fix(NOWEB): template message with image header — hasMedia:true but download fails - fix #2275

closes #2260
Co-authored-by: ropu <rovagnati@gmail.com>

.claude/settings.local.json

@@ -1,15 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(yarn build:*)",
-      "Bash(cat:*)",
-      "Bash(node:*)",
-      "Bash(npm show:*)",
-      "Bash(python3:*)",
-      "Bash(yarn test:unit:*)",
-      "Bash(npx tsc:*)",
-      "Bash(pre-commit run:*)",
-      "Bash(yarn test:*)"
-    ]
-  }
-}

.env.example

@@ -56,6 +56,20 @@ WAHA_LOG_LEVEL=info
 # Don't print QR codes in logs
 WAHA_PRINT_QR=False
 
+# ======================
+# ===== PROMETHEUS =====
+# ======================
+# Prometheus metrics endpoint - GET /metrics
+# WAHA_PROMETHEUS_ENABLED=True
+# WAHA_PROMETHEUS_PATH=/metrics
+# WAHA_PROMETHEUS_METRIC_PREFIX=waha_
+# WAHA_PROMETHEUS_HTTP_DURATION_BUCKETS=0.005,0.01,0.025,0.05,0.1,0.25,0.5,1,2.5,5,10,30
+# Events to count in waha_events_total ('*' for all) - the server actively processes listed events even with no webhooks
+# WAHA_PROMETHEUS_TRACK_EVENTS=message.any
+# Optional basic auth for the metrics endpoint (both must be set)
+# WAHA_PROMETHEUS_USERNAME=admin
+# WAHA_PROMETHEUS_PASSWORD=secret
+
 # =========================
 # ===== MEDIA STORAGE =====
 # =========================
@@ -64,7 +78,17 @@ WAHA_MEDIA_STORAGE=LOCAL
 WHATSAPP_FILES_LIFETIME=0
 WHATSAPP_FILES_FOLDER=/app/.media
 
+#
 # Media download settings
+#
+# Events (webhooks, websockets)
+# WAHA_EVENTS_DOWNLOAD_MEDIA=true
+# WAHA_EVENTS_DOWNLOAD_MEDIA_MIMETYPES=image/jpeg,image/png
+# API default behavior (GET /api/{session}/chats/{chatId}/messages, etc.)
+# WAHA_API_DOWNLOAD_MEDIA=true
+# WAHA_API_DOWNLOAD_MEDIA_MIMETYPES=image/jpeg,image/png
+
+# DEPRECATED - use WAHA_EVENTS_* and WAHA_API_* variables above
 # WHATSAPP_DOWNLOAD_MEDIA=true
 # WHATSAPP_FILES_MIMETYPES=image/jpeg,image/png
 

.env.yarn

@@ -0,0 +1 @@
+SHARP_IGNORE_GLOBAL_LIBVIPS=1

.github/workflows/dev.yaml

@@ -35,13 +35,14 @@ jobs:
   #        run: yarn test:unit
 
   docker-build:
-    if: github.repository == 'devlikeapro/waha-plus'
+    if: github.repository == 'devlikeapro/waha'
     #    needs: unit-tests
     runs-on: ${{ matrix.runner }}
     name:
       ${{ matrix.engine }} - ${{ matrix.browser }} - ${{ matrix.platform }} -
       ${{ matrix.tag }}
     strategy:
+      fail-fast: false
       matrix:
         include:
           # Chromium - x86
@@ -72,6 +73,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         with:
+          ref: dev
           fetch-depth: 0
 
       - name: Check recent changes

.gitignore

@@ -1,3 +1,4 @@
+openapi.json
 tmp/*
 src/core/engines/gows/proto
 .env

.yarnrc.yml

@@ -1,9 +1,16 @@
+approvedGitRepositories:
+  - '**'
+
 compressionLevel: mixed
 
 enableGlobalCache: false
 
+enableScripts: true
+
 nodeLinker: node-modules
 
+npmMinimalAgeGate: 0
+
 supportedArchitectures:
   cpu:
     - arm

AGENTS.md

@@ -3,183 +3,69 @@
 This guide summarizes how to explore, modify, and validate the WhatsApp HTTP API
 (WAHA) codebase when assisting as an automation or coding agent.
 
-- When you asked to refactor or "apply new lib" instead of current one - do not
-  change the behavior, make a minimum amount of changes possible. If you see
-  some edge case during that process that haven't been covered - tell it,
-  suggest fix, but don't change the code.
-
 ## Product & Variants
 
-- WAHA ships in **Core** and **Plus** editions. Core lives under `src/core` and
-  only supports the default session plus minimal media features. Plus extends
-  core via `src/plus` to add multi-session orchestration, richer media handling,
-  and external storage integrations.
-- Core code must remain free from Plus-only references. A pre-commit hook
-  rejects the word `plus` inside core files; reuse abstractions exposed through
-  `@waha/core/**` instead of importing Plus modules from Core.
-- Commit subjects are validated: changes that touch `src/plus` require a
-  `[PLUS] …` prefix and must not include non-Plus files; everything else must
-  use `[core] …`. Verify against `./.precommit/validate_commit_message.py` if
-  unsure.
+- WAHA ships in **Core** and **Plus** editions
+- Core lives under `src/core` and supports the default session with minimal
+  media features
+- Plus extends core via `src/plus` to add multi-session orchestration, richer
+  media handling, and external storage integrations
+- Core code must remain free from Plus-only references (pre-commit hook rejects
+  "plus" in core files)
+- Commit subjects: changes that touch `src/plus` require `[PLUS] …` prefix;
+  everything else uses `[core] …`
 
-## Tech Stack Snapshot
+## Tech Stack
 
-- **Runtime**: Node.js 22.x, Yarn 3.6 (Berry). Always install packages and run
-  scripts with Yarn.
-- **Framework**: NestJS v11 with dependency injection, modular controllers in
-  `src/api`, and Pino-based logging via `nestjs-pino`.
-- **Engines**: WhatsApp engines are abstracted (`WEBJS`, `GOWS`, `NOWEB`). Core
-  uses `SessionManagerCore`; Plus swaps to `SessionManagerPlus` with extra
-  storage backends (Mongo/Postgres/SQLite).
+- **Runtime**: Node.js 22.x, Yarn 3.6 (Berry)
+- **Framework**: NestJS v11 with dependency injection and modular controllers in
+  `src/api`
+- **Engines**: WhatsApp engines are abstracted (`WEBJS`, `GOWS`, `NOWEB`,
+  `WPP`). Core uses `SessionManagerCore`; Plus swaps to `SessionManagerPlus`
+  with extra storage backends (Mongo/Postgres/SQLite)
 - **ESM Bridge**: ESM-only dependencies (Baileys) load through
-  `src/vendor/esm.ts`. Add new ESM modules there to ensure they load exactly
-  once.
-- **Utilities**: RxJS streams (`SwitchObservable`, `DefaultMap`) drive webhook
-  event fan-out. Prefer existing helpers in `src/utils` and `src/core/utils`
-  before adding bespoke logic.
-- **OS** - the project works on any OS inside the Docker container; the base
-  image is defined in `Dockerfile`.
-- **CPU** - the image must run on both `x86_64` (including pre-v2 CPUs without
-  SSE4.2) and `aarch64`.
+  `src/vendor/esm.ts`
+- **Utilities**: RxJS streams drive webhook event fan-out. Prefer existing
+  helpers in `src/utils` and `src/core/utils`
 
-## Repository Landmarks
+## Key Paths
 
-- `src/main.ts`: runtime entry point; dynamically loads the correct AppModule
-  (Core vs Plus) and configures global interceptors/filters.
-- `src/api/**`: REST controllers and WebSocket gateway. Keep handlers thin;
-  delegate to managers/services. HTTP routes follow `/api/{sessionName}/…`;
-  always thread the session name through request DTOs and guards instead of
-  hardcoding `default`.
+- `src/main.ts`: runtime entry point; dynamically loads AppModule (Core vs Plus)
+- `src/api/**`: REST controllers and WebSocket gateway
 - `src/core/**`: shared abstractions (config services, engine bootstrap,
-  storage, session management). Core only allows the `default` session and
-  cleans up storage on boot.
+  storage, session management)
 - `src/plus/**`: multi-session orchestration, advanced media services, and
-  external persistence layers (Mongo, Postgres). Reuse this layer when adding
-  Plus-only capabilities.
-- `src/apps/**`: integrations (e.g., ChatWoot) and application-specific
-  services.
+  external persistence layers
 - `src/structures/**` and `src/utils/**`: DTOs, enums (event names follow
-  `domain.action`), helper utilities. Maintain naming consistency when
-  introducing new events.
-- `tests/**`: Jest-based suites; do not add new tests unless explicitly asked,
-  but keep existing tests working.
+  `domain.action`), helper utilities
 
 ## Coding Expectations
 
-- Favor composable, long-lived solutions. If a helper already exists (e.g.,
-  `parseBool`, `DefaultMap`, media factories), extend it instead of reinventing
-  logic. Lodash ships with the project—prefer its utilities over hand-rolled
-  helpers. Import lodash as a namespace (`import * as lodash from 'lodash';`) so
-  helpers like `lodash.camelCase` stay consistent across files. When a new
-  third-party library seems necessary, confirm with the user, especially if the
-  package looks stale.
+- Favor composability and long-lived solutions
+- Reuse existing helpers (`parseBool`, `DefaultMap`, media factories) instead of
+  reinventing logic
 - Stick to NestJS patterns: inject dependencies through constructors, expose
-  provider tokens from modules, and keep controllers free from business logic.
+  provider tokens from modules
 - Logging goes through injected `PinoLogger` or helpers in
-  `src/utils/logging.ts`. `console.log` is blocked by pre-commit.
-- Respect path aliases (`@waha/...`) defined in `tsconfig.json`; keep imports
-  consistent (use absolute aliases, not relative `../../../`).
-- Prefer named function declarations over `const` arrow functions when possible.
-- Avoid naming unused variables with a leading underscore; if a parameter is
-  required by a signature, explicitly `void` it instead.
-- Do not write verbose ternaries like
-  `condition !== undefined ? condition : default`; use idiomatic helpers such as
-  `??` (nullish coalescing) or existing boolean parsers so flags stay readable.
-- Do not place `await` or other async calls inside ternary expressions (`?:`);
-  use explicit `if/else` blocks instead.
-- For configs, prefer runtime configurability over constants. Environment keys
-  follow `WAHA_*` for global values and `WAHA_SESSION_CONFIG_*` /
-  `session.config.*` for per-session overrides. If both env and config are
-  supported, honor both (`WAHA_WEBJS_CONFIG_*` vs. `session.webjs.config.*`).
+  `src/utils/logging.ts`
+- Respect path aliases (`@waha/...`) defined in `tsconfig.json`
+- Prefer named function declarations over `const` arrow functions
+- Avoid naming unused variables with a leading underscore
+- Always use explicit property names in object literals — never shorthand: write
+  `{ key: value }`, not `{ value }` (even when the variable name matches the
+  key)
+- Do not write verbose ternaries; use idiomatic helpers like `??` (nullish
+  coalescing)
+- Do not place `await` or other async calls inside ternary expressions (`?:`) or
+  nullish-coalescing expressions (`??`); use explicit `if/else` blocks or assign
+  the awaited value to a variable first
+- For configs, prefer runtime configurability over constants (environment keys
+  follow `WAHA_*` and `WAHA_SESSION_CONFIG_*`)
+- Do not use decorative comment blocks (lines of dashes/underscores with a
+  label) such as `// ─────────── NAME ───────────`; use plain inline comments or
+  no comment at all
 
-## Language & Localization
-
-- Keep identifiers (classes, methods, variables) and code comments in English so
-  the codebase stays consistent for the global team.
-- Route user-visible strings through the existing i18n structure rather than
-  hardcoding text. ChatWoot copy belongs in `src/apps/chatwoot/i18n` with
-  English as the source locale before adding translations.
-
-## ChatWoot Integration Notes
-
-- Avoid introducing synthetic events; map onto existing webhook or engine events
-  whenever plausible. Always use the official ChatWoot API client located in
-  `src/apps/chatwoot/client`.
-- When adding events, align consumer names with webhook/event identifiers (e.g.,
-  `message.any`).
-
-## Workflow Checklist
-
-1. Identify whether work targets Core, Plus, or shared layers. If Plus-only,
-   isolate changes to `src/plus` and ensure the commit prefix matches.
-2. Lean on existing services/managers; extend the appropriate session manager
-   rather than branching logic inline.
-3. After edits run:
-   - `pre-commit run --all-files`
-   - `yarn build`
-   - `yarn test --watchman=false`
-4. Do **not** start the application yourself; ask the user to run it if runtime
-   validation is required.
-5. Capture any assumptions or open questions for the user, especially when
-   touching configs, introducing dependencies, or modifying public APIs.
-
-## Additional Tips
-
-- Concurrency-sensitive sections (session start/stop) rely on `async-lock`. When
-  adding async flows, reuse `SessionManager.withLock` or existing retry
-  utilities (`promiseTimeout`, `waitUntil`).
-- Media features centralize through `MediaManager` and `MediaStorageFactory`.
-  When altering media behavior, update both Core and Plus variants where
-  applicable.
-- Keep docs and code ASCII unless a file already uses other characters. When
-  updating documentation, mirror the concise, actionable tone used here.
-
-## Yes No
-
-Always define key for objects (and in return too)
-
-```js
-// NO
-const variable = 123;
-const b = { variable };
-
-// YES
-const variable = 123;
-const b = { variable: variable };
-```
-
-Use the three-line comment style for section headers inside files:
-
-```ts
-// NO
-// ─── Section name ─────────────────────────────────────────────────────────────
-
-// YES
-//
-// Section name
-//
-```
-
-## Related Sources Code
-
-You can find and read related source code in the following paths:
-
-- WEBJS: `../whatsapp-web.js`
-- NOWEB: `../WhiskeySockets-Baileys`
-  - whatsapp-rust-bridge - `../whatsapp-rust-bridge`
-- GOWS: `../gows`
-  - whatsmeow - `../whatsmeow`
-- WPP: `../wa-js`, `../wppconnect`, `../wppconnect-server`
-- ChatWoot: `../chatwoot`
-
-Following this playbook keeps contributions aligned with WAHA’s structure,
-automation hooks, and release process.
-
-## How to run API
-
-You can run the project outside of sandbox using the below command, then run
-queries against `default` session (if not asked to do something different) using
-`curl` and `X-Api-Key: 666` header.
+## How to Run API
 
 ```bash
 export DEBUG=1
@@ -197,17 +83,49 @@ export WHATSAPP_FILES_FOLDER=./.media
 npm run start
 ```
 
-- Ask user before running the server.
-- Before executing some queries make sure the session is in `WORKING` status.
-- If it's `FAILED` or `SCAN_QR_CODE` ask user to scan QR code or fix failed
-  session.
+## Code Guidelines
 
-## Code
+- Add `@Activity()` (from `src/core/abc/activity.ts`) to every engine method
+  that makes a network call to WhatsApp servers
+- It triggers `maintainPresenceOnline()` before the method runs, keeping the
+  session ONLINE during API activity and scheduling an OFFLINE transition after
+  an idle period
+- Skip it on methods that only throw `NotImplementedByEngineError` /
+  `AvailableInPlusVersion`
 
-### @Activity Decorator and Presence Tracking
+## MCP Tools
 
-Add `@Activity()` (from `src/core/abc/activity.ts`) to every engine method that
-makes a network call to WhatsApp servers. It triggers `maintainPresenceOnline()`
-before the method runs, keeping the session ONLINE during API activity and
-scheduling an OFFLINE transition after an idle period. Skip it on methods that
-only throw `NotImplementedByEngineError` / `AvailableInPlusVersion`.
+MCP tools live in `src/apps/mcp/tools/` and expose the HTTP API to AI clients.
+Each tool file mirrors an API domain (e.g. `chats.tools.ts` → chats endpoints).
+
+**When you change an existing API endpoint:**
+
+- Check the corresponding `*.tools.ts` file and update the tool's `inputSchema`,
+  description, or behavior if the API signature changed.
+
+**When you add a new API endpoint:**
+
+- Ask the user whether an MCP tool is needed for the new endpoint before
+  creating one.
+- If yes, add the tool to the matching `*.tools.ts` file (or create a new file
+  for a new domain).
+- Every `@Tool` decorator must include an `annotations` block with all three
+  fields:
+  ```typescript
+  annotations: {
+    readOnlyHint: true | false,   // true = no side effects (GET-style)
+    destructiveHint: true | false, // true = irreversible deletion/logout
+    idempotentHint: true | false,  // true = safe to repeat with same args
+  }
+  ```
+- Input schemas live in the matching `*.zod.ts` file.
+- Tools call the API via `this.textRequest({ method, url, ... })` inherited from
+  `McpController`.
+
+## Related Sources
+
+- WEBJS: `../whatsapp-web.js`
+- NOWEB: `../WhiskeySockets-Baileys` and `../whatsapp-rust-bridge`
+- GOWS: `../gows` and `../whatsmeow`
+- WPP: `../wa-js`, `../wppconnect`, `../wppconnect-server`
+- ChatWoot: `../chatwoot`

Dockerfile

@@ -16,10 +16,10 @@ RUN apt-get update && \
 WORKDIR /git
 COPY package.json .
 COPY yarn.lock .
+COPY .yarnrc.yml .
 ENV YARN_CHECKSUM_BEHAVIOR=update
 
 RUN npm install -g corepack && corepack enable
-RUN yarn set version 4.9.2
 RUN yarn install
 
 # App
@@ -179,7 +179,7 @@ RUN if [ "$USE_BROWSER" = "chromium" ]; then \
 # Install Chrome
 # Available versions:
 # https://www.ubuntuupdates.org/package/google_chrome/stable/main/base/google-chrome-stable
-ARG CHROME_VERSION="140.0.7339.80-1"
+ARG CHROME_VERSION="152.0.7977.82-1"
 ARG OPUSTAGS_VERSION="1.10.1"
 RUN if [ "$USE_BROWSER" = "chrome" ]; then \
         wget --no-verbose -O /tmp/chrome.deb https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${CHROME_VERSION}_amd64.deb \
@@ -247,7 +247,7 @@ ENV CHOKIDAR_INTERVAL=5000
 ENV WAHA_ZIPPER=ZIPUNZIP
 
 # GOWS - use libc DNS resolver
-ENV GODEBUG netdns=cgo
+ENV GODEBUG=netdns=cgo
 
 # Run command, etc
 EXPOSE 3000

Makefile

@@ -35,17 +35,30 @@ for-swagger:
 	export WHATSAPP_SWAGGER_CONFIG_ADVANCED=true && export WHATSAPP_SWAGGER_PASSWORD=666 && yarn start
 
 up-noweb:
-	yarn up @adiwajshing/baileys@github:devlikeapro/Baileys#fork-master-2026-02-11
+	yarn up @adiwajshing/baileys@github:devlikeapro/Baileys#fork-master-2026-04-28
 
 up-noweb-libsignal:
 	yarn up libsignal@github:devlikeapro/libsignal-node#fork-master
 
 up-webjs:
-	yarn up whatsapp-web.js@github:devlikeapro/whatsapp-web.js#fork-main-2026-02-18
+	yarn up whatsapp-web.js@github:devlikeapro/whatsapp-web.js#fork-main-2026-06-26
+
+link-webjs:
+	yarn up whatsapp-web.js@link:../whatsapp-web.js
+
+unlink-webjs: up-webjs
+
+rebuild-noweb:
+	cd ../Baileys && yarn build
+
+link-noweb: rebuild-noweb
+	yarn up @adiwajshing/baileys@link:../Baileys
+
+unlink-noweb: up-noweb
 
 up-wpp:
-	yarn up @wppconnect-team/wppconnect
-	yarn up @wppconnect/wa-js
+	SHARP_IGNORE_GLOBAL_LIBVIPS=1 yarn up @wppconnect-team/wppconnect@github:wppconnect-team/wppconnect#master
+	SHARP_IGNORE_GLOBAL_LIBVIPS=1 yarn up @wppconnect/wa-js@github:wppconnect-team/wa-js#main
 
 up-rust-bridge:
 	yarn up -R whatsapp-rust-bridge
@@ -61,6 +74,17 @@ gows:
 	(export PATH=${HOME}/go/bin:${PATH} || echo failed) && \
 	make all
 
+ORIGIN ?= waha-plus
+CORE_REMOTE ?= waha
+
+release:
+	node scripts/release.js
+
+release-push: release
+	git push $(ORIGIN) core plus
+	git push --force-with-lease $(ORIGIN) dev
+	git push $(CORE_REMOTE) core
+
 up-dashboard:
 	node scripts/up-dashboard.js
 

docker-compose/chatwoot/.waha.env

@@ -60,7 +60,17 @@ WAHA_MEDIA_STORAGE=LOCAL
 WHATSAPP_FILES_LIFETIME=1800
 WHATSAPP_FILES_FOLDER=/app/.media
 
+#
 # Media download settings
+#
+# Events (webhooks, websockets)
+# WAHA_EVENTS_DOWNLOAD_MEDIA=true
+# WAHA_EVENTS_DOWNLOAD_MEDIA_MIMETYPES=image/jpeg,image/png
+# API default behavior (GET /api/{session}/chats/{chatId}/messages, etc.)
+# WAHA_API_DOWNLOAD_MEDIA=true
+# WAHA_API_DOWNLOAD_MEDIA_MIMETYPES=image/jpeg,image/png
+
+# DEPRECATED - use WAHA_EVENTS_* and WAHA_API_* variables above
 # WHATSAPP_DOWNLOAD_MEDIA=true
 # WHATSAPP_FILES_MIMETYPES=image/jpeg,image/png
 

nest-cli.json

@@ -4,12 +4,12 @@
   "compilerOptions": {
     "plugins": ["@nestjs/swagger"],
     "assets": [
-      "dashboard/**",
-      "core/engines/webjs/*",
-      "plus/engines/webjs/*",
-      "apps/chatwoot/i18n/locales/*.yaml",
-      "apps/chatwoot/i18n/locales/*.yml"
+      { "include": "dashboard/**", "watchAssets": false },
+      { "include": "core/engines/webjs/*", "watchAssets": true },
+      { "include": "plus/engines/webjs/*", "watchAssets": true },
+      { "include": "apps/chatwoot/i18n/locales/*.yaml", "watchAssets": true },
+      { "include": "apps/chatwoot/i18n/locales/*.yml", "watchAssets": true }
     ],
-    "watchAssets": true
+    "watchAssets": false
   }
 }

package.json

@@ -29,7 +29,7 @@
     "gows:proto": "yarn gows:proto:fetch && yarn gows:proto:build"
   },
   "dependencies": {
-    "@adiwajshing/baileys": "github:devlikeapro/Baileys#fork-master-2026-02-11",
+    "@adiwajshing/baileys": "github:devlikeapro/Baileys#fork-master-2026-04-28",
     "@adiwajshing/keyed-db": "^0.2.4",
     "@aws-sdk/client-s3": "^3.633.0",
     "@aws-sdk/s3-request-presigner": "^3.633.0",
@@ -39,6 +39,9 @@
     "@casl/ability": "^6.8.0",
     "@figuro/chatwoot-sdk": "^1.1.17",
     "@liaoliaots/nestjs-redis": "^9",
+    "@lottiefiles/dotlottie-web": "^0.72.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@napi-rs/canvas": "^1.0.0",
     "@nestjs/axios": "^3.0.2",
     "@nestjs/bullmq": "^11.0.2",
     "@nestjs/common": "^11.0.0",
@@ -51,19 +54,25 @@
     "@nestjs/swagger": "^7.1.11",
     "@nestjs/terminus": "^10.2.3",
     "@nestjs/websockets": "^11.0.0",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/instrumentation-http": "^0.221.0",
+    "@opentelemetry/instrumentation-pino": "^0.67.0",
+    "@opentelemetry/sdk-node": "^0.221.0",
+    "@opentelemetry/sdk-trace": "^2.10.0",
+    "@prometheus-io/client": "^0.16.1",
     "@types/better-sqlite3": "^7.6.10",
     "@types/lodash": "^4.14.194",
     "@types/mustache": "^4.2.5",
     "@types/passport": "^1.0.17",
     "@types/sqlite3": "^5.1.0",
     "@types/ws": "^8.5.4",
-    "@wppconnect-team/wppconnect": "^1.41.1",
-    "@wppconnect/wa-js": "^3.23.3",
+    "@wppconnect-team/wppconnect": "github:wppconnect-team/wppconnect#master",
+    "@wppconnect/wa-js": "github:wppconnect-team/wa-js#main",
     "adm-zip": "0.5.10",
     "agentkeepalive": "^4.5.0",
     "async-lock": "^1.4.1",
     "audio-decode": "^2.2.2",
-    "axios": "^1.9.0",
+    "axios": "^1.19.0",
     "axios-retry": "^4.5.0",
     "better-sqlite3": "^12.4.1",
     "bullmq": "^5.48.1",
@@ -93,14 +102,16 @@
     "mustache": "^4.2.0",
     "nestjs-pino": "^4.1.0",
     "node-cache": "5.1.2",
+    "node-webpmux": "^3.2.1",
     "passport": "^0.7.0",
     "passport-headerapikey": "^1.2.2",
     "pg": "^8.13.1",
+    "pg-copy-streams": "^6.0.0",
     "pino-http": "^10.2.0",
     "pino-pretty": "^11.2.1",
     "pretty-bytes": "5.6.0",
     "promise-retry": "^2.0.1",
-    "puppeteer": "^24.31.0",
+    "puppeteer": "^25.10.0",
     "qrcode": "^1.5.1",
     "qrcode-terminal": "^0.12.0",
     "reflect-metadata": "^0.1.13",
@@ -110,13 +121,15 @@
     "shell-quote": "^1.8.3",
     "sqlite3": "^5.1.7",
     "swagger-ui-express": "^4.1.4",
+    "tapable": "^2.2.2",
     "ulid": "^2.3.0",
     "undici": "^7.16.0",
     "uniqid": "^5.4.0",
     "user-agents": "^1.1.669",
-    "whatsapp-web.js": "github:devlikeapro/whatsapp-web.js#fork-main-2026-02-18",
+    "whatsapp-web.js": "github:devlikeapro/whatsapp-web.js#fork-main-2026-06-26",
     "write-file-atomic": "^6.0.0",
-    "yaml": "^2.7.1"
+    "yaml": "^2.7.1",
+    "zod": "^4.3.6"
   },
   "optionalDependencies": {
     "bufferutil": "^4.0.8"
@@ -125,10 +138,11 @@
     "typescript": "5.9.2",
     "bufferutil": "^4.0.8",
     "ws": "^8.18.0",
-    "puppeteer": "^24.31.0",
+    "puppeteer": "^25.10.0",
     "whatwg-url": "13.0.0",
-    "axios": "^1.9.0",
-    "whatsapp-rust-bridge": "npm:@devlikeapro/whatsapp-rust-bridge@0.5.2"
+    "axios": "^1.19.0",
+    "whatsapp-rust-bridge": "npm:@devlikeapro/whatsapp-rust-bridge@0.5.2",
+    "sharp": "0.35.3"
   },
   "devDependencies": {
     "@grpc/grpc-js": "^1.14.1",
@@ -199,5 +213,5 @@
       }
     ]
   },
-  "packageManager": "yarn@4.9.2"
+  "packageManager": "yarn@4.17.1"
 }

scripts/release.js

@@ -0,0 +1,218 @@
+#!/usr/bin/env node
+'use strict';
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { execFileSync } = require('child_process');
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const readline = require('readline');
+
+const DEV_BRANCH = process.env.WAHA_DEV_BRANCH || 'dev';
+const CORE_BRANCH = process.env.WAHA_CORE_BRANCH || 'core';
+const PLUS_BRANCH = process.env.WAHA_PLUS_BRANCH || 'plus';
+
+const CORE_PREFIX = '[core]';
+const PLUS_PREFIX = '[PLUS]';
+
+const args = process.argv.slice(2);
+const dryRun = args.includes('--dry-run');
+const assumeYes = args.includes('--yes') || args.includes('-y');
+
+function git(gitArgs, options) {
+  const opts = options || {};
+  return execFileSync('git', gitArgs, {
+    encoding: 'utf8',
+    stdio: opts.inherit ? 'inherit' : ['ignore', 'pipe', 'pipe'],
+  });
+}
+
+function gitOut(gitArgs) {
+  return git(gitArgs, { inherit: false }).trim();
+}
+
+function log(message) {
+  console.log(message);
+}
+
+function fail(message) {
+  console.error(`\n✗ ${message}`);
+  process.exit(1);
+}
+
+function ensureCleanTree() {
+  const status = gitOut(['status', '--porcelain']);
+  if (status) {
+    fail(
+      'Working tree is not clean. Commit or stash your changes before releasing.',
+    );
+  }
+}
+
+function ensureBranchExists(branch) {
+  try {
+    git(['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`]);
+  } catch {
+    fail(`Branch "${branch}" does not exist locally.`);
+  }
+}
+
+// Non-merge commits in `boundary..head`, oldest first, whose subject starts
+// with prefix. The boundary is the last-released plus tip: dev is rebased onto
+// plus every release, so `plus..dev` is exactly the new, unreleased work.
+// We intentionally do not use `git cherry` (patch-id matching) because core is
+// a rewritten history whose old commits share no patch-ids with dev.
+function commitsToCherryPick(boundary, head, prefix) {
+  const format = '%H%x09%s';
+  const output = gitOut([
+    'rev-list',
+    '--reverse',
+    '--no-merges',
+    `--format=${format}`,
+    `${boundary}..${head}`,
+  ]);
+  if (!output) {
+    return [];
+  }
+  const picks = [];
+  for (const line of output.split('\n')) {
+    // rev-list --format prefixes each entry with a "commit <sha>" header line.
+    if (!line || line.startsWith('commit ')) {
+      continue;
+    }
+    const tab = line.indexOf('\t');
+    const sha = line.slice(0, tab);
+    const subject = line.slice(tab + 1);
+    if (subject.startsWith(prefix)) {
+      picks.push({ sha: sha, subject: subject });
+    }
+  }
+  return picks;
+}
+
+function cherryPickAll(picks) {
+  for (const pick of picks) {
+    log(`  cherry-pick ${pick.sha.slice(0, 9)} ${pick.subject}`);
+    if (dryRun) {
+      continue;
+    }
+    try {
+      git(['cherry-pick', pick.sha], { inherit: true });
+    } catch {
+      git(['cherry-pick', '--abort'], { inherit: true });
+      fail(
+        `Cherry-pick of ${pick.sha.slice(0, 9)} failed (conflict). ` +
+          `Aborted the cherry-pick — resolve manually and re-run.`,
+      );
+    }
+  }
+}
+
+function checkout(branch) {
+  log(`\n→ checkout ${branch}`);
+  if (!dryRun) {
+    git(['checkout', branch], { inherit: true });
+  }
+}
+
+function confirm(question) {
+  if (assumeYes || dryRun) {
+    return Promise.resolve(true);
+  }
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+  return new Promise(function resolver(resolve) {
+    rl.question(`${question} [y/N] `, function onAnswer(answer) {
+      rl.close();
+      resolve(/^y(es)?$/i.test(answer.trim()));
+    });
+  });
+}
+
+async function main() {
+  ensureCleanTree();
+  [DEV_BRANCH, CORE_BRANCH, PLUS_BRANCH].forEach(ensureBranchExists);
+
+  const startBranch = gitOut(['rev-parse', '--abbrev-ref', 'HEAD']);
+
+  if (dryRun) {
+    log('Running in --dry-run mode: no branches will be modified.\n');
+  }
+
+  // Capture the last-released plus tip before we touch anything. Step 3 merges
+  // core into plus and moves the branch, so both pick sets must be computed
+  // against this saved boundary, not the live plus ref.
+  const boundary = gitOut(['rev-parse', PLUS_BRANCH]);
+  log(`Boundary (last released ${PLUS_BRANCH}): ${boundary.slice(0, 9)}\n`);
+
+  const corePicks = commitsToCherryPick(boundary, DEV_BRANCH, CORE_PREFIX);
+  log(
+    `Found ${corePicks.length} "${CORE_PREFIX}" commit(s) in ` +
+      `${DEV_BRANCH} since last ${PLUS_BRANCH} release.`,
+  );
+
+  // Step 1 + 2: bring missing [core] commits onto core.
+  checkout(CORE_BRANCH);
+  cherryPickAll(corePicks);
+
+  // Step 3: merge the freshly updated core into plus.
+  checkout(PLUS_BRANCH);
+  log(`\n→ merge ${CORE_BRANCH} into ${PLUS_BRANCH}`);
+  if (!dryRun) {
+    try {
+      git(['merge', '--no-edit', CORE_BRANCH], { inherit: true });
+    } catch {
+      git(['merge', '--abort'], { inherit: true });
+      fail(
+        `Merge of ${CORE_BRANCH} into ${PLUS_BRANCH} failed (conflict). ` +
+          `Aborted the merge — resolve manually and re-run.`,
+      );
+    }
+  }
+
+  // Step 4: bring missing [PLUS] commits onto plus (same saved boundary).
+  const plusPicks = commitsToCherryPick(boundary, DEV_BRANCH, PLUS_PREFIX);
+  log(
+    `\nFound ${plusPicks.length} "${PLUS_PREFIX}" commit(s) in ` +
+      `${DEV_BRANCH} since last ${PLUS_BRANCH} release.`,
+  );
+  cherryPickAll(plusPicks);
+
+  // Step 5: rebase dev onto the freshly built plus.
+  log(`\n→ rebase ${DEV_BRANCH} onto ${PLUS_BRANCH} (rewrites ${DEV_BRANCH})`);
+  const proceed = await confirm(
+    `This will force-rewrite "${DEV_BRANCH}". Continue?`,
+  );
+  if (!proceed) {
+    fail('Aborted before rebasing dev. core/plus changes are kept.');
+  }
+  checkout(DEV_BRANCH);
+  if (!dryRun) {
+    try {
+      git(['rebase', PLUS_BRANCH], { inherit: true });
+    } catch {
+      git(['rebase', '--abort'], { inherit: true });
+      fail(
+        `Rebase of ${DEV_BRANCH} onto ${PLUS_BRANCH} failed (conflict). ` +
+          `Aborted the rebase — resolve manually and re-run.`,
+      );
+    }
+  }
+
+  if (dryRun) {
+    checkout(startBranch);
+    log('\nDry run complete. Re-run without --dry-run to apply.');
+  } else {
+    log(
+      `\n✓ Release complete. ${DEV_BRANCH} now sits on top of ${PLUS_BRANCH}.`,
+    );
+    log(
+      `  Push when ready: git push origin ${CORE_BRANCH} ${PLUS_BRANCH} ` +
+        `&& git push --force-with-lease origin ${DEV_BRANCH}`,
+    );
+  }
+}
+
+main().catch(function onError(error) {
+  fail(error.message || String(error));
+});

src/api/apikeys.controller.ts

@@ -3,24 +3,25 @@ import {
   Controller,
   Delete,
   Get,
-  NotFoundException,
   Param,
   Post,
   Put,
-  UnprocessableEntityException,
   UseGuards,
   UsePipes,
 } from '@nestjs/common';
 import { ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
 import { SessionManager } from '@waha/core/abc/manager.abc';
 import { Action } from '@waha/core/auth/casl.types';
-import { CanServer } from '@waha/core/auth/policies';
+import { CanServer, CanSession, FromBody } from '@waha/core/auth/policies';
 import { CheckPolicies } from '@waha/core/auth/policies.decorator';
 import { PoliciesGuard } from '@waha/core/auth/policies.guard';
-import { ApiKey, CheckInvariant } from '@waha/core/storage/IApiKeyRepository';
+import { ApiKeyService } from '@waha/core/services/ApiKeyService';
 import { WAHAValidationPipe } from '@waha/nestjs/pipes/WAHAValidationPipe';
-import { ApiKeyDTO, ApiKeyRequest } from '@waha/structures/apikeys.dto';
-import { generatePrefixedId, generateSecret } from '@waha/utils/ids';
+import {
+  ApiKeyDTO,
+  ApiKeyRequest,
+  ScopedApiKeyRequest,
+} from '@waha/structures/apikeys.dto';
 
 @ApiSecurity('api_key')
 @Controller('api/keys')
@@ -30,57 +31,41 @@ import { generatePrefixedId, generateSecret } from '@waha/utils/ids';
 export class ApiKeysController {
   constructor(private manager: SessionManager) {}
 
+  private get service(): ApiKeyService {
+    return new ApiKeyService(this.manager);
+  }
+
   @Post('/')
   @ApiOperation({ summary: 'Create a new API key' })
   @UsePipes(new WAHAValidationPipe())
   async create(@Body() body: ApiKeyRequest): Promise<ApiKeyDTO> {
-    CheckInvariant(body);
-    if (body.session) {
-      const exists = await this.manager.exists(body.session);
-      if (!exists) {
-        throw new UnprocessableEntityException(
-          `Session "${body.session}" does not exist`,
-        );
-      }
-    }
-    let apikey: ApiKey | null = null;
-    // Try 5 times to check there's no conflict on id and key
-    for (let i = 0; i < 5; i++) {
-      apikey = {
-        id: generatePrefixedId('key_id'),
-        key: `key_${generateSecret(32)}`,
-        isActive: body.isActive,
-        isAdmin: body.isAdmin,
-        session: body.session,
-        rules: null,
-      };
-      const idExists = await this.manager.apiKeyRepository.getById(apikey.id);
-      if (idExists) {
-        continue;
-      }
-      const keyExists = await this.manager.apiKeyRepository.getByKey(
-        apikey.key,
-      );
-      if (keyExists) {
-        continue;
-      }
-      break;
-    }
-    if (!apikey) {
-      throw new UnprocessableEntityException(
-        `Failed to generate API key, try again`,
-      );
-    }
-    CheckInvariant(apikey);
-    await this.manager.apiKeyRepository.upsert(apikey);
-    return ApiKeyToDTO(apikey);
+    return this.service.create(body);
   }
 
   @Get('/')
   @ApiOperation({ summary: 'Get all API keys' })
   async list(): Promise<ApiKeyDTO[]> {
-    const keys = await this.manager.apiKeyRepository.list();
-    return keys.map((key) => ApiKeyToDTO(key));
+    return this.service.list();
+  }
+
+  @Post('/media')
+  @ApiOperation({
+    summary: 'Create or get a media-download-only API key for a session',
+  })
+  @CheckPolicies(CanSession(Action.Read, FromBody('session')))
+  @UsePipes(new WAHAValidationPipe())
+  async media(@Body() body: ScopedApiKeyRequest): Promise<ApiKeyDTO> {
+    return this.service.createOrGetMediaKey(body.session);
+  }
+
+  @Post('/control')
+  @ApiOperation({
+    summary: 'Create or get a control-only API key for a session',
+  })
+  @CheckPolicies(CanSession(Action.Control, FromBody('session')))
+  @UsePipes(new WAHAValidationPipe())
+  async control(@Body() body: ScopedApiKeyRequest): Promise<ApiKeyDTO> {
+    return this.service.createOrGetControlKey(body.session);
   }
 
   @Put('/:id')
@@ -90,50 +75,12 @@ export class ApiKeysController {
     @Param('id') id: string,
     @Body() body: ApiKeyRequest,
   ): Promise<ApiKeyDTO> {
-    const existing = await this.manager.apiKeyRepository.getById(id);
-    if (!existing) {
-      throw new NotFoundException('API key not found');
-    }
-
-    const apikey: ApiKey = {
-      ...existing,
-      isActive: body.isActive,
-      isAdmin: body.isAdmin,
-      session: body.session,
-    };
-    CheckInvariant(apikey);
-    if (apikey.session) {
-      const exists = await this.manager.exists(apikey.session);
-      if (!exists) {
-        throw new UnprocessableEntityException(
-          `Session "${apikey.session}" does not exist`,
-        );
-      }
-    }
-
-    CheckInvariant(apikey);
-    await this.manager.apiKeyRepository.upsert(apikey);
-    return ApiKeyToDTO(apikey);
+    return this.service.update(id, body);
   }
 
   @Delete('/:id')
   @ApiOperation({ summary: 'Delete an API key' })
   async delete(@Param('id') id: string): Promise<{ result: true }> {
-    const existing = await this.manager.apiKeyRepository.getById(id);
-    if (!existing) {
-      throw new NotFoundException('API key not found');
-    }
-    await this.manager.apiKeyRepository.deleteById(id);
-    return { result: true };
+    return this.service.delete(id);
   }
 }
-
-function ApiKeyToDTO(apikey: ApiKey): ApiKeyDTO {
-  return {
-    id: apikey.id,
-    key: apikey.key,
-    isActive: apikey.isActive,
-    isAdmin: apikey.isAdmin,
-    session: apikey.session,
-  };
-}

src/api/auth.controller.ts

@@ -7,7 +7,12 @@ import {
   UseInterceptors,
   UseGuards,
 } from '@nestjs/common';
-import { ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
+import {
+  ApiOkResponse,
+  ApiOperation,
+  ApiSecurity,
+  ApiTags,
+} from '@nestjs/swagger';
 import { ApiFileAcceptHeader } from '@waha/nestjs/ApiFileAcceptHeader';
 import {
   QRCodeSessionParam,
@@ -19,6 +24,9 @@ import { SessionManager } from '../core/abc/manager.abc';
 import { WhatsappSession } from '../core/abc/session.abc';
 import { BufferResponseInterceptor } from '../nestjs/BufferResponseInterceptor';
 import {
+  PasskeyAssertionRequest,
+  PasskeyChallenge,
+  PasskeyConfirmationResponse,
   QRCodeFormat,
   QRCodeQuery,
   QRCodeValue,
@@ -35,7 +43,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/auth')
 @ApiTags('📱 Pairing')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
+@CheckPolicies(CanSession(Action.Control, FromParam('session')))
 class AuthController {
   constructor(private manager: SessionManager) {}
 
@@ -68,6 +76,54 @@ class AuthController {
   ) {
     return session.requestCode(request.phoneNumber, request.method, request);
   }
+
+  @Get('passkey/challenge')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Get the pending passkey (WebAuthn) challenge.',
+    description:
+      'Available while the session is in PASSKEY_REQUIRED status. ' +
+      'Pass the challenge to navigator.credentials.get({ publicKey: challenge }) ' +
+      'on the https://web.whatsapp.com origin.',
+  })
+  @ApiOkResponse({ type: PasskeyChallenge })
+  getPasskeyChallenge(@SessionParam session: WhatsappSession) {
+    return session.getPasskeyChallenge();
+  }
+
+  @Post('passkey')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Submit a WebAuthn passkey assertion to finish pairing.',
+  })
+  submitPasskey(
+    @SessionParam session: WhatsappSession,
+    @Body() request: PasskeyAssertionRequest,
+  ) {
+    return session.sendPasskeyResponse(JSON.stringify(request));
+  }
+
+  @Get('passkey/confirmation')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Get the pending passkey confirmation code.',
+    description:
+      'Available while the session is in PASSKEY_CONFIRMATION_REQUIRED status. ' +
+      'Most pairings skip this step - WhatsApp confirms them right after the assertion.',
+  })
+  @ApiOkResponse({ type: PasskeyConfirmationResponse })
+  getPasskeyConfirmation(@SessionParam session: WhatsappSession) {
+    return session.getPasskeyConfirmation();
+  }
+
+  @Post('passkey/confirm')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Confirm passkey pairing (only needed for the manual code case).',
+  })
+  confirmPasskey(@SessionParam session: WhatsappSession) {
+    return session.confirmPasskey();
+  }
 }
 
 export { AuthController };

src/api/calls.controller.ts

@@ -25,7 +25,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/calls')
 @ApiTags('📞 Calls')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
+@CheckPolicies(CanSession(Action.Send, FromParam('session')))
 export class CallsController {
   constructor(private manager: SessionManager) {}
 

src/api/channels.controller.ts

@@ -50,7 +50,6 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/channels')
 @ApiTags('📢 Channels')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class ChannelsController {
   constructor(
     private manager: SessionManager,
@@ -59,6 +58,7 @@ export class ChannelsController {
 
   @Get('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get list of know channels' })
   async list(
     @WorkingSessionParam session: WhatsappSession,
@@ -69,6 +69,7 @@ export class ChannelsController {
 
   @Post('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Create a new channel.' })
   create(
     @WorkingSessionParam session: WhatsappSession,
@@ -80,6 +81,7 @@ export class ChannelsController {
   @Delete(':id')
   @SessionApiParam
   @NewsletterIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Delete the channel.' })
   delete(
     @WorkingSessionParam session: WhatsappSession,
@@ -91,6 +93,7 @@ export class ChannelsController {
   @Get(':id')
   @SessionApiParam
   @NewsletterIdOrInviteCodeApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary: 'Get the channel info',
     description:
@@ -111,6 +114,7 @@ export class ChannelsController {
 
   @Get(':id/messages/preview')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   @ApiParam({
     name: 'id',
@@ -146,6 +150,7 @@ export class ChannelsController {
   @Post(':id/follow')
   @SessionApiParam
   @NewsletterIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Follow the channel.' })
   follow(
     @WorkingSessionParam session: WhatsappSession,
@@ -157,6 +162,7 @@ export class ChannelsController {
   @Post(':id/unfollow')
   @SessionApiParam
   @NewsletterIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Unfollow the channel.' })
   unfollow(
     @WorkingSessionParam session: WhatsappSession,
@@ -168,6 +174,7 @@ export class ChannelsController {
   @Post(':id/mute')
   @SessionApiParam
   @NewsletterIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Mute the channel.' })
   mute(
     @WorkingSessionParam session: WhatsappSession,
@@ -179,6 +186,7 @@ export class ChannelsController {
   @Post(':id/unmute')
   @SessionApiParam
   @NewsletterIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Unmute the channel.' })
   unmute(
     @WorkingSessionParam session: WhatsappSession,
@@ -190,6 +198,7 @@ export class ChannelsController {
   @Post('/search/by-view')
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   @ApiOperation({ summary: 'Search for channels (by view)' })
   async searchByView(
@@ -202,6 +211,7 @@ export class ChannelsController {
   @Post('/search/by-text')
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   @ApiOperation({ summary: 'Search for channels (by text)' })
   async searchByText(
@@ -213,6 +223,7 @@ export class ChannelsController {
 
   @Get('/search/views')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get list of views for channel search' })
   getSearchViews(): Promise<ChannelView[]> {
     return this.channelsInfoService.getViews();
@@ -220,6 +231,7 @@ export class ChannelsController {
 
   @Get('/search/countries')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get list of countries for channel search' })
   getSearchCountries(): Promise<ChannelCountry[]> {
     return this.channelsInfoService.getCountries();
@@ -227,6 +239,7 @@ export class ChannelsController {
 
   @Get('/search/categories')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get list of categories for channel search' })
   getSearchCategories(): Promise<ChannelCategory[]> {
     return this.channelsInfoService.getCategories();

src/api/chats.controller.ts

@@ -52,12 +52,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @ApiTags('💬 Chats')
 @UsePipes(new ValidationPipe({ transform: true }))
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 class ChatsController {
   constructor(private manager: SessionManager) {}
 
   @Get('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get chats' })
   getChats(
     @WorkingSessionParam session: WhatsappSession,
@@ -68,6 +68,7 @@ class ChatsController {
 
   @Get('overview')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary:
       'Get chats overview. Includes all necessary things to build UI "your chats overview" page - chat id, name, picture, last message. Sorting by last message timestamp',
@@ -83,6 +84,7 @@ class ChatsController {
 
   @Post('overview')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary:
       'Get chats overview. Use POST if you have too many "ids" params - GET can limit it',
@@ -97,6 +99,7 @@ class ChatsController {
 
   @Delete(':chatId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Deletes the chat' })
   @ChatIdApiParam
   deleteChat(
@@ -108,6 +111,7 @@ class ChatsController {
 
   @Get(':chatId/picture')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Gets chat picture' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getChatPicture(
@@ -121,6 +125,7 @@ class ChatsController {
 
   @Get(':chatId/messages')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Gets messages in the chat' })
   @ChatIdApiParam
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
@@ -141,6 +146,7 @@ class ChatsController {
 
   @Post(':chatId/messages/read')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Read unread messages in the chat' })
   @ChatIdApiParam
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
@@ -154,6 +160,7 @@ class ChatsController {
 
   @Get(':chatId/messages/:messageId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Gets message by id' })
   @ChatIdApiParam
   async getChatMessage(
@@ -171,6 +178,7 @@ class ChatsController {
 
   @Post(':chatId/messages/:messageId/pin')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Pins a message in the chat' })
   @ChatIdApiParam
   async pinMessage(
@@ -185,6 +193,7 @@ class ChatsController {
 
   @Post(':chatId/messages/:messageId/unpin')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Unpins a message in the chat' })
   @ChatIdApiParam
   async unpinMessage(
@@ -198,6 +207,7 @@ class ChatsController {
 
   @Delete(':chatId/messages')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Clears all messages from the chat' })
   @ChatIdApiParam
   clearMessages(
@@ -209,6 +219,7 @@ class ChatsController {
 
   @Delete(':chatId/messages/:messageId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ChatIdApiParam
   @MessageIdApiParam
   @ApiOperation({ summary: 'Deletes a message from the chat' })
@@ -222,6 +233,7 @@ class ChatsController {
 
   @Put(':chatId/messages/:messageId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ChatIdApiParam
   @MessageIdApiParam
   @ApiOperation({ summary: 'Edits a message in the chat' })
@@ -236,6 +248,7 @@ class ChatsController {
 
   @Post(':chatId/archive')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ChatIdApiParam
   @ApiOperation({ summary: 'Archive the chat' })
   archiveChat(
@@ -247,6 +260,7 @@ class ChatsController {
 
   @Post(':chatId/unarchive')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ChatIdApiParam
   @ApiOperation({ summary: 'Unarchive the chat' })
   unarchiveChat(
@@ -258,6 +272,7 @@ class ChatsController {
 
   @Post(':chatId/unread')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ChatIdApiParam
   @ApiOperation({ summary: 'Unread the chat' })
   unreadChat(

src/api/chatting.controller.ts

@@ -9,7 +9,7 @@ import {
   UsePipes,
   ValidationPipe,
 } from '@nestjs/common';
-import { ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
+import { ApiBody, ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
 import { WAHAValidationPipe } from '@waha/nestjs/pipes/WAHAValidationPipe';
 import {
   GetChatMessagesFilter,
@@ -37,10 +37,12 @@ import {
   MessageReactionRequest,
   MessageReplyRequest,
   MessageStarRequest,
+  MessageStickerRequest,
   MessageTextQuery,
   MessageTextRequest,
   MessageVideoRequest,
   MessageVoiceRequest,
+  NewMessageIDResponse,
   SendSeenRequest,
   WANumberExistResult,
 } from '../structures/chatting.dto';
@@ -49,9 +51,19 @@ import {
   mentionsAll,
   validateRequestMentions,
 } from '@waha/core/utils/mentions.all';
+import {
+  SessionApiParam,
+  WorkingSessionParam,
+} from '@waha/nestjs/params/SessionApiParam';
+import { WhatsappSession } from '@waha/core/abc/session.abc';
 import { PoliciesGuard } from '@waha/core/auth/policies.guard';
 import { CheckPolicies } from '@waha/core/auth/policies.decorator';
-import { CanSession, FromBody, FromQuery } from '@waha/core/auth/policies';
+import {
+  CanSession,
+  FromBody,
+  FromParam,
+  FromQuery,
+} from '@waha/core/auth/policies';
 
 import { Action } from '@waha/core/auth/casl.types';
 
@@ -64,7 +76,7 @@ export class ChattingController {
 
   @Post('/sendText')
   @ApiOperation({ summary: 'Send a text message' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendText(@Body() request: MessageTextRequest): Promise<WAMessage> {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     if (mentionsAll(request)) {
@@ -80,7 +92,7 @@ export class ChattingController {
     description:
       'Either from an URL or base64 data - look at the request schemas for details.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendImage(@Body() request: MessageImageRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     if (mentionsAll(request)) {
@@ -96,7 +108,7 @@ export class ChattingController {
     description:
       'Either from an URL or base64 data - look at the request schemas for details.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendFile(@Body() request: MessageFileRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     if (mentionsAll(request)) {
@@ -112,7 +124,7 @@ export class ChattingController {
     description:
       'Either from an URL or base64 data - look at the request schemas for details.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendVoice(@Body() request: MessageVoiceRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.sendVoice(request);
@@ -124,7 +136,7 @@ export class ChattingController {
     description:
       'Either from an URL or base64 data - look at the request schemas for details.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendVideo(@Body() request: MessageVideoRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     if (mentionsAll(request)) {
@@ -134,13 +146,53 @@ export class ChattingController {
     return whatsapp.sendVideo(request);
   }
 
+  @Post('/sendSticker')
+  @ApiOperation({
+    summary: 'Send a sticker',
+    description:
+      'The image will not be converted. It must already be in WebP format. PNG and JPEG are not supported.',
+  })
+  @ApiBody({
+    type: MessageStickerRequest,
+    examples: {
+      url: {
+        summary: 'From URL',
+        value: {
+          session: 'default',
+          chatId: '11111111111@c.us',
+          reply_to: null,
+          file: {
+            url: 'https://www.gstatic.com/webp/gallery/1.webp',
+          },
+        },
+      },
+      base64webp: {
+        summary: 'From base64 WebP',
+        value: {
+          session: 'default',
+          chatId: '11111111111@c.us',
+          reply_to: null,
+          file: {
+            mimetype: 'image/webp',
+            data: 'your-base64-data-of-webp',
+          },
+        },
+      },
+    },
+  })
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
+  async sendSticker(@Body() request: MessageStickerRequest) {
+    const whatsapp = await this.manager.getWorkingSession(request.session);
+    return whatsapp.sendSticker(request);
+  }
+
   @Post('/send/link-custom-preview')
   @ApiOperation({
     summary: 'Send a text message with a CUSTOM link preview.',
     description:
       'You can use regular /api/sendText if you wanna send auto-generated link preview.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   @UsePipes(new WAHAValidationPipe())
   async sendLinkCustomPreview(
     @Body() request: MessageLinkCustomPreviewRequest,
@@ -160,7 +212,7 @@ export class ChattingController {
     description: 'Send Buttons',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   @UsePipes(new WAHAValidationPipe())
   async sendButtons(@Body() request: SendButtonsRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
@@ -172,7 +224,7 @@ export class ChattingController {
     summary: 'Send a list message (interactive)',
     description: 'Send a List message with sections and rows',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   @UsePipes(new WAHAValidationPipe())
   async sendList(@Body() request: SendListRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
@@ -180,7 +232,7 @@ export class ChattingController {
   }
 
   @Post('/forwardMessage')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async forwardMessage(
     @Body() request: MessageForwardRequest,
   ): Promise<WAMessage> {
@@ -189,7 +241,7 @@ export class ChattingController {
   }
 
   @Post('/sendSeen')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendSeen(@Body() chat: SendSeenRequest) {
     const hasMessageId = chat.messageIds?.length > 0 || Boolean(chat.messageId);
     if (!hasMessageId) {
@@ -205,7 +257,7 @@ export class ChattingController {
   }
 
   @Post('/startTyping')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async startTyping(@Body() chat: ChatRequest) {
     // It's infinitive action
     const whatsapp = await this.manager.getWorkingSession(chat.session);
@@ -214,7 +266,7 @@ export class ChattingController {
   }
 
   @Post('/stopTyping')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async stopTyping(@Body() chat: ChatRequest) {
     const whatsapp = await this.manager.getWorkingSession(chat.session);
     await whatsapp.stopTyping(chat);
@@ -223,7 +275,7 @@ export class ChattingController {
 
   @Put('/reaction')
   @ApiOperation({ summary: 'React to a message with an emoji' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async setReaction(@Body() request: MessageReactionRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.setReaction(request);
@@ -231,7 +283,7 @@ export class ChattingController {
 
   @Put('/star')
   @ApiOperation({ summary: 'Star or unstar a message' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async setStar(@Body() request: MessageStarRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     await whatsapp.setStar(request);
@@ -243,7 +295,8 @@ export class ChattingController {
     summary: 'Send a poll with options',
     description: 'You can use it as buttons or list replacement',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
+  @UsePipes(new WAHAValidationPipe())
   async sendPoll(@Body() request: MessagePollRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.sendPoll(request);
@@ -254,7 +307,7 @@ export class ChattingController {
     summary: 'Vote on a poll',
     description: 'Cast vote(s) on an existing poll message',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   @UsePipes(new WAHAValidationPipe())
   async sendPollVote(@Body() request: MessagePollVoteRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
@@ -262,14 +315,14 @@ export class ChattingController {
   }
 
   @Post('/sendLocation')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendLocation(@Body() request: MessageLocationRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.sendLocation(request);
   }
 
   @Post('/sendContactVcard')
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendContactVcard(@Body() request: MessageContactVcardRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.sendContactVCard(request);
@@ -279,7 +332,7 @@ export class ChattingController {
   @ApiOperation({
     summary: 'Reply on a button message',
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async sendButtonsReply(@Body() request: MessageButtonReply) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
@@ -288,7 +341,7 @@ export class ChattingController {
 
   @Get('/sendText')
   @ApiOperation({ summary: 'Send a text message', deprecated: true })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Send, FromQuery('session')))
   async sendTextGet(@Query() query: MessageTextQuery) {
     const whatsapp = await this.manager.getWorkingSession(query.session);
     const msg = new MessageTextRequest();
@@ -303,7 +356,7 @@ export class ChattingController {
     description: 'DEPRECATED. Use "GET /api/chats/{id}/messages" instead',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getMessages(
     @Query() query: GetMessageQuery,
@@ -320,7 +373,7 @@ export class ChattingController {
     description: 'DEPRECATED. Use "POST /contacts/check-exists" instead',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   async DEPRECATED_checkNumberStatus(
     @Query() request: CheckNumberStatusQuery,
   ): Promise<WANumberExistResult> {
@@ -334,7 +387,7 @@ export class ChattingController {
       'DEPRECATED - you can set "reply_to" field when sending text, image, etc',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async reply(@Body() request: MessageReplyRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.reply(request);
@@ -342,9 +395,20 @@ export class ChattingController {
 
   @Post('/sendLinkPreview')
   @ApiOperation({ deprecated: true })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async sendLinkPreview_DEPRECATED(@Body() request: MessageLinkPreviewRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.sendLinkPreview(request);
   }
+
+  @Get('/:session/new-message-id')
+  @SessionApiParam
+  @ApiOperation({ summary: 'Generate a new message ID' })
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  async getNewMessageId(
+    @WorkingSessionParam session: WhatsappSession,
+  ): Promise<NewMessageIDResponse> {
+    const id = await session.generateNewMessageId();
+    return { id: id };
+  }
 }

src/api/contacts.controller.ts

@@ -37,7 +37,7 @@ export class ContactsController {
 
   @Get('/all')
   @ApiOperation({ summary: 'Get all contacts' })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getAll(
     @Query() query: SessionQuery,
@@ -53,7 +53,7 @@ export class ContactsController {
     description:
       'The method always return result, even if the phone number is not registered in WhatsApp. For that - use /contacts/check-exists endpoint below.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   async get(@Query() query: ContactQuery) {
     const whatsapp = await this.manager.getWorkingSession(query.session);
     return whatsapp.getContact(query);
@@ -61,7 +61,7 @@ export class ContactsController {
 
   @Get('/check-exists')
   @ApiOperation({ summary: 'Check phone number is registered in WhatsApp.' })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   async checkExists(
     @Query() request: CheckNumberStatusQuery,
   ): Promise<WANumberExistResult> {
@@ -75,7 +75,7 @@ export class ContactsController {
     description:
       'Returns null if you do not have permission to read their status.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   async getAbout(@Query() query: ContactQuery) {
     const whatsapp = await this.manager.getWorkingSession(query.session);
     return whatsapp.getContactAbout(query);
@@ -87,7 +87,7 @@ export class ContactsController {
     description:
       'If privacy settings do not allow to get the picture, the method will return null.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.Read, FromQuery('session')))
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getProfilePicture(@Query() query: ContactProfilePictureQuery) {
     const whatsapp = await this.manager.getWorkingSession(query.session);
@@ -100,7 +100,7 @@ export class ContactsController {
 
   @Post('/block')
   @ApiOperation({ summary: 'Block contact' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async block(@Body() request: ContactRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.blockContact(request);
@@ -108,7 +108,7 @@ export class ContactsController {
 
   @Post('/unblock')
   @ApiOperation({ summary: 'Unblock contact' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.Send, FromBody('session')))
   async unblock(@Body() request: ContactRequest) {
     const whatsapp = await this.manager.getWorkingSession(request.session);
     return whatsapp.unblockContact(request);

src/api/contacts.session.controller.ts

@@ -28,12 +28,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/contacts')
 @ApiTags('👤 Contacts')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class ContactsSessionController {
   constructor(private manager: SessionManager) {}
 
   @Get('/:id')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiParam({
     name: 'id',
     required: true,
@@ -56,6 +56,7 @@ export class ContactsSessionController {
   @Put('/:chatId')
   @SessionApiParam
   @ChatIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Create or update contact',
     description:

src/api/events.controller.ts

@@ -30,7 +30,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/events')
 @ApiTags('📅 Events')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
+@CheckPolicies(CanSession(Action.Send, FromParam('session')))
 export class EventsController {
   constructor(private manager: SessionManager) {}
 

src/api/groups.controller.ts

@@ -32,12 +32,16 @@ import {
   CreateGroupRequest,
   DescriptionRequest,
   GroupField,
+  GroupJoinRequest,
+  GroupJoinRequestResult,
   GroupParticipant,
   GroupsListFields,
   GroupsPaginationParams,
   JoinGroupRequest,
   JoinGroupResponse,
   ParticipantsRequest,
+  SettingsMemberAddMode,
+  SettingsMembershipApproval,
   SettingsSecurityChangeInfo,
   SubjectRequest,
 } from '../structures/groups.dto';
@@ -51,12 +55,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/groups')
 @ApiTags('👥 Groups')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class GroupsController {
   constructor(private manager: SessionManager) {}
 
   @Post('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Create a new group.' })
   createGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -67,6 +71,7 @@ export class GroupsController {
 
   @Get('join-info')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get info about the group before joining.' })
   async joinInfoGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -79,6 +84,7 @@ export class GroupsController {
   @Post('join')
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Join group via code' })
   async joinGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -91,6 +97,7 @@ export class GroupsController {
 
   @Get('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get all groups.' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getGroups(
@@ -105,6 +112,7 @@ export class GroupsController {
 
   @Get('/count')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get the number of groups.' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getGroupsCount(
@@ -120,6 +128,7 @@ export class GroupsController {
   @Post('refresh')
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Refresh groups from the server.' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async refreshGroups(@WorkingSessionParam session: WhatsappSession) {
@@ -129,6 +138,7 @@ export class GroupsController {
   @Get(':id')
   @GroupIdApiParam
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get the group.' })
   getGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -140,6 +150,7 @@ export class GroupsController {
   @Delete(':id')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Delete the group.' })
   deleteGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -152,6 +163,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Leave the group.' })
   leaveGroup(
     @WorkingSessionParam session: WhatsappSession,
@@ -163,6 +175,7 @@ export class GroupsController {
   @Get(':id/picture')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get group picture' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async getChatPicture(
@@ -177,6 +190,7 @@ export class GroupsController {
   @Put(':id/picture')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Set group picture' })
   async setPicture(
     @Param('id') id: string,
@@ -190,6 +204,7 @@ export class GroupsController {
   @Delete(':id/picture')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Delete group picture' })
   async deletePicture(
     @Param('id') id: string,
@@ -207,6 +222,7 @@ export class GroupsController {
   })
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   setDescription(
     @WorkingSessionParam session: WhatsappSession,
     @Param('id') id: string,
@@ -218,6 +234,7 @@ export class GroupsController {
   @Put(':id/subject')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Updates the group subject',
     description:
@@ -234,6 +251,7 @@ export class GroupsController {
   @Put(':id/settings/security/info-admin-only')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Updates the group "info admin only" settings.',
     description:
@@ -250,6 +268,7 @@ export class GroupsController {
   @Get(':id/settings/security/info-admin-only')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary: "Get the group's 'info admin only' settings.",
     description:
@@ -265,6 +284,7 @@ export class GroupsController {
   @Put(':id/settings/security/messages-admin-only')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Update settings - who can send messages',
     description:
@@ -281,6 +301,7 @@ export class GroupsController {
   @Get(':id/settings/security/messages-admin-only')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary: 'Get settings - who can send messages',
     description: 'The group settings to only allow admins to send messages.',
@@ -292,9 +313,125 @@ export class GroupsController {
     return session.getMessagesAdminsOnly(id);
   }
 
+  @Put(':id/settings/security/member-add-mode')
+  @SessionApiParam
+  @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
+  @ApiOperation({
+    summary: 'Update settings - who can add new members',
+    description:
+      'Updates the group settings for who can add new members to the group - all members or admins only.',
+  })
+  setMemberAddMode(
+    @WorkingSessionParam session: WhatsappSession,
+    @Param('id') id: string,
+    @Body() request: SettingsMemberAddMode,
+  ) {
+    return session.setMemberAddMode(id, request.membersCanAddNewMember);
+  }
+
+  @Get(':id/settings/security/member-add-mode')
+  @SessionApiParam
+  @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  @ApiOperation({
+    summary: 'Get settings - who can add new members',
+    description:
+      'The group settings for who can add new members to the group - all members or admins only.',
+  })
+  getMemberAddMode(
+    @WorkingSessionParam session: WhatsappSession,
+    @Param('id') id: string,
+  ): Promise<SettingsMemberAddMode> {
+    return session.getMemberAddMode(id);
+  }
+
+  @Put(':id/settings/security/membership-approval')
+  @SessionApiParam
+  @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
+  @ApiOperation({
+    summary: 'Update settings - approve new members',
+    description:
+      'Enables or disables admin approval for users requesting to join the group.',
+  })
+  setMembershipApprovalMode(
+    @WorkingSessionParam session: WhatsappSession,
+    @Param('id') id: string,
+    @Body() request: SettingsMembershipApproval,
+  ): Promise<boolean> {
+    return session.setMembershipApprovalMode(
+      id,
+      request.newMembersApprovalRequired,
+    );
+  }
+
+  @Get(':id/settings/security/membership-approval')
+  @SessionApiParam
+  @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  @ApiOperation({
+    summary: 'Get settings - approve new members',
+    description:
+      'Returns whether admin approval is required for users requesting to join the group.',
+  })
+  getMembershipApprovalMode(
+    @WorkingSessionParam session: WhatsappSession,
+    @Param('id') id: string,
+  ): Promise<SettingsMembershipApproval> {
+    return session.getMembershipApprovalMode(id);
+  }
+
+  @Get(':id/participants/join-requests')
+  @SessionApiParam
+  @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  @ApiOperation({
+    summary: 'Get pending requests to join the group',
+  })
+  getGroupJoinRequests(
+    @WorkingSessionParam session: WhatsappSession,
+    @Param('id') id: string,
+  ): Promise<GroupJoinRequest[]> {
+    return session.getGroupJoinRequests(id);
+  }
+
+  @Post(':id/participants/join-requests/approve')
+  @HttpCode(HttpStatus.OK)
+  @SessionApiParam
+  @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
+  @ApiOperation({
+    summary: 'Approve pending requests to join the group',
+  })
+  approveGroupJoinRequests(
+    @WorkingSessionParam session: WhatsappSession,
+    @Param('id') id: string,
+    @Body() request: ParticipantsRequest,
+  ): Promise<GroupJoinRequestResult[]> {
+    return session.approveGroupJoinRequests(id, request);
+  }
+
+  @Post(':id/participants/join-requests/reject')
+  @HttpCode(HttpStatus.OK)
+  @SessionApiParam
+  @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
+  @ApiOperation({
+    summary: 'Reject pending requests to join the group',
+  })
+  rejectGroupJoinRequests(
+    @WorkingSessionParam session: WhatsappSession,
+    @Param('id') id: string,
+    @Body() request: ParticipantsRequest,
+  ): Promise<GroupJoinRequestResult[]> {
+    return session.rejectGroupJoinRequests(id, request);
+  }
+
   @Get(':id/invite-code')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Gets the invite code for the group.' })
   getInviteCode(
     @WorkingSessionParam session: WhatsappSession,
@@ -307,6 +444,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary:
       'Invalidates the current group invite code and generates a new one.',
@@ -321,6 +459,7 @@ export class GroupsController {
   @Get(':id/participants/')
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get participants' })
   getParticipants(
     @WorkingSessionParam session: WhatsappSession,
@@ -332,6 +471,7 @@ export class GroupsController {
   @Get(':id/participants/v2')
   @GroupIdApiParam
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get group participants.' })
   getGroupParticipants(
     @WorkingSessionParam session: WhatsappSession,
@@ -344,6 +484,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Add participants' })
   addParticipants(
     @WorkingSessionParam session: WhatsappSession,
@@ -357,6 +498,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Remove participants',
   })
@@ -372,6 +514,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Promote participants to admin users.' })
   promoteToAdmin(
     @WorkingSessionParam session: WhatsappSession,
@@ -385,6 +528,7 @@ export class GroupsController {
   @HttpCode(HttpStatus.OK)
   @SessionApiParam
   @GroupIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Demotes participants to regular users.' })
   demoteToAdmin(
     @WorkingSessionParam session: WhatsappSession,

src/api/labels.controller.ts

@@ -37,12 +37,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/labels')
 @ApiTags('🏷️ Labels')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class LabelsController {
   constructor(private manager: SessionManager) {}
 
   @Get('/')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get all labels' })
   getAll(@WorkingSessionParam session: WhatsappSession): Promise<Label[]> {
     return session.getLabels();
@@ -50,6 +50,7 @@ export class LabelsController {
 
   @Post('/')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Create a new label' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async create(
@@ -75,6 +76,7 @@ export class LabelsController {
 
   @Put('/:labelId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Update a label' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async update(
@@ -106,6 +108,7 @@ export class LabelsController {
 
   @Delete('/:labelId')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Delete a label' })
   @UsePipes(new ValidationPipe({ transform: true, whitelist: true }))
   async delete(
@@ -123,6 +126,7 @@ export class LabelsController {
   @Get('/chats/:chatId')
   @SessionApiParam
   @ChatIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get labels for the chat' })
   getChatLabels(
     @WorkingSessionParam session: WhatsappSession,
@@ -134,6 +138,7 @@ export class LabelsController {
   @Put('/chats/:chatId')
   @SessionApiParam
   @ChatIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Save labels for the chat' })
   putChatLabels(
     @WorkingSessionParam session: WhatsappSession,
@@ -145,6 +150,7 @@ export class LabelsController {
 
   @Get('/:labelId/chats')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get chats by label' })
   getChatsByLabel(
     @WorkingSessionParam session: WhatsappSession,

src/api/lids.controller.ts

@@ -33,7 +33,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/lids')
 @ApiTags('👤 Contacts')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
+@CheckPolicies(CanSession(Action.Read, FromParam('session')))
 export class LidsController {
   constructor(private manager: SessionManager) {}
 

src/api/media.controller.ts

@@ -32,7 +32,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/media')
 @ApiTags('🖼️ Media')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
+@CheckPolicies(CanSession(Action.Read, FromParam('session')))
 class MediaController {
   constructor(private manager: SessionManager) {}
 

src/api/presence.controller.ts

@@ -31,12 +31,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/presence')
 @ApiTags('✅ Presence')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class PresenceController {
   constructor(private manager: SessionManager) {}
 
   @Post('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Set session presence' })
   setPresence(
     @WorkingSessionParam session: WhatsappSession,
@@ -67,6 +67,7 @@ export class PresenceController {
 
   @Get('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get all subscribed presence information.' })
   getPresenceAll(
     @WorkingSessionParam session: WhatsappSession,
@@ -77,6 +78,7 @@ export class PresenceController {
   @Get(':chatId')
   @SessionApiParam
   @ChatIdApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({
     summary:
       "Get the presence for the chat id. If it hasn't been subscribed - it also subscribes to it.",
@@ -91,6 +93,7 @@ export class PresenceController {
   @Post(':chatId/subscribe')
   @SessionApiParam
   @ChatIdApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Subscribe to presence events for the chat.',
   })

src/api/profile.controller.ts

@@ -33,12 +33,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/profile')
 @ApiTags('🆔 Profile')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 export class ProfileController {
   constructor(private manager: SessionManager) {}
 
   @Get('')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @ApiOperation({ summary: 'Get my profile' })
   async getMyProfile(
     @WorkingSessionParam session: WhatsappSession,
@@ -57,6 +57,7 @@ export class ProfileController {
 
   @Put('/name')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   @ApiOperation({ summary: 'Set my profile name' })
   async setProfileName(
@@ -69,6 +70,7 @@ export class ProfileController {
 
   @Put('/status')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   @ApiOperation({ summary: 'Set profile status (About)' })
   async setProfileStatus(
@@ -81,6 +83,7 @@ export class ProfileController {
 
   @Put('/picture')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Set profile picture' })
   async setProfilePicture(
     @WorkingSessionParam session: WhatsappSession,
@@ -92,6 +95,7 @@ export class ProfileController {
 
   @Delete('/picture')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Delete profile picture' })
   async deleteProfilePicture(
     @WorkingSessionParam session: WhatsappSession,

src/api/screenshot.controller.ts

@@ -24,7 +24,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api')
 @ApiTags('📱 Pairing')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+@CheckPolicies(CanSession(Action.Control, FromQuery('session')))
 export class ScreenshotController {
   constructor(private manager: SessionManager) {}
 

src/api/server.controller.ts

@@ -42,7 +42,7 @@ export class ServerController {
 
   @Get('version')
   @ApiOperation({ summary: 'Get the version of the server' })
-  @CheckPolicies(CanServer(Action.Read))
+  @CheckPolicies(CanServer(Action.Retrieve))
   get(): WAHAEnvironment {
     return VERSION;
   }
@@ -76,7 +76,7 @@ export class ServerController {
 
   @Get('status')
   @ApiOperation({ summary: 'Get the server status' })
-  @CheckPolicies(CanServer(Action.Read))
+  @CheckPolicies(CanServer(Action.Retrieve))
   async status(): Promise<ServerStatusResponse> {
     const now = Date.now();
     const uptime = Math.floor(process.uptime() * 1000);

src/api/sessions.controller.ts

@@ -3,8 +3,6 @@ import {
   Controller,
   Delete,
   Get,
-  Inject,
-  NotFoundException,
   Param,
   Post,
   Put,
@@ -26,27 +24,24 @@ import {
   SessionParam,
 } from '@waha/nestjs/params/SessionApiParam';
 import { WAHAValidationPipe } from '@waha/nestjs/pipes/WAHAValidationPipe';
-import {
-  AppsService,
-  IAppsService,
-} from '@waha/apps/app_sdk/services/IAppsService';
 import {
   SessionLogoutDeprecatedRequest,
   SessionStartDeprecatedRequest,
   SessionStopDeprecatedRequest,
 } from '@waha/structures/sessions.deprecated.dto';
-import { generatePrefixedId } from '@waha/utils/ids';
 
-import { SessionManager } from '../core/abc/manager.abc';
 import { WhatsappSession } from '../core/abc/session.abc';
 import {
   ListSessionsQuery,
   MeInfo,
+  MessageCappingData,
+  ReachoutTimelockData,
   SessionCreateRequest,
   SessionDTO,
   SessionExpand,
   SessionInfo,
   SessionInfoQuery,
+  SessionLogoutRequest,
   SessionUpdateRequest,
 } from '../structures/sessions.dto';
 import { SessionExamples } from './sessions.examples';
@@ -55,39 +50,29 @@ import { CheckPolicies } from '../core/auth/policies.decorator';
 import { PoliciesGuard } from '../core/auth/policies.guard';
 import { CanSession, FromBody, FromParam } from '../core/auth/policies';
 import { Action } from '@waha/core/auth/casl.types';
+import { SessionService } from '@waha/core/services/SessionService';
 
 @ApiSecurity('api_key')
 @Controller('api/sessions')
 @ApiTags('🖥️ Sessions')
 @UseGuards(PoliciesGuard)
 class SessionsController {
-  constructor(
-    private manager: SessionManager,
-    @Inject(AppsService) private appsService: IAppsService,
-  ) {}
-
-  private withLock(name: string, fn: () => any) {
-    return this.manager.withLock(name, fn);
-  }
+  constructor(private readonly sessionService: SessionService) {}
 
   @Get('/')
-  @ApiOperation({
-    summary: 'List all sessions',
-  })
+  @ApiOperation({ summary: 'List all sessions' })
   @CheckPolicies(CanSession(Action.List))
   @ApiOAuth2(['read:items'])
   async list(
     @Query(new WAHAValidationPipe()) query: ListSessionsQuery,
     @Req() req,
   ): Promise<SessionInfo[]> {
-    let sessions = await this.manager.getSessions(query.all);
+    let sessions = await this.sessionService.getSessions(query.all);
     if (!req.user?.isAdmin) {
-      sessions = FilterSessions(req.ability, Action.Read, sessions);
+      sessions = FilterSessions(req.ability, Action.Retrieve, sessions);
     }
     if (query.expand?.includes(SessionExpand.apps)) {
-      for (const session of sessions) {
-        session.apps = await this.appsService.list(this.manager, session.name);
-      }
+      await this.sessionService.expandSessionApps(sessions);
     }
     return sessions;
   }
@@ -95,18 +80,15 @@ class SessionsController {
   @Get('/:session')
   @ApiOperation({ summary: 'Get session information' })
   @SessionApiParam
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async get(
     @Param('session') name: string,
     @Query() query: SessionInfoQuery,
   ): Promise<SessionInfo> {
-    const session = await this.manager.getSessionInfo(name);
-    if (session === null) {
-      throw new NotFoundException('Session not found');
-    }
+    const session = await this.sessionService.getSession(name);
     if (query.expand?.includes(SessionExpand.apps)) {
-      session.apps = await this.appsService.list(this.manager, name);
+      await this.sessionService.expandSessionApps([session]);
     }
     return session;
   }
@@ -114,9 +96,42 @@ class SessionsController {
   @Get(':session/me')
   @SessionApiParam
   @ApiOperation({ summary: 'Get information about the authenticated account' })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
   getMe(@SessionParam session: WhatsappSession): MeInfo | null {
-    return session.getSessionMeInfo();
+    return this.sessionService.getSessionMe(session);
+  }
+
+  @Get(':session/capping')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Fetch the account new-chat message capping (per-cycle quota)',
+    description:
+      'Fetch a fresh new-chat message capping (quota) state from WhatsApp. ' +
+      'The same value is also available under me.messageCapping in the session ' +
+      'info, and changes are pushed through the session.status event.',
+  })
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  fetchMessageCapping(
+    @SessionParam session: WhatsappSession,
+  ): Promise<MessageCappingData> {
+    return session.fetchMessageCapping();
+  }
+
+  @Get(':session/timelock')
+  @SessionApiParam
+  @ApiOperation({
+    summary: 'Fetch the account reachout timelock state',
+    description:
+      'Fetch a fresh reachout timelock state from WhatsApp - the restriction ' +
+      'behind "server returned error 463" when messaging new contacts. ' +
+      'The same value is also available under me.reachoutTimelock in the session ' +
+      'info, and changes are pushed through the session.status event.',
+  })
+  @CheckPolicies(CanSession(Action.Read, FromParam('session')))
+  fetchReachoutTimelock(
+    @SessionParam session: WhatsappSession,
+  ): Promise<ReachoutTimelockData> {
+    return session.fetchReachoutTimelock();
   }
 
   @Post('')
@@ -129,71 +144,20 @@ class SessionsController {
   @CheckPolicies(CanSession(Action.Create))
   @UsePipes(new WAHAValidationPipe())
   async create(@Body() request: SessionCreateRequest): Promise<SessionDTO> {
-    const name = request.name || generatePrefixedId('session');
-    await this.withLock(name, async () => {
-      if (await this.manager.exists(name)) {
-        const msg = `Session '${name}' already exists. Use PUT to update it.`;
-        throw new UnprocessableEntityException(msg);
-      }
-      const config = request.config;
-      const start = request.start || false;
-      await this.manager.upsert(name, config);
-      if (request.apps) {
-        await this.appsService.syncSessionApps(
-          this.manager,
-          name,
-          request.apps,
-        );
-      }
-      if (start) {
-        await this.manager.assign(name);
-        await this.manager.start(name);
-      }
-    });
-    const session = await this.manager.getSessionInfo(name);
-    if (request.apps) {
-      session.apps = await this.appsService.list(this.manager, name);
-    }
-    return session;
+    return this.sessionService.createSession(request);
   }
 
   @Put(':session')
-  @ApiOperation({
-    summary: 'Update a session',
-    description: '',
-  })
+  @ApiOperation({ summary: 'Update a session' })
   @SessionApiParam
   @ApiBody({ type: SessionUpdateRequest, examples: SessionExamples })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Setting, FromParam('session')))
   @UsePipes(new WAHAValidationPipe({ forbidNonWhitelisted: false }))
   async update(
     @Param('session') name: string,
     @Body() request: SessionUpdateRequest,
   ): Promise<SessionDTO> {
-    await this.withLock(name, async () => {
-      if (!(await this.manager.exists(name))) {
-        throw new NotFoundException('Session not found');
-      }
-      const config = request.config;
-      const isRunning = this.manager.isRunning(name);
-      await this.manager.stop(name, true);
-      await this.manager.upsert(name, config);
-      if (request.apps) {
-        await this.appsService.syncSessionApps(
-          this.manager,
-          name,
-          request.apps,
-        );
-      }
-      if (isRunning) {
-        await this.manager.start(name);
-      }
-    });
-    const session = await this.manager.getSessionInfo(name);
-    if (request.apps) {
-      session.apps = await this.appsService.list(this.manager, name);
-    }
-    return session;
+    return this.sessionService.updateSession(name, request);
   }
 
   @Delete(':session')
@@ -206,13 +170,7 @@ class SessionsController {
   @CheckPolicies(CanSession(Action.Delete, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async delete(@Param('session') name: string): Promise<void> {
-    await this.withLock(name, async () => {
-      await this.manager.unassign(name);
-      await this.manager.unpair(name);
-      await this.manager.stop(name, true);
-      await this.manager.logout(name);
-      await this.manager.delete(name);
-    });
+    return this.sessionService.deleteSession(name);
   }
 
   @Post(':session/start')
@@ -222,18 +180,10 @@ class SessionsController {
     description:
       'Start the session with the given name. The session must exist. Idempotent operation.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Control, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async start(@Param('session') name: string): Promise<SessionDTO> {
-    await this.withLock(name, async () => {
-      const exists = await this.manager.exists(name);
-      if (!exists) {
-        throw new NotFoundException('Session not found');
-      }
-      await this.manager.assign(name);
-      await this.manager.start(name);
-    });
-    return await this.manager.getSessionInfo(name);
+    return this.sessionService.startSession(name);
   }
 
   @Post(':session/stop')
@@ -242,14 +192,10 @@ class SessionsController {
     summary: 'Stop the session',
     description: 'Stop the session with the given name. Idempotent operation.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Control, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async stop(@Param('session') name: string): Promise<SessionDTO> {
-    await this.withLock(name, async () => {
-      await this.manager.unassign(name);
-      await this.manager.stop(name, false);
-    });
-    return await this.manager.getSessionInfo(name);
+    return this.sessionService.stopSession(name);
   }
 
   @Post(':session/logout')
@@ -258,23 +204,14 @@ class SessionsController {
     summary: 'Logout from the session',
     description: 'Logout the session, restart a session if it was not STOPPED',
   })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @ApiBody({ type: SessionLogoutRequest, required: false })
+  @CheckPolicies(CanSession(Action.Control, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
-  async logout(@Param('session') name: string): Promise<SessionDTO> {
-    await this.withLock(name, async () => {
-      const exists = await this.manager.exists(name);
-      if (!exists) {
-        throw new NotFoundException('Session not found');
-      }
-      const isRunning = this.manager.isRunning(name);
-      await this.manager.unpair(name);
-      await this.manager.stop(name, true);
-      await this.manager.logout(name);
-      if (isRunning) {
-        await this.manager.start(name);
-      }
-    });
-    return await this.manager.getSessionInfo(name);
+  async logout(
+    @Param('session') name: string,
+    @Body() request?: SessionLogoutRequest,
+  ): Promise<SessionDTO> {
+    return this.sessionService.logoutSession(name, request);
   }
 
   @Post(':session/restart')
@@ -283,11 +220,10 @@ class SessionsController {
     summary: 'Restart the session',
     description: 'Restart the session with the given name.',
   })
-  @CheckPolicies(CanSession(Action.Use, FromParam('session')))
+  @CheckPolicies(CanSession(Action.Control, FromParam('session')))
   @UsePipes(new WAHAValidationPipe())
   async restart(@Param('session') name: string): Promise<SessionDTO> {
-    await this.manager.restart(name);
-    return await this.manager.getSessionInfo(name);
+    return this.sessionService.restartSession(name);
   }
 
   @Post('/start/')
@@ -297,25 +233,22 @@ class SessionsController {
       'Create session (if not exists) or update a config (if exists) and start it.',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('name')))
+  @CheckPolicies(CanSession(Action.Control, FromBody('name')))
   async DEPRACATED_start(
     @Body() request: SessionStartDeprecatedRequest,
   ): Promise<SessionDTO> {
-    const name = request.name;
     if (!request.name) {
       throw new UnprocessableEntityException('Session name is required');
     }
-    if (this.manager.isRunning(name)) {
-      const msg = `Session '${name}' is already started.`;
-      throw new UnprocessableEntityException(msg);
+    if (this.sessionService.isSessionRunning(request.name)) {
+      throw new UnprocessableEntityException(
+        `Session '${request.name}' is already started.`,
+      );
     }
-
-    return await this.withLock(name, async () => {
-      const config = request.config;
-      await this.manager.upsert(name, config);
-      await this.manager.assign(name);
-      return await this.manager.start(name);
-    });
+    return this.sessionService.upsertAndStartSession(
+      request.name,
+      request.config,
+    );
   }
 
   @Post('/stop/')
@@ -324,30 +257,18 @@ class SessionsController {
     description: 'Stop session and Logout by default.',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('name')))
+  @CheckPolicies(CanSession(Action.Control, FromBody('name')))
   async DEPRECATED_stop(
     @Body() request: SessionStopDeprecatedRequest,
   ): Promise<void> {
     if (!request.name) {
       throw new UnprocessableEntityException('Session name is required');
     }
-    const name = request.name;
     if (request.logout) {
-      // Old API did remove the session complete
-      await this.withLock(name, async () => {
-        await this.manager.unassign(name);
-        await this.manager.unpair(name);
-        await this.manager.stop(name, true);
-        await this.manager.logout(name);
-        await this.manager.delete(name);
-      });
+      await this.sessionService.deleteSession(request.name);
     } else {
-      await this.withLock(name, async () => {
-        await this.manager.unassign(name);
-        await this.manager.stop(name, false);
-      });
+      await this.sessionService.stopSession(request.name);
     }
-    return;
   }
 
   @Post('/logout/')
@@ -356,22 +277,14 @@ class SessionsController {
     description: 'Stop, Logout and Delete session.',
     deprecated: true,
   })
-  @CheckPolicies(CanSession(Action.Use, FromBody('name')))
+  @CheckPolicies(CanSession(Action.Control, FromBody('name')))
   async DEPRECATED_logout(
     @Body() request: SessionLogoutDeprecatedRequest,
   ): Promise<void> {
     if (!request.name) {
       throw new UnprocessableEntityException('Session name is required');
     }
-    const name = request.name;
-    await this.withLock(name, async () => {
-      await this.manager.unassign(name);
-      await this.manager.unpair(name);
-      await this.manager.stop(name, true);
-      await this.manager.logout(name);
-      await this.manager.delete(name);
-    });
-    return;
+    await this.sessionService.deleteSession(request.name);
   }
 }
 

src/api/sessions.examples.ts

@@ -1,4 +1,4 @@
-import { AppName } from '@waha/apps/app_sdk/apps/name';
+import { AppName } from '@waha/apps/app_sdk/apps/apps';
 
 export const SessionExamples = {
   basic: {

src/api/status.controller.ts

@@ -25,12 +25,12 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/:session/status')
 @ApiTags('🟢 Status')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanSession(Action.Use, FromParam('session')))
 class StatusController {
   constructor(private manager: SessionManager) {}
 
   @Post('text')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Send text status' })
   sendTextStatus(
     @WorkingSessionParam session: WhatsappSession,
@@ -41,6 +41,7 @@ class StatusController {
 
   @Post('image')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Send image status' })
   sendImageStatus(
     @WorkingSessionParam session: WhatsappSession,
@@ -51,6 +52,7 @@ class StatusController {
 
   @Post('voice')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Send voice status' })
   sendVoiceStatus(
     @WorkingSessionParam session: WhatsappSession,
@@ -61,6 +63,7 @@ class StatusController {
 
   @Post('video')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'Send video status' })
   sendVideoStatus(
     @WorkingSessionParam session: WhatsappSession,
@@ -71,6 +74,7 @@ class StatusController {
 
   @Post('delete')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({ summary: 'DELETE sent status' })
   deleteStatus(
     @WorkingSessionParam session: WhatsappSession,
@@ -81,6 +85,7 @@ class StatusController {
 
   @Get('new-message-id')
   @SessionApiParam
+  @CheckPolicies(CanSession(Action.Send, FromParam('session')))
   @ApiOperation({
     summary: 'Generate message ID you can use to batch contacts',
   })

src/api/version.controller.ts

@@ -13,7 +13,7 @@ import { Action } from '@waha/core/auth/casl.types';
 @Controller('api/version')
 @ApiTags('🔍 Observability')
 @UseGuards(PoliciesGuard)
-@CheckPolicies(CanServer(Action.Read))
+@CheckPolicies(CanServer(Action.Retrieve))
 export class VersionController {
   @Get('')
   @ApiOperation({

src/api/websocket.gateway.core.ts

@@ -86,18 +86,18 @@ export class WebsocketGatewayCore
     const params = this.getParams(request);
     let session: string = params.session;
     const ability = this.casl.createForUser(user);
-    if (session == '*' && !ability.can(Action.Use, 'all')) {
+    if (session == '*' && !ability.can(Action.Manage, 'all')) {
       // Limit user to listen only the session events
       session = user.session;
     }
 
-    if (!ability.can(Action.Use, new SessionName(session))) {
+    if (!ability.can(Action.Read, new SessionName(session))) {
       socket.close(WebSocketCloseCode.POLICY_VIOLATION, 'Forbidden');
       return;
     }
 
     this.logger.debug(`New client connected: ${request.url} - ${socket.id}`);
-    const events: WAHAEvents[] = params.events;
+    const events = params.events as WAHAEvents[];
     this.logger.debug(
       `Client connected to session: '${session}', events: ${events}, ${socket.id}`,
     );
@@ -131,8 +131,13 @@ export class WebsocketGatewayCore
     const paramsEvents = query.getAll('events');
     const eventsRaw = paramsEvents.length > 0 ? paramsEvents : ['*'];
     const eventsList = eventsRaw.flatMap((value) => value.split(','));
-    const events = this.eventUnmask.unmask(eventsList);
-    return { session, events };
+    const result = this.eventUnmask.unmask(eventsList);
+    if (result.unknown.length > 0) {
+      this.logger.warn(
+        `Ignoring unknown websocket events: ${result.unknown.join(', ')}`,
+      );
+    }
+    return { session, events: result.events };
   }
 
   handleDisconnect(socket: WebSocket): any {

src/apps/app_sdk/JobLoggerWrapper.ts

@@ -52,7 +52,7 @@ export class JobLoggerWrapper implements ILogger {
     this.job
       .log(`[${timestamp}] ${level.toUpperCase()}: ${msg}`)
       .catch((err) => {
-        this.logger.error('Error logging message to job', err);
+        this.logger.error(err, 'Error logging message to job');
       });
   }
 }

src/apps/app_sdk/api/apps.controller.ts

@@ -14,7 +14,9 @@ import {
   UseGuards,
   UsePipes,
 } from '@nestjs/common';
-import { ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
+import { ApiOperation, ApiParam, ApiSecurity, ApiTags } from '@nestjs/swagger';
+import { AppName } from '@waha/apps/app_sdk/apps/apps';
+import { UniqueAppResolver } from '@waha/apps/app_sdk/services/UniqueAppResolver';
 import {
   AppsService,
   IAppsService,
@@ -26,11 +28,13 @@ import {
   CanServer,
   CanSession,
   FromBody,
+  FromParam,
   FromQuery,
 } from '@waha/core/auth/policies';
 import { Action, session as SessionName } from '@waha/core/auth/casl.types';
 import { WAHAValidationPipe } from '@waha/nestjs/pipes/WAHAValidationPipe';
 
+import { GetApp } from '../apps/registry';
 import { App } from '../dto/app.dto';
 import { ListAppsQuery } from '../dto/query.dto';
 
@@ -43,11 +47,12 @@ export class AppsController {
     @Inject(AppsService)
     private appsService: IAppsService,
     private manager: SessionManager,
+    private resolver: UniqueAppResolver,
   ) {}
 
   @Get('/')
   @ApiOperation({ summary: 'List all apps for a session' })
-  @CheckPolicies(CanSession(Action.Use, FromQuery('session')))
+  @CheckPolicies(CanSession(Action.App, FromQuery('session')))
   @UsePipes(new WAHAValidationPipe())
   async list(
     @Query(new WAHAValidationPipe()) query: ListAppsQuery,
@@ -57,12 +62,16 @@ export class AppsController {
 
   @Post('/')
   @ApiOperation({ summary: 'Create a new app' })
-  @CheckPolicies(CanSession(Action.Use, FromBody('session')))
+  @CheckPolicies(CanSession(Action.App, FromBody('session')))
   @UsePipes(new WAHAValidationPipe())
   async create(@Body() app: App): Promise<App> {
     const result = await this.appsService.create(this.manager, app);
     const isRunning = this.manager.isRunning(app.session);
-    if (isRunning && app.enabled) {
+    if (
+      isRunning &&
+      app.enabled &&
+      GetApp(app.app)?.definition.restartOnChange
+    ) {
       await this.manager.restart(app.session);
     }
     return result;
@@ -70,14 +79,14 @@ export class AppsController {
 
   @Get('/:id')
   @ApiOperation({ summary: 'Get app by ID' })
-  @CheckPolicies(CanServer(Action.Read))
+  @CheckPolicies(CanServer(Action.Retrieve))
   @UsePipes(new WAHAValidationPipe())
   async get(@Param('id') id: string, @Req() req: any): Promise<App> {
     const app = await this.appsService.get(this.manager, id);
     if (!app) {
       throw new NotFoundException(`App '${id}' not found`);
     }
-    if (!req.ability?.can(Action.Use, new SessionName(app.session))) {
+    if (!req.ability?.can(Action.App, new SessionName(app.session))) {
       throw new ForbiddenException();
     }
     return app;
@@ -85,7 +94,7 @@ export class AppsController {
 
   @Put('/:id')
   @ApiOperation({ summary: 'Update an existing app' })
-  @CheckPolicies(CanServer(Action.Read))
+  @CheckPolicies(CanServer(Action.Retrieve))
   @UsePipes(new WAHAValidationPipe())
   async update(
     @Param('id') id: string,
@@ -94,11 +103,11 @@ export class AppsController {
   ): Promise<App> {
     const existing = await this.appsService.get(this.manager, id);
     if (existing) {
-      if (!req.ability?.can(Action.Use, new SessionName(existing.session))) {
+      if (!req.ability?.can(Action.App, new SessionName(existing.session))) {
         throw new ForbiddenException();
       }
     } else {
-      if (!req.ability?.can(Action.Use, new SessionName(app.session))) {
+      if (!req.ability?.can(Action.App, new SessionName(app.session))) {
         throw new ForbiddenException();
       }
     }
@@ -112,29 +121,65 @@ export class AppsController {
     }
 
     const result = await this.appsService.upsert(this.manager, app);
-    const isRunning = this.manager.isRunning(app.session);
-    if (isRunning) {
-      await this.manager.restart(app.session);
+    const isRunning = this.manager.isRunning(result.session);
+    if (isRunning && GetApp(result.app)?.definition.restartOnChange) {
+      await this.manager.restart(result.session);
     }
     return result;
   }
 
   @Delete('/:id')
   @ApiOperation({ summary: 'Delete an app' })
-  @CheckPolicies(CanServer(Action.Read))
+  @CheckPolicies(CanServer(Action.Retrieve))
   @UsePipes(new WAHAValidationPipe())
   async delete(@Param('id') id: string, @Req() req: any): Promise<void> {
     const existing = await this.appsService.get(this.manager, id);
     if (!existing) {
       throw new NotFoundException(`App '${id}' not found`);
     }
-    if (!req.ability?.can(Action.Use, new SessionName(existing.session))) {
+    if (!req.ability?.can(Action.App, new SessionName(existing.session))) {
       throw new ForbiddenException();
     }
     const app = await this.appsService.delete(this.manager, id);
     const isRunning = this.manager.isRunning(app.session);
-    if (isRunning) {
+    if (isRunning && GetApp(app.app)?.definition.restartOnChange) {
       await this.manager.restart(app.session);
     }
   }
+
+  @Post('/:id/purge')
+  @ApiOperation({
+    summary: 'Purge app storage by app ID',
+    description:
+      "Delete the app's stored data (database rows, caches) while keeping the app configured.",
+  })
+  @CheckPolicies(CanServer(Action.Retrieve))
+  @UsePipes(new WAHAValidationPipe())
+  async purge(@Param('id') id: string, @Req() req: any): Promise<App> {
+    const existing = await this.appsService.get(this.manager, id);
+    if (!existing) {
+      throw new NotFoundException(`App '${id}' not found`);
+    }
+    if (!req.ability?.can(Action.App, new SessionName(existing.session))) {
+      throw new ForbiddenException();
+    }
+    return await this.appsService.purge(this.manager, id);
+  }
+
+  @Post('/:app/:session/purge')
+  @ApiOperation({
+    summary: 'Purge app storage by app name and session',
+    description:
+      "Delete the unique app's stored data for the session. The app must be enabled.",
+  })
+  @ApiParam({ name: 'app', enum: AppName })
+  @CheckPolicies(CanSession(Action.App, FromParam('session')))
+  @UsePipes(new WAHAValidationPipe())
+  async purgeUniqueApp(
+    @Param('app') appName: string,
+    @Param('session') session: string,
+  ): Promise<App> {
+    const app = await this.resolver.getEnabledApp(session, appName);
+    return await this.appsService.purge(this.manager, app.id);
+  }
 }

src/apps/app_sdk/api/tags.ts

@@ -0,0 +1,28 @@
+import { AppApiTag } from '@waha/apps/app_sdk/apps/openapi';
+import { AppRuntimeConfig } from '@waha/apps/app_sdk/apps/AppRuntime';
+import { GetApps } from '@waha/apps/app_sdk/apps/registry';
+
+export interface ApiTag {
+  name: string;
+  description: string;
+}
+
+/**
+ * OpenAPI tags for all registered apps - one "🧩 Apps: {Title}" tag per app,
+ * so app-specific endpoints get their own section in Swagger.
+ * Includes disabled apps too (only their openapi metadata is used) - some app
+ * controllers are served even when apps are disabled ('disabledControllers');
+ * their description is prefixed with "DISABLED" to make the state visible.
+ */
+export function GetAppsApiTags(): ApiTag[] {
+  return GetApps().map((app) => {
+    const enabled = AppRuntimeConfig.HasApp(app.name);
+    const description = enabled
+      ? app.openapi.description
+      : `DISABLED - ${app.openapi.description}`;
+    return {
+      name: AppApiTag(app.openapi),
+      description: description,
+    };
+  });
+}

src/apps/app_sdk/apps/AppRuntime.ts

@@ -1,15 +1,15 @@
 import { AppEnv } from '@waha/apps/app_sdk/env';
-import { AppDefinition, APPS } from '@waha/apps/app_sdk/apps/definition';
-import { AppName } from '@waha/apps/app_sdk/apps/name';
+import { AppModule } from '@waha/apps/app_sdk/apps/definition';
+import { GetApps } from '@waha/apps/app_sdk/apps/registry';
 
 class AppRuntimeConfigC {
-  private constructor(private apps: AppDefinition[] | null) {}
+  private constructor(private apps: AppModule[] | null) {}
 
   static FromEnv(env: typeof AppEnv) {
     if (!env.enabled) {
       return new AppRuntimeConfigC(null);
     }
-    let apps = Object.values(APPS);
+    let apps: AppModule[] = GetApps();
     // Include
     if (env.on && env.on.length > 0) {
       apps = apps.filter((app) => env.on!.includes(app.name));
@@ -30,18 +30,18 @@ class AppRuntimeConfigC {
   }
 
   GetAppsWithMigration() {
-    return this.GetApps().filter((app) => app.migrations);
+    return this.GetApps().filter((app) => app.definition.migrations);
   }
 
   GetAppsRequiringPlainKey() {
-    return this.GetApps().filter((app) => app.plainkey);
+    return this.GetApps().filter((app) => app.definition.plainkey);
   }
 
   GetAppsRequiringQueue() {
-    return this.GetApps().filter((app) => app.queue);
+    return this.GetApps().filter((app) => app.definition.queue);
   }
 
-  HasApp(name: AppName) {
+  HasApp(name: string) {
     return this.GetApps().some((app) => app.name === name);
   }
 

src/apps/app_sdk/apps/apps.ts

@@ -0,0 +1,37 @@
+import { ArgentinePhoneNumbersAppConfig } from '@waha/apps/argentine-phone-numbers/dto';
+import { Type } from '@nestjs/common';
+import { BrazilianPhoneNumbersAppConfig } from '@waha/apps/brazilian-phone-numbers/dto';
+import { CallsAppConfig } from '@waha/apps/calls/dto/config.dto';
+import { ChatWootAppConfig } from '@waha/apps/chatwoot/dto/config.dto';
+import { McpAppConfig } from '@waha/apps/mcp/dto/config.dto';
+import { MexicanPhoneNumbersAppConfig } from '@waha/apps/mexican-phone-numbers/dto';
+import { PhoneNumbersAppConfig } from '@waha/apps/phone-numbers/dto/config.dto';
+
+export enum AppName {
+  argentinePhoneNumbers = 'argentine-phone-numbers',
+  brazilianPhoneNumbers = 'brazilian-phone-numbers',
+  chatwoot = 'chatwoot',
+  calls = 'calls',
+  mcp = 'mcp',
+  mexicanPhoneNumbers = 'mexican-phone-numbers',
+  phoneNumbers = 'phone-numbers',
+}
+
+/**
+ * DTO classes used to transform and validate App.config, by app name.
+ * Kept separate from the registry so DTOs (imported by core structures) can resolve config classes
+ * without pulling in every app module (controllers, services, queues) - that creates require cycles.
+ */
+export const AppConfigClasses: Record<AppName, Type<any>> = {
+  [AppName.argentinePhoneNumbers]: ArgentinePhoneNumbersAppConfig,
+  [AppName.brazilianPhoneNumbers]: BrazilianPhoneNumbersAppConfig,
+  [AppName.phoneNumbers]: PhoneNumbersAppConfig,
+  [AppName.calls]: CallsAppConfig,
+  [AppName.chatwoot]: ChatWootAppConfig,
+  [AppName.mcp]: McpAppConfig,
+  [AppName.mexicanPhoneNumbers]: MexicanPhoneNumbersAppConfig,
+};
+
+export function GetAppConfigClass(name: AppName): Type<any> {
+  return AppConfigClasses[name] ?? Object;
+}

src/apps/app_sdk/apps/definition.ts

@@ -1,28 +1,63 @@
-import { AppName } from '@waha/apps/app_sdk/apps/name';
+import { Type } from '@nestjs/common';
+import { AppName } from '@waha/apps/app_sdk/apps/apps';
+import { AppOpenAPI } from '@waha/apps/app_sdk/apps/openapi';
+import { GetApp } from '@waha/apps/app_sdk/apps/registry';
+import { IAppService } from '@waha/apps/app_sdk/services/IAppService';
 
 export interface AppDefinition {
-  // App name
-  name: AppName;
   // If app requires WAHA_API_KEY_PLAIN to work
   plainkey: boolean;
   // If app requires queue to work
   queue: boolean;
   // If app has any migrations
   migrations: boolean;
+  // If adding, updating, or removing this app requires a session restart
+  restartOnChange: boolean;
+  // If only one instance of this app is allowed per session
+  unique: boolean;
 }
 
-// All Apps
-export const APPS: Record<AppName, AppDefinition> = {
-  [AppName.calls]: {
-    name: AppName.calls,
-    plainkey: false,
-    queue: false,
-    migrations: false,
-  },
-  [AppName.chatwoot]: {
-    name: AppName.chatwoot,
-    plainkey: true,
-    queue: true,
-    migrations: true,
-  },
-};
+// NestJS module parts, included when the app is enabled in runtime configuration
+export interface AppNestJS {
+  imports: any[];
+  controllers: any[];
+  providers: any[];
+}
+
+/**
+ * Contract for the default export of 'src/apps/<name>/app.module.ts'.
+ * Each app self-describes with this and gets listed in the registry ('apps/registry.ts').
+ */
+export interface AppModule {
+  // App name
+  name: AppName;
+  // OpenAPI metadata (tag title, description) from 'src/apps/<name>/openapi.ts'
+  openapi: AppOpenAPI;
+  // Static app metadata (requirements, behavior flags)
+  definition: AppDefinition;
+  // NestJS module parts
+  nestjs: AppNestJS;
+  // Service implementing app lifecycle hooks; must also be listed in 'nestjs.providers'
+  Service: Type<IAppService>;
+}
+
+export function isUniqueApp(name: AppName): boolean {
+  return GetApp(name)?.definition.unique === true;
+}
+
+// Returns the first unique AppName that appears more than once in the list, or null
+export function findDuplicateUniqueApp(
+  apps: Array<{ app: AppName }>,
+): AppName | null {
+  const seen = new Set<AppName>();
+  for (const app of apps) {
+    if (!isUniqueApp(app.app)) {
+      continue;
+    }
+    if (seen.has(app.app)) {
+      return app.app;
+    }
+    seen.add(app.app);
+  }
+  return null;
+}

src/apps/app_sdk/apps/name.ts

@@ -1,4 +0,0 @@
-export enum AppName {
-  chatwoot = 'chatwoot',
-  calls = 'calls',
-}

src/apps/app_sdk/apps/openapi.ts

@@ -0,0 +1,14 @@
+/**
+ * OpenAPI metadata for an app, defined inline in the app's AppModule ('openapi' field).
+ * The registry applies the "🧩 Apps: {Title}" tag to every controller in 'nestjs.controllers',
+ * so app controllers do not declare @ApiTags themselves - a new app only touches its own folder.
+ */
+export interface AppOpenAPI {
+  title: string;
+  description: string;
+}
+
+// OpenAPI tag for app-specific endpoints - "🧩 Apps: {Title}"
+export function AppApiTag(openapi: AppOpenAPI): string {
+  return `🧩 Apps: ${openapi.title}`;
+}

src/apps/app_sdk/apps/registry.ts

@@ -0,0 +1,40 @@
+import ArgentinePhoneNumbersAppModule from '@waha/apps/argentine-phone-numbers/app.module';
+import { ApiTags } from '@nestjs/swagger';
+import BrazilianPhoneNumbersAppModule from '@waha/apps/brazilian-phone-numbers/app.module';
+import { AppModule } from '@waha/apps/app_sdk/apps/definition';
+import { AppApiTag } from '@waha/apps/app_sdk/apps/openapi';
+import CallsAppModule from '@waha/apps/calls/app.module';
+import ChatWootAppModule from '@waha/apps/chatwoot/app.module';
+import McpAppModule from '@waha/apps/mcp/app.module';
+import MexicanPhoneNumbersAppModule from '@waha/apps/mexican-phone-numbers/app.module';
+import PhoneNumbersAppModule from '@waha/apps/phone-numbers/app.module';
+
+/**
+ * Registry of available apps.
+ * Add new apps here - the rest of app_sdk works off this list.
+ */
+const APPS: AppModule[] = [
+  ArgentinePhoneNumbersAppModule,
+  BrazilianPhoneNumbersAppModule,
+  CallsAppModule,
+  ChatWootAppModule,
+  McpAppModule,
+  MexicanPhoneNumbersAppModule,
+  PhoneNumbersAppModule,
+];
+
+// Tag every app controller with the app's OpenAPI tag ("🧩 Apps: {Title}") from AppModule.openapi,
+// so controllers do not declare @ApiTags themselves (they cannot import their own app.module - require cycle).
+for (const app of APPS) {
+  for (const controller of app.nestjs.controllers) {
+    ApiTags(AppApiTag(app.openapi))(controller);
+  }
+}
+
+export function GetApps(): AppModule[] {
+  return APPS;
+}
+
+export function GetApp(name: string): AppModule | undefined {
+  return APPS.find((app) => app.name === name);
+}

src/apps/app_sdk/dto/app.dto.ts

@@ -1,5 +1,3 @@
-import { ChatWootAppConfig } from '@waha/apps/chatwoot/dto/config.dto';
-import { CallsAppConfig } from '@waha/apps/calls/dto/config.dto';
 import { Type } from 'class-transformer';
 import {
   IsBoolean,
@@ -9,12 +7,13 @@ import {
   ValidateNested,
 } from 'class-validator';
 import { ApiExtraModels, ApiProperty } from '@nestjs/swagger';
-import { AppName } from '@waha/apps/app_sdk/apps/name';
+import {
+  AppConfigClasses,
+  AppName,
+  GetAppConfigClass,
+} from '@waha/apps/app_sdk/apps/apps';
 
-export type AllowedAppConfig = ChatWootAppConfig | CallsAppConfig;
-
-@ApiExtraModels(ChatWootAppConfig, CallsAppConfig)
-export class App<T extends AllowedAppConfig = any> {
+export class App<T = any> {
   @IsString()
   id: string;
 
@@ -37,29 +36,14 @@ export class App<T extends AllowedAppConfig = any> {
 
   @ValidateNested()
   @Type((options) => {
-    if (options && options.object && options.object.app) {
-      switch (options.object.app) {
-        case AppName.chatwoot:
-          return ChatWootAppConfig;
-        case AppName.calls:
-          return CallsAppConfig;
-        default:
-          return Object;
-      }
+    const name = options?.object?.app;
+    if (!name) {
+      return Object;
     }
-    return Object;
+    return GetAppConfigClass(name);
   })
   config: T;
 }
 
-export class ChatWootAppDto extends App<ChatWootAppConfig> {
-  @Type(() => ChatWootAppConfig)
-  config: ChatWootAppConfig;
-}
-
-export class CallsAppDto extends App<CallsAppConfig> {
-  @Type(() => CallsAppConfig)
-  config: CallsAppConfig;
-}
-
-export type AppDto = ChatWootAppDto | CallsAppDto;
+// Swagger models for app configs
+ApiExtraModels(...Object.values(AppConfigClasses))(App);

src/apps/app_sdk/env.ts

@@ -1,9 +1,9 @@
 import { parseBool } from '@waha/helpers';
-import { APPS } from '@waha/apps/app_sdk/apps/definition';
+import { GetApps } from '@waha/apps/app_sdk/apps/registry';
 
 // Apps that don't require queue (Redis) - derived from AppDefinition
-const IN_MEMORY_APPS = Object.values(APPS)
-  .filter((app) => !app.queue)
+const IN_MEMORY_APPS = GetApps()
+  .filter((app) => !app.definition.queue)
   .map((app) => app.name);
 
 function parseCommaSeparatedList(value: string | undefined): string[] {

src/apps/app_sdk/services/AppsDisabledService.ts

@@ -41,6 +41,14 @@ export class AppsDisabledService implements IAppsService {
     throw new AppsIsDisabledError();
   }
 
+  async purge(manager: SessionManager, appId: string): Promise<App> {
+    throw new AppsIsDisabledError();
+  }
+
+  async purgeBySession(manager: SessionManager, session: string) {
+    return;
+  }
+
   async removeBySession(manager: SessionManager, session: string) {
     return;
   }

src/apps/app_sdk/services/AppsEnabledService.ts

@@ -1,14 +1,12 @@
 import {
   Injectable,
   NotFoundException,
-  Optional,
   UnprocessableEntityException,
 } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
 import { migrate } from '@waha/apps/app_sdk/migrations';
 import { IAppService } from '@waha/apps/app_sdk/services/IAppService';
 import { IAppsService } from '@waha/apps/app_sdk/services/IAppsService';
-import { ChatWootAppService } from '@waha/apps/chatwoot/services/ChatWootAppService';
-import { CallsAppService } from '@waha/apps/calls/services/CallsAppService';
 import { DataStore } from '@waha/core/abc/DataStore';
 import { SessionManager } from '@waha/core/abc/manager.abc';
 import { WhatsappSession } from '@waha/core/abc/session.abc';
@@ -18,8 +16,12 @@ import { InjectPinoLogger, PinoLogger } from 'nestjs-pino';
 
 import { App } from '../dto/app.dto';
 import { AppRepository } from '../storage/AppRepository';
-import { AppName } from '@waha/apps/app_sdk/apps/name';
 import { AppRuntimeConfig } from '@waha/apps/app_sdk/apps/AppRuntime';
+import {
+  findDuplicateUniqueApp,
+  isUniqueApp,
+} from '@waha/apps/app_sdk/apps/definition';
+import { GetApp } from '@waha/apps/app_sdk/apps/registry';
 
 export class AppDisableError extends UnprocessableEntityException {
   constructor(app: string) {
@@ -29,22 +31,32 @@ export class AppDisableError extends UnprocessableEntityException {
   }
 }
 
+export class AppUniquePerSessionError extends UnprocessableEntityException {
+  constructor(app: string, session: string, existingAppId: string) {
+    super(
+      `Only one '${app}' app is allowed per session. ` +
+        `Session '${session}' already has a '${app}' app with ID '${existingAppId}'.`,
+    );
+  }
+}
+
 @Injectable()
 export class AppsEnabledService implements IAppsService {
   constructor(
     @InjectPinoLogger('AppsService')
     protected logger: PinoLogger,
-    @Optional() protected readonly chatwootService: ChatWootAppService,
-    @Optional() protected readonly callsAppService: CallsAppService,
+    private readonly moduleRef: ModuleRef,
   ) {}
 
   async list(manager: SessionManager, session: string): Promise<App[]> {
     const knex = manager.store.getWAHADatabase();
     const repo = new AppRepository(knex);
     const apps = await repo.getAllBySession(session);
-    apps.forEach((app) => {
+    for (const app of apps) {
       delete app.pk;
-    });
+      const service = this.getAppService(app);
+      await service?.enrich(manager, app);
+    }
     return apps;
   }
 
@@ -60,31 +72,17 @@ export class AppsEnabledService implements IAppsService {
       throw new Error(`App with ID '${app.id}' already exists.`);
     }
 
-    let existingApps: App[] = [];
-    if (app.app === AppName.chatwoot || app.app === AppName.calls) {
-      existingApps = await repo.getAllBySession(app.session);
-    }
-    // Validate only one Chatwoot app per session
-    if (app.app === AppName.chatwoot) {
-      const existingChatwootApp = existingApps.find(
-        (existingApp) => existingApp.app === AppName.chatwoot,
+    // Validate only one instance of a unique app per session
+    if (isUniqueApp(app.app)) {
+      const existingApps = await repo.getAllBySession(app.session);
+      const duplicateApp = existingApps.find(
+        (existingApp) => existingApp.app === app.app,
       );
-
-      if (existingChatwootApp) {
-        throw new Error(
-          `Only one Chatwoot app is allowed per session. Session '${app.session}' already has a Chatwoot app with ID '${existingChatwootApp.id}'.`,
-        );
-      }
-    }
-    // Validate only one Calls app per session
-    if (app.app === AppName.calls) {
-      const existingCallsApp = existingApps.find(
-        (existingApp) => existingApp.app === AppName.calls,
-      );
-
-      if (existingCallsApp) {
-        throw new Error(
-          `Only one Calls app is allowed per session. Session '${app.session}' already has a Calls app with ID '${existingCallsApp.id}'.`,
+      if (duplicateApp) {
+        throw new AppUniquePerSessionError(
+          app.app,
+          app.session,
+          duplicateApp.id,
         );
       }
     }
@@ -101,6 +99,9 @@ export class AppsEnabledService implements IAppsService {
 
     const result = await repo.save(app);
     delete result.pk;
+    if (app.enabled !== false) {
+      await service?.afterCreated(manager, result);
+    }
     return result;
   }
 
@@ -112,6 +113,8 @@ export class AppsEnabledService implements IAppsService {
       return null;
     }
     delete (app as any).pk;
+    const service = this.getAppService(app);
+    await service?.enrich(manager, app);
     return app;
   }
 
@@ -156,12 +159,12 @@ export class AppsEnabledService implements IAppsService {
 
     if (hasEnabledChange) {
       if (app.enabled) {
-        await service?.beforeEnabled(savedApp, app);
+        await service?.beforeEnabled(manager, savedApp, app);
       } else {
-        await service?.beforeDisabled(savedApp, app);
+        await service?.beforeDisabled(manager, savedApp, app);
       }
     } else {
-      await service?.beforeUpdated(savedApp, app);
+      await service?.beforeUpdated(manager, savedApp, app);
     }
     await repo.update(app.id, app);
     const updated = await repo.getById(app.id);
@@ -177,15 +180,49 @@ export class AppsEnabledService implements IAppsService {
       throw new NotFoundException(`App '${appId}' not found`);
     }
     const service = this.getAppService(app);
-    await service?.beforeDeleted(app);
+    await service?.beforeDeleted(manager, app);
     await repo.delete(app.id);
     delete app.pk;
     return app;
   }
 
+  async purge(manager: SessionManager, appId: string): Promise<App> {
+    const knex = manager.store.getWAHADatabase();
+    const repo = new AppRepository(knex);
+    const app = await repo.getById(appId);
+    if (!app) {
+      throw new NotFoundException(`App '${appId}' not found`);
+    }
+    const service = this.getAppService(app);
+    if (!service) {
+      throw new AppDisableError(app.app);
+    }
+    await service.purge(manager, app);
+    delete app.pk;
+    return app;
+  }
+
+  async purgeBySession(manager: SessionManager, session: string) {
+    const knex = manager.store.getWAHADatabase();
+    const repo = new AppRepository(knex);
+    const apps = await repo.getAllBySession(session);
+    for (const app of apps) {
+      const service = this.getAppService(app);
+      if (!service) {
+        continue;
+      }
+      await service.purge(manager, app);
+    }
+  }
+
   async removeBySession(manager: SessionManager, session: string) {
     const knex = manager.store.getWAHADatabase();
     const repo = new AppRepository(knex);
+    const apps = await repo.getAllBySession(session);
+    for (const app of apps) {
+      const service = this.getAppService(app);
+      await service?.beforeSessionDeleted(manager, app);
+    }
     await repo.deleteBySession(session);
   }
 
@@ -198,6 +235,10 @@ export class AppsEnabledService implements IAppsService {
       if (!service && !AppRuntimeConfig.HasApp(app.app)) {
         throw new AppDisableError(app.app);
       }
+      const plugins = service.plugins(app, session, store);
+      for (const options of plugins) {
+        session.plugins.add(options, app.id);
+      }
       service.beforeSessionStart(app, session);
     }
   }
@@ -220,6 +261,15 @@ export class AppsEnabledService implements IAppsService {
     session: string,
     apps: App[],
   ): Promise<void> {
+    // Reject duplicate unique apps in the payload before any writes,
+    // otherwise the by-type matching below binds them to the same app
+    const duplicateUniqueApp = findDuplicateUniqueApp(apps);
+    if (duplicateUniqueApp !== null) {
+      throw new UnprocessableEntityException(
+        `Only one '${duplicateUniqueApp}' app is allowed per session - remove duplicate entries from 'apps'.`,
+      );
+    }
+
     const existing = await this.list(manager, session);
     const ids = new Set<string>();
 
@@ -252,13 +302,15 @@ export class AppsEnabledService implements IAppsService {
   }
 
   private getAppService(app: App): IAppService | null {
-    switch (app.app) {
-      case AppName.chatwoot:
-        return this.chatwootService;
-      case AppName.calls:
-        return this.callsAppService;
-      default:
-        throw new Error(`App '${app.app}' not supported`);
+    const appModule = GetApp(app.app);
+    if (!appModule) {
+      throw new Error(`App '${app.app}' not supported`);
+    }
+    try {
+      return this.moduleRef.get(appModule.Service, { strict: false });
+    } catch {
+      // Provider is not registered - app is disabled via WAHA_APPS_ON / WAHA_APPS_OFF
+      return null;
     }
   }
 

src/apps/app_sdk/services/IAppService.ts

@@ -1,5 +1,8 @@
 import { App } from '@waha/apps/app_sdk/dto/app.dto';
+import { DataStore } from '@waha/core/abc/DataStore';
+import { SessionManager } from '@waha/core/abc/manager.abc';
 import { WhatsappSession } from '@waha/core/abc/session.abc';
+import { PluginOptions } from '@waha/core/abc/session.plugin';
 
 /**
  * Exact App service
@@ -9,19 +12,66 @@ export interface IAppService {
 
   beforeCreated(app: App): Promise<void>;
 
+  /**
+   * Called after the app record is saved to the database during creation.
+   * Use this for side effects that must happen after the app exists in storage.
+   */
+  afterCreated(manager: SessionManager, app: App): Promise<void>;
+
   /**
    * Called only when the app transitions from disabled -> enabled.
    */
-  beforeEnabled(savedApp: App, newApp: App): Promise<void>;
+  beforeEnabled(
+    manager: SessionManager,
+    savedApp: App,
+    newApp: App,
+  ): Promise<void>;
 
   /**
    * Called only when the app transitions from enabled -> disabled.
    */
-  beforeDisabled(savedApp: App, newApp: App): Promise<void>;
+  beforeDisabled(
+    manager: SessionManager,
+    savedApp: App,
+    newApp: App,
+  ): Promise<void>;
 
-  beforeUpdated(savedApp: App, newApp: App): Promise<void>;
+  beforeUpdated(
+    manager: SessionManager,
+    savedApp: App,
+    newApp: App,
+  ): Promise<void>;
 
-  beforeDeleted(app: App): Promise<void>;
+  beforeDeleted(manager: SessionManager, app: App): Promise<void>;
+
+  /**
+   * Deletes the app's stored data (database rows, caches) while keeping the app configured.
+   * Apps without storage implement it as a no-op.
+   */
+  purge(manager: SessionManager, app: App): Promise<void>;
+
+  /**
+   * Called for each app before a bulk session deletion removes all app records.
+   * Use this to clean up external resources tied to the app (e.g. API keys).
+   */
+  beforeSessionDeleted(manager: SessionManager, app: App): Promise<void>;
+
+  /**
+   * Called after reading an app from storage, before returning it to the caller.
+   * Use this to populate transient fields that are not persisted (e.g. secret values).
+   */
+  enrich(manager: SessionManager, app: App): Promise<void>;
+
+  /**
+   * Session plugins contributed by this app. AppsEnabledService registers them with the app id,
+   * and the session manager attaches their hooks and events before session.start().
+   * store - the server data store, for apps whose plugins persist data.
+   */
+  plugins(
+    app: App,
+    session: WhatsappSession,
+    store?: DataStore,
+  ): PluginOptions[];
 
   beforeSessionStart(app: App, session: WhatsappSession): void;
 

src/apps/app_sdk/services/IAppsService.ts

@@ -17,6 +17,10 @@ export interface IAppsService {
 
   delete(manager: SessionManager, appId: string): Promise<App>;
 
+  purge(manager: SessionManager, appId: string): Promise<App>;
+
+  purgeBySession(manager: SessionManager, session: string): Promise<void>;
+
   removeBySession(manager: SessionManager, session: string): Promise<void>;
 
   beforeSessionStart(session: WhatsappSession, store: DataStore): Promise<void>;

src/apps/app_sdk/services/UniqueAppResolver.ts

@@ -0,0 +1,55 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { AppRepository } from '@waha/apps/app_sdk/storage/AppRepository';
+import { AppDB } from '@waha/apps/app_sdk/storage/types';
+import { SessionManager } from '@waha/core/abc/manager.abc';
+import { SessionPlugin } from '@waha/core/abc/session.plugin';
+
+/**
+ * Resolves the single instance of a unique-per-session app ('definition.unique') by session name,
+ * so app controllers can expose session-keyed routes ('api/apps/{app}/{session}/...') instead of app-id ones.
+ * Uniqueness is guaranteed at write time by AppsEnabledService, so the first enabled row is the instance.
+ * Must not import 'apps/registry.ts' or 'apps/definition.ts' - controllers import this resolver,
+ * and the registry imports app modules (with their controllers), which would create a require cycle.
+ */
+@Injectable()
+export class UniqueAppResolver {
+  constructor(private readonly manager: SessionManager) {}
+
+  /**
+   * Enabled app row for the session; 404 if the app is missing or disabled.
+   * Does not require the session to be running - persistent app data stays accessible for stopped sessions.
+   */
+  async getEnabledApp(sessionName: string, appName: string): Promise<AppDB> {
+    const knex = this.manager.store.getWAHADatabase();
+    const repository = new AppRepository(knex);
+    const app = await repository.getEnabledBySessionAndApp(
+      sessionName,
+      appName,
+    );
+    if (!app) {
+      throw new NotFoundException(
+        `App '${appName}' is not enabled for session '${sessionName}'`,
+      );
+    }
+    return app;
+  }
+
+  /**
+   * Live plugin instance for the app, or null when the session is not running (best-effort access).
+   */
+  getPlugin<Plugin extends SessionPlugin<any, any>>(
+    app: AppDB,
+    PluginClass: abstract new (...args: any[]) => Plugin,
+  ): Plugin | null {
+    if (!this.manager.isRunning(app.session)) {
+      return null;
+    }
+    let session;
+    try {
+      session = this.manager.getSession(app.session);
+    } catch {
+      return null;
+    }
+    return session.plugins.get(PluginClass, app.id);
+  }
+}

src/apps/app_sdk/storage/AppRepository.ts

@@ -83,6 +83,25 @@ export class AppRepository {
     return this.deserialize(app);
   }
 
+  /**
+   * Gets the enabled app of the given type for a session.
+   * Intended for unique-per-session apps - returns the first match.
+   */
+  async getEnabledBySessionAndApp(
+    session: string,
+    appName: string,
+  ): Promise<AppDB | null> {
+    const app = await this.knex(this.tableName)
+      .where('session', session)
+      .andWhere('app', appName)
+      .andWhere('enabled', true)
+      .first();
+    if (!app) {
+      return null;
+    }
+    return this.deserialize(app);
+  }
+
   /**
    * Gets all apps
    */

src/apps/app_sdk/waha/WAHASelf.ts

@@ -13,8 +13,7 @@ import {
   WANumberExistResult,
 } from '@waha/structures/chatting.dto';
 import { SessionInfo } from '@waha/structures/sessions.dto';
-import axios, { AxiosInstance } from 'axios';
-import { Auth } from '@waha/core/auth/config';
+import axios, { AxiosInstance, AxiosRequestConfig } from 'axios';
 import { ContactSortField } from '@waha/structures/contacts.dto';
 import { PaginationParams } from '@waha/structures/pagination.dto';
 
@@ -25,9 +24,7 @@ export interface RequestOptions {
 export class WAHASelf {
   public client: AxiosInstance;
 
-  constructor() {
-    // Set 'X-Api-Key'
-    const key = Auth.keyplain.value;
+  constructor(public key: string) {
     const port =
       parseInt(process.env.PORT) ||
       parseInt(process.env.WHATSAPP_API_PORT) ||
@@ -42,6 +39,10 @@ export class WAHASelf {
     });
   }
 
+  request(config: AxiosRequestConfig) {
+    return this.client.request(config);
+  }
+
   async fetch(url: string, opts?: RequestOptions): Promise<Buffer> {
     const response = await this.client.get(url, {
       responseType: 'arraybuffer',

src/apps/apps.module.disabled.ts

@@ -1,5 +1,6 @@
 import { AppsService } from '@waha/apps/app_sdk/services/IAppsService';
 import { AppsDisabledService } from '@waha/apps/app_sdk/services/AppsDisabledService';
+import { UniqueAppResolver } from '@waha/apps/app_sdk/services/UniqueAppResolver';
 import { AppsController } from '@waha/apps/app_sdk/api/apps.controller';
 import { ChatwootLocalesController } from '@waha/apps/chatwoot/api/chatwoot.locales.controller';
 
@@ -9,6 +10,7 @@ export const AppsDisabled = {
       provide: AppsService,
       useClass: AppsDisabledService,
     },
+    UniqueAppResolver,
   ],
   imports: [],
   controllers: [AppsController, ChatwootLocalesController],

src/apps/apps.module.enabled.ts

@@ -4,16 +4,20 @@ import { RMutexModule } from '@waha/modules/rmutex';
 import { BullBoardModule } from '@bull-board/nestjs';
 import { ExpressAdapter } from '@bull-board/express';
 import { BullAuthMiddleware } from '@waha/apps/app_sdk/auth';
-import { ChatWootExports } from '@waha/apps/chatwoot/chatwoot.module';
 import { AppsController } from '@waha/apps/app_sdk/api/apps.controller';
-import { CallsAppExports } from '@waha/apps/calls/calls.module';
 import { AppsService } from '@waha/apps/app_sdk/services/IAppsService';
 import { AppsEnabledService } from '@waha/apps/app_sdk/services/AppsEnabledService';
+import { UniqueAppResolver } from '@waha/apps/app_sdk/services/UniqueAppResolver';
 import { Auth } from '@waha/core/auth/config';
 import { AppRuntimeConfig } from '@waha/apps/app_sdk/apps/AppRuntime';
-import { AppName } from '@waha/apps/app_sdk/apps/name';
+import { GetApps } from '@waha/apps/app_sdk/apps/registry';
+import { HttpPathsRegistration } from '@waha/plugins/http.paths.module';
 
 const QUEUES_IMPORTS_REQUIRED = [
+  HttpPathsRegistration(
+    { prefix: '/jobs', include: { authBasic: false } },
+    { prefix: '/jobs/', include: { authBasic: false, accessLog: false } },
+  ),
   BullModule.forRoot({
     connection: {
       url: process.env.REDIS_URL || 'redis://:redis@localhost:6379',
@@ -70,42 +74,27 @@ const QUEUES_IMPORTS = AppRuntimeConfig.HasAppsRequiringQueue()
   ? QUEUES_IMPORTS_REQUIRED
   : [];
 
-function getAppModule(name: AppName) {
-  if (!AppRuntimeConfig.HasApp(name)) {
-    return {
-      imports: [],
-      controllers: [],
-      providers: [],
-    };
-  }
-  switch (name) {
-    case AppName.calls:
-      return CallsAppExports;
-    case AppName.chatwoot:
-      return ChatWootExports;
-    default:
-      throw Error(`App module not found for ${name}`);
-  }
-}
+// Apps enabled in the runtime configuration (WAHA_APPS_ON / WAHA_APPS_OFF)
+const ENABLED_APPS = GetApps().filter((app) =>
+  AppRuntimeConfig.HasApp(app.name),
+);
 
 export const AppsEnabled = {
   imports: [
     ...QUEUES_IMPORTS,
-    ...getAppModule(AppName.chatwoot).imports,
-    ...getAppModule(AppName.calls).imports,
+    ...ENABLED_APPS.flatMap((app) => app.nestjs.imports),
   ],
   controllers: [
     AppsController,
-    ...getAppModule(AppName.chatwoot).controllers,
-    ...getAppModule(AppName.calls).controllers,
+    ...ENABLED_APPS.flatMap((app) => app.nestjs.controllers),
   ],
   providers: [
     {
       provide: AppsService,
       useClass: AppsEnabledService,
     },
-    ...getAppModule(AppName.calls).providers,
-    ...getAppModule(AppName.chatwoot).providers,
+    UniqueAppResolver,
+    ...ENABLED_APPS.flatMap((app) => app.nestjs.providers),
   ],
 };
 

src/apps/argentine-phone-numbers/app.module.ts

@@ -0,0 +1,28 @@
+import { AppModule } from '@waha/apps/app_sdk/apps/definition';
+import { AppName } from '@waha/apps/app_sdk/apps/apps';
+import { ArgentinePhoneNumbersController } from '@waha/apps/argentine-phone-numbers/controller';
+import { ArgentinePhoneNumbersAppService } from '@waha/apps/argentine-phone-numbers/services/ArgentinePhoneNumbersAppService';
+
+const ArgentinePhoneNumbersAppModule: AppModule = {
+  name: AppName.argentinePhoneNumbers,
+  openapi: {
+    title: 'Phone Numbers: Argentina',
+    description:
+      'Resolve Argentine phone numbers (with and without the mobile 9)',
+  },
+  definition: {
+    plainkey: false,
+    queue: false,
+    migrations: true,
+    restartOnChange: true,
+    unique: true,
+  },
+  nestjs: {
+    imports: [],
+    controllers: [ArgentinePhoneNumbersController],
+    providers: [ArgentinePhoneNumbersAppService],
+  },
+  Service: ArgentinePhoneNumbersAppService,
+};
+
+export default ArgentinePhoneNumbersAppModule;

src/apps/argentine-phone-numbers/controller.ts

@@ -0,0 +1,21 @@
+import { Controller, UseGuards } from '@nestjs/common';
+import { ApiSecurity } from '@nestjs/swagger';
+import { AppName } from '@waha/apps/app_sdk/apps/apps';
+import { UniqueAppResolver } from '@waha/apps/app_sdk/services/UniqueAppResolver';
+import { ArgentinePhoneNumbersAppService } from '@waha/apps/argentine-phone-numbers/services/ArgentinePhoneNumbersAppService';
+import { PhoneNumbersCacheController } from '@waha/apps/phone-numbers/api/PhoneNumbersCacheController';
+import { SessionManager } from '@waha/core/abc/manager.abc';
+import { PoliciesGuard } from '@waha/core/auth/policies.guard';
+
+@ApiSecurity('api_key')
+@Controller('api/apps/argentine-phone-numbers/:session')
+@UseGuards(PoliciesGuard)
+export class ArgentinePhoneNumbersController extends PhoneNumbersCacheController {
+  constructor(
+    manager: SessionManager,
+    resolver: UniqueAppResolver,
+    appService: ArgentinePhoneNumbersAppService,
+  ) {
+    super(manager, resolver, appService, AppName.argentinePhoneNumbers);
+  }
+}

src/apps/argentine-phone-numbers/dto.ts

@@ -0,0 +1,3 @@
+import { PhoneNumbersBaseConfig } from '@waha/apps/phone-numbers/dto/config.dto';
+
+export class ArgentinePhoneNumbersAppConfig extends PhoneNumbersBaseConfig {}

src/apps/argentine-phone-numbers/migrations/001_init_app.ts

@@ -0,0 +1,9 @@
+import { migrations_001_init_cache } from '@waha/apps/phone-numbers/storage/migrations_001_init_cache';
+
+const migration = migrations_001_init_cache({
+  table: 'app_argentine_phone_numbers_cache',
+  index: 'arphone',
+});
+
+exports.up = migration.up;
+exports.down = migration.down;

src/apps/argentine-phone-numbers/plugins/ArgentinePhoneNumbers.test.ts

@@ -0,0 +1,106 @@
+import { UnprocessableEntityException } from '@nestjs/common';
+import { ArgentinePhoneNumberRules } from '@waha/apps/argentine-phone-numbers/rules/ArgentinePhoneNumberRules';
+import { PhoneNumbersBaseConfig } from '@waha/apps/phone-numbers/dto/config.dto';
+import {
+  buildPlugin as buildPhoneNumbersPlugin,
+  resolveChat,
+  stubLookup,
+} from '@waha/apps/phone-numbers/plugins/testing';
+
+function buildPlugin(config: Partial<PhoneNumbersBaseConfig> = {}) {
+  return buildPhoneNumbersPlugin({
+    config: config,
+    rules: ArgentinePhoneNumberRules(),
+  });
+}
+
+describe('ArgentinePhoneNumbers', () => {
+  it('uses the supplied form when it exists, without checking the other one', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, { numberExists: true, chatId: '541112345678@c.us' });
+
+    const resolved = await resolveChat(session, '+541112345678');
+
+    expect(resolved).toBe('541112345678@c.us');
+    expect(session.checkNumberStatus).toHaveBeenCalledTimes(1);
+    expect(session.checkNumberStatus).toHaveBeenCalledWith({
+      phone: '541112345678',
+      session: 'test',
+    });
+  });
+
+  it('tries the form with 9 after the supplied one is absent, keeps a LID answer', async () => {
+    const { session } = buildPlugin();
+    session.checkNumberStatus = jest
+      .fn()
+      .mockResolvedValueOnce({ numberExists: false })
+      .mockResolvedValueOnce({ numberExists: true, chatId: '123456@lid' });
+
+    const resolved = await resolveChat(session, '541112345678@c.us');
+
+    expect(resolved).toBe('123456@lid');
+    expect(session.checkNumberStatus).toHaveBeenLastCalledWith({
+      phone: '5491112345678',
+      session: 'test',
+    });
+    // Both forms hit the cache now
+    expect(await resolveChat(session, '5491112345678@c.us')).toBe('123456@lid');
+    expect(session.checkNumberStatus).toHaveBeenCalledTimes(2);
+  });
+
+  it('tries the form without 9 as the fallback', async () => {
+    const { session } = buildPlugin();
+    session.checkNumberStatus = jest
+      .fn()
+      .mockResolvedValueOnce({ numberExists: false })
+      .mockResolvedValueOnce({
+        numberExists: true,
+        chatId: '542920123456@c.us',
+      });
+
+    const resolved = await resolveChat(session, '5492920123456@c.us');
+
+    expect(resolved).toBe('542920123456@c.us');
+  });
+
+  it('prefers the pn when the engine answers with both pn and a LID', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '123@lid',
+      pn: '5491112345678@c.us',
+    });
+
+    expect(await resolveChat(session, '541112345678@c.us')).toBe(
+      '5491112345678@c.us',
+    );
+  });
+
+  it('soft mode keeps the supplied form when both are absent, strict rejects', async () => {
+    const soft = buildPlugin();
+    stubLookup(soft.session, { numberExists: false });
+    expect(await resolveChat(soft.session, '541112345678@c.us')).toBe(
+      '541112345678@c.us',
+    );
+    expect(soft.session.checkNumberStatus).toHaveBeenCalledTimes(2);
+
+    const strict = buildPlugin({ strict: true });
+    stubLookup(strict.session, { numberExists: false });
+    await expect(
+      resolveChat(strict.session, '541112345678@c.us'),
+    ).rejects.toThrow(UnprocessableEntityException);
+  });
+
+  it('leaves local forms and other countries untouched', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, { numberExists: false });
+
+    expect(await resolveChat(session, '1112345678@c.us')).toBe(
+      '1112345678@c.us',
+    );
+    expect(await resolveChat(session, '5511912345678@c.us')).toBe(
+      '5511912345678@c.us',
+    );
+    expect(session.checkNumberStatus).not.toHaveBeenCalled();
+  });
+});

src/apps/argentine-phone-numbers/rules/ArgentinePhoneNumberRules.test.ts

@@ -0,0 +1,33 @@
+import { ArgentinePhoneNumberRules } from './ArgentinePhoneNumberRules';
+
+describe('ArgentinePhoneNumberRules', () => {
+  const rules = ArgentinePhoneNumberRules();
+
+  function resolve(digits: string) {
+    const rule = rules.find((r) => r.matches(digits));
+    return rule?.resolve(digits) ?? null;
+  }
+
+  it.each([
+    ['541112345678', ['541112345678', '5491112345678']],
+    ['5491112345678', ['5491112345678', '541112345678']],
+    ['543511234567', ['543511234567', '5493511234567']],
+    ['5492920123456', ['5492920123456', '542920123456']],
+  ])('keeps the supplied form first for %s', (digits, expected) => {
+    expect(resolve(digits)).toEqual({ candidates: expected, fallback: digits });
+  });
+
+  it.each([
+    '0111512345678',
+    '1112345678',
+    '91112345678',
+    '54111512345678',
+    '548001234567',
+    '54911123',
+    '54911123456789',
+    '5511912345678',
+    '',
+  ])('does not match %s', (digits) => {
+    expect(resolve(digits)).toBeNull();
+  });
+});

src/apps/argentine-phone-numbers/rules/ArgentinePhoneNumberRules.ts

@@ -0,0 +1,13 @@
+import { PhoneNumberRule } from '@waha/apps/phone-numbers/rules/PhoneNumberRule';
+import { RegexpPhoneNumberRule } from '@waha/apps/phone-numbers/rules/RegexpPhoneNumberRule';
+
+/**
+ * Argentina: mobiles have a 9 after the country code, callers send either form - check the supplied one first.
+ * 54 + area code (1-3...) + number, 10 digits, international form only
+ */
+export function ArgentinePhoneNumberRules(): PhoneNumberRule[] {
+  return [
+    new RegexpPhoneNumberRule('^54([1-3]\\d{9})$', '549$1'),
+    new RegexpPhoneNumberRule('^549([1-3]\\d{9})$', '54$1'),
+  ];
+}

src/apps/argentine-phone-numbers/services/ArgentinePhoneNumbersAppService.ts

@@ -0,0 +1,21 @@
+import { Injectable } from '@nestjs/common';
+import { UniqueAppResolver } from '@waha/apps/app_sdk/services/UniqueAppResolver';
+import { ArgentinePhoneNumbersAppConfig } from '@waha/apps/argentine-phone-numbers/dto';
+import { ArgentinePhoneNumberRules } from '@waha/apps/argentine-phone-numbers/rules/ArgentinePhoneNumberRules';
+import { ArgentinePhoneNumbersCacheRepository } from '@waha/apps/argentine-phone-numbers/storage/ArgentinePhoneNumbersCacheRepository';
+import { PhoneNumberRule } from '@waha/apps/phone-numbers/rules/PhoneNumberRule';
+import { PhoneNumbersAppServiceBase } from '@waha/apps/phone-numbers/services/PhoneNumbersAppServiceBase';
+
+@Injectable()
+export class ArgentinePhoneNumbersAppService extends PhoneNumbersAppServiceBase<ArgentinePhoneNumbersAppConfig> {
+  protected readonly Repository = ArgentinePhoneNumbersCacheRepository;
+
+  constructor(resolver: UniqueAppResolver) {
+    super(resolver);
+  }
+
+  protected rules(config: ArgentinePhoneNumbersAppConfig): PhoneNumberRule[] {
+    void config;
+    return ArgentinePhoneNumberRules();
+  }
+}

src/apps/argentine-phone-numbers/storage/ArgentinePhoneNumbersCacheRepository.ts

@@ -0,0 +1,5 @@
+import { PhoneNumbersCacheRepository } from '@waha/apps/phone-numbers/storage/PhoneNumbersCacheRepository';
+
+export class ArgentinePhoneNumbersCacheRepository extends PhoneNumbersCacheRepository {
+  static tableName = 'app_argentine_phone_numbers_cache';
+}

src/apps/brazilian-phone-numbers/app.module.ts

@@ -0,0 +1,27 @@
+import { AppModule } from '@waha/apps/app_sdk/apps/definition';
+import { AppName } from '@waha/apps/app_sdk/apps/apps';
+import { BrazilianPhoneNumbersController } from '@waha/apps/brazilian-phone-numbers/controller';
+import { BrazilianPhoneNumbersAppService } from '@waha/apps/brazilian-phone-numbers/services/BrazilianPhoneNumbersAppService';
+
+const BrazilianPhoneNumbersAppModule: AppModule = {
+  name: AppName.brazilianPhoneNumbers,
+  openapi: {
+    title: 'Phone Numbers: Brazil',
+    description: 'Resolve Brazilian phone numbers (with and without 9 digit)',
+  },
+  definition: {
+    plainkey: false,
+    queue: false,
+    migrations: true,
+    restartOnChange: true,
+    unique: true,
+  },
+  nestjs: {
+    imports: [],
+    controllers: [BrazilianPhoneNumbersController],
+    providers: [BrazilianPhoneNumbersAppService],
+  },
+  Service: BrazilianPhoneNumbersAppService,
+};
+
+export default BrazilianPhoneNumbersAppModule;

src/apps/brazilian-phone-numbers/controller.ts

@@ -0,0 +1,21 @@
+import { Controller, UseGuards } from '@nestjs/common';
+import { ApiSecurity } from '@nestjs/swagger';
+import { AppName } from '@waha/apps/app_sdk/apps/apps';
+import { UniqueAppResolver } from '@waha/apps/app_sdk/services/UniqueAppResolver';
+import { BrazilianPhoneNumbersAppService } from '@waha/apps/brazilian-phone-numbers/services/BrazilianPhoneNumbersAppService';
+import { PhoneNumbersCacheController } from '@waha/apps/phone-numbers/api/PhoneNumbersCacheController';
+import { SessionManager } from '@waha/core/abc/manager.abc';
+import { PoliciesGuard } from '@waha/core/auth/policies.guard';
+
+@ApiSecurity('api_key')
+@Controller('api/apps/brazilian-phone-numbers/:session')
+@UseGuards(PoliciesGuard)
+export class BrazilianPhoneNumbersController extends PhoneNumbersCacheController {
+  constructor(
+    manager: SessionManager,
+    resolver: UniqueAppResolver,
+    appService: BrazilianPhoneNumbersAppService,
+  ) {
+    super(manager, resolver, appService, AppName.brazilianPhoneNumbers);
+  }
+}

src/apps/brazilian-phone-numbers/dto.ts

@@ -0,0 +1,3 @@
+import { PhoneNumbersBaseConfig } from '@waha/apps/phone-numbers/dto/config.dto';
+
+export class BrazilianPhoneNumbersAppConfig extends PhoneNumbersBaseConfig {}

src/apps/brazilian-phone-numbers/migrations/001_init_brazilian_phone_numbers.ts

@@ -0,0 +1,9 @@
+import { migrations_001_init_cache } from '@waha/apps/phone-numbers/storage/migrations_001_init_cache';
+
+const migration = migrations_001_init_cache({
+  table: 'app_brazilian_phone_numbers_cache',
+  index: 'brphone',
+});
+
+exports.up = migration.up;
+exports.down = migration.down;

src/apps/brazilian-phone-numbers/plugins/BrazilianPhoneNumbers.test.ts

@@ -0,0 +1,431 @@
+import { UnprocessableEntityException } from '@nestjs/common';
+import { BrazilianPhoneNumberRule } from '@waha/apps/brazilian-phone-numbers/rules/BrazilianPhoneNumberRule';
+import { PhoneNumbersBaseConfig } from '@waha/apps/phone-numbers/dto/config.dto';
+import { PhoneNumbersGowsPlugin } from '@waha/apps/phone-numbers/plugins/PhoneNumbersGowsPlugin';
+import { PhoneNumbersNowebPlugin } from '@waha/apps/phone-numbers/plugins/PhoneNumbersNowebPlugin';
+import { PhoneNumbersCorePlugin } from '@waha/apps/phone-numbers/plugins/PhoneNumbersCorePlugin';
+import {
+  buildPlugin as buildPhoneNumbersPlugin,
+  resolveChat,
+  stubLookup,
+} from '@waha/apps/phone-numbers/plugins/testing';
+
+interface BuildOptions {
+  config?: Partial<PhoneNumbersBaseConfig>;
+  repository?: any;
+  pluginClass?: typeof PhoneNumbersCorePlugin;
+}
+
+function buildPlugin(options: BuildOptions = {}) {
+  return buildPhoneNumbersPlugin({
+    ...options,
+    rules: [new BrazilianPhoneNumberRule()],
+  });
+}
+
+describe('BrazilianPhoneNumbers - wid.chat', () => {
+  it('resolves and caches the canonical phone when the engine answers with a PN', async () => {
+    // '558591203123' is the real number: DDD 85 with an 8-digit local part.
+    const { session } = buildPlugin();
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '558591203123@c.us',
+    });
+
+    const first = await resolveChat(session, '5585991203123@c.us');
+    const second = await resolveChat(session, '5585991203123@c.us');
+
+    expect(first).toBe('558591203123@c.us');
+    expect(second).toBe('558591203123@c.us');
+    // Second call is served from cache - no extra WhatsApp lookup.
+    expect(session.checkNumberStatus).toHaveBeenCalledTimes(1);
+    expect(session.checkNumberStatus).toHaveBeenCalledWith({
+      phone: '558591203123',
+      session: 'test',
+    });
+  });
+
+  it('prefers the pn form when the engine answers with both pn and a LID', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '77820596330581@lid',
+      pn: '558591203123@c.us',
+    });
+
+    const resolved = await resolveChat(session, '5585991203123@c.us');
+
+    expect(resolved).toBe('558591203123@c.us');
+  });
+
+  it('caches a LID answer as-is instead of stapling a phone suffix on it', async () => {
+    // Engines answer with a LID only when the account has no phone form. The
+    // LID is routable, but '77820596330581@c.us' - its digits with a phone
+    // suffix - addresses nobody.
+    const { session } = buildPlugin();
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '77820596330581@lid',
+    });
+
+    const first = await resolveChat(session, '5585991203123@c.us');
+    const second = await resolveChat(session, '5585991203123@c.us');
+
+    expect(first).toBe('77820596330581@lid');
+    expect(second).toBe('77820596330581@lid');
+    expect(session.checkNumberStatus).toHaveBeenCalledTimes(1);
+  });
+
+  it('reuses the cache across both forms of the same number', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '558591203123@c.us',
+    });
+
+    // Wrong form first, then the already-correct one: same target, one lookup.
+    const wrongForm = await resolveChat(session, '5585991203123@c.us');
+    const rightForm = await resolveChat(session, '558591203123@c.us');
+
+    expect(wrongForm).toBe('558591203123@c.us');
+    expect(rightForm).toBe('558591203123@c.us');
+    expect(session.checkNumberStatus).toHaveBeenCalledTimes(1);
+  });
+
+  it('shares one in-flight lookup between concurrent sends (single-flight)', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '558591203123@c.us',
+    });
+
+    const [first, second] = await Promise.all([
+      resolveChat(session, '5585991203123@c.us'),
+      resolveChat(session, '558591203123@c.us'),
+    ]);
+
+    expect(first).toBe('558591203123@c.us');
+    expect(second).toBe('558591203123@c.us');
+    expect(session.checkNumberStatus).toHaveBeenCalledTimes(1);
+  });
+
+  it('rewrites a dialed toll-free (0800) to the stored form, no lookup', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, { numberExists: false });
+
+    // Dialed forms with and without the country code, plus the already-stored
+    // form, all address the same chat id - and none hits the WhatsApp lookup.
+    expect(await resolveChat(session, '08000464636@c.us')).toBe(
+      '558000464636@c.us',
+    );
+    expect(await resolveChat(session, '5508000464636@c.us')).toBe(
+      '558000464636@c.us',
+    );
+    expect(await resolveChat(session, '558000464636@c.us')).toBe(
+      '558000464636@c.us',
+    );
+    expect(session.checkNumberStatus).not.toHaveBeenCalled();
+  });
+
+  it('applies the static 9th-digit rule for DDD below the lookup range, no lookup', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, { numberExists: false });
+
+    const resolved = await resolveChat(session, '551198765432@c.us');
+
+    expect(resolved).toBe('5511998765432@c.us');
+    expect(session.checkNumberStatus).not.toHaveBeenCalled();
+  });
+
+  it('leaves numbers of other countries untouched', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, { numberExists: false });
+
+    const resolved = await resolveChat(session, '12132132130@c.us');
+
+    expect(resolved).toBe('12132132130@c.us');
+    expect(session.checkNumberStatus).not.toHaveBeenCalled();
+  });
+
+  it('passes recursion-sensitive methods through untouched', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, { numberExists: false });
+
+    const viaCheck = await resolveChat(
+      session,
+      '5585991203123@c.us',
+      'checkNumberStatus',
+    );
+    const viaLidMap = await resolveChat(
+      session,
+      '5585991203123@c.us',
+      'findLIDByPhoneNumber',
+    );
+
+    expect(viaCheck).toBe('5585991203123@c.us');
+    expect(viaLidMap).toBe('5585991203123@c.us');
+    expect(session.checkNumberStatus).not.toHaveBeenCalled();
+  });
+
+  it('resolves non-send methods locally only - no lookup, cache still honored', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '558591203123@c.us',
+    });
+
+    // Cache miss on a local-only method: input goes through unresolved.
+    const cold = await resolveChat(
+      session,
+      '5585991203123@c.us',
+      'startTyping',
+    );
+    expect(cold).toBe('5585991203123@c.us');
+    expect(session.checkNumberStatus).not.toHaveBeenCalled();
+
+    // A send resolves and caches; the local-only method now sees the cache.
+    await resolveChat(session, '5585991203123@c.us', 'sendText');
+    const warm = await resolveChat(
+      session,
+      '5585991203123@c.us',
+      'startTyping',
+    );
+    expect(warm).toBe('558591203123@c.us');
+    expect(session.checkNumberStatus).toHaveBeenCalledTimes(1);
+  });
+
+  it('throws 422 for a malformed number on send, passes it through otherwise', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, { numberExists: false });
+
+    await expect(resolveChat(session, '55859912@c.us')).rejects.toThrow(
+      UnprocessableEntityException,
+    );
+    const readOp = await resolveChat(session, '55859912@c.us', 'getPresence');
+    expect(readOp).toBe('55859912@c.us');
+  });
+
+  it('soft mode: sends the best-guess when the number is confirmed not to exist', async () => {
+    const { session } = buildPlugin();
+    stubLookup(session, { numberExists: false });
+
+    const resolved = await resolveChat(session, '558591203123@c.us');
+
+    // DDD 85 keeps the 8-digit heuristic as the best-guess.
+    expect(resolved).toBe('558591203123@c.us');
+    // Both candidates were tried before giving up.
+    expect(session.checkNumberStatus).toHaveBeenCalledTimes(2);
+  });
+
+  it('strict mode: rejects a confirmed-nonexistent number and caches the negative', async () => {
+    const { session } = buildPlugin({ config: { strict: true } });
+    stubLookup(session, { numberExists: false });
+
+    await expect(resolveChat(session, '5585991203123@c.us')).rejects.toThrow(
+      UnprocessableEntityException,
+    );
+    const lookups = session.checkNumberStatus.mock.calls.length;
+
+    // The negative is cached - the retry rejects without a new lookup...
+    await expect(resolveChat(session, '5585991203123@c.us')).rejects.toThrow(
+      UnprocessableEntityException,
+    );
+    expect(session.checkNumberStatus).toHaveBeenCalledTimes(lookups);
+    // ...and local-only methods still pass the number through.
+    const readOp = await resolveChat(
+      session,
+      '5585991203123@c.us',
+      'getPresence',
+    );
+    expect(readOp).toBe('5585991203123@c.us');
+  });
+
+  it('sends as-is without caching when the lookup fails', async () => {
+    const { session } = buildPlugin();
+    session.checkNumberStatus = jest.fn(async () => {
+      throw new Error('engine down');
+    });
+
+    const resolved = await resolveChat(session, '5585991203123@c.us');
+
+    expect(resolved).toBe('5585991203123@c.us');
+    const lookups = session.checkNumberStatus.mock.calls.length;
+    // Not cached: the next send retries the lookup.
+    await resolveChat(session, '5585991203123@c.us');
+    expect(session.checkNumberStatus.mock.calls.length).toBeGreaterThan(
+      lookups,
+    );
+  });
+
+  it('lookup: false disables the WhatsApp tier', async () => {
+    const { session } = buildPlugin({ config: { lookup: false } });
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '558591203123@c.us',
+    });
+
+    const resolved = await resolveChat(session, '5585991203123@c.us');
+
+    expect(resolved).toBe('5585991203123@c.us');
+    expect(session.checkNumberStatus).not.toHaveBeenCalled();
+  });
+});
+
+describe('BrazilianPhoneNumbers - wid.mention', () => {
+  it('resolves mentions best-effort and never breaks the send', async () => {
+    const { session } = buildPlugin({ config: { strict: true } });
+    stubLookup(session, { numberExists: false });
+
+    // Strict mode rejects the number on the chat hook, but a mention falls
+    // back to the input instead of failing the whole message.
+    const mention = await session.hooks.wid.mention.promise(
+      '5585991203123@c.us',
+      'sendText',
+    );
+
+    expect(mention).toBe('5585991203123@c.us');
+  });
+});
+
+describe('BrazilianPhoneNumbers - persistent cache tier', () => {
+  function buildRepository() {
+    return {
+      get: jest.fn().mockResolvedValue(null),
+      setMany: jest.fn().mockResolvedValue(undefined),
+    };
+  }
+
+  it('serves a persisted resolution without any lookup and warms the memory tier', async () => {
+    const repository = buildRepository();
+    repository.get.mockResolvedValue({
+      key: '5585991203123',
+      chatId: '558591203123@c.us',
+      verified: true,
+      resolvedAt: new Date(),
+    });
+    const { session } = buildPlugin({ repository: repository });
+    stubLookup(session, { numberExists: false });
+
+    const first = await resolveChat(session, '5585991203123@c.us');
+    const second = await resolveChat(session, '5585991203123@c.us');
+
+    expect(first).toBe('558591203123@c.us');
+    expect(second).toBe('558591203123@c.us');
+    expect(session.checkNumberStatus).not.toHaveBeenCalled();
+    // Second call hits the memory tier - the database is read once.
+    expect(repository.get).toHaveBeenCalledTimes(1);
+  });
+
+  it('persists verified resolutions under both forms of the number', async () => {
+    const repository = buildRepository();
+    const { session } = buildPlugin({ repository: repository });
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '558591203123@c.us',
+    });
+
+    await resolveChat(session, '5585991203123@c.us');
+
+    expect(repository.setMany).toHaveBeenCalledTimes(1);
+    const [keys, chatId, verified] = repository.setMany.mock.calls[0];
+    expect([...keys].sort()).toEqual(['558591203123', '5585991203123']);
+    expect(chatId).toBe('558591203123@c.us');
+    expect(verified).toBe(true);
+  });
+
+  it('does not persist best-guesses or static-rule rewrites', async () => {
+    const repository = buildRepository();
+    const { session } = buildPlugin({ repository: repository });
+    stubLookup(session, { numberExists: false });
+
+    // Static rule (DDD 11) and a confirmed-nonexistent best-guess (DDD 85).
+    await resolveChat(session, '551198765432@c.us');
+    await resolveChat(session, '558591203123@c.us');
+
+    expect(repository.setMany).not.toHaveBeenCalled();
+  });
+
+  it('resolves normally when the persistent tier errors out', async () => {
+    const repository = buildRepository();
+    repository.get.mockRejectedValue(new Error('db down'));
+    const { session } = buildPlugin({ repository: repository });
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '558591203123@c.us',
+    });
+
+    const resolved = await resolveChat(session, '5585991203123@c.us');
+
+    expect(resolved).toBe('558591203123@c.us');
+  });
+});
+
+describe('BrazilianPhoneNumbers GOWS - local LID map tier', () => {
+  it('resolves via the LID map with no WhatsApp lookup', async () => {
+    const { session } = buildPlugin({ pluginClass: PhoneNumbersGowsPlugin });
+    stubLookup(session, { numberExists: false });
+    session.findLIDByPhoneNumber = jest.fn(async (phone: string) => {
+      if (phone === '558591203123') {
+        return { lid: '77820596330581@lid', pn: '558591203123@c.us' };
+      }
+      return { lid: null, pn: null };
+    });
+
+    const resolved = await resolveChat(session, '5585991203123@c.us');
+
+    expect(resolved).toBe('558591203123@c.us');
+    expect(session.checkNumberStatus).not.toHaveBeenCalled();
+  });
+
+  it('falls through to the WhatsApp lookup for unknown numbers', async () => {
+    const { session } = buildPlugin({ pluginClass: PhoneNumbersGowsPlugin });
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '5585991203123@c.us',
+    });
+    session.findLIDByPhoneNumber = jest.fn(async () => {
+      return { lid: null, pn: null };
+    });
+
+    const resolved = await resolveChat(session, '5585991203123@c.us');
+
+    expect(resolved).toBe('5585991203123@c.us');
+    expect(session.checkNumberStatus).toHaveBeenCalled();
+  });
+});
+
+describe('BrazilianPhoneNumbers NOWEB - local contact store tier', () => {
+  it('resolves via the contact store with no WhatsApp lookup', async () => {
+    const { session } = buildPlugin({ pluginClass: PhoneNumbersNowebPlugin });
+    stubLookup(session, { numberExists: false });
+    session.store = {
+      getContactById: jest.fn(async (jid: string) => {
+        if (jid === '558591203123@s.whatsapp.net') {
+          return { id: '558591203123@s.whatsapp.net' };
+        }
+        return null;
+      }),
+    };
+
+    const resolved = await resolveChat(session, '5585991203123@c.us');
+
+    expect(resolved).toBe('558591203123@c.us');
+    expect(session.checkNumberStatus).not.toHaveBeenCalled();
+  });
+
+  it('falls through to the WhatsApp lookup when the store has no match', async () => {
+    const { session } = buildPlugin({ pluginClass: PhoneNumbersNowebPlugin });
+    stubLookup(session, {
+      numberExists: true,
+      chatId: '558591203123@c.us',
+    });
+    session.store = {
+      getContactById: jest.fn(async () => null),
+    };
+
+    const resolved = await resolveChat(session, '5585991203123@c.us');
+
+    expect(resolved).toBe('558591203123@c.us');
+    expect(session.checkNumberStatus).toHaveBeenCalled();
+  });
+});

src/apps/brazilian-phone-numbers/rules/BrazilianPhoneNumberRule.test.ts

@@ -0,0 +1,122 @@
+import {
+  extractPhoneDigits,
+  shouldSkipPhoneNormalization,
+} from '@waha/apps/phone-numbers/utils/phone';
+import {
+  generateBrazilMobileLookupCandidates,
+  isBrazilCountryCode,
+  isBrazilLandline,
+  isBrazilMobile,
+  isMalformedBrazilPhone,
+  needsBrazilWhatsAppLookup,
+  normalizeBrazilMobileForSendDigits,
+  normalizeBrazilTollFreeDigits,
+} from './BrazilianPhoneNumberRule';
+
+describe('BrazilianPhoneNumberRule', () => {
+  it('skips groups and lids', () => {
+    expect(shouldSkipPhoneNormalization('123@g.us')).toBe(true);
+    expect(shouldSkipPhoneNormalization('123@lid')).toBe(true);
+  });
+
+  it('detects BR country code', () => {
+    expect(isBrazilCountryCode('558591203123')).toBe(true);
+    expect(isBrazilCountryCode('5491123456789')).toBe(false);
+  });
+
+  it('flags malformed BR numbers and accepts valid lengths', () => {
+    expect(isMalformedBrazilPhone('55859912')).toBe(true);
+    expect(isMalformedBrazilPhone('558591203123')).toBe(false);
+    expect(isMalformedBrazilPhone('5585991203123')).toBe(false);
+    // not a BR number, not our concern
+    expect(isMalformedBrazilPhone('123')).toBe(false);
+  });
+
+  it('detects BR landline numbers', () => {
+    expect(isBrazilLandline('558540423147')).toBe(true);
+    expect(isBrazilMobile('558540423147')).toBe(false);
+  });
+
+  it('detects BR mobile numbers', () => {
+    expect(isBrazilMobile('558591203123')).toBe(true);
+    expect(isBrazilMobile('5585991203123')).toBe(true);
+  });
+
+  it('accepts any digit after the leading 9 on a 9-digit local', () => {
+    // Brazil has no 9-digit landline, so '9' + 8 digits is always mobile.
+    // The old rule required 6-9 right after the 9 and rejected real SP lines.
+    expect(isBrazilMobile('5511953523741')).toBe(true);
+    expect(isBrazilLandline('5511953523741')).toBe(false);
+    expect(isBrazilMobile('5511912345678')).toBe(true);
+    expect(isBrazilMobile('5511902345678')).toBe(true);
+  });
+
+  it('keeps 9-digit mobiles out of the lookup range untouched', () => {
+    // DDD 11 is below the lookup range: no candidates, no WhatsApp lookup.
+    expect(needsBrazilWhatsAppLookup('5511953523741')).toBe(false);
+    expect(normalizeBrazilMobileForSendDigits('5511953523741')).toBe(
+      '5511953523741',
+    );
+  });
+
+  it('detects landlines in both DDD ranges', () => {
+    expect(isBrazilLandline('551151923057')).toBe(true);
+    expect(isBrazilLandline('558540428310')).toBe(true);
+    expect(isBrazilMobile('551151923057')).toBe(false);
+    expect(isBrazilMobile('558540428310')).toBe(false);
+  });
+
+  it('rewrites toll-free (0800) numbers to the stored form', () => {
+    // Dialed '0800' + 7 digits -> stored '55800' + 7 digits (leading 0 dropped,
+    // country code added). Both the bare and the 55-prefixed dialed forms map
+    // to the same stored number the server resolves them to.
+    expect(normalizeBrazilTollFreeDigits('08000464636')).toBe('558000464636');
+    expect(normalizeBrazilTollFreeDigits('5508000464636')).toBe('558000464636');
+  });
+
+  it('leaves non-toll-free and already-stored numbers untouched', () => {
+    // Already-stored form routes through normally, so no rewrite here.
+    expect(normalizeBrazilTollFreeDigits('558000464636')).toBeNull();
+    expect(normalizeBrazilTollFreeDigits('5585991203123')).toBeNull();
+    expect(normalizeBrazilTollFreeDigits('551151923057')).toBeNull();
+    // 0300/0500/0900 share the shape but are not handled here.
+    expect(normalizeBrazilTollFreeDigits('03001234567')).toBeNull();
+  });
+
+  it('requires lookup only for DDD 31-99 mobile numbers', () => {
+    expect(needsBrazilWhatsAppLookup('5511987654321')).toBe(false);
+    expect(needsBrazilWhatsAppLookup('558591203123')).toBe(true);
+    expect(needsBrazilWhatsAppLookup('558540423147')).toBe(false);
+  });
+
+  it('keeps send heuristic without 9 for DDD 31-99 until lookup resolves', () => {
+    expect(normalizeBrazilMobileForSendDigits('558591203123')).toBe(
+      '558591203123',
+    );
+    expect(normalizeBrazilMobileForSendDigits('555399034520')).toBe(
+      '555399034520',
+    );
+  });
+
+  it('normalizes low DDD mobile numbers for send with 9 digits', () => {
+    expect(normalizeBrazilMobileForSendDigits('551198765432')).toBe(
+      '5511998765432',
+    );
+  });
+
+  it('generates with and without 9 candidates', () => {
+    expect(generateBrazilMobileLookupCandidates('558591203123')).toEqual([
+      '558591203123',
+      '5585991203123',
+    ]);
+    expect(generateBrazilMobileLookupCandidates('5585991203123')).toEqual([
+      '558591203123',
+      '5585991203123',
+    ]);
+  });
+
+  it('extracts digits from chat ids', () => {
+    expect(extractPhoneDigits('558591203123@c.us')).toBe('558591203123');
+    expect(extractPhoneDigits('+558591203123')).toBe('558591203123');
+  });
+});

src/apps/brazilian-phone-numbers/rules/BrazilianPhoneNumberRule.ts

@@ -0,0 +1,166 @@
+import {
+  PhoneNumberResolution,
+  PhoneNumberRule,
+} from '@waha/apps/phone-numbers/rules/PhoneNumberRule';
+
+const COUNTRY_CODE = '55';
+const LANDLINE_FIRST_DIGIT = /^[2-5]/;
+const MOBILE_FIRST_DIGIT = /^[6-9]/;
+
+export const BR_PHONE_DDD_LOOKUP_MIN = 31;
+export const BR_PHONE_DDD_LOOKUP_MAX = 99;
+
+// A Brazil number (country code 55) must be 55 + DDD(2) + local(8 or 9) digits.
+const BR_PHONE_MIN_LENGTH = 12;
+const BR_PHONE_MAX_LENGTH = 13;
+
+export function isBrazilCountryCode(digits: string): boolean {
+  return digits.startsWith(COUNTRY_CODE);
+}
+
+export function isMalformedBrazilPhone(digits: string): boolean {
+  if (!isBrazilCountryCode(digits)) {
+    return false;
+  }
+  return (
+    digits.length < BR_PHONE_MIN_LENGTH || digits.length > BR_PHONE_MAX_LENGTH
+  );
+}
+
+export function isBrazilPhone(digits: string): boolean {
+  return digits.startsWith(COUNTRY_CODE) && digits.length >= 12;
+}
+
+export function getBrazilDdd(digits: string): number {
+  return parseInt(digits.substring(2, 4), 10);
+}
+
+export function getBrazilLocalPart(digits: string): string {
+  return digits.substring(4);
+}
+
+export function isBrazilLandline(digits: string): boolean {
+  if (!isBrazilPhone(digits)) {
+    return false;
+  }
+  const local = getBrazilLocalPart(digits);
+  if (local.length !== 8) {
+    return false;
+  }
+  return LANDLINE_FIRST_DIGIT.test(local);
+}
+
+export function isBrazilMobile(digits: string): boolean {
+  if (!isBrazilPhone(digits) || isBrazilLandline(digits)) {
+    return false;
+  }
+  const local = getBrazilLocalPart(digits);
+  // 8-digit local: the legacy form, missing its 9. Only 6-9 tells it apart
+  // from a landline - 2-5 is genuinely ambiguous and treated as a landline.
+  if (local.length === 8) {
+    return MOBILE_FIRST_DIGIT.test(local);
+  }
+  // 9-digit local starting with 9: unambiguously mobile. Brazil has no
+  // 9-digit landline, and the digit after the leading 9 is unrestricted -
+  // e.g. SP 11 9535-23741. Do not test it.
+  if (local.length === 9 && local[0] === '9') {
+    return true;
+  }
+  return false;
+}
+
+// Brazilian toll-free (0800) numbers are non-geographic: dialed as '0800' plus
+// 7 subscriber digits. WhatsApp stores them under country code 55 with the
+// leading 0 dropped ('08000464636' -> '558000464636'). Callers send the dialed
+// form, so map it to the stored one. The rewrite is deterministic - no WhatsApp
+// lookup, unlike the 9th-digit mobile case. Returns null when not a toll-free
+// number in a dialed form (the stored form '55800...' already routes untouched).
+const BR_TOLLFREE_DIALED = /^0800\d{7}$/;
+const BR_TOLLFREE_DIALED_CC = /^550800\d{7}$/;
+
+export function normalizeBrazilTollFreeDigits(digits: string): string | null {
+  if (BR_TOLLFREE_DIALED.test(digits)) {
+    return `${COUNTRY_CODE}${digits.slice(1)}`;
+  }
+  if (BR_TOLLFREE_DIALED_CC.test(digits)) {
+    return `${COUNTRY_CODE}${digits.slice(3)}`;
+  }
+  return null;
+}
+
+export function needsBrazilWhatsAppLookup(digits: string): boolean {
+  if (!isBrazilMobile(digits)) {
+    return false;
+  }
+  const ddd = getBrazilDdd(digits);
+  return ddd >= BR_PHONE_DDD_LOOKUP_MIN && ddd <= BR_PHONE_DDD_LOOKUP_MAX;
+}
+
+export function normalizeBrazilMobileForSendDigits(digits: string): string {
+  if (!isBrazilMobile(digits)) {
+    return digits;
+  }
+  const ddd = getBrazilDdd(digits);
+  if (ddd >= BR_PHONE_DDD_LOOKUP_MIN) {
+    return digits;
+  }
+  const local = getBrazilLocalPart(digits);
+  if (local.length === 8 && MOBILE_FIRST_DIGIT.test(local)) {
+    return `${COUNTRY_CODE}${ddd}9${local}`;
+  }
+  return digits;
+}
+
+export function generateBrazilMobileLookupCandidates(digits: string): string[] {
+  if (!isBrazilMobile(digits)) {
+    return [digits];
+  }
+  const ddd = digits.substring(2, 4);
+  const local = getBrazilLocalPart(digits);
+  let without9 = digits;
+  let with9 = digits;
+
+  if (local.length === 9 && local[0] === '9') {
+    without9 = `${COUNTRY_CODE}${ddd}${local.substring(1)}`;
+    with9 = `${COUNTRY_CODE}${ddd}${local}`;
+  } else if (local.length === 8) {
+    without9 = `${COUNTRY_CODE}${ddd}${local}`;
+    with9 = `${COUNTRY_CODE}${ddd}9${local}`;
+  }
+
+  const candidates = [without9, with9];
+  return [...new Set(candidates)];
+}
+
+/**
+ * Brazil: mobiles got a 9th digit, callers send either form - static rule for DDD < 31, lookup for the rest
+ */
+export class BrazilianPhoneNumberRule implements PhoneNumberRule {
+  matches(digits: string): boolean {
+    // Dialed toll-free has no country code
+    return isBrazilCountryCode(digits) || BR_TOLLFREE_DIALED.test(digits);
+  }
+
+  resolve(digits: string): PhoneNumberResolution | null {
+    // Before the length check - dialed '0800...' is shorter than a full number
+    const tollFree = normalizeBrazilTollFreeDigits(digits);
+    if (tollFree) {
+      return { candidates: [], fallback: tollFree };
+    }
+    if (isMalformedBrazilPhone(digits)) {
+      return null;
+    }
+    // Landlines are sent as is
+    if (!isBrazilMobile(digits)) {
+      return { candidates: [], fallback: digits };
+    }
+    const normalized = normalizeBrazilMobileForSendDigits(digits);
+    if (!needsBrazilWhatsAppLookup(digits)) {
+      return { candidates: [], fallback: normalized };
+    }
+    return {
+      candidates: generateBrazilMobileLookupCandidates(digits),
+      fallback: normalized,
+    };
+  }
+}

src/apps/brazilian-phone-numbers/services/BrazilianPhoneNumbersAppService.ts

@@ -0,0 +1,21 @@
+import { Injectable } from '@nestjs/common';
+import { UniqueAppResolver } from '@waha/apps/app_sdk/services/UniqueAppResolver';
+import { BrazilianPhoneNumbersAppConfig } from '@waha/apps/brazilian-phone-numbers/dto';
+import { BrazilianPhoneNumberRule } from '@waha/apps/brazilian-phone-numbers/rules/BrazilianPhoneNumberRule';
+import { BrazilianPhoneNumbersCacheRepository } from '@waha/apps/brazilian-phone-numbers/storage/BrazilianPhoneNumbersCacheRepository';
+import { PhoneNumberRule } from '@waha/apps/phone-numbers/rules/PhoneNumberRule';
+import { PhoneNumbersAppServiceBase } from '@waha/apps/phone-numbers/services/PhoneNumbersAppServiceBase';
+
+@Injectable()
+export class BrazilianPhoneNumbersAppService extends PhoneNumbersAppServiceBase<BrazilianPhoneNumbersAppConfig> {
+  protected readonly Repository = BrazilianPhoneNumbersCacheRepository;
+
+  constructor(resolver: UniqueAppResolver) {
+    super(resolver);
+  }
+
+  protected rules(config: BrazilianPhoneNumbersAppConfig): PhoneNumberRule[] {
+    void config;
+    return [new BrazilianPhoneNumberRule()];
+  }
+}

src/apps/brazilian-phone-numbers/storage/BrazilianPhoneNumbersCacheRepository.ts

@@ -0,0 +1,5 @@
+import { PhoneNumbersCacheRepository } from '@waha/apps/phone-numbers/storage/PhoneNumbersCacheRepository';
+
+export class BrazilianPhoneNumbersCacheRepository extends PhoneNumbersCacheRepository {
+  static tableName = 'app_brazilian_phone_numbers_cache';
+}

src/apps/calls/app.module.ts

@@ -0,0 +1,26 @@
+import { AppModule } from '@waha/apps/app_sdk/apps/definition';
+import { AppName } from '@waha/apps/app_sdk/apps/apps';
+import { CallsAppService } from '@waha/apps/calls/services/CallsAppService';
+
+const CallsAppModule: AppModule = {
+  name: AppName.calls,
+  openapi: {
+    title: 'Calls',
+    description: 'Handle incoming calls - reject, message back',
+  },
+  definition: {
+    plainkey: false,
+    queue: false,
+    migrations: false,
+    restartOnChange: true,
+    unique: true,
+  },
+  nestjs: {
+    imports: [],
+    controllers: [],
+    providers: [CallsAppService],
+  },
+  Service: CallsAppService,
+};
+
+export default CallsAppModule;

src/apps/calls/calls.module.ts

@@ -1,7 +0,0 @@
-import { CallsAppService } from '@waha/apps/calls/services/CallsAppService';
-
-export const CallsAppExports = {
-  providers: [CallsAppService],
-  imports: [],
-  controllers: [],
-};

src/apps/calls/dto/app.dto.ts

@@ -0,0 +1,8 @@
+import { App } from '@waha/apps/app_sdk/dto/app.dto';
+import { CallsAppConfig } from '@waha/apps/calls/dto/config.dto';
+import { Type } from 'class-transformer';
+
+export class CallsAppDto extends App<CallsAppConfig> {
+  @Type(() => CallsAppConfig)
+  config: CallsAppConfig;
+}

src/apps/calls/services/CallsAppService.ts

@@ -1,18 +1,14 @@
 import { Injectable } from '@nestjs/common';
 import { App } from '@waha/apps/app_sdk/dto/app.dto';
 import { IAppService } from '@waha/apps/app_sdk/services/IAppService';
+import { PluginOptions } from '@waha/core/abc/session.plugin';
 import { CallsAppConfig } from '@waha/apps/calls/dto/config.dto';
+import { CallsPlugin } from '@waha/apps/calls/services/CallsPlugin';
+import { SessionManager } from '@waha/core/abc/manager.abc';
 import { WhatsappSession } from '@waha/core/abc/session.abc';
-import { InjectPinoLogger, PinoLogger } from 'nestjs-pino';
-import { CallsListener } from '@waha/apps/calls/services/CallsListener';
 
 @Injectable()
 export class CallsAppService implements IAppService {
-  constructor(
-    @InjectPinoLogger('CallsAppService')
-    private readonly logger: PinoLogger,
-  ) {}
-
   validate(app: App<CallsAppConfig>): void {
     // The DTO validation covers structure; no extra validation rules.
     void app;
@@ -25,38 +21,84 @@ export class CallsAppService implements IAppService {
   }
 
   async beforeEnabled(
+    manager: SessionManager,
     savedApp: App<CallsAppConfig>,
     newApp: App<CallsAppConfig>,
   ): Promise<void> {
-    // Enabling behaves the same as creating for this lightweight app.
+    void manager;
     void savedApp;
     void newApp;
-    return;
   }
 
   async beforeDisabled(
+    manager: SessionManager,
     savedApp: App<CallsAppConfig>,
     newApp: App<CallsAppConfig>,
   ): Promise<void> {
-    void newApp;
+    void manager;
     void savedApp;
+    void newApp;
   }
 
   async beforeUpdated(
+    manager: SessionManager,
     savedApp: App<CallsAppConfig>,
     newApp: App<CallsAppConfig>,
   ): Promise<void> {
+    void manager;
     void savedApp;
     void newApp;
   }
 
-  async beforeDeleted(app: App<CallsAppConfig>): Promise<void> {
+  async beforeDeleted(
+    manager: SessionManager,
+    app: App<CallsAppConfig>,
+  ): Promise<void> {
+    void manager;
     void app;
   }
 
+  async afterCreated(
+    manager: SessionManager,
+    app: App<CallsAppConfig>,
+  ): Promise<void> {
+    void manager;
+    void app;
+  }
+
+  async beforeSessionDeleted(
+    manager: SessionManager,
+    app: App<CallsAppConfig>,
+  ): Promise<void> {
+    void manager;
+    void app;
+  }
+
+  async purge(
+    manager: SessionManager,
+    app: App<CallsAppConfig>,
+  ): Promise<void> {
+    void manager;
+    void app;
+  }
+
+  async enrich(
+    manager: SessionManager,
+    app: App<CallsAppConfig>,
+  ): Promise<void> {
+    void manager;
+    void app;
+  }
+
+  plugins(app: App<CallsAppConfig>, session: WhatsappSession): PluginOptions[] {
+    void session;
+    return [CallsPlugin.with(app.config, null)];
+  }
+
   beforeSessionStart(app: App<CallsAppConfig>, session: WhatsappSession): void {
-    const listener = new CallsListener(app, session, this.logger);
-    listener.attach();
+    void app;
+    void session;
+    return;
   }
 
   afterSessionStart(app: App<CallsAppConfig>, session: WhatsappSession): void {

src/apps/calls/services/CallsPlugin.ts

@@ -1,62 +1,29 @@
-import { Subscription } from 'rxjs';
 import {
   CallsAppChannelConfig,
   CallsAppConfig,
 } from '@waha/apps/calls/dto/config.dto';
-import { Logger } from 'pino';
-import { App } from '@waha/apps/app_sdk/dto/app.dto';
-import { PinoLogger } from 'nestjs-pino';
-import { WhatsappSession } from '@waha/core/abc/session.abc';
-import { WAHAEvents, WAHAPresenceStatus } from '@waha/structures/enums.dto';
+import { SessionPlugin } from '@waha/core/abc/session.plugin';
+import { PluginEvent } from '@waha/core/abc/session.plugin.events';
 import { CallData } from '@waha/structures/calls.dto';
 import { MessageTextRequest } from '@waha/structures/chatting.dto';
+import { WAHAEvents, WAHAPresenceStatus } from '@waha/structures/enums.dto';
 import { sleep } from '@waha/utils/promiseTimeout';
+import { Observable } from 'rxjs';
 
-export class CallsListener {
-  private subscription?: Subscription;
-  private config: CallsAppConfig;
-  private readonly log: Logger;
-  private readonly session: WhatsappSession;
-
-  constructor(
-    app: App<CallsAppConfig>,
-    session: WhatsappSession,
-    logger: PinoLogger,
-  ) {
-    this.session = session;
-    this.config = app.config;
-    this.log = logger.logger.child({
-      app: 'calls',
-      session: app.session,
-    });
-  }
-
-  attach(): void {
-    this.detach();
-
-    const observable = this.session.getEventObservable(
-      WAHAEvents.CALL_RECEIVED,
-    );
-    if (!observable) {
-      this.log.warn('CALL_RECEIVED event stream is not available, skipping');
-      return;
-    }
-
-    this.subscription = observable.subscribe((payload) => {
-      this.handleCall(payload as CallData).catch((error) => {
-        this.log.error(
-          { err: error, callId: (payload as any)?.id },
+/**
+ * Rejects incoming calls and optionally sends an auto-reply message.
+ */
+export class CallsPlugin extends SessionPlugin<CallsAppConfig> {
+  @PluginEvent(WAHAEvents.CALL_RECEIVED)
+  onCallReceived(calls$: Observable<CallData>) {
+    calls$.subscribe((call: CallData) => {
+      this.handleCall(call).catch((error) => {
+        this.logger.error(
+          { err: error, callId: call?.id },
           'Failed to handle incoming call',
         );
       });
     });
-
-    this.log.info('Calls app listener is attached');
-  }
-
-  detach(): void {
-    this.subscription?.unsubscribe();
-    this.subscription = undefined;
   }
 
   private configFor(call: CallData): CallsAppChannelConfig {
@@ -65,17 +32,17 @@ export class CallsListener {
 
   private async handleCall(call: CallData): Promise<void> {
     if (!call.from) {
-      this.log.warn({ call: call?.id }, 'Incoming call has no chat id');
+      this.logger.warn({ call: call?.id }, 'Incoming call has no chat id');
       return;
     }
     if (!call.id) {
-      this.log.warn({ from: call.from }, 'Incoming call has no from');
+      this.logger.warn({ from: call.from }, 'Incoming call has no from');
       return;
     }
 
     const config = this.configFor(call);
     if (!config) {
-      this.log.warn({ callId: call.id }, 'No calls config found, skipping');
+      this.logger.warn({ callId: call.id }, 'No calls config found, skipping');
       return;
     }
 
@@ -84,7 +51,7 @@ export class CallsListener {
     const shouldMessage = message.length > 0;
 
     if (!shouldReject && !shouldMessage) {
-      this.log.debug(
+      this.logger.debug(
         { callId: call.id, chatId: call.from },
         'No actions configured for this call',
       );
@@ -105,16 +72,19 @@ export class CallsListener {
   }
 
   private async rejectCall(call: CallData): Promise<void> {
-    this.log.debug({ from: call.from, id: call.id }, 'Rejecting incoming call');
+    this.logger.debug(
+      { from: call.from, id: call.id },
+      'Rejecting incoming call',
+    );
     await this.session.rejectCall(call.from, call.id);
-    this.log.info({ from: call.from, id: call.id }, 'Call rejected');
+    this.logger.info({ from: call.from, id: call.id }, 'Call rejected');
   }
 
   private async replyWithTyping(
     chatId: string,
     message: string,
   ): Promise<void> {
-    this.log.info(
+    this.logger.info(
       { chatId: chatId },
       'Sending auto-response for rejected call',
     );
@@ -132,7 +102,7 @@ export class CallsListener {
     try {
       await this.session.setPresence(WAHAPresenceStatus.TYPING, chatId);
     } catch (error) {
-      this.log.warn(
+      this.logger.warn(
         { err: error, chatId: chatId },
         'Failed to set typing presence before reply',
       );
@@ -146,7 +116,7 @@ export class CallsListener {
     try {
       await this.session.setPresence(WAHAPresenceStatus.PAUSED, chatId);
     } catch (error) {
-      this.log.warn(
+      this.logger.warn(
         { err: error, chatId: chatId },
         'Failed to clear typing presence after reply',
       );

src/apps/chatwoot/api/chatwoot.locales.controller.ts

@@ -1,6 +1,6 @@
 import { Controller, Get } from '@nestjs/common';
 import { sortBy } from 'lodash';
-import { ApiOperation, ApiSecurity, ApiTags } from '@nestjs/swagger';
+import { ApiOperation, ApiSecurity } from '@nestjs/swagger';
 import { i18n } from '@waha/apps/chatwoot/i18n';
 
 interface LanguageResponse {
@@ -10,7 +10,6 @@ interface LanguageResponse {
 
 @Controller('api/apps/chatwoot')
 @ApiSecurity('api_key')
-@ApiTags('🧩 Apps')
 export class ChatwootLocalesController {
   @Get('locales')
   @ApiOperation({

src/apps/chatwoot/api/chatwoot.webhook.controller.ts

@@ -5,7 +5,7 @@ import {
   Param,
   Post,
 } from '@nestjs/common';
-import { ApiOperation, ApiTags } from '@nestjs/swagger';
+import { ApiOperation } from '@nestjs/swagger';
 import { IsCommandsChat } from '@waha/apps/chatwoot/client/ids';
 import { EventName, MessageType } from '@waha/apps/chatwoot/client/types';
 import { InboxData } from '@waha/apps/chatwoot/consumers/types';
@@ -13,9 +13,9 @@ import { ChatWootQueueService } from '@waha/apps/chatwoot/services/ChatWootQueue
 import { SessionManager } from '@waha/core/abc/manager.abc';
 import { AppRepository } from '@waha/apps/app_sdk/storage/AppRepository';
 import { CommandPrefix } from '@waha/apps/chatwoot/cli';
+import { IsExternalEcho } from '@waha/apps/chatwoot/api/webhook.guards';
 
 @Controller('webhooks/chatwoot/')
-@ApiTags('🧩 Apps')
 export class ChatwootWebhookController {
   constructor(
     private readonly chatWootQueueService: ChatWootQueueService,
@@ -42,8 +42,13 @@ export class ChatwootWebhookController {
     }
 
     const isCommandsChat = IsCommandsChat(body);
-    // Ignore private notes (most of them)
     const deleted = body?.content_attributes?.deleted;
+    // Ignore messages that came from WhatsApp, do not send them back
+    if (IsExternalEcho(body) && !deleted) {
+      return { success: true };
+    }
+
+    // Ignore private notes (most of them)
     if (body.private) {
       // Ignore any private note in commands chats
       if (isCommandsChat) {

src/apps/chatwoot/api/webhook.guards.ts

@@ -0,0 +1,15 @@
+import { conversation_message_create } from '@figuro/chatwoot-sdk';
+
+/**
+ * Mark a message WAHA creates from a WhatsApp message, so the webhook does not send it back
+ */
+export function SetExternalEcho(body: conversation_message_create) {
+  body.content_attributes = { ...body.content_attributes, external_echo: true };
+}
+
+/**
+ * Message was created by WAHA from a WhatsApp message, not by an agent
+ */
+export function IsExternalEcho(body: any): boolean {
+  return Boolean(body?.content_attributes?.external_echo);
+}

src/apps/chatwoot/app.module.ts

@@ -1,3 +1,5 @@
+import { AppModule } from '@waha/apps/app_sdk/apps/definition';
+import { AppName } from '@waha/apps/app_sdk/apps/apps';
 import { RegisterAppQueue } from '@waha/apps/app_sdk/BullUtils';
 import {
   ExponentialRetriesJobOptions,
@@ -37,10 +39,15 @@ import { TaskContactsPullConsumer } from '@waha/apps/chatwoot/consumers/task/con
 import { TaskMessagesPullConsumer } from '@waha/apps/chatwoot/consumers/task/messages.pull';
 import { BullModule } from '@nestjs/bullmq';
 import { QueueManager } from '@waha/apps/chatwoot/services/QueueManager';
+import { HttpPathsRegistration } from '@waha/plugins/http.paths.module';
 
 const CONTROLLERS = [ChatwootWebhookController, ChatwootLocalesController];
 
 const IMPORTS = lodash.flatten([
+  HttpPathsRegistration({
+    prefix: '/webhooks/',
+    include: { authBasic: false },
+  }),
   BullModule.registerFlowProducer({
     name: FlowProducerName.MESSAGES_PULL_FLOW,
   }),
@@ -160,8 +167,25 @@ const PROVIDERS = [
   QueueManager,
 ];
 
-export const ChatWootExports = {
-  providers: PROVIDERS,
-  imports: IMPORTS,
-  controllers: CONTROLLERS,
+const ChatWootAppModule: AppModule = {
+  name: AppName.chatwoot,
+  openapi: {
+    title: 'Chatwoot',
+    description: 'Chatwoot integration',
+  },
+  definition: {
+    plainkey: true,
+    queue: true,
+    migrations: true,
+    restartOnChange: true,
+    unique: true,
+  },
+  nestjs: {
+    imports: IMPORTS,
+    controllers: CONTROLLERS,
+    providers: PROVIDERS,
+  },
+  Service: ChatWootAppService,
 };
+
+export default ChatWootAppModule;

src/apps/chatwoot/cli/program.contacts.ts

@@ -14,6 +14,7 @@ import {
 import { ContactsPullOptions } from '@waha/apps/chatwoot/consumers/task/contacts.pull';
 import { JobsOptions } from 'bullmq';
 import { JobDataTimeout } from '@waha/apps/app_sdk/AppConsumer';
+import { NameUpdateMode } from '@waha/apps/chatwoot/client/ContactService';
 
 export function AddContactsCommand(program: Command, ctx: CommandContext) {
   const l = ctx.l;
@@ -39,6 +40,14 @@ export function AddContactsCommand(program: Command, ctx: CommandContext) {
         .choices(['if-missing', 'update'])
         .preset('if-missing'),
     )
+    .addOption(
+      new Option(
+        '-n, --update-names <mode>',
+        l.r('cli.cmd.contacts.pull.option.update-names'),
+      )
+        .choices(Object.values(NameUpdateMode))
+        .default(NameUpdateMode.NO),
+    )
     .option('-g, --groups', l.r('cli.cmd.contacts.pull.option.groups'))
     .option('-l, --lids', l.r('cli.cmd.contacts.pull.option.lids'))
     .option(
@@ -92,6 +101,7 @@ export function AddContactsCommand(program: Command, ctx: CommandContext) {
         batch: opts.batch,
         progress: opts.progress,
         avatar: opts.avatar,
+        updateNames: opts.updateNames,
         attributes: opts.attributes,
         contacts: {
           lids: opts.lids,

src/apps/chatwoot/client/ContactConversationService.ts

@@ -24,6 +24,36 @@ import { AttributeKey } from '@waha/apps/chatwoot/const';
 export interface ContactInfo {
   ChatId(): string;
 
+  /**
+   * Reuse an already fetched WhatsApp contact instead of requesting it again
+   */
+  SetFetchedContact(contact: any): void;
+
+  /**
+   * Linked id - @lid, null when unknown
+   */
+  LidId(): Promise<string | null>;
+
+  /**
+   * Phone number jid - @c.us, null when unknown
+   */
+  JidId(): Promise<string | null>;
+
+  /**
+   * Resolved E.164 phone number, null when not applicable
+   */
+  PhoneNumberE164(): Promise<string | null>;
+
+  /**
+   * Name saved in the phone book, null when not saved
+   */
+  SavedName(): Promise<string | null>;
+
+  /**
+   * Name the contact set for themselves, null when unknown
+   */
+  PushName(): Promise<string | null>;
+
   AvatarUrl(): Promise<string | null>;
 
   Attributes(): Promise<any>;

src/apps/chatwoot/client/ContactService.test.ts

@@ -1,4 +1,7 @@
-import { sanitizeName } from '@waha/apps/chatwoot/client/ContactService';
+import {
+  IsRawName,
+  sanitizeName,
+} from '@waha/apps/chatwoot/client/ContactService';
 
 describe('sanitizeName', () => {
   it('should return the same name', () => {
@@ -21,3 +24,36 @@ describe('sanitizeName', () => {
     expect(sanitizeName(name)).toBe(name);
   });
 });
+
+describe('IsRawName', () => {
+  const placeholders = [
+    '11111111111@c.us',
+    '11111111111@c.us',
+    '011111111111111@lid',
+    '+11111111111',
+    '+11111111111',
+    'Johnny',
+  ];
+  const cases: Array<{ name: string; expected: boolean }> = [
+    { name: '', expected: true },
+    { name: '   ', expected: true },
+    { name: '11111111111@c.us', expected: true },
+    { name: '11111111111', expected: true },
+    { name: '+11111111111', expected: true },
+    { name: '011111111111111@lid', expected: true },
+    { name: '011111111111111', expected: true },
+    { name: 'Johnny', expected: true },
+    { name: ' johnny ', expected: true },
+    { name: 'John Doe', expected: false },
+    { name: 'John (Sales)', expected: false },
+  ];
+
+  it.each(cases)('$name', ({ name, expected }) => {
+    expect(IsRawName(name, placeholders)).toBe(expected);
+  });
+
+  it('treats a nameless contact with no ids as placeholder', () => {
+    expect(IsRawName('', [null, undefined])).toBe(true);
+    expect(IsRawName('John', [null, undefined])).toBe(false);
+  });
+});

src/apps/chatwoot/client/ContactService.ts

@@ -26,6 +26,43 @@ export enum AvatarUpdateMode {
   ALWAYS,
 }
 
+export enum NameUpdateMode {
+  // skip name updates, only new contacts get a name (phone book, push name or phone number)
+  NO = 'no',
+  // keep names set by hand, replace raw ones (phone number, push name) from the phone book
+  IF_RAW = 'if-raw',
+  // the phone book is the source of truth, overwrite any name
+  ALWAYS = 'always',
+}
+
+/**
+ * Raw name - empty or one of the ids the contact was created with, nobody typed it by hand
+ */
+export function IsRawName(
+  name: string,
+  placeholders: Array<string | null | undefined>,
+): boolean {
+  const current = normalizeName(name);
+  if (!current) {
+    return true;
+  }
+  for (const placeholder of placeholders) {
+    if (!placeholder) {
+      continue;
+    }
+    const value = normalizeName(placeholder);
+    const bare = value.replace(/@.*$/, '').replace(/^\+/, '');
+    if (current === value || current === bare || current === `+${bare}`) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function normalizeName(name: string): string {
+  return name.trim().toLowerCase();
+}
+
 export function sanitizeName(name: string) {
   // 255 chars max
   const limit = 255;
@@ -40,6 +77,18 @@ export function sanitizeName(name: string) {
   return clean.slice(0, 255).trim();
 }
 
+function SearchClauseEqualTo(key: string, values: string[]) {
+  // equal_to with multiple values acts as IN
+  return {
+    attribute_key: key,
+    filter_operator: 'equal_to',
+    values: values,
+    attribute_model: 'standard',
+    custom_attribute_type: '',
+    query_operator: 'OR',
+  };
+}
+
 export class ContactService {
   constructor(
     private config: ChatWootAPIConfig,
@@ -52,8 +101,11 @@ export class ContactService {
     contactInfo: ContactInfo,
   ): Promise<[ContactResponse, boolean]> {
     const chatId = contactInfo.ChatId();
-    let contact = await this.searchByAnyID(chatId);
+    const lid = await contactInfo.LidId();
+    const jid = await contactInfo.JidId();
+    let contact = await this.search(chatId, lid, jid);
     if (contact) {
+      await this.upsertPhoneNumber(contact, contactInfo);
       return [contact, false];
     }
 
@@ -62,73 +114,94 @@ export class ContactService {
     return [contact, true];
   }
 
-  async searchByAnyID(chatId: string): Promise<ContactResponse | null> {
-    const payload: any[] = [
-      {
-        attribute_key: AttributeKey.WA_CHAT_ID,
-        filter_operator: 'equal_to',
-        values: [chatId],
-        attribute_model: 'standard',
-        custom_attribute_type: '',
-        query_operator: 'OR',
-      },
-      {
-        attribute_key: AttributeKey.WA_JID,
-        filter_operator: 'equal_to',
-        values: [chatId],
-        attribute_model: 'standard',
-        custom_attribute_type: '',
-        query_operator: 'OR',
-      },
-      {
-        attribute_key: AttributeKey.WA_LID,
-        filter_operator: 'equal_to',
-        values: [chatId],
-        attribute_model: 'standard',
-        custom_attribute_type: '',
-        query_operator: 'OR',
-      },
-      {
-        attribute_key: 'identifier',
-        filter_operator: 'equal_to',
-        values: [chatId],
-        attribute_model: 'standard',
-        custom_attribute_type: '',
-      },
-    ];
-
-    if (isJidCusFormat(chatId)) {
-      // Search by phone
-      const phoneNumberE164 = E164Parser.fromJid(chatId);
-      const phone_number = phoneNumberE164.replace('+', '');
-      payload[payload.length - 1].query_operator = 'OR';
-      payload.push({
-        attribute_key: 'phone_number',
-        filter_operator: 'equal_to',
-        values: [phone_number],
-      });
+  async search(
+    chatId: string,
+    lid: string | null,
+    jid: string | null,
+  ): Promise<ContactResponse | null> {
+    // The chat id attribute holds the latest used address, so match any known form there
+    const chatIds = lodash.uniq(lodash.compact([chatId, jid, lid]));
+    if (chatIds.length == 0) {
+      return null;
     }
 
+    const payload: any[] = [
+      SearchClauseEqualTo(AttributeKey.WA_CHAT_ID, chatIds),
+      SearchClauseEqualTo('identifier', chatIds),
+    ];
+    if (jid) {
+      payload.push(SearchClauseEqualTo(AttributeKey.WA_JID, [jid]));
+    }
+    if (lid) {
+      payload.push(SearchClauseEqualTo(AttributeKey.WA_LID, [lid]));
+    }
+    if (jid && isJidCusFormat(jid)) {
+      // Search by phone - both with and without the leading '+'
+      const phoneNumberE164 = E164Parser.fromJid(jid);
+      let phones = [phoneNumberE164, phoneNumberE164.replace('+', '')];
+      payload.push(SearchClauseEqualTo('phone_number', phones));
+    }
+    // The terminal clause must have no query_operator
+    delete payload[payload.length - 1].query_operator;
+
     const response: any = await this.accountAPI.contacts.filter({
       accountId: this.config.accountId,
       payload: payload as any,
     });
 
     const contacts = response.payload;
-    if (contacts.length == 0) {
+    const candidates: ContactResponse[] = [];
+    for (const contact of contacts) {
+      const inboxes = lodash.filter(contact.contact_inboxes, {
+        inbox: { id: this.config.inboxId },
+      });
+      if (inboxes.length == 0) {
+        continue;
+      }
+      candidates.push({
+        data: contact,
+        sourceId: inboxes[0].source_id,
+      });
+    }
+    if (candidates.length == 0) {
       return null;
     }
-    const contact = contacts[0];
-    const inboxes = lodash.filter(contact.contact_inboxes, {
-      inbox: { id: this.config.inboxId },
-    });
-    if (inboxes.length == 0) {
-      return null;
+    // Prefer a contact with a phone number over a phone-less duplicate
+    const withPhone = candidates.find((candidate) =>
+      Boolean(candidate.data.phone_number),
+    );
+    return withPhone ?? candidates[0];
+  }
+
+  private async upsertPhoneNumber(
+    contact: ContactResponse,
+    contactInfo: ContactInfo,
+  ): Promise<void> {
+    if (contact.data.phone_number) {
+      return;
+    }
+    const phoneNumberE164 = await contactInfo.PhoneNumberE164();
+    if (!phoneNumberE164) {
+      return;
+    }
+    try {
+      await this.accountAPI.contacts.update({
+        id: contact.data.id,
+        accountId: this.config.accountId,
+        data: { phone_number: phoneNumberE164 },
+      });
+      contact.data.phone_number = phoneNumberE164;
+      this.logger.info(
+        `Set phone_number for contact.id: ${
+          contact.data.id
+        }, chat.id: ${contactInfo.ChatId()}`,
+      );
+    } catch (err) {
+      // Chatwoot returns 422 when another contact already owns the phone number
+      this.logger.warn(
+        `Error updating phone_number for contact.id: ${contact.data.id} - ${err}`,
+      );
     }
-    return {
-      data: contact,
-      sourceId: inboxes[0].source_id,
-    };
   }
 
   public async upsertCustomAttributes(
@@ -149,6 +222,37 @@ export class ContactService {
     return true;
   }
 
+  /**
+   * Set the contact name, returns true when it changed
+   */
+  public async updateName(
+    contact: ContactResponse,
+    name: string,
+  ): Promise<boolean> {
+    name = sanitizeName(name);
+    const current = contact.data.name ?? '';
+    if (!name || current.trim() === name.trim()) {
+      return false;
+    }
+    try {
+      await this.accountAPI.contacts.update({
+        id: contact.data.id,
+        accountId: this.config.accountId,
+        data: { name: name },
+      });
+    } catch (err) {
+      this.logger.warn(
+        `Error updating name for contact.id: ${contact.data.id} - ${err}`,
+      );
+      return false;
+    }
+    this.logger.info(
+      `Renamed contact.id: ${contact.data.id}: '${current}' => '${name}'`,
+    );
+    contact.data.name = name;
+    return true;
+  }
+
   public async create(
     chatId: string,
     payload: public_contact_create_update_payload,

src/apps/chatwoot/client/Conversation.ts

@@ -1,6 +1,7 @@
 import ChatwootClient from '@figuro/chatwoot-sdk';
 import type { conversation_message_create } from '@figuro/chatwoot-sdk/dist/models/conversation_message_create';
-import { MessageType } from '@waha/apps/chatwoot/client/types';
+import type { conversation_message_update } from '@figuro/chatwoot-sdk/dist/models/conversation_message_update';
+import { MessageStatus, MessageType } from '@waha/apps/chatwoot/client/types';
 
 export class Conversation {
   public onError: (e: any) => void;
@@ -43,6 +44,20 @@ export class Conversation {
     return this.send(data);
   }
 
+  /**
+   * Update message status (sent/delivered/read/failed)
+   */
+  public async updateMessageStatus(messageId: number, status: MessageStatus) {
+    // The SDK model has no "status" field, but the endpoint accepts only status (and external_error)
+    const data = { status: status } as unknown as conversation_message_update;
+    return this.accountAPI.messages.update({
+      accountId: this.accountId,
+      conversationId: this.conversationId,
+      messageId: messageId,
+      data: data,
+    });
+  }
+
   public async activity(text: string) {
     const data: conversation_message_create = {
       content: text,

src/apps/chatwoot/client/ids.ts

@@ -1,7 +1,7 @@
 import { AttributeKey, INBOX_CONTACT_CHAT_ID } from '@waha/apps/chatwoot/const';
 import * as lodash from 'lodash';
 import { WhatsAppMessage } from '@waha/apps/chatwoot/storage';
-import { buildMessageId } from '@waha/core/engines/noweb/session.noweb.core';
+import { buildMessageId } from '@waha/core/engines/noweb/utils';
 import { isLidUser, normalizeJid } from '@waha/core/utils/jids';
 
 export function GetJID(contact: any): string | null {

src/apps/chatwoot/client/types.ts

@@ -36,6 +36,13 @@ export enum MessageType {
   ACTIVITY = 'activity',
 }
 
+export enum MessageStatus {
+  SENT = 'sent',
+  DELIVERED = 'delivered',
+  READ = 'read',
+  FAILED = 'failed',
+}
+
 export enum CustomAttributeType {
   TEXT = 0,
   NUMBER = 1,

src/apps/chatwoot/consumers/inbox/message_created.ts

@@ -38,6 +38,7 @@ import {
 } from '@waha/apps/chatwoot/dto/config.dto';
 import { Locale } from '@waha/apps/chatwoot/i18n/locale';
 import { isJidGroup } from '@waha/core/utils/jids';
+import { MessageStatusService } from '@waha/apps/chatwoot/services/MessageStatusService';
 
 // eslint-disable-next-line @typescript-eslint/no-var-requires
 const mime = require('mime-types');
@@ -65,6 +66,7 @@ export class ChatWootInboxMessageCreatedConsumer extends ChatWootInboxMessageCon
       session,
       container.ChatWootConfig(),
       container.Locale(),
+      container.MessageStatusService(),
     );
     return await handler.handle(body);
   }
@@ -77,6 +79,7 @@ export class MessageHandler {
     private session: WAHASessionAPI,
     private config: ChatWootConfig,
     private l: Locale,
+    private statusService: MessageStatusService,
   ) {}
 
   async handle(body: any) {
@@ -114,6 +117,7 @@ export class MessageHandler {
     // Send text (Part 1 if present)
     const attachments = message.attachments || [];
     const sendText = content && attachments.length !== 1;
+    const parts = attachments.length + (sendText ? 1 : 0);
     if (sendText) {
       part += 1; // Text is the first possible part
       const exists = await this.getMapping(message, part);
@@ -129,7 +133,7 @@ export class MessageHandler {
         });
         const msg = await this.sendTextMessage(chatId, text, replyTo, mentions);
         results.push(msg);
-        await this.saveMapping(message, msg, part);
+        await this.saveMapping(message, msg, part, parts);
         this.logger.info(`Text message sent: ${msg.id}`);
       }
     }
@@ -155,20 +159,42 @@ export class MessageHandler {
         `File message sent: ${msg.id} - ${file.data_url} - ${file.file_type}`,
       );
       results.push(msg);
-      await this.saveMapping(message, msg, part);
+      await this.saveMapping(message, msg, part, parts);
+    }
+    if (this.config.conversations.syncMessageStatus) {
+      await this.syncStatus(message, parts);
     }
     return results;
   }
 
+  /**
+   * Push acks that arrived before the last part was mapped, best effort
+   */
+  private async syncStatus(message: any, parts: number) {
+    try {
+      await this.statusService.sync({
+        conversation_id: message.conversation.id,
+        message_id: message.id,
+        parts: parts,
+      });
+    } catch (err) {
+      this.logger.warn(
+        `ChatWoot => WhatsApp: error syncing status for Chatwoot message ${message.id}: ${err}`,
+      );
+    }
+  }
+
   private async saveMapping(
     chatwootMessage: any,
     whatsappMessage: any,
     part: number,
+    parts: number,
   ): Promise<void> {
     const chatwoot: Omit<ChatwootMessage, 'id'> = {
       timestamp: new Date(chatwootMessage.created_at),
       conversation_id: chatwootMessage.conversation.id,
       message_id: chatwootMessage.id,
+      parts: parts,
     };
     const whatsapp = EngineHelper.WhatsAppMessageKeys(whatsappMessage);
     await this.mappingService.map(chatwoot, whatsapp, part);
@@ -221,10 +247,23 @@ export class MessageHandler {
       mentions: mentions,
     };
     const session = this.session;
-    await session.readMessages(chatId);
-    await session.startTyping({ chatId: chatId, session: '' });
+    // Best effort - do not block sending on read-receipt failure
+    await session.readMessages(chatId).catch((err) => {
+      this.logger.warn(
+        `ChatWoot => WhatsApp: error reading messages in chat '${chatId}': ${err}`,
+      );
+    });
+    await session.startTyping({ chatId: chatId, session: '' }).catch((err) => {
+      this.logger.warn(
+        `ChatWoot => WhatsApp: error starting typing in chat '${chatId}': ${err}`,
+      );
+    });
     await sleep(2000);
-    await session.stopTyping({ chatId: chatId, session: '' });
+    await session.stopTyping({ chatId: chatId, session: '' }).catch((err) => {
+      this.logger.warn(
+        `ChatWoot => WhatsApp: error stopping typing in chat '${chatId}': ${err}`,
+      );
+    });
     const msg = await session.sendText(request);
     return msg;
   }

src/apps/chatwoot/consumers/inbox/message_updated.ts

@@ -35,6 +35,7 @@ export class ChatWootInboxMessageUpdatedConsumer extends ChatWootInboxMessageCon
       session,
       container.ChatWootConfig(),
       container.Locale(),
+      container.MessageStatusService(),
     );
     return await handler.handle(body);
   }

src/apps/chatwoot/consumers/scheduled/message.cleanup.ts

@@ -44,5 +44,7 @@ export class MessageCleanupConsumer extends ChatWootScheduledConsumer {
       .MessageMappingService()
       .cleanup(removeAfter);
     logger.info(`Removed ${removed} mappings for messages`);
+    const acks = await container.MessageStatusService().cleanup(removeAfter);
+    logger.info(`Removed ${acks} acks for messages`);
   }
 }

src/apps/chatwoot/consumers/task/contacts.pull.ts

@@ -17,6 +17,8 @@ import { SortOrder } from '@waha/structures/pagination.dto';
 import {
   AvatarUpdateMode,
   ContactService,
+  IsRawName,
+  NameUpdateMode,
 } from '@waha/apps/chatwoot/client/ContactService';
 import { Conversation } from '@waha/apps/chatwoot/client/Conversation';
 import { Locale } from '@waha/apps/chatwoot/i18n/locale';
@@ -34,6 +36,7 @@ export interface ContactsPullOptions {
   batch: number;
   progress: number | null;
   avatar: null | 'if-missing' | 'update';
+  updateNames: NameUpdateMode;
   attributes: boolean;
   contacts: {
     groups: boolean;
@@ -88,6 +91,7 @@ export class TaskContactsPullConsumer extends ChatWootTaskConsumer {
 interface Progress {
   created: number;
   updated: number;
+  renamed: number;
   skipped: number;
   errors: number;
   avatar: {
@@ -104,6 +108,7 @@ function total(progress: Progress) {
 const NullProgress: Progress = {
   created: 0,
   updated: 0,
+  renamed: 0,
   skipped: 0,
   errors: 0,
   avatar: {
@@ -201,12 +206,13 @@ class ContactsPullHandler {
         }
 
         this.logger.debug(`Pulling ${chatId}...`);
-        const result = await this.pullOneContact(options, chatId);
+        const result = await this.pullOneContact(options, contact);
         progress.created += result.created;
         progress.updated += result.updated;
+        progress.renamed += result.renamed;
         progress.avatar.updated += result.avatar.updated;
         this.logger.info(
-          `Contact ${chatId}: created=${result.created}, updated=${result.updated}, avatar.updated=${result.avatar.updated}`,
+          `Contact ${chatId}: created=${result.created}, updated=${result.updated}, renamed=${result.renamed}, avatar.updated=${result.avatar.updated}`,
         );
       } catch (e) {
         this.logger.error(`Error pulling contact ${contact.id}: ${e}`);
@@ -220,11 +226,47 @@ class ContactsPullHandler {
     await this.activity.completed(progress);
   }
 
-  private async pullOneContact(options: ContactsPullOptions, chatId: string) {
-    // Contact
-    const contactInfo = WhatsAppContactInfo(this.session, chatId, this.l);
+  private async pullOneContact(options: ContactsPullOptions, contact: any) {
+    const contactInfo = WhatsAppContactInfo(this.session, contact.id, this.l);
+    contactInfo.SetFetchedContact(contact);
     let [cwContact, created] =
       await this.contactService.findOrCreateContact(contactInfo);
+
+    // Name
+    let renamed = false;
+    if (!created) {
+      switch (options.updateNames) {
+        case NameUpdateMode.ALWAYS: {
+          const name = await contactInfo.SavedName();
+          if (name) {
+            renamed = await this.contactService.updateName(cwContact, name);
+          }
+          break;
+        }
+        case NameUpdateMode.IF_RAW: {
+          const name = await contactInfo.SavedName();
+          if (!name) {
+            break;
+          }
+          // Replace only raw names, nobody typed them by hand
+          const placeholders = [
+            contactInfo.ChatId(),
+            await contactInfo.JidId(),
+            await contactInfo.LidId(),
+            await contactInfo.PhoneNumberE164(),
+            cwContact.data.phone_number,
+            await contactInfo.PushName(),
+          ];
+          const current = cwContact.data.name ?? '';
+          if (!IsRawName(current, placeholders)) {
+            break;
+          }
+          renamed = await this.contactService.updateName(cwContact, name);
+          break;
+        }
+      }
+    }
+
     // Attributes
     if (options.attributes) {
       const attributes = await contactInfo.Attributes();
@@ -233,6 +275,7 @@ class ContactsPullHandler {
         attributes,
       );
     }
+
     // Avatar
     let avatarUpdated = false;
     switch (options.avatar) {
@@ -251,9 +294,11 @@ class ContactsPullHandler {
         );
         break;
     }
+
     return {
       created: created ? 1 : 0,
       updated: created ? 0 : 1,
+      renamed: renamed ? 1 : 0,
       avatar: {
         updated: avatarUpdated ? 1 : 0,
       },

src/apps/chatwoot/consumers/task/messages.pull.ts

@@ -294,6 +294,7 @@ class MessagesPullHandler {
       this.session,
       container.Locale(),
       container.WAHASelf(),
+      container.OutgoingMode(),
     );
     handler.force = options.force;
 

src/apps/chatwoot/consumers/utils.ts

@@ -0,0 +1,13 @@
+export function clearContent(attachments) {
+  /**
+   * Remove actual base64 "content" from attachment
+   */
+  if (!attachments) {
+    return attachments;
+  }
+  return attachments.map((attachment) => {
+    attachment = { ...attachment };
+    attachment.content = '';
+    return attachment;
+  });
+}

src/apps/chatwoot/consumers/waha/base.ts

@@ -36,9 +36,11 @@ import { EngineHelper } from '@waha/apps/chatwoot/waha';
 import { EnsureSeconds } from '@waha/utils/timehelper';
 import { CHATWOOT_MESSAGE_CALENDAR_THRESHOLD_SECONDS } from '@waha/apps/chatwoot/env';
 import {
-  ChatWootAppConfig,
   ChatWootConfig,
+  ChatWootOutgoingMode,
 } from '@waha/apps/chatwoot/dto/config.dto';
+import { clearContent } from '@waha/apps/chatwoot/consumers/utils';
+import { SetExternalEcho } from '@waha/apps/chatwoot/api/webhook.guards';
 
 export function ListenEventsForChatWoot(config: ChatWootConfig) {
   const events = [
@@ -51,7 +53,8 @@ export function ListenEventsForChatWoot(config: ChatWootConfig) {
     WAHAEvents.CALL_ACCEPTED,
     WAHAEvents.CALL_REJECTED,
   ];
-  if (config.conversations.markAsRead) {
+  const conversations = config.conversations;
+  if (conversations.markAsRead || conversations.syncMessageStatus) {
     events.push(WAHAEvents.MESSAGE_ACK);
   }
   return events;
@@ -234,6 +237,7 @@ export abstract class MessageBaseHandler<
     protected session: WAHASessionAPI,
     protected l: Locale,
     protected waha: WAHASelf,
+    protected outgoingMode: ChatWootOutgoingMode,
   ) {}
 
   protected abstract getMessage(
@@ -319,6 +323,7 @@ export abstract class MessageBaseHandler<
       this.session,
       EngineHelper.ChatID(payload as any),
       this.l,
+      EngineHelper.PhoneNumber(payload as any),
     );
     const conversation = await this.repo.ConversationByContact(contactInfo);
     this.info.onConversationId(conversation.conversationId);
@@ -329,6 +334,8 @@ export abstract class MessageBaseHandler<
       `Created message as '${message.message_type}' from WhatsApp: ${response.id}`,
     );
     await this.saveMapping(response, payload);
+    // Clear attachments content to avoid saving it in the task result
+    message.attachments = clearContent(message.attachments);
     return message;
   }
 
@@ -398,10 +405,35 @@ export abstract class MessageBaseHandler<
       },
     );
 
-    const private_ = message.private ?? payload.fromMe;
-    const type = private_ ? MessageType.OUTGOING : MessageType.INCOMING;
+    // Send the message as a private note or as a regular message?
+    let private_ = message.private;
+    if (private_ === undefined) {
+      switch (this.outgoingMode) {
+        case ChatWootOutgoingMode.MESSAGE:
+          // Regular outgoing message, not a note
+          private_ = false;
+          break;
+        case ChatWootOutgoingMode.PRIVATE_NOTE:
+        default: // no value - old config, treat it as PRIVATE_NOTE
+          // Mark my messages as private notes
+          private_ = Boolean(payload.fromMe);
+          break;
+      }
+    }
+
+    // Send the message as incoming or outgoing?
+    let type: MessageType = MessageType.INCOMING;
+    if (payload.fromMe) {
+      // Any message from me is outgoing, private or not
+      type = MessageType.OUTGOING;
+    }
+    if (private_) {
+      // Private notes can only be sent as outgoing messages
+      type = MessageType.OUTGOING;
+    }
+
     content = this.finalizeContent(content, payload);
-    return {
+    const body: conversation_message_create = {
       content: content,
       message_type: type,
       private: private_,
@@ -410,6 +442,10 @@ export abstract class MessageBaseHandler<
         in_reply_to: replyTo,
       },
     };
+    if (payload.fromMe) {
+      SetExternalEcho(body);
+    }
+    return body;
   }
 
   async getReplyToChatWootMessageID(

src/apps/chatwoot/consumers/waha/call.accepted.ts

@@ -59,6 +59,7 @@ export class WAHACallAcceptedConsumer extends ChatWootWAHABaseConsumer {
       new WAHASessionAPI(event.session, container.WAHASelf()),
       locale,
       container.WAHASelf(),
+      container.OutgoingMode(),
     );
     const msg = BuildCallMessagePayload(
       event.payload,

src/apps/chatwoot/consumers/waha/call.received.ts

@@ -60,6 +60,7 @@ export class WAHACallReceivedConsumer extends ChatWootWAHABaseConsumer {
       new WAHASessionAPI(event.session, container.WAHASelf()),
       locale,
       container.WAHASelf(),
+      container.OutgoingMode(),
     );
     const msg = BuildCallMessagePayload(
       event.payload,

src/apps/chatwoot/consumers/waha/call.rejected.ts

@@ -59,6 +59,7 @@ export class WAHACallRejectedConsumer extends ChatWootWAHABaseConsumer {
       new WAHASessionAPI(event.session, container.WAHASelf()),
       locale,
       container.WAHASelf(),
+      container.OutgoingMode(),
     );
     const msg = BuildCallMessagePayload(
       event.payload,

src/apps/chatwoot/consumers/waha/message.ack.ts

@@ -14,12 +14,23 @@ import { WAHASessionAPI } from '@waha/apps/app_sdk/waha/WAHASelf';
 import { SessionManager } from '@waha/core/abc/manager.abc';
 import { RMutexService } from '@waha/modules/rmutex/rmutex.service';
 import { WAHAEvents } from '@waha/structures/enums.dto';
-import { WAHAWebhookMessageAck } from '@waha/structures/webhooks.dto';
+import {
+  WAHAWebhookMessageAck,
+  WAMessageAckBody,
+} from '@waha/structures/webhooks.dto';
 import { Job } from 'bullmq';
 import { PinoLogger } from 'nestjs-pino';
-import { ShouldMarkAsReadInChatWoot } from '@waha/apps/chatwoot/consumers/waha/message.ack.utils';
+import { MultipleErrors } from '@waha/utils/errors';
+import {
+  ShouldMarkAsReadInChatWoot,
+  ShouldProcessAckInChatWoot,
+} from '@waha/apps/chatwoot/consumers/waha/message.ack.utils';
 import { parseMessageIdSerialized } from '@waha/core/utils/ids';
-import { MessageMappingService } from '@waha/apps/chatwoot/storage';
+import {
+  ChatwootMessage,
+  MessageMappingService,
+} from '@waha/apps/chatwoot/storage';
+import { MessageStatusService } from '@waha/apps/chatwoot/services/MessageStatusService';
 
 @Processor(QueueName.WAHA_MESSAGE_ACK, { concurrency: JOB_CONCURRENCY })
 export class WAHAMessageAckConsumer extends ChatWootWAHABaseConsumer {
@@ -32,7 +43,7 @@ export class WAHAMessageAckConsumer extends ChatWootWAHABaseConsumer {
   }
 
   ShouldProcess(event: any): boolean {
-    return ShouldMarkAsReadInChatWoot(event);
+    return ShouldProcessAckInChatWoot(event);
   }
 
   GetChatId(event: WAHAWebhookMessageAck): string {
@@ -46,13 +57,20 @@ export class WAHAMessageAckConsumer extends ChatWootWAHABaseConsumer {
     const container = await this.DIContainer(job, job.data.app);
     const event = job.data.event as WAHAWebhookMessageAck;
     const session = new WAHASessionAPI(event.session, container.WAHASelf());
+    const conversations = container.ChatWootConfig().conversations;
+    const config: MessageAckHandlerConfig = {
+      markAsRead: conversations.markAsRead,
+      syncMessageStatus: conversations.syncMessageStatus,
+    };
     const handler = new MessageAckHandler(
+      config,
       container.ContactConversationService(),
       container.MessageMappingService(),
       container.Logger(),
       info,
       session,
       container.Locale(),
+      container.MessageStatusService(),
     );
     try {
       await handler.handle(event);
@@ -64,26 +82,72 @@ export class WAHAMessageAckConsumer extends ChatWootWAHABaseConsumer {
   }
 }
 
+interface MessageAckHandlerConfig {
+  markAsRead: boolean;
+  syncMessageStatus: boolean;
+}
+
 class MessageAckHandler {
   constructor(
+    private readonly config: MessageAckHandlerConfig,
     private readonly contactConversationService: ContactConversationService,
     protected mappingService: MessageMappingService,
     private readonly logger: ILogger,
     private readonly info: IMessageInfo,
     private readonly session: WAHASessionAPI,
     private readonly locale: Locale,
+    private readonly statusService: MessageStatusService,
   ) {}
 
   async handle(event: WAHAWebhookMessageAck): Promise<void> {
-    const payload = event.payload;
+    const promises: Promise<void>[] = [];
+    if (this.config.syncMessageStatus) {
+      promises.push(this.syncMessageStatus(event));
+    }
+    if (this.config.markAsRead && ShouldMarkAsReadInChatWoot(event)) {
+      promises.push(this.markConversationAsRead(event));
+    }
+    const results = await Promise.allSettled(promises);
+    const errors = results
+      .filter((result) => result.status === 'rejected')
+      .map((result: PromiseRejectedResult) => result.reason);
+    if (errors.length > 0) {
+      throw new MultipleErrors(errors);
+    }
+  }
 
+  /**
+   * No chatwoot message - old message or some service ack, nothing to do
+   */
+  private async getChatWootMessage(
+    payload: WAMessageAckBody,
+  ): Promise<ChatwootMessage | null> {
     const key = parseMessageIdSerialized(payload.id);
-    const chatwoot = await this.mappingService.getChatWootMessage({
+    return this.mappingService.getChatWootMessage({
       chat_id: null,
       message_id: key.id,
     });
-    // No chatwoot message found, so we don't mark it as read
-    // Filters out old messages and some service ack messages
+  }
+
+  private async syncMessageStatus(event: WAHAWebhookMessageAck) {
+    const payload = event.payload;
+    const key = parseMessageIdSerialized(payload.id);
+    // Save the ack first, then look up the mapping.
+    await this.statusService.record(
+      key.id,
+      payload.ack,
+      new Date(event.timestamp),
+    );
+    const chatwoot = await this.getChatWootMessage(payload);
+    if (!chatwoot) {
+      return;
+    }
+    await this.statusService.sync(chatwoot);
+  }
+
+  private async markConversationAsRead(event: WAHAWebhookMessageAck) {
+    const payload = event.payload;
+    const chatwoot = await this.getChatWootMessage(payload);
     if (!chatwoot) {
       return;
     }