**
-   * Process the version check job
-   * Checks for new versions and notifies if updates are available
-   */
   protected async Process(container: DIContainer, job: Job): Promise<any> {
-    await this.CheckWAHACoreVersion(container);
-    await this.CheckNewVersionAvailable(container);
-  }
-
-  private async CheckWAHACoreVersion(container: DIContainer) {
-    const logger = container.Logger();
-    const locale = container.Locale();
-    const conversation = await container
-      .ContactConversationService()
-      .InboxNotifications();
-    // If using the CORE version, send a message encouraging support
-    if (VERSION.tier !== WAHAVersion.CORE) {
-      logger.info('WAHA is not using the CORE version');
-      return;
-    }
-    logger.info('WAHA is using the CORE version');
-    const supportMessage = locale.key(TKey.WAHA_CORE_VERSION_USED).render({
-      supportUrl: SUPPORT_US_URL,
-    });
-    await conversation.incoming(supportMessage);
-  }
-
-  private async CheckNewVersionAvailable(container: DIContainer) {
     const logger = container.Logger();
     logger.info('Processing version check job');
     const currentVersion = VERSION.version;
@@ -72,7 +40,6 @@ export class CheckVersionConsumer extends ChatWootScheduledConsumer {
       `New version available: ${latestVersion} (current: ${currentVersion})`,
     );
 
-    // Send a message to Chatwoot conversation about a new version
     const locale = container.Locale();
     const message = locale.key(TKey.WAHA_NEW_VERSION_AVAILABLE).render({
       currentVersion: currentVersion,

src/apps/chatwoot/consumers/task/messages.pull.ts

@@ -212,7 +212,11 @@ class MessagesPullHandler {
 
     // Perform some actions before any job started
     if (options.pause) {
-      await this.queueManager.pause();
+      const queues = [
+        ...this.queueManager.resolve('inbox'),
+        ...this.queueManager.resolve('waha'),
+      ];
+      await this.queueManager.pause(queues);
       await this.activity.queue(true);
     }
   }
@@ -228,7 +232,11 @@ class MessagesPullHandler {
 
     // Resume queues if paused
     if (options.pause) {
-      await this.queueManager.resume();
+      const queues = [
+        ...this.queueManager.resolve('inbox'),
+        ...this.queueManager.resolve('waha'),
+      ];
+      await this.queueManager.resume(queues);
       await this.activity.queue(false);
     }
     // Progress summary

src/apps/chatwoot/consumers/utils.ts

@@ -0,0 +1,13 @@
+export function clearContent(attachments) {
+  /**
+   * Remove actual base64 "content" from attachment
+   */
+  if (!attachments) {
+    return attachments;
+  }
+  return attachments.map((attachment) => {
+    attachment = { ...attachment };
+    attachment.content = '';
+    return attachment;
+  });
+}

src/apps/chatwoot/consumers/waha/base.ts

@@ -39,6 +39,7 @@ import {
   ChatWootAppConfig,
   ChatWootConfig,
 } from '@waha/apps/chatwoot/dto/config.dto';
+import { clearContent } from '@waha/apps/chatwoot/consumers/utils';
 
 export function ListenEventsForChatWoot(config: ChatWootConfig) {
   const events = [
@@ -319,6 +320,7 @@ export abstract class MessageBaseHandler<
       this.session,
       EngineHelper.ChatID(payload as any),
       this.l,
+      EngineHelper.PhoneNumber(payload as any),
     );
     const conversation = await this.repo.ConversationByContact(contactInfo);
     this.info.onConversationId(conversation.conversationId);
@@ -329,6 +331,8 @@ export abstract class MessageBaseHandler<
       `Created message as '${message.message_type}' from WhatsApp: ${response.id}`,
     );
     await this.saveMapping(response, payload);
+    // Clear attachments content to avoid saving it in the task result
+    message.attachments = clearContent(message.attachments);
     return message;
   }
 
@@ -347,7 +351,7 @@ export abstract class MessageBaseHandler<
       chat_id: toCusFormat(key.remoteJid),
       message_id: key.id,
       from_me: key.fromMe,
-      participant: null,
+      participant: isJidGroup(key.remoteJid) ? key.participant : null,
     };
     await this.mappingService.map(chatwoot, whatsapp, 1);
     return;

src/apps/chatwoot/consumers/waha/message.any.ts

@@ -26,6 +26,7 @@ import {
   PollMessage,
   ListMessage,
   ShareContactMessage,
+  StatusReplyMessage,
   TextMessage,
   UnsupportedMessage,
   AlbumMessage,
@@ -86,6 +87,18 @@ export class MessageAnyHandler extends MessageBaseHandler<WAMessage> {
       return msg;
     }
 
+    converter = new StatusReplyMessage(
+      this.l,
+      this.logger,
+      this.waha,
+      this.job,
+      this.session,
+    );
+    msg = await converter.convert(payload, protoMessage);
+    if (msg) {
+      return msg;
+    }
+
     converter = new TextMessage(this.l, this.logger, this.waha, this.job);
     msg = await converter.convert(payload, null);
     if (msg) {

src/apps/chatwoot/consumers/waha/message.reaction.ts

@@ -32,7 +32,10 @@ export class WAHAMessageReactionConsumer extends ChatWootWAHABaseConsumer {
   }
 
   GetChatId(event: WAHAWebhookMessageReaction): string {
-    if (event.environment?.engine == WAHAEngine.WEBJS) {
+    if (
+      event.environment?.engine == WAHAEngine.WEBJS ||
+      event.environment?.engine == WAHAEngine.WPP
+    ) {
       // chat in "to" field for WEBJS for message.reaction
       // probably we need to set it to "from"
       // but for backward compatability we do this

src/apps/chatwoot/contacts/WhatsAppContactInfo.ts

@@ -13,6 +13,7 @@ import {
   isJidStatusBroadcast,
   isLidUser,
   isPnUser,
+  normalizeJid,
 } from '@waha/core/utils/jids';
 import { UnknownJIDFormat } from '@waha/apps/chatwoot/errors';
 import { E164Parser } from '@waha/core/utils/PhoneJidNormalizer';
@@ -88,9 +89,21 @@ class JidContactInfo extends ChatContactInfo {
  * LID contact info
  */
 class LidContactInfo extends ChatContactInfo {
+  constructor(
+    session: WAHASessionAPI,
+    chatId: string,
+    locale: Locale,
+    private pn: string | null = null,
+  ) {
+    super(session, chatId, locale);
+  }
+
   @CacheAsync()
   async jid() {
-    const pn = await this.session.findPNByLid(this.chatId);
+    let pn = this.pn;
+    if (!pn) {
+      pn = await this.session.findPNByLid(this.chatId);
+    }
     if (!pn) {
       return null;
     }
@@ -260,6 +273,7 @@ export function WhatsAppContactInfo(
   session: WAHASessionAPI,
   chatId: string,
   locale: Locale,
+  pn: string | null = null,
 ): ContactInfo {
   if (isJidGroup(chatId)) {
     return new GroupContactInfo(session, chatId, locale);
@@ -270,7 +284,7 @@ export function WhatsAppContactInfo(
   } else if (isJidBroadcast(chatId)) {
     return new BroadcastContactInfo(session, chatId, locale);
   } else if (isLidUser(chatId)) {
-    return new LidContactInfo(session, chatId, locale);
+    return new LidContactInfo(session, normalizeJid(chatId), locale, pn);
   } else if (isPnUser(chatId)) {
     return new JidContactInfo(session, chatId, locale);
   } else {

src/apps/chatwoot/di/DIContainer.ts

@@ -30,6 +30,7 @@ import {
   ConversationSelector,
   ConversationSort,
 } from '@waha/apps/chatwoot/services/ConversationSelector';
+import { Auth } from '@waha/core/auth/config';
 
