@ardennguyen/zalo-agent-cli 2.5.9 → 3.0.0

package/patches/zca-js+2.2.0.patch

@@ -1,1445 +0,0 @@
-diff --git a/node_modules/zca-js/dist/apis.js b/node_modules/zca-js/dist/apis.js
-index c8b38fb..ebcf8f9 100644
---- a/node_modules/zca-js/dist/apis.js
-+++ b/node_modules/zca-js/dist/apis.js
-@@ -154,6 +154,7 @@ import { uploadAttachmentFactory } from "./apis/uploadAttachment.js";
- import { uploadProductPhotoFactory } from "./apis/uploadProductPhoto.js";
- import { votePollFactory } from "./apis/votePoll.js";
- import { customFactory } from "./apis/custom.js";
-+import { logoutV2Factory } from "./apis/logoutV2.js";
- export class API {
-     constructor(ctx, zpwServiceMap, wsUrls) {
-         this.zpwServiceMap = zpwServiceMap;
-@@ -313,5 +314,6 @@ export class API {
-         this.uploadProductPhoto = uploadProductPhotoFactory(ctx, this);
-         this.votePoll = votePollFactory(ctx, this);
-         this.custom = customFactory(ctx, this);
-+        this.logoutV2 = logoutV2Factory(ctx, this);
-     }
- }
-diff --git a/node_modules/zca-js/dist/apis/forwardMessage.js b/node_modules/zca-js/dist/apis/forwardMessage.js
-index ff4f6c6..499fbcf 100644
---- a/node_modules/zca-js/dist/apis/forwardMessage.js
-+++ b/node_modules/zca-js/dist/apis/forwardMessage.js
-@@ -1,6 +1,19 @@
- import { ZaloApiError } from "../Errors/ZaloApiError.js";
- import { ThreadType } from "../models/index.js";
- import { apiFactory } from "../utils.js";
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * A forward produces a real message that `undo` and `deleteMessage` both
-+ * need a cliMsgId to remove, and upstream returns only {msgId}. One
-+ * clientId covers every target thread in a call, so the single resolved
-+ * response is the right place to put it.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- export const forwardMessageFactory = apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/mforward`),
-@@ -94,6 +107,8 @@ export const forwardMessageFactory = apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
-diff --git a/node_modules/zca-js/dist/apis/loginQR.js b/node_modules/zca-js/dist/apis/loginQR.js
-index 7405811..309c23c 100644
---- a/node_modules/zca-js/dist/apis/loginQR.js
-+++ b/node_modules/zca-js/dist/apis/loginQR.js
-@@ -12,16 +12,33 @@ export var LoginQRCallbackEventType;
-     LoginQRCallbackEventType[LoginQRCallbackEventType["QRCodeDeclined"] = 3] = "QRCodeDeclined";
-     LoginQRCallbackEventType[LoginQRCallbackEventType["GotLoginInfo"] = 4] = "GotLoginInfo";
- })(LoginQRCallbackEventType || (LoginQRCallbackEventType = {}));
-+// Client Hints (sec-ch-ua*) for the QR-login handshake, derived from
-+// ctx.secChUa/secChUaPlatform/secChUaMobile when the caller supplies them
-+// (see zalo-agent-cli's device-fingerprint generator), falling back to the
-+// original hardcoded Chrome-130/Windows literals otherwise — so behavior is
-+// unchanged for any caller that doesn't set these ctx fields.
-+//
-+// Why this exists: the User-Agent header sent for this whole handshake
-+// (ctx.userAgent, defaulted in zalo.js to a Firefox UA string) previously
-+// had NO relationship to these sec-ch-ua values at all — every request
-+// claimed "Firefox/133.0" in User-Agent while separately, unconditionally
-+// claiming Chromium/Chrome v130 via Client Hints. Real browsers never
-+// produce that combination (Firefox doesn't send sec-ch-ua headers), and
-+// it was identical across every zca-js install on earth regardless of what
-+// was actually running the CLI. Deriving these from the same ctx fields
-+// the caller controls for userAgent keeps the whole fingerprint internally
-+// consistent.