 /**
  * Dependency Injection Container for ChatWoot
@@ -194,7 +195,7 @@ export class DIContainer {
    */
   @CacheSync()
   public WAHASelf(): WAHASelf {
-    const self = new WAHASelf();
+    const self = new WAHASelf(Auth.keyplain.value);
     const logging = new AxiosLogging(this.Logger());
     logging.applyTo(self.client);
     return self;

src/apps/chatwoot/i18n/locales/ar-AE.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 تحقق مما هو جديد في [**🆕 سجل التغييرات**]({{{changelogUrl}}})
 
+  _لإيقاف هذه الإشعارات، أرسل_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **ادعم WAHA!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **تم إرسال PIX نسخ ولصق**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **رد على حالة واتساب**
+  🏷️ **النوع:** {{type}}
+  {{#quotedText}}
+  📝 **نص الحالة:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **هذا النوع من الرسائل غير مدعوم في هذا الصندوق الوارد.**
   📱 يرجى فتح **WhatsApp** لعرضه.

src/apps/chatwoot/i18n/locales/bn-BD.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 [**🆕 পরিবর্তন লগ**]({{{changelogUrl}}}) এ নতুন কি আছে তা দেখুন
 
+  _এই বিজ্ঞপ্তিগুলি অক্ষম করতে, পাঠান_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **WAHA সমর্থন করুন!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX কপি এবং পেস্ট পাঠানো হয়েছে**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **WhatsApp স্ট্যাটাসের জবাব**
+  🏷️ **ধরন:** {{type}}
+  {{#quotedText}}
+  📝 **স্ট্যাটাসের টেক্সট:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **এই ধরনের বার্তা এই ইনবক্সে সমর্থিত নয়।**
   📱 এটি দেখতে অনুগ্রহ করে **WhatsApp** খুলুন।

src/apps/chatwoot/i18n/locales/de-DE.yaml

@@ -328,6 +328,8 @@ waha.new.version.available: |-
 
   👉 Sehen Sie, was neu ist im [**🆕 Änderungsprotokoll**]({{{changelogUrl}}})
 
+  _Um diese Benachrichtigungen zu deaktivieren, senden Sie_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **Unterstützen Sie WAHA!**
 
@@ -490,6 +492,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX Kopieren und Einfügen gesendet**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **Antwort auf WhatsApp-Status**
+  🏷️ **Typ:** {{type}}
+  {{#quotedText}}
+  📝 **Status-Text:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **Dieser Nachrichtentyp wird in dieser Inbox nicht unterstützt.**
   📱 Bitte öffne **WhatsApp**, um ihn anzusehen.

src/apps/chatwoot/i18n/locales/en-US.yaml

@@ -268,6 +268,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX Copy and Paste sent**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **Reply to WhatsApp Status**
+  🏷️ **Type:** {{type}}
+  {{#quotedText}}
+  📝 **Status Text:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.has.media.no.media: |-
   {{#content}}
   {{{content}}}
@@ -705,6 +714,8 @@ waha.new.version.available: |-
 
   👉 Check out what's new in the [**🆕 Changelog**]({{{changelogUrl}}})
 
+  _To disable these notifications, send_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **Support WAHA!**
 

src/apps/chatwoot/i18n/locales/es-ES.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 Mira qué hay de nuevo en el [**🆕 Registro de Cambios**]({{{changelogUrl}}})
 
+  _Para desactivar estas notificaciones, envía_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **¡Apoya a WAHA!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX Copiar y Pegar enviado**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **Respuesta al estado de WhatsApp**
+  🏷️ **Tipo:** {{type}}
+  {{#quotedText}}
+  📝 **Texto del Estado:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **Este tipo de mensaje no es compatible con esta bandeja de entrada.**
   📱 Por favor, abre **WhatsApp** para verlo.

src/apps/chatwoot/i18n/locales/fa-IR.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 موارد جدید را در [**🆕 تغییرات**]({{{changelogUrl}}}) مشاهده کنید
 
+  _برای غیرفعال کردن این اعلان‌ها، ارسال کنید_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **از WAHA پشتیبانی کنید!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX کپی و چسباندن ارسال شد**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **پاسخ به وضعیت واتساپ**
+  🏷️ **نوع:** {{type}}
+  {{#quotedText}}
+  📝 **متن وضعیت:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **این نوع پیام در این صندوق ورودی پشتیبانی نمی‌شود.**
   📱 لطفاً برای مشاهده آن **WhatsApp** را باز کنید.

src/apps/chatwoot/i18n/locales/fr-FR.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 Découvrez les nouveautés dans le [**🆕 Journal des modifications**]({{{changelogUrl}}})
 
+  _Pour désactiver ces notifications, envoyez_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **Soutenez WAHA !**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX Copier et Coller envoyé**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **Réponse au statut WhatsApp**
+  🏷️ **Type :** {{type}}
+  {{#quotedText}}
+  📝 **Texte du Statut :** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **Ce type de message n’est pas pris en charge dans cette boîte de réception.**
   📱 Veuillez ouvrir **WhatsApp** pour l’afficher.

src/apps/chatwoot/i18n/locales/he-IL.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 בדוק מה חדש ב[**🆕 יומן שינויים**]({{{changelogUrl}}})
 
+  _כדי לבטל התראות אלו, שלח_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **תמוך ב-WAHA!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX העתק והדבק נשלח**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **תגובה לסטטוס ב-WhatsApp**
+  🏷️ **סוג:** {{type}}
+  {{#quotedText}}
+  📝 **טקסט הסטטוס:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **סוג הודעה זה אינו נתמך בתיבה זו.**
   📱 אנא פתח/י את **WhatsApp** כדי לצפות בזה.

src/apps/chatwoot/i18n/locales/hi-IN.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 [**🆕 चेंजलॉग**]({{{changelogUrl}}}) में क्या नया है देखें
 
+  _इन सूचनाओं को अक्षम करने के लिए, भेजें_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **WAHA का समर्थन करें!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX कॉपी और पेस्ट भेजा गया**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **WhatsApp स्टेटस का जवाब**
+  🏷️ **प्रकार:** {{type}}
+  {{#quotedText}}
+  📝 **स्टेटस टेक्स्ट:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **इस प्रकार का संदेश इस इनबॉक्स में समर्थित नहीं है।**
   📱 इसे देखने के लिए कृपया **WhatsApp** खोलें।

src/apps/chatwoot/i18n/locales/id-ID.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 Lihat apa yang baru di [**🆕 Changelog**]({{{changelogUrl}}})
 
+  _Untuk menonaktifkan notifikasi ini, kirim_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **Dukung WAHA!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX Salin dan Tempel terkirim**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **Balasan ke Status WhatsApp**
+  🏷️ **Tipe:** {{type}}
+  {{#quotedText}}
+  📝 **Teks Status:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **Jenis pesan ini tidak didukung di kotak masuk ini.**
   📱 Silakan buka **WhatsApp** untuk melihatnya.

src/apps/chatwoot/i18n/locales/it-IT.yaml

@@ -268,6 +268,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX Copia e Incolla inviato**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **Risposta allo stato di WhatsApp**
+  🏷️ **Tipo:** {{type}}
+  {{#quotedText}}
+  📝 **Testo dello Stato:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.has.media.no.media: |-
   {{#content}}
   {{{content}}}
@@ -705,6 +714,8 @@ waha.new.version.available: |-
 
   👉 Scopri le novità nel [**🆕 Changelog**]({{{changelogUrl}}})
 
+  _Per disattivare queste notifiche, invia_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **Supporta WAHA!**
 

src/apps/chatwoot/i18n/locales/pa-PK.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 [**🆕 ਬਦਲਾਅ ਲੌਗ**]({{{changelogUrl}}}) ਵਿੱਚ ਨਵਾਂ ਕੀ ਹੈ ਦੇਖੋ
 
+  _ਇਹ ਸੂਚਨਾਵਾਂ ਬੰਦ ਕਰਨ ਲਈ, ਭੇਜੋ_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **WAHA ਦਾ ਸਮਰਥਨ ਕਰੋ!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX ਕਾਪੀ ਅਤੇ ਪੇਸਟ ਭੇਜਿਆ ਗਿਆ**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **WhatsApp ਸਟੇਟਸ ਦਾ ਜਵਾਬ**
+  🏷️ **ਕਿਸਮ:** {{type}}
+  {{#quotedText}}
+  📝 **ਸਟੇਟਸ ਲਿਖਤ:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **ਇਹ ਸੁਨੇਹੇ ਦੀ ਕਿਸਮ ਇਸ ਇਨਬਾਕਸ ਵਿੱਚ ਸਮਰਥਿਤ ਨਹੀਂ ਹੈ।**
   📱 ਇਸਨੂੰ ਦੇਖਣ ਲਈ ਕਿਰਪਾ ਕਰਕੇ **WhatsApp** ਖੋਲ੍ਹੋ।

src/apps/chatwoot/i18n/locales/pt-BR.yaml

@@ -326,6 +326,8 @@ waha.new.version.available: |-
 
   👉 Confira o que há de novo no [**🆕 Registro de Alterações**]({{{changelogUrl}}})
 
+  _Para desativar essas notificações, envie_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **Apoie o WAHA!**
 
@@ -492,6 +494,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX Copia e Cola enviado**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **Resposta a Status do WhatsApp**
+  🏷️ **Tipo:** {{type}}
+  {{#quotedText}}
+  📝 **Texto do Status:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **Esse tipo de mensagem não é suportado nesta caixa de entrada.**
   📱 Por favor, abra o **WhatsApp** para visualizá-la.

src/apps/chatwoot/i18n/locales/ru-RU.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 Узнайте, что нового в [**🆕 Списке изменений**]({{{changelogUrl}}})
 
+  _Чтобы отключить эти уведомления, отправьте_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **Поддержите WAHA!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX Копировать и вставить отправлен**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **Ответ на статус WhatsApp**
+  🏷️ **Тип:** {{type}}
+  {{#quotedText}}
+  📝 **Текст Статуса:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **Этот тип сообщения не поддерживается в этом Inbox.**
   📱 Пожалуйста, откройте **WhatsApp**, чтобы просмотреть.

src/apps/chatwoot/i18n/locales/tr-TR.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 [**🆕 Değişiklik Günlüğü**]({{{changelogUrl}}}) içinde yenilikleri kontrol edin
 
+  _Bu bildirimleri devre dışı bırakmak için gönderin_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **WAHA'yı Destekleyin!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX Kopyala ve Yapıştır gönderildi**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **WhatsApp Durumuna Yanıt**
+  🏷️ **Tür:** {{type}}
+  {{#quotedText}}
+  📝 **Durum Metni:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **Bu mesaj türü bu gelen kutusunda desteklenmiyor.**
   📱 Görüntülemek için lütfen **WhatsApp’ı** açın.

src/apps/chatwoot/i18n/locales/uk-UA.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 Перевірте, що нового у [**🆕 Журналі змін**]({{{changelogUrl}}})
 
+  _Щоб вимкнути ці сповіщення, надішліть_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **Підтримайте WAHA!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX Копіювати та Вставити надіслано**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **Відповідь на статус WhatsApp**
+  🏷️ **Тип:** {{type}}
+  {{#quotedText}}
+  📝 **Текст Статусу:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **Цей тип повідомлення не підтримується в цих вхідних.**
   📱 Будь ласка, відкрийте **WhatsApp**, щоб переглянути.

src/apps/chatwoot/i18n/locales/ur-PK.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 [**🆕 تبدیلیوں کی فہرست**]({{{changelogUrl}}}) میں نیا کیا ہے دیکھیں
 
+  _ان اطلاعات کو بند کرنے کے لیے بھیجیں_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **WAHA کی حمایت کریں!**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX کاپی اور پیسٹ بھیج دیا گیا**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **WhatsApp اسٹیٹس کا جواب**
+  🏷️ **قسم:** {{type}}
+  {{#quotedText}}
+  📝 **اسٹیٹس کا متن:** {{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **اس قسم کا پیغام اس انبکس میں معاونت یافتہ نہیں ہے۔**
   📱 اسے دیکھنے کے لیے براہ کرم **WhatsApp** کھولیں۔

src/apps/chatwoot/i18n/locales/zh-CN.yaml

@@ -325,6 +325,8 @@ waha.new.version.available: |-
 
   👉 查看[**🆕 更新日志**]({{{changelogUrl}}})
 
+  _要禁用这些通知，请发送_ `queue stop check.version`
+
 waha.core.version.used: |-
   ❤️ **支持 WAHA！**
 
@@ -487,6 +489,15 @@ whatsapp.to.chatwoot.message.pix: |-
   💳 **PIX 复制粘贴已发送**
   {{/pixData}}
 
+whatsapp.to.chatwoot.message.status.reply: |-
+  📣 **回复 WhatsApp 状态**
+  🏷️ **类型：**{{type}}
+  {{#quotedText}}
+  📝 **状态文本：**{{quotedText}}
+  {{/quotedText}}
+
+  {{content}}
+
 whatsapp.to.chatwoot.message.unsupported: |-
   ⚠️ **此收件箱不支持此消息类型。**
   📱 请打开 **WhatsApp** 查看。

src/apps/chatwoot/i18n/templates.ts

@@ -54,6 +54,7 @@ export enum TKey {
   WA_TO_CW_MESSAGE_POLL = 'whatsapp.to.chatwoot.message.poll',
   WA_TO_CW_MESSAGE_EVENT = 'whatsapp.to.chatwoot.message.event',
   WA_TO_CW_MESSAGE_PIX = 'whatsapp.to.chatwoot.message.pix',
+  WA_TO_CW_MESSAGE_STATUS_REPLY = 'whatsapp.to.chatwoot.message.status.reply',
   WA_TO_CW_MESSAGE_UNSUPPORTED = 'whatsapp.to.chatwoot.message.unsupported',
   WA_TO_CW_MESSAGE_FACEBOOK_AD = 'whatsapp.to.chatwoot.message.facebook.ad',
   WA_TO_CW_MESSAGE_LIST = 'whatsapp.to.chatwoot.message.list',
@@ -189,6 +190,11 @@ export type TemplatePayloads = {
     message: proto.Message | null;
     pixData: PixTemplatePayload;
   };
+  [TKey.WA_TO_CW_MESSAGE_STATUS_REPLY]: {
+    type: string;
+    quotedText?: string;
+    content: string;
+  };
   [TKey.WA_TO_CW_MESSAGE_UNSUPPORTED]: { details: Link };
   [TKey.WA_TO_CW_MESSAGE_FACEBOOK_AD]: {
     payload: WAMessage;

src/apps/chatwoot/messages/to/chatwoot/StatusReplyMessage.ts

@@ -0,0 +1,231 @@
+import type { proto } from '@adiwajshing/baileys';
+import { ILogger } from '@waha/apps/app_sdk/ILogger';
+import { WAHASelf, WAHASessionAPI } from '@waha/apps/app_sdk/waha/WAHASelf';
+import { ChatWootMessagePartial } from '@waha/apps/chatwoot/consumers/waha/base';
+import { Locale } from '@waha/apps/chatwoot/i18n/locale';
+import { TKey } from '@waha/apps/chatwoot/i18n/templates';
+import { WhatsappToMarkdown } from '@waha/apps/chatwoot/messages/to/chatwoot/utils/markdown';
+import { EngineHelper, QuotedMedia } from '@waha/apps/chatwoot/waha';
+import { Jid } from '@waha/core/engines/const';
+import { WAMessage } from '@waha/structures/responses.dto';
+import { Job } from 'bullmq';
+import { TextMessage } from './TextMessage';
+import { isEmptyString } from './utils/text';
+import { SendAttachment } from '@waha/apps/chatwoot/client/types';
+import esm from '@waha/vendor/esm';
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const mime = require('mime-types');
+
+type StatusReplyType = 'text' | 'image' | 'audio' | 'video' | 'unknown';
+
+interface StatusQuotedMessageInfo {
+  data?: any;
+  id: string;
+  type: StatusReplyType;
+  text?: string;
+}
+
+export class StatusReplyMessage extends TextMessage {
+  constructor(
+    locale: Locale,
+    logger: ILogger,
+    waha: WAHASelf,
+    job: Job,
+    private readonly session: WAHASessionAPI,
+  ) {
+    super(locale, logger, waha, job);
+  }
+
+  async convert(
+    payload: WAMessage,
+    protoMessage: proto.Message | null,
+  ): Promise<ChatWootMessagePartial | null> {
+    if (!payload.replyTo?.id) {
+      return null;
+    }
+    if (!EngineHelper.IsReplyToStatus(payload, protoMessage)) {
+      return null;
+    }
+
+    let attachments: SendAttachment[] = [];
+    const quoted = this.getStatusQuotedMessageInfo(payload);
+    let wamessage = null; // aka "quoted from store"
+
+    // Media - Use provided replyTo.media if present
+    if (attachments.length === 0 && payload.replyTo.media) {
+      const extension = mime.extension(payload.replyTo.media.mimetype);
+      payload.replyTo.media.filename = `status-message.${extension}`;
+      const quotedAttachments = await super.getAttachments(payload.replyTo);
+      attachments = [...attachments, ...quotedAttachments];
+    }
+
+    // Media - fetch message by id from store and use it's "media"
+    if (attachments.length == 0) {
+      wamessage = await this.fetchStatusMessage(quoted.id);
+      if (wamessage?.media?.url) {
+        const extension = mime.extension(wamessage.media.mimetype);
+        wamessage.media.filename = `status-message.${extension}`;
+        const quotedAttachments = await super.getAttachments(wamessage);
+        attachments = [...attachments, ...quotedAttachments];
+      }
+    }
+
+    // Media - get media url, key and try to decrypt it
+    if (attachments.length == 0) {
+      const replyData = payload.replyTo._data;
+      const quotedMedia = EngineHelper.ExtractQuotedMedia(replyData);
+      if (quotedMedia) {
+        const attachment =
+          await this.downloadQuotedMediaAttachment(quotedMedia);
+        if (attachment) {
+          attachments.push(attachment);
+        }
+      }
+    }
+
+    // Act as regular text message, but we'll adjust some properties
+    const msg = await super.convert(payload, protoMessage);
+    // First goes Quoted attachments, then what sender sent
+    msg.attachments = [...attachments, ...msg.attachments];
+
+    // Wrap content with additional info
+    const quotedText = quoted.text ?? wamessage?.body ?? payload.replyTo?.body;
+    if (
+      isEmptyString(quotedText) &&
+      isEmptyString(msg.content) &&
+      attachments.length === 0
+    ) {
+      // Nothing to send.
+      // Must check msg.content before wrapping it in status reply
+      return null;
+    }
+
+    msg.content = this.locale.r(TKey.WA_TO_CW_MESSAGE_STATUS_REPLY, {
+      type: quoted.type,
+      quotedText: WhatsappToMarkdown(quotedText),
+      content: msg.content,
+    });
+    return msg;
+  }
+
+  private getStatusQuotedMessageInfo(
+    payload: WAMessage,
+  ): StatusQuotedMessageInfo {
+    const replyData = payload.replyTo._data;
+    const imageMessage =
+      replyData?.imageMessage || this.getWebjsMediaData(replyData, 'image');
+    if (imageMessage) {
+      return {
+        data: replyData,
+        id: payload.replyTo.id,
+        type: 'image',
+        text: imageMessage.caption ?? payload.replyTo.body ?? replyData?.body,
+      };
+    }
+
+    const videoMessage =
+      replyData?.videoMessage || this.getWebjsMediaData(replyData, 'video');
+    if (videoMessage) {
+      return {
+        data: replyData,
+        id: payload.replyTo.id,
+        type: 'video',
+        text: videoMessage.caption ?? payload.replyTo.body ?? replyData?.body,
+      };
+    }
+
+    const audioMessage =
+      replyData?.audioMessage || this.getWebjsMediaData(replyData, 'audio');
+    if (audioMessage) {
+      return {
+        data: replyData,
+        id: payload.replyTo.id,
+        type: 'audio',
+        text: audioMessage.caption ?? payload.replyTo.body ?? replyData?.body,
+      };
+    }
+
+    const quotedText =
+      replyData?.extendedTextMessage?.text ??
+      replyData?.conversation ??
+      payload.replyTo.body ??
+      replyData?.body;
+    return {
+      data: replyData,
+      id: payload.replyTo.id,
+      type: quotedText ? 'text' : 'unknown',
+      text: quotedText,
+    };
+  }
+
+  private getWebjsMediaData(
+    replyData: any,
+    expectedKind: 'image' | 'video' | 'audio',
+  ): any | null {
+    if (!replyData) {
+      return null;
+    }
+    const kind = replyData.kind ?? replyData.type;
+    if (kind !== expectedKind) {
+      return null;
+    }
+    return replyData;
+  }
+
+  private async downloadQuotedMediaAttachment(
+    quotedMedia: QuotedMedia,
+  ): Promise<SendAttachment | null> {
+    try {
+      const decrypt = !!quotedMedia.mediaKey;
+      const mediaKeyBuffer = decrypt
+        ? Buffer.from(quotedMedia.mediaKey, 'base64')
+        : undefined;
+      const stream = await esm.b.downloadContentFromMessage(
+        {
+          mediaKey: mediaKeyBuffer,
+          directPath: quotedMedia.directPath,
+          url: quotedMedia.url,
+        },
+        quotedMedia.mediaType as any,
+        {},
+        decrypt,
+      );
+      const chunks: Buffer[] = [];
+      for await (const chunk of stream) {
+        chunks.push(chunk);
+      }
+      const buffer = Buffer.concat(chunks);
+      const extension = mime.extension(quotedMedia.mimetype);
+      const filename = `status-message.${extension}`;
+      return {
+        content: buffer.toString('base64'),
+        filename: filename,
+        encoding: 'base64',
+      };
+    } catch (error) {
+      this.logger.warn('Failed to download quoted status media directly');
+      this.logger.debug(error);
+      return null;
+    }
+  }
+
+  private async fetchStatusMessage(
+    replyMessageId: string,
+  ): Promise<WAMessage | null> {
+    try {
+      const quotedMessage = await this.session.getMessageById(
+        Jid.BROADCAST,
+        replyMessageId,
+        true,
+      );
+      return quotedMessage || null;
+    } catch (error) {
+      this.logger.warn(
+        `Failed to fetch original status message '${replyMessageId}'`,
+      );
+      this.logger.debug(error);
+      return null;
+    }
+  }
+}

src/apps/chatwoot/messages/to/chatwoot/TextMessage.ts

@@ -11,16 +11,17 @@ import { MessageToChatWootConverter } from '@waha/apps/chatwoot/messages/to/chat
 import { WhatsappToMarkdown } from '@waha/apps/chatwoot/messages/to/chatwoot/utils/markdown';
 import { JobLink } from '@waha/apps/app_sdk/JobUtils';
 import { Job } from 'bullmq';
+import { WAMedia } from '@waha/structures/media.dto';
 
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const mime = require('mime-types');
 
 export class TextMessage implements MessageToChatWootConverter {
   constructor(
-    private readonly locale: Locale,
-    private readonly logger: ILogger,
-    private readonly waha: WAHASelf,
-    private readonly job: Job,
+    protected readonly locale: Locale,
+    protected readonly logger: ILogger,
+    protected readonly waha: WAHASelf,
+    protected readonly job: Job,
   ) {}
 
   async convert(
@@ -52,12 +53,14 @@ export class TextMessage implements MessageToChatWootConverter {
     }
     return {
       content: WhatsappToMarkdown(content),
-      attachments,
+      attachments: attachments,
       private: undefined,
     };
   }
 
-  private async getAttachments(payload: WAMessage): Promise<SendAttachment[]> {
+  protected async getAttachments(payload: {
+    media?: WAMedia;
+  }): Promise<SendAttachment[]> {
     const hasMedia = payload.media?.url;
     if (!hasMedia) {
       return [];

src/apps/chatwoot/messages/to/chatwoot/index.ts

@@ -13,6 +13,7 @@ export { EventMessage } from './EventMessage';
 export { PixMessage } from './PixMessage';
 export { ListMessage } from './ListMessage';
 export { AlbumMessage } from './AlbumMessage';
+export { StatusReplyMessage } from './StatusReplyMessage';
 
 export type Awaitable<T> = T | Promise<T>;
 

src/apps/chatwoot/messages/to/whatsapp/markdown.test.ts

@@ -15,6 +15,14 @@ describe('MarkdownToWhatsApp', () => {
     expect(MarkdownToWhatsApp(input)).toBe(expected);
   });
 
+  // ChatWoot v4.10.1+ escapes newlines with trailing backslash
+  it('strips trailing backslash before newlines', () => {
+    const input = 'Hi \\\ntext message \\\nwith line \\\nbreak';
+    expect(MarkdownToWhatsApp(input)).toBe(
+      'Hi \ntext message \nwith line \nbreak',
+    );
+  });
+
   // Tests for URL protection
   it('preserves URLs with multiple underscores', () => {
     const input = 'https://example.com/page__name__test';

src/apps/chatwoot/messages/to/whatsapp/markdown.ts

@@ -4,6 +4,8 @@ export function MarkdownToWhatsApp(text: string): string {
   }
   return (
     text
+      // Remove trailing backslash before newlines (ChatWoot v4.10.1+ escaping)
+      .replace(/\\\n/g, '\n')
       // Triple-backtick blocks → WhatsApp monospace blocks (same syntax)
       .replace(/```([\s\S]*?)```/g, '```$1```')
       // Italic **first**, but only single‐star or single‐underscore

src/apps/chatwoot/services/ChatWootAppService.ts

@@ -6,6 +6,7 @@ import { ChatWootAppConfig } from '@waha/apps/chatwoot/dto/config.dto';
 import { ChatWootScheduleService } from '@waha/apps/chatwoot/services/ChatWootScheduleService';
 import { ChatWootWAHAQueueService } from '@waha/apps/chatwoot/services/ChatWootWAHAQueueService';
 import { App } from '@waha/apps/chatwoot/storage';
+import { SessionManager } from '@waha/core/abc/manager.abc';
 import { WhatsappSession } from '@waha/core/abc/session.abc';
 import { InjectPinoLogger, PinoLogger } from 'nestjs-pino';
 
@@ -38,27 +39,31 @@ export class ChatWootAppService implements IAppService {
   }
 
   async beforeEnabled(
+    manager: SessionManager,
     savedApp: App<ChatWootAppConfig>,
     newApp: App<ChatWootAppConfig>,
   ): Promise<void> {
+    void manager;
     // Enabling -> behave like created
     await this.beforeCreated(newApp);
-    return;
   }
 
   async beforeDisabled(
+    manager: SessionManager,
     savedApp: App<ChatWootAppConfig>,
     newApp: App<ChatWootAppConfig>,
   ): Promise<void> {
+    void manager;
     // Disabling -> behave like deleted
-    await this.beforeDeleted(savedApp);
-    return;
+    await this.beforeDeleted(manager, savedApp);
   }
 
   async beforeUpdated(
+    manager: SessionManager,
     savedApp: App<ChatWootAppConfig>,
     newApp: App<ChatWootAppConfig>,
   ) {
+    void manager;
     const isTheSameUrl = savedApp.config.url === newApp.config.url;
     const isTheSameInboxId = savedApp.config.inboxId === newApp.config.inboxId;
     const isTheSameInbox = isTheSameUrl && isTheSameInboxId;
@@ -76,7 +81,11 @@ export class ChatWootAppService implements IAppService {
     }
   }
 
-  async beforeDeleted(app: App<ChatWootAppConfig>): Promise<void> {
+  async beforeDeleted(
+    manager: SessionManager,
+    app: App<ChatWootAppConfig>,
+  ): Promise<void> {
+    void manager;
     await this.chatWootScheduleService.unschedule(app.id, app.session);
     this.cleanCache(app);
     this.sendDisconnectedMessage(app).catch((err) => {
@@ -86,6 +95,30 @@ export class ChatWootAppService implements IAppService {
     });
   }
 
+  async afterCreated(
+    manager: SessionManager,
+    app: App<ChatWootAppConfig>,
+  ): Promise<void> {
+    void manager;
+    void app;
+  }
+
+  async beforeSessionDeleted(
+    manager: SessionManager,
+    app: App<ChatWootAppConfig>,
+  ): Promise<void> {
+    void manager;
+    void app;
+  }
+
+  async enrich(
+    manager: SessionManager,
+    app: App<ChatWootAppConfig>,
+  ): Promise<void> {
+    void manager;
+    void app;
+  }
+
   private async sendConnectedMessage(app: App<ChatWootAppConfig>) {
     const di = new DIContainer(0, app.config, this.logger, null);
     const repo = di.ContactConversationService();

src/apps/chatwoot/services/ChatWootScheduleService.ts

@@ -54,6 +54,21 @@ export class ChatWootScheduleService {
         },
       },
     );
+    // Check the tier
+    const checkTierQueue = this.queueRegistry.queue(
+      QueueName.SCHEDULED_CHECK_TIER,
+    );
+    await checkTierQueue.upsertJobScheduler(
+      this.JobId(QueueName.SCHEDULED_CHECK_TIER, appId),
+      // Every Monday (1) at 14:00
+      { pattern: '0 0 14 * * 1' },
+      {
+        data: {
+          app: appId,
+          session: sessionName,
+        },
+      },
+    );
   }
 
   async unschedule(appId: string, sessionName: string): Promise<void> {
@@ -71,6 +86,13 @@ export class ChatWootScheduleService {
     await checkVersionQueue.removeJobScheduler(
       this.JobId(QueueName.SCHEDULED_CHECK_VERSION, appId),
     );
+    // Check the tier
+    const checkTierQueue = this.queueRegistry.queue(
+      QueueName.SCHEDULED_CHECK_TIER,
+    );
+    await checkTierQueue.removeJobScheduler(
+      this.JobId(QueueName.SCHEDULED_CHECK_TIER, appId),
+    );
 
     // contacts
     const contactsPullQueue = this.queueRegistry.queue(

src/apps/chatwoot/services/QueueManager.ts

@@ -1,6 +1,7 @@
 import { QueueName } from '../consumers/QueueName';
 import { QueueRegistry } from '@waha/apps/chatwoot/services/QueueRegistry';
 import { Injectable } from '@nestjs/common';
+import { QueueNameRepr } from '@waha/apps/app_sdk/JobUtils';
 
 const Managable = true;
 const Locked = false;
@@ -18,7 +19,8 @@ export class QueueManager {
   constructor(private readonly registry: QueueRegistry) {
     this.queues = {
       [QueueName.SCHEDULED_MESSAGE_CLEANUP]: Locked,
-      [QueueName.SCHEDULED_CHECK_VERSION]: Locked,
+      [QueueName.SCHEDULED_CHECK_VERSION]: Managable,
+      [QueueName.SCHEDULED_CHECK_TIER]: Locked,
       [QueueName.TASK_CONTACTS_PULL]: Locked,
       [QueueName.TASK_MESSAGES_PULL]: Locked,
       [QueueName.WAHA_SESSION_STATUS]: Locked,
@@ -75,8 +77,19 @@ export class QueueManager {
       case undefined:
         return queues;
 
-      default:
+      default: {
+        const matches = queues.filter((q) => q.split(' | ')[1] === shortcut);
+        if (matches.length === 1) {
+          return [matches[0]];
+        }
+        if (matches.length > 1) {
+          const names = matches.map(QueueNameRepr).join(', ');
+          throw new Error(
+            `Ambiguous queue name "${shortcut}", matches: ${names}`,
+          );
+        }
         return [shortcut as QueueName];
+      }
     }
   }
 

src/apps/chatwoot/services/QueueRegistry.ts

@@ -16,6 +16,8 @@ export class QueueRegistry {
     private readonly scheduledMessageCleanupQueue: Queue,
     @InjectQueue(QueueName.SCHEDULED_CHECK_VERSION)
     private readonly scheduledCheckVersionQueue: Queue,
+    @InjectQueue(QueueName.SCHEDULED_CHECK_TIER)
+    private readonly scheduledCheckTierQueue: Queue,
     @InjectQueue(QueueName.TASK_CONTACTS_PULL)
     private readonly taskContactsPullQueue: Queue,
     @InjectQueue(QueueName.TASK_MESSAGES_PULL)
@@ -55,6 +57,7 @@ export class QueueRegistry {
     this.queues = {
       [QueueName.SCHEDULED_MESSAGE_CLEANUP]: this.scheduledMessageCleanupQueue,
       [QueueName.SCHEDULED_CHECK_VERSION]: this.scheduledCheckVersionQueue,
+      [QueueName.SCHEDULED_CHECK_TIER]: this.scheduledCheckTierQueue,
       [QueueName.TASK_CONTACTS_PULL]: this.taskContactsPullQueue,
       [QueueName.TASK_MESSAGES_PULL]: this.taskMessagesPullQueue,
       [QueueName.WAHA_SESSION_STATUS]: this.wahaSessionStatusQueue,

src/apps/chatwoot/waha/engines.ts

@@ -1,17 +1,45 @@
 import * as lodash from 'lodash';
+import type { proto } from '@adiwajshing/baileys';
 import { WhatsAppMessage } from '@waha/apps/chatwoot/storage';
 import { WAHAEngine } from '@waha/structures/enums.dto';
 import { getEngineName } from '@waha/version';
 import { Message as MessageInstance } from 'whatsapp-web.js/src/structures';
-import { isLidUser, isPnUser, toCusFormat } from '@waha/core/utils/jids';
+import { Jid } from '@waha/core/engines/const';
+import {
+  isLidUser,
+  isPnUser,
+  jidsFromKey,
+  toCusFormat,
+} from '@waha/core/utils/jids';
+import { parseMessageIdSerialized } from '@waha/core/utils/ids';
 import { WAMessage } from '@waha/structures/responses.dto';
 import { CallData } from '@waha/structures/calls.dto';
+import { getContextInfo } from '@waha/core/utils/pwa';
+
+export interface QuotedMedia {
+  url?: string;
+  directPath: string;
+  mediaKey?: string;
+  mimetype: string;
+  mediaType: string;
+}
 
 interface IEngineHelper {
   ChatID(message: WAMessage | any): string;
 
+  /**
+   * Phone number chat id (@c.us) of the DM contact extracted from the message payload
+   * (alt jid fields), when the engine provides it. Null otherwise.
+   */
+  PhoneNumber(message: WAMessage | any): string | null;
+
   CallChatID(call: CallData | any): string;
 
+  IsReplyToStatus(
+    message: WAMessage,
+    protoMessage: proto.Message | null,
+  ): boolean;
+
   WhatsAppMessageKeys(message: any): WhatsAppMessage;
 
   IterateMessages<T extends { timestamp: number }>(
@@ -23,6 +51,8 @@ interface IEngineHelper {
   FilterChatIdsForMessages(chats: string[]): string[];
 
   SupportsAllChatForMessage(): boolean;
+
+  ExtractQuotedMedia(replyData: any): QuotedMedia | null;
 }
 
 class NOWEBHelper implements IEngineHelper {
@@ -30,10 +60,27 @@ class NOWEBHelper implements IEngineHelper {
     return message.from;
   }
 
+  PhoneNumber(message: WAMessage | any): string | null {
+    const key = message._data?.key;
+    if (!key) {
+      return null;
+    }
+    const jids = jidsFromKey(key);
+    return pnChatIdOrNull(jids?.pn);
+  }
+
   CallChatID(call: CallData): string {
     return call.from;
   }
 
+  IsReplyToStatus(
+    message: WAMessage,
+    protoMessage: proto.Message | null,
+  ): boolean {
+    void message;
+    return getContextInfo(protoMessage)?.remoteJid === Jid.BROADCAST;
+  }
+
   WhatsAppMessageKeys(message: any): WhatsAppMessage {
     const timestamp = parseInt(message.messageTimestamp) * 1000;
     return {
@@ -52,7 +99,7 @@ class NOWEBHelper implements IEngineHelper {
   }
 
   FilterChatIdsForMessages(chats: string[]): string[] {
-    return chats;
+    return preferPnChats(chats);
   }
 
   ContactIsMy(contact) {
@@ -62,6 +109,10 @@ class NOWEBHelper implements IEngineHelper {
   SupportsAllChatForMessage(): boolean {
     return true;
   }
+
+  ExtractQuotedMedia(replyData: any): QuotedMedia | null {
+    return extractProtoQuotedMedia(replyData);
+  }
 }
 
 class GOWSHelper implements IEngineHelper {
@@ -69,10 +120,33 @@ class GOWSHelper implements IEngineHelper {
     return message.from;
   }
 
+  PhoneNumber(message: WAMessage | any): string | null {
+    const info = message._data?.Info;
+    if (!info) {
+      return null;
+    }
+    // SenderAlt / RecipientAlt carry the phone number for @lid-addressed chats
+    let pn: string | null;
+    if (info.IsFromMe) {
+      pn = info.RecipientAlt || null;
+    } else {
+      pn = info.SenderAlt || null;
+    }
+    return pnChatIdOrNull(pn);
+  }
+
   CallChatID(call: CallData): string {
     return call._data?.CallCreator || call.from;
   }
 
+  IsReplyToStatus(
+    message: WAMessage,
+    protoMessage: proto.Message | null,
+  ): boolean {
+    void message;
+    return getContextInfo(protoMessage)?.remoteJid === Jid.BROADCAST;
+  }
+
   /**
    * Parse API response and get the data
    * API Response depends on engine right now
@@ -96,7 +170,7 @@ class GOWSHelper implements IEngineHelper {
   }
 
   FilterChatIdsForMessages(chats: string[]): string[] {
-    return chats;
+    return preferPnChats(chats);
   }
 
   SupportsAllChatForMessage(): boolean {
@@ -106,6 +180,10 @@ class GOWSHelper implements IEngineHelper {
   ContactIsMy(contact) {
     return true;
   }
+
+  ExtractQuotedMedia(replyData: any): QuotedMedia | null {
+    return extractProtoQuotedMedia(replyData, true);
+  }
 }
 
 class WEBJSHelper implements IEngineHelper {
@@ -113,10 +191,23 @@ class WEBJSHelper implements IEngineHelper {
     return message._data?.id?.remote || message.from;
   }
 
+  PhoneNumber(message: WAMessage | any): string | null {
+    void message;
+    return null;
+  }
+
   CallChatID(call: CallData): string {
     return call.from;
   }
 
+  IsReplyToStatus(
+    message: WAMessage,
+    protoMessage: proto.Message | null,
+  ): boolean {
+    void protoMessage;
+    return message._data?.quotedRemoteJid === Jid.BROADCAST;
+  }
+
   /**
    * Parse API response and get the data for WEBJS engine
    */
@@ -150,17 +241,7 @@ class WEBJSHelper implements IEngineHelper {
   }
 
   FilterChatIdsForMessages(chats: string[]): string[] {
-    if (chats.length == 2) {
-      const lidChat = chats.find(isLidUser);
-      const cusChat = chats.find(isPnUser);
-      if (lidChat && cusChat) {
-        return [lidChat];
-      }
-      // WEBJS engine merges messages for @lid and @c.us
-      // into single chat, so it's fine to pull only from one
-    }
-    // Otherwise - return the original
-    return chats;
+    return preferPnChats(chats);
   }
 
   SupportsAllChatForMessage(): boolean {
@@ -170,6 +251,83 @@ class WEBJSHelper implements IEngineHelper {
   ContactIsMy(contact) {
     return contact.isMyContact;
   }
+
+  ExtractQuotedMedia(replyData: any): QuotedMedia | null {
+    return extractBrowserQuotedMedia(replyData);
+  }
+}
+
+class WPPHelper implements IEngineHelper {
+  ChatID(message: WAMessage): string {
+    return toCusFormat(parseMessageIdSerialized(message.id as any).remoteJid);
+  }
+
+  PhoneNumber(message: WAMessage | any): string | null {
+    void message;
+    return null;
+  }
+
+  CallChatID(call: CallData): string {
+    return call.from;
+  }
+
+  IsReplyToStatus(
+    message: WAMessage,
+    protoMessage: proto.Message | null,
+  ): boolean {
+    void protoMessage;
+    return message._data?.quotedRemoteJid === Jid.BROADCAST;
+  }
+
+  /**
+   * Parse API response and get the data for WPP engine.
+   * WPP returns message.id as a composite string "fromMe_chatId_msgId".
+   */
+  WhatsAppMessageKeys(message: any): WhatsAppMessage {
+    const parsed = parseMessageIdSerialized(message.id);
+    return {
+      timestamp: new Date(message.timestamp * 1000),
+      from_me: parsed.fromMe,
+      chat_id: toCusFormat(parsed.remoteJid),
+      message_id: parsed.id,
+      participant: message.author || null,
+    };
+  }
+
+  /**
+   * WPP API lacks server-side sorting hooks, so we buffer and sort by the unix timestamp in memory.
+   */
+  async *IterateMessages<T extends { timestamp: number }>(
+    messages: AsyncGenerator<T>,
+  ): AsyncGenerator<T> {
+    const buffer: T[] = [];
+
+    for await (const message of messages) {
+      buffer.push(message);
+    }
+
+    const sorted = lodash.sortBy(buffer, (item) => item.timestamp);
+
+    for (const message of sorted) {
+      yield message;
+    }
+  }
+
+  FilterChatIdsForMessages(chats: string[]): string[] {
+    return preferPnChats(chats);
+  }
+
+  SupportsAllChatForMessage(): boolean {
+    return false;
+  }
+
+  ContactIsMy(contact) {
+    return contact.isMyContact;
+  }
+
+  ExtractQuotedMedia(replyData: any): QuotedMedia | null {
+    return extractBrowserQuotedMedia(replyData);
+  }
 }
 
 // Choose the right EngineHelper based on getEngineName() function
@@ -185,8 +343,93 @@ switch (getEngineName()) {
   case WAHAEngine.WEBJS:
     engineHelper = new WEBJSHelper();
     break;
+  case WAHAEngine.WPP:
+    engineHelper = new WPPHelper();
+    break;
   default:
     engineHelper = new WEBJSHelper(); // Default to WEBJS as it's the default engine
 }
 
 export const EngineHelper = engineHelper;
+
+//
+// Quoted media extraction helpers
+//
+
+function extractProtoQuotedMedia(
+  replyData: any,
+  capitalUrl = false,
+): QuotedMedia | null {
+  if (!replyData) {
+    return null;
+  }
+  const mediaTypes: Array<[string, string]> = [
+    ['imageMessage', 'image'],
+    ['videoMessage', 'video'],
+    ['audioMessage', 'audio'],
+  ];
+  for (const [key, mediaType] of mediaTypes) {
+    const msg = replyData[key];
+    if (!msg) {
+      continue;
+    }
+    const url: string | undefined = capitalUrl ? msg.URL ?? msg.url : msg.url;
+    const directPath: string = msg.directPath;
+    const mimetype: string = msg.mimetype;
+    if (!directPath || !mimetype) {
+      continue;
+    }
+    return {
+      url: url,
+      directPath: directPath,
+      mediaKey: msg.mediaKey,
+      mimetype: mimetype,
+      mediaType: mediaType,
+    };
+  }
+  return null;
+}
+
+function extractBrowserQuotedMedia(replyData: any): QuotedMedia | null {
+  if (!replyData) {
+    return null;
+  }
+  const kind: string = replyData.kind ?? replyData.type;
+  if (kind !== 'image' && kind !== 'video' && kind !== 'audio') {
+    return null;
+  }
+  const directPath: string = replyData.directPath;
+  const mimetype: string = replyData.mimetype;
+  if (!directPath || !mimetype) {
+    return null;
+  }
+  return {
+    url: replyData.deprecatedMms3Url,
+    directPath: directPath,
+    mediaKey: replyData.mediaKey,
+    mimetype: mimetype,
+    mediaType: kind,
+  };
+}
+
+function pnChatIdOrNull(pn: string | null | undefined): string | null {
+  if (!pn) {
+    return null;
+  }
+  const chatId = toCusFormat(pn);
+  if (isPnUser(chatId)) {
+    return chatId;
+  }
+  return null;
+}
+
+function preferPnChats(chats: string[]): string[] {
+  const unique = lodash.uniq(chats ?? []);
+  const hasPn = unique.some(isPnUser);
+  const hasLid = unique.some(isLidUser);
+  if (hasPn && hasLid) {
+    // Prefer @c.us / phone chats when both formats exist to avoid duplicate fetches.
+    return unique.filter(isPnUser);
+  }
+  return unique;
+}

src/apps/chatwoot/waha/index.ts

@@ -1,3 +1,5 @@
 import { EngineHelper } from './engines';
+import type { QuotedMedia } from './engines';
 
 export { EngineHelper };
+export type { QuotedMedia };

src/apps/mcp/api/mcp.controller.ts

@@ -0,0 +1,15 @@
+import { Controller, Post, Req, Res } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import type { Request, Response } from 'express';
+import { McpService } from '../mcp.service';
+
+@Controller('mcp')
+@ApiTags('🧩 Apps')
+export class McpController {
+  constructor(private readonly mcp: McpService) {}
+
+  @Post()
+  post(@Req() req: Request, @Res() res: Response) {
+    return this.mcp.handlePost(req, res);
+  }
+}

src/apps/mcp/decorators/controller.ts

@@ -0,0 +1,58 @@
+import { WAHASelf } from '@waha/apps/app_sdk/waha/WAHASelf';
+import { AxiosRequestConfig } from 'axios';
+import { ImageMcpResponse, TextMcpResponse } from '@waha/apps/mcp/responses';
+
+export class McpController {
+  constructor(protected readonly api: WAHASelf) {}
+
+  protected async request(config: AxiosRequestConfig<any>) {
+    const requestConfig = { ...config };
+    requestConfig.validateStatus = () => true;
+    const response = await this.api.request(requestConfig);
+    return response;
+  }
+
+  protected async textRequest(config: AxiosRequestConfig) {
+    const response = await this.request(config);
+    const responseText =
+      typeof response.data === 'string'
+        ? response.data
+        : JSON.stringify(response.data);
+    return TextMcpResponse(
+      JSON.stringify({ status: response.status, response: responseText }),
+    );
+  }
+
+  protected async imageRequest(url: string) {
+    const response = await this.api.request({
+      method: 'GET',
+      url: url,
+      responseType: 'arraybuffer',
+    });
+    return ImageMcpResponse(Buffer.from(response.data));
+  }
+
+  protected async scopedApiKey(
+    url: string,
+    session: string,
+  ): Promise<string | null> {
+    const response = await this.request({
+      method: 'POST',
+      url: url,
+      data: { session: session },
+    });
+    if (response.status >= 200 && response.status < 300) {
+      return response.data?.key ?? null;
+    }
+    // e.g. 403 (caller lacks the scope) or 422 (session missing) → fall back
+    return null;
+  }
+
+  protected async mediaApiKey(session: string): Promise<string | null> {
+    return this.scopedApiKey('/api/keys/media', session);
+  }
+
+  protected async controlApiKey(session: string): Promise<string | null> {
+    return this.scopedApiKey('/api/keys/control', session);
+  }
+}

src/apps/mcp/decorators/resource.ts

@@ -0,0 +1,54 @@
+import type { ResourceMetadata } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpController } from '@waha/apps/mcp/decorators/controller';
+
+export const RESOURCES_KEY = Symbol('waha:mcp:resources');
+export const RESOURCE_TEMPLATES_KEY = Symbol('waha:mcp:resource-templates');
+
+export interface ResourceDef {
+  name: string;
+  uri: string;
+  config: ResourceMetadata;
+  method: string;
+}
+
+export interface ResourceTemplateDef {
+  name: string;
+  uriTemplate: string;
+  config: ResourceMetadata;
+  method: string;
+}
+
+export function Resource(
+  name: string,
+  uri: string,
+  config: ResourceMetadata = {},
+) {
+  return (target: object, propertyKey: string) => {
+    const defs: ResourceDef[] = (target as any)[RESOURCES_KEY] ?? [];
+    defs.push({ name, uri, config, method: propertyKey });
+    (target as any)[RESOURCES_KEY] = defs;
+  };
+}
+
+export function ResourceTemplate(
+  name: string,
+  uriTemplate: string,
+  config: ResourceMetadata = {},
+) {
+  return (target: object, propertyKey: string) => {
+    const defs: ResourceTemplateDef[] =
+      (target as any)[RESOURCE_TEMPLATES_KEY] ?? [];
+    defs.push({ name, uriTemplate, config, method: propertyKey });
+    (target as any)[RESOURCE_TEMPLATES_KEY] = defs;
+  };
+}
+
+export function getResources(controller: McpController): ResourceDef[] {
+  return (controller as any)[RESOURCES_KEY] ?? [];
+}
+
+export function getResourceTemplates(
+  controller: McpController,
+): ResourceTemplateDef[] {
+  return (controller as any)[RESOURCE_TEMPLATES_KEY] ?? [];
+}

src/apps/mcp/decorators/tool.ts

@@ -0,0 +1,23 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { McpController } from '@waha/apps/mcp/decorators/controller';
+
+export const TOOLS_KEY = Symbol('waha:mcp:tools');
+export type ToolConfig = Parameters<McpServer['registerTool']>[1];
+
+export interface ToolDef {
+  name: string;
+  config: ToolConfig;
+  method: string;
+}
+
+export function Tool(name: string, config: ToolConfig) {
+  return (target: object, propertyKey: string) => {
+    const defs: ToolDef[] = (target as any)[TOOLS_KEY] ?? [];
+    defs.push({ name, config, method: propertyKey });
+    (target as any)[TOOLS_KEY] = defs;
+  };
+}
+
+export function getTools(controller: McpController): ToolDef[] {
+  return (controller as any)[TOOLS_KEY] ?? [];
+}