-+function secChUaHeaders(ctx) {
-+    var _a, _b, _c;
-+    return {
-+        "sec-ch-ua": (_a = ctx.secChUa) !== null && _a !== void 0 ? _a : '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
-+        "sec-ch-ua-mobile": (_b = ctx.secChUaMobile) !== null && _b !== void 0 ? _b : "?0",
-+        "sec-ch-ua-platform": (_c = ctx.secChUaPlatform) !== null && _c !== void 0 ? _c : '"Windows"',
-+    };
-+}
- async function loadLoginPage(ctx) {
-     const response = await request(ctx, "https://id.zalo.me/account?continue=https%3A%2F%2Fchat.zalo.me%2F", {
--        headers: {
--            accept: "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
--            "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
--            "cache-control": "max-age=0",
--            priority: "u=0, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+        headers: Object.assign({ accept: "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "cache-control": "max-age=0", priority: "u=0, i" }, secChUaHeaders(ctx), {
-             "sec-fetch-dest": "document",
-             "sec-fetch-mode": "navigate",
-             "sec-fetch-site": "same-site",
-@@ -29,7 +46,7 @@ async function loadLoginPage(ctx) {
-             "upgrade-insecure-requests": "1",
-             Referer: "https://chat.zalo.me/",
-             "Referrer-Policy": "strict-origin-when-cross-origin",
--        },
-+        }),
-         method: "GET",
-     });
-     const html = await response.text();
-@@ -37,25 +54,34 @@ async function loadLoginPage(ctx) {
-     const match = html.match(regex);
-     return match === null || match === void 0 ? void 0 : match[1];
- }
-+// `continue` target for the id.zalo.me SSO handshake — "https://zalo.me/pc"
-+// on getLoginInfo/verifyClient/generate, distinct from loadLoginPage/
-+// waitingScan/waitingConfirm/checkSession's "https://chat.zalo.me/". TWO
-+// live-tested attempts (2026-09-19) to unify these on "chat.zalo.me/" both
-+// broke QR generation outright (phone reports the QR invalid/unreadable on
-+// scan), even after adding the `cliGenQR=1` flag a live capture of the real
-+// web client showed on its generate() call. Reverted both times. Whatever
-+// the real server-side check is, it isn't fully explained by this request's
-+// body fields alone — plausibly something header- or cookie-level from an
-+// actual browser session (a CSRF/anti-forgery token embedded in the real
-+// loadLoginPage HTML response and echoed back on later calls, which this
-+// library never reads because it only regex-extracts the login version out
-+// of that HTML — or an Origin/sec-fetch header combination a non-browser
-+// HTTP client can't authentically reproduce). Leave `continue` alone here;
-+// don't re-attempt this without capturing full REQUEST headers (not just
-+// body) from a real browser session for comparison, not just the body.
- async function getLoginInfo(ctx, version) {
-     const form = new URLSearchParams();
-     form.append("continue", "https://zalo.me/pc");
-     form.append("v", version);
-     return await request(ctx, "https://id.zalo.me/account/logininfo", {
--        headers: {
--            accept: "*/*",
--            "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
--            "content-type": "application/x-www-form-urlencoded",
--            priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "content-type": "application/x-www-form-urlencoded", priority: "u=1, i" }, secChUaHeaders(ctx), {
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-origin",
-             Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fzalo.me%2Fpc",
-             "Referrer-Policy": "strict-origin-when-cross-origin",
--        },
-+        }),
-         body: form,
-         method: "POST",
-     })
-@@ -68,20 +94,13 @@ async function verifyClient(ctx, version) {
-     form.append("continue", "https://zalo.me/pc");
-     form.append("v", version);
-     return await request(ctx, "https://id.zalo.me/account/verify-client", {
--        headers: {
--            accept: "*/*",
--            "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
--            "content-type": "application/x-www-form-urlencoded",
--            priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "content-type": "application/x-www-form-urlencoded", priority: "u=1, i" }, secChUaHeaders(ctx), {
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-origin",
-             Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fzalo.me%2Fpc",
-             "Referrer-Policy": "strict-origin-when-cross-origin",
--        },
-+        }),
-         body: form,
-         method: "POST",
-     })
-@@ -93,20 +112,13 @@ async function generate(ctx, version) {
-     form.append("continue", "https://zalo.me/pc");
-     form.append("v", version);
-     return await request(ctx, "https://id.zalo.me/account/authen/qr/generate", {
--        headers: {
--            accept: "*/*",
--            "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
--            "content-type": "application/x-www-form-urlencoded",
--            priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "content-type": "application/x-www-form-urlencoded", priority: "u=1, i" }, secChUaHeaders(ctx), {
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-origin",
-             Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fzalo.me%2Fpc",
-             "Referrer-Policy": "strict-origin-when-cross-origin",
--        },
-+        }),
-         body: form,
-         method: "POST",
-     })
-@@ -122,20 +134,13 @@ async function waitingScan(ctx, version, code, signal) {
-     form.append("continue", "https://chat.zalo.me/");
-     form.append("v", version);
-     return await request(ctx, "https://id.zalo.me/account/authen/qr/waiting-scan", {
--        headers: {
--            accept: "*/*",
--            "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
--            "content-type": "application/x-www-form-urlencoded",
--            priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "content-type": "application/x-www-form-urlencoded", priority: "u=1, i" }, secChUaHeaders(ctx), {
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-origin",
-             Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fchat.zalo.me%2F",
-             "Referrer-Policy": "strict-origin-when-cross-origin",
--        },
-+        }),
-         body: form,
-         method: "POST",
-         signal,
-@@ -153,28 +158,29 @@ async function waitingScan(ctx, version, code, signal) {
-     });
- }
- async function waitingConfirm(ctx, version, code, signal) {
-+    // Live-captured 2026-09-19 from the real chat.zalo.me/id.zalo.me web
-+    // client: its waiting-confirm request body is ONLY continue+code+v (the
-+    // same three fields waitingScan sends) — never gToken/gAction. Sending
-+    // those two extra, real-client-never-sends fields (as upstream zca-js
-+    // did) is very likely why a decline on the phone was never observed
-+    // here: the real client's identical 3-field long-poll got error_code
-+    // -13 back in a single ~8s round trip the moment the phone declined,
-+    // while zca-js kept getting error_code 8 (busy-wait) over and over
-+    // until the outer 100s QR timer killed the whole login attempt. Dropped
-+    // to match the real client exactly.
-     const form = new URLSearchParams();
-     form.append("code", code);
--    form.append("gToken", "");
--    form.append("gAction", "CONFIRM_QR");
-     form.append("continue", "https://chat.zalo.me/");
-     form.append("v", version);
-     logger(ctx).info("Please confirm on your phone");
-     return await request(ctx, "https://id.zalo.me/account/authen/qr/waiting-confirm", {
--        headers: {
--            accept: "*/*",
--            "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
--            "content-type": "application/x-www-form-urlencoded",
--            priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", "content-type": "application/x-www-form-urlencoded", priority: "u=1, i" }, secChUaHeaders(ctx), {
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-origin",
-             Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fchat.zalo.me%2F",
-             "Referrer-Policy": "strict-origin-when-cross-origin",
--        },
-+        }),
-         body: form,
-         method: "POST",
-         signal,
-@@ -193,39 +199,27 @@ async function waitingConfirm(ctx, version, code, signal) {
- }
- async function checkSession(ctx) {
-     return await request(ctx, "https://id.zalo.me/account/checksession?continue=https%3A%2F%2Fchat.zalo.me%2Findex.html", {
--        headers: {
--            accept: "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
--            "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
--            priority: "u=0, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+        headers: Object.assign({ accept: "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", priority: "u=0, i" }, secChUaHeaders(ctx), {
-             "sec-fetch-dest": "document",
-             "sec-fetch-mode": "navigate",
-             "sec-fetch-site": "same-origin",
-             "upgrade-insecure-requests": "1",
-             Referer: "https://id.zalo.me/account?continue=https%3A%2F%2Fchat.zalo.me%2F",
-             "Referrer-Policy": "strict-origin-when-cross-origin",
--        },
-+        }),
-         redirect: "manual",
-         method: "GET",
-     }).catch(logger(ctx).error);
- }
- async function getUserInfo(ctx) {
-     return await request(ctx, "https://jr.chat.zalo.me/jr/userinfo", {
--        headers: {
--            accept: "*/*",
--            "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
--            priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+        headers: Object.assign({ accept: "*/*", "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5", priority: "u=1, i" }, secChUaHeaders(ctx), {
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-site",
-             Referer: "https://chat.zalo.me/",
-             "Referrer-Policy": "strict-origin-when-cross-origin",
--        },
-+        }),
-         method: "GET",
-     })
-         .then((res) => res.json())
-@@ -234,6 +228,13 @@ async function getUserInfo(ctx) {
- export async function loginQR(ctx, options, callback) {
-     ctx.cookie = new CookieJar();
-     ctx.userAgent = options.userAgent;
-+    // See secChUaHeaders() above — falls back to the original hardcoded
-+    // Chrome-130/Windows literals when the caller (an older zalo-agent-cli,
-+    // or any other zca-js consumer) doesn't pass these, so this is purely
-+    // additive and doesn't change behavior for anyone not opting in.
-+    ctx.secChUa = options.secChUa;
-+    ctx.secChUaPlatform = options.secChUaPlatform;
-+    ctx.secChUaMobile = options.secChUaMobile;
-     return new Promise(async (resolve, reject) => {
-         var _a;
-         const controller = new AbortController();
-@@ -322,6 +323,18 @@ export async function loginQR(ctx, options, callback) {
-                 throw new ZaloApiError("Cannot get confirm result");
-             clearTimeout(qrTimeout);
-             if (confirmResult.error_code == -13) {
-+                // Decline is a terminal state — settle the outer Promise
-+                // either way. Upstream zca-js only rejected in the
-+                // no-callback branch; with a callback, it fired the
-+                // QRCodeDeclined event and then just `return`ed, leaving
-+                // the Promise this function returns permanently pending
-+                // (the caller's `await loginQR(...)` — e.g.
-+                // zalo-agent-cli's `await loginWithQR(...)` — would hang
-+                // until the unrelated 100s qrTimeout eventually fired,
-+                // misreporting the decline as an expiry). Now the callback
-+                // (when present) still fires first for UI purposes, but
-+                // this always rejects afterward so the promise settles
-+                // immediately.
-                 if (callback) {
-                     callback({
-                         type: LoginQRCallbackEventType.QRCodeDeclined,
-@@ -334,11 +347,9 @@ export async function loginQR(ctx, options, callback) {
-                         },
-                     });
-                 }
--                else {
--                    logger(ctx).error("QRCode login declined");
--                    throw new ZaloApiLoginQRDeclined();
--                }
--                return;
-+                logger(ctx).error("QRCode login declined");
-+                cleanUp();
-+                return reject(new ZaloApiLoginQRDeclined());
-             }
-             else if (confirmResult.error_code != 0) {
-                 throw new ZaloApiError(`An error has occurred.\nResponse: ${JSON.stringify(confirmResult, null, 2)}`);
-diff --git a/node_modules/zca-js/dist/apis/logoutV2.js b/node_modules/zca-js/dist/apis/logoutV2.js
-new file mode 100644
-index 0000000..e250100
---- /dev/null
-+++ b/node_modules/zca-js/dist/apis/logoutV2.js
-@@ -0,0 +1,79 @@
-+import { ZaloApiError } from "../Errors/ZaloApiError.js";
-+import { apiFactory } from "../utils.js";
-+
-+// CONFIRMED live 2026-09-19 against a real account. Mirrors Zalo Web's own
-+// `ServiceURL.logoutV2(imei, compId?)` (commandId 12743, POST
-+// /api/v2/login/logOut), reverse-engineered from the production webpack
-+// bundle:
-+//   static logoutV2(e,t=void 0){
-+//     const a = _.b.getDevDomainV3() + "/api/v2/login/logOut?" + this._getCommonParams();
-+//     let s = { time, imei: e, computer_name, language };
-+//     if (t !== void 0) s.compId = t;
-+//     return this._post(a, "params=" + encodeURIComponent(encodeAES(JSON.stringify(s))), null, 12743);
-+//   }
-+//
-+// DOMAIN — resolved by trial (each guess live-tested against a real
-+// account):
-+//   1. `zpwServiceMap.aext` (aextra-wpa.chat.zalo.me) — the accessor
-+//      `getListDevice` uses. DISPROVEN: real HTTP 404.
-+//   2. `zpwServiceMap.zavi` (wpa.zaloapp.com) — DISPROVEN: reachable, but a
-+//      real API error ({error_code:102, "session key was improperly
-+//      submitted..."}) — `zaloapp.com` is a different registrable domain
-+//      from `zalo.me`, so the zpw_sek session cookie (scoped to `.zalo.me`)
-+//      never reached it.
-+//   3. `https://wpa.chat.zalo.me` (HARDCODED, not from zpwServiceMap) —
-+//      CONFIRMED CORRECT, live-tested 2026-09-19. Matches `getSettings.js`
-+//      in this same package (a genuinely working, authenticated,
-+//      hardcoded-domain call) and the known hardcoded PRE-login host this
-+//      package's `login.js` already uses. Live response:
-+//      `{"error_code":0,"error_message":"Successful.","data":1}`.
-+//   4. `https://stg-wpa.chat.zalo.me` — what the real production webpack
-+//      bundle's `getDevDomainV3()` singleton actually returned when called
-+//      live in-browser 2026-09-18 (via webpack-jsonp module-cache capture,
-+//      zero real requests made). CONFIRMED CORRECT end-to-end, live-tested
-+//      2026-09-19 via a real `logout --purge`: "Server session invalidated
-+//      for imei e239d3d5…", no fallback warning — a real authenticated
-+//      call against this domain, not just the direct-call capture. ACTIVE
-+//      BELOW. Candidate #3 above is left documented as the previously-
-+//      confirmed fallback in case this domain is ever retired/changed, but
-+//      is no longer needed.
-+//
-+// ENCRYPTION — the response body above is CONFIRMED to be plain JSON, not
-+// the usual AES-encrypted `data` field most zca-js API responses use.
-+// `utils.resolve()` defaults to `isEncrypted = true`, which tried to
-+// AES-decrypt the literal number `1` and, because crypto-js silently
-+// returns an empty string on bad ciphertext/padding rather than throwing,
-+// produced "Failed to parse response data: SyntaxError: Unexpected end of
-+// JSON input" (from `JSON.parse("")`) even though the call had already
-+// succeeded server-side. Fixed by passing `isEncrypted = false` to
-+// `utils.resolve()` here so `result.data` is used as-is.
-+//
-+// (Earlier iterations of this file also had a real bug where
-+// `utils.resolve(response)` was called without `await` — since it wraps
-+// an `async function`, that returned a pending Promise instead of the
-+// actual result, which silently broke a since-removed multi-candidate
-+// fallback loop. Not relevant now that the domain is confirmed and this
-+// is back to a single direct call, but noted here in case this file ever
-+// grows a retry/fallback again: always `await utils.resolve(...)`.)
-+export const logoutV2Factory = apiFactory()((api, ctx, utils) => {
-+    const serviceURL = utils.makeURL("https://stg-wpa.chat.zalo.me/api/v2/login/logOut");
-+    return async function logoutV2(compId = undefined) {
-+        const params = {
-+            time: Date.now(),
-+            imei: ctx.imei,
-+            computer_name: "Web",
-+            language: ctx.language || "vi"
-+        };
-+        if (compId !== undefined) params.compId = compId;
-+        const encryptedParams = utils.encodeAES(JSON.stringify(params));
-+        if (!encryptedParams) throw new ZaloApiError("Failed to encrypt message");
-+        const response = await utils.request(serviceURL, {
-+            method: "POST",
-+            body: new URLSearchParams({
-+                params: encryptedParams,
-+            }),
-+        });
-+        // isEncrypted = false — see the file header note above.
-+        return await utils.resolve(response, undefined, false);
-+    };
-+});
-diff --git a/node_modules/zca-js/dist/apis/sendBankCard.js b/node_modules/zca-js/dist/apis/sendBankCard.js
-index f1fbae0..5841159 100644
---- a/node_modules/zca-js/dist/apis/sendBankCard.js
-+++ b/node_modules/zca-js/dist/apis/sendBankCard.js
-@@ -1,6 +1,19 @@
- import { ZaloApiError } from "../Errors/ZaloApiError.js";
- import { ThreadType } from "../models/index.js";
- import { apiFactory } from "../utils.js";
-+/**
-+ * Hand the caller the cliMsgId that went on the wire.
-+ *
-+ * This endpoint names the field `cliMsgId` rather than `clientId`, but the
-+ * problem is the same: it is generated here, posted, and then discarded, so
-+ * `undo` and `deleteMessage` — both of which require it — had nothing to
-+ * work with and a sent bank card could never be recalled.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- export const sendBankCardFactory = apiFactory()((api, _, utils) => {
-     const serviceURL = utils.makeURL(`${api.zpwServiceMap.zimsg[0]}/api/transfer/card`);
-     /**
-@@ -14,11 +27,12 @@ export const sendBankCardFactory = apiFactory()((api, _, utils) => {
-      */
-     return async function sendBankCard(payload, threadId, type = ThreadType.User) {
-         var _a;
-+        const cliMsgId = Date.now().toString();
-         const params = {
-             binBank: payload.binBank,
-             numAccBank: payload.numAccBank,
-             nameAccBank: ((_a = payload.nameAccBank) === null || _a === void 0 ? void 0 : _a.toUpperCase()) || "---",
--            cliMsgId: Date.now().toString(),
-+            cliMsgId: cliMsgId,
-             tsMsg: Date.now(),
-             destUid: threadId,
-             destType: type === ThreadType.Group ? 1 : 0,
-@@ -32,6 +46,8 @@ export const sendBankCardFactory = apiFactory()((api, _, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, cliMsgId);
-+        return resolved;
-     };
- });
-diff --git a/node_modules/zca-js/dist/apis/sendCard.js b/node_modules/zca-js/dist/apis/sendCard.js
-index 6904bc9..31b3c34 100644
---- a/node_modules/zca-js/dist/apis/sendCard.js
-+++ b/node_modules/zca-js/dist/apis/sendCard.js
-@@ -1,6 +1,20 @@
- import { ZaloApiError } from "../Errors/ZaloApiError.js";
- import { ThreadType } from "../models/index.js";
- import { apiFactory } from "../utils.js";
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in sendMessage.js; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- export const sendCardFactory = apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/forward`),
-@@ -54,6 +68,8 @@ export const sendCardFactory = apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
-diff --git a/node_modules/zca-js/dist/apis/sendLink.js b/node_modules/zca-js/dist/apis/sendLink.js
-index b171101..4da232d 100644
---- a/node_modules/zca-js/dist/apis/sendLink.js
-+++ b/node_modules/zca-js/dist/apis/sendLink.js
-@@ -1,6 +1,20 @@
- import { ZaloApiError } from "../Errors/ZaloApiError.js";
- import { ThreadType } from "../models/index.js";
- import { apiFactory } from "../utils.js";
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in sendMessage.js; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- export const sendLinkFactory = apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.chat[0]}/api/message/link`, {
-@@ -22,6 +36,7 @@ export const sendLinkFactory = apiFactory()((api, ctx, utils) => {
-     return async function sendLink(options, threadId, type = ThreadType.User) {
-         var _a;
-         const res = await api.parseLink(options.link);
-+        const clientId = Date.now();
-         const params = {
-             msg: options.msg && options.msg.trim()
-                 ? options.msg.includes(options.link)
-@@ -36,7 +51,7 @@ export const sendLinkFactory = apiFactory()((api, ctx, utils) => {
-             type: 2, // 0
-             media: JSON.stringify(res.data.media),
-             ttl: (_a = options.ttl) !== null && _a !== void 0 ? _a : 0,
--            clientId: Date.now(),
-+            clientId: clientId,
-         };
-         if (type == ThreadType.Group) {
-             params.grid = threadId;
-@@ -56,6 +71,8 @@ export const sendLinkFactory = apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
-diff --git a/node_modules/zca-js/dist/apis/sendMessage.d.ts b/node_modules/zca-js/dist/apis/sendMessage.d.ts
-index 8031f4e..c085286 100644
---- a/node_modules/zca-js/dist/apis/sendMessage.d.ts
-+++ b/node_modules/zca-js/dist/apis/sendMessage.d.ts
-@@ -1,6 +1,12 @@
- import { ThreadType, type TMessage, type AttachmentSource } from "../models/index.js";
- export type SendMessageResult = {
-     msgId: number;
-+    /**
-+     * The clientId this library put on the wire for the message, which Zalo
-+     * echoes back as its cliMsgId. Present for text messages sent through
-+     * `handleMessage`; absent for attachments.
-+     */
-+    cliMsgId?: string;
- };
- export type SendMessageResponse = {
-     message: SendMessageResult | null;
-diff --git a/node_modules/zca-js/dist/apis/sendMessage.js b/node_modules/zca-js/dist/apis/sendMessage.js
-index 5bda5bc..5982d78 100644
---- a/node_modules/zca-js/dist/apis/sendMessage.js
-+++ b/node_modules/zca-js/dist/apis/sendMessage.js
-@@ -9,6 +9,18 @@ const attachmentUrlType = {
-     video: "asyncfile/msg?",
-     others: "asyncfile/msg?",
- };
-+/**
-+ * Record on the send response the clientId that was actually sent.
-+ *
-+ * The send endpoint returns only `{msgId}`, so without this the caller has
-+ * no way to learn the cliMsgId Zalo now holds for the message -- guessing it
-+ * with a second Date.now() is off by however long the encrypt + POST took.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- function prepareQMSGAttach(quote) {
-     const quoteData = quote;
-     if (typeof quoteData.content == "string")
-@@ -177,12 +189,16 @@ export const sendMessageFactory = apiFactory()((api, ctx, utils) => {
-             }
-         }
-         const isMentionsValid = mentionsFinal.length > 0 && isGroupMessage;
-+        // Hoisted so the caller can learn which clientId went on the wire.
-+        // Zalo echoes this back as the message's cliMsgId, and `msg react`,
-+        // `msg undo` and quote-replies all need that exact value.
-+        const clientId = Date.now();
-         const params = quote
-             ? {
-                 toid: isGroupMessage ? undefined : threadId,
-                 grid: isGroupMessage ? threadId : undefined,
-                 message: msg,
--                clientId: Date.now(),
-+                clientId,
-                 mentionInfo: isMentionsValid ? JSON.stringify(mentionsFinal) : undefined,
-                 qmsgOwner: quote.uidFrom,
-                 qmsgId: quote.msgId,
-@@ -198,7 +214,7 @@ export const sendMessageFactory = apiFactory()((api, ctx, utils) => {
-             }
-             : {
-                 message: msg,
--                clientId: Date.now(),
-+                clientId,
-                 mentionInfo: isMentionsValid ? JSON.stringify(mentionsFinal) : undefined,
-                 imei: isGroupMessage ? undefined : ctx.imei,
-                 ttl: ttl !== null && ttl !== void 0 ? ttl : 0,
-@@ -225,6 +241,7 @@ export const sendMessageFactory = apiFactory()((api, ctx, utils) => {
-         return {
-             url: finalServiceUrl.toString(),
-             body: new URLSearchParams({ params: encryptedParams }),
-+            clientId: String(clientId),
-         };
-     }
-     async function handleAttachment({ msg, attachments, mentions, quote, ttl, urgency }, threadId, type) {
-@@ -383,6 +400,9 @@ export const sendMessageFactory = apiFactory()((api, ctx, utils) => {
-                 body: formData.getBuffer(),
-                 headers: formData.getHeaders(),
-                 fileType: "gif",
-+                // Retained so the caller can learn which clientId went on the
-+                // wire; the params object itself is encrypted past this point.
-+                clientId: params.clientId,
-             });
-         }
-         const responses = [];
-@@ -393,6 +413,9 @@ export const sendMessageFactory = apiFactory()((api, ctx, utils) => {
-                 }, data.query || {})),
-                 body: data.body,
-                 headers: data.fileType == "gif" ? data.headers : {},
-+                // send() reads url/body/headers only, so this rides along
-+                // untouched and lets sendMessage() stamp the response.
-+                clientId: data.clientId != undefined ? data.clientId : data.params && data.params.clientId,
-             });
-         }
-         return responses;
-@@ -435,17 +458,28 @@ export const sendMessageFactory = apiFactory()((api, ctx, utils) => {
-                 // send message and attachment separately
-                 await handleMessage(message, threadId, type).then(async (data) => {
-                     responses.message = (await send(data))[0];
-+                    stampClientId(responses.message, data.clientId);
-                 });
-                 msg = "";
-                 mentions = undefined;
-             }
-             const handledData = await handleAttachment({ msg, mentions, attachments, quote, ttl, styles, urgency }, threadId, type);
--            responses.attachment = await send(handledData);
-+            // Stamp the attachment responses too. Upstream stamps only
-+            // responses.message, and for a single jpg/jpeg/png/webp canBeDesc
-+            // is true so the caption folds into the attachment and
-+            // responses.message stays null -- leaving an attachment send with
-+            // NO cliMsgId anywhere, which makes `msg undo` unable to recall it
-+            // at all. send() is Promise.all over the input array, so the
-+            // results are index-aligned with handledData.
-+            const sentAttachments = await send(handledData);
-+            sentAttachments.forEach((r, i) => stampClientId(r, handledData[i] && handledData[i].clientId));
-+            responses.attachment = sentAttachments;
-             msg = "";
-         }
-         if (msg.length > 0) {
-             const handledData = await handleMessage(message, threadId, type);
-             responses.message = (await send(handledData))[0];
-+            stampClientId(responses.message, handledData.clientId);
-         }
-         return responses;
-     };
-diff --git a/node_modules/zca-js/dist/apis/sendSticker.js b/node_modules/zca-js/dist/apis/sendSticker.js
-index e27c04e..7aeadae 100644
---- a/node_modules/zca-js/dist/apis/sendSticker.js
-+++ b/node_modules/zca-js/dist/apis/sendSticker.js
-@@ -1,6 +1,20 @@
- import { ZaloApiError } from "../Errors/ZaloApiError.js";
- import { ThreadType } from "../models/index.js";
- import { apiFactory, removeUndefinedKeys } from "../utils.js";
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in sendMessage.js; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- export const sendStickerFactory = apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.chat[0]}/api/message/sticker`, {
-@@ -32,11 +46,12 @@ export const sendStickerFactory = apiFactory()((api, ctx, utils) => {
-         if (!sticker.type)
-             throw new ZaloApiError("Missing sticker type");
-         const isGroupMessage = type === ThreadType.Group;
-+        const clientId = Date.now();
-         const params = {
-             stickerId: sticker.id,
-             cateId: sticker.cateId,
-             type: sticker.type,
--            clientId: Date.now(),
-+            clientId: clientId,
-             imei: ctx.imei,
-             zsource: 101,
-             toid: isGroupMessage ? undefined : threadId,
-@@ -52,6 +67,8 @@ export const sendStickerFactory = apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
-diff --git a/node_modules/zca-js/dist/apis/sendVideo.js b/node_modules/zca-js/dist/apis/sendVideo.js
-index 03c818c..ce8a096 100644
---- a/node_modules/zca-js/dist/apis/sendVideo.js
-+++ b/node_modules/zca-js/dist/apis/sendVideo.js
-@@ -1,6 +1,20 @@
- import { ZaloApiError } from "../Errors/ZaloApiError.js";
- import { ThreadType } from "../models/index.js";
- import { apiFactory } from "../utils.js";
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in sendMessage.js; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- export const sendVideoFactory = apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/forward`),
-@@ -113,6 +127,8 @@ export const sendVideoFactory = apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
-diff --git a/node_modules/zca-js/dist/apis/sendVoice.js b/node_modules/zca-js/dist/apis/sendVoice.js
-index f8bcc6b..806fb2e 100644
---- a/node_modules/zca-js/dist/apis/sendVoice.js
-+++ b/node_modules/zca-js/dist/apis/sendVoice.js
-@@ -1,6 +1,20 @@
- import { ZaloApiError } from "../Errors/ZaloApiError.js";
- import { ThreadType } from "../models/index.js";
- import { apiFactory } from "../utils.js";
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in sendMessage.js; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- export const sendVoiceFactory = apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/forward`),
-@@ -68,6 +82,8 @@ export const sendVoiceFactory = apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
-diff --git a/node_modules/zca-js/dist/cjs/apis.cjs b/node_modules/zca-js/dist/cjs/apis.cjs
-index c151de0..e49f3d6 100644
---- a/node_modules/zca-js/dist/cjs/apis.cjs
-+++ b/node_modules/zca-js/dist/cjs/apis.cjs
-@@ -156,6 +156,7 @@ var uploadAttachment = require('./apis/uploadAttachment.cjs');
- var uploadProductPhoto = require('./apis/uploadProductPhoto.cjs');
- var votePoll = require('./apis/votePoll.cjs');
- var custom = require('./apis/custom.cjs');
-+var logoutV2 = require('./apis/logoutV2.cjs');
- 
- class API {
-     constructor(ctx, zpwServiceMap, wsUrls) {
-@@ -316,6 +317,7 @@ class API {
-         this.uploadProductPhoto = uploadProductPhoto.uploadProductPhotoFactory(ctx, this);
-         this.votePoll = votePoll.votePollFactory(ctx, this);
-         this.custom = custom.customFactory(ctx, this);
-+        this.logoutV2 = logoutV2.logoutV2Factory(ctx, this);
-     }
- }
- 
-diff --git a/node_modules/zca-js/dist/cjs/apis/forwardMessage.cjs b/node_modules/zca-js/dist/cjs/apis/forwardMessage.cjs
-index f9c670b..4dfa11c 100644
---- a/node_modules/zca-js/dist/cjs/apis/forwardMessage.cjs
-+++ b/node_modules/zca-js/dist/cjs/apis/forwardMessage.cjs
-@@ -13,6 +13,20 @@ require('../models/Reminder.cjs');
- require('../models/ZBusiness.cjs');
- var utils = require('../utils.cjs');
- 
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in the ESM build; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- const forwardMessageFactory = utils.apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [Enum.ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/mforward`),
-@@ -106,7 +120,9 @@ const forwardMessageFactory = utils.apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
- 
-diff --git a/node_modules/zca-js/dist/cjs/apis/loginQR.cjs b/node_modules/zca-js/dist/cjs/apis/loginQR.cjs
-index dbd08ed..8abfdab 100644
---- a/node_modules/zca-js/dist/cjs/apis/loginQR.cjs
-+++ b/node_modules/zca-js/dist/cjs/apis/loginQR.cjs
-@@ -15,6 +15,20 @@ exports.LoginQRCallbackEventType = void 0;
-     LoginQRCallbackEventType[LoginQRCallbackEventType["QRCodeDeclined"] = 3] = "QRCodeDeclined";
-     LoginQRCallbackEventType[LoginQRCallbackEventType["GotLoginInfo"] = 4] = "GotLoginInfo";
- })(exports.LoginQRCallbackEventType || (exports.LoginQRCallbackEventType = {}));
-+/**
-+ * Device-fingerprint client hints, with the original hardcoded values as the
-+ * fallback. src/core/zalo-client.js puts secChUa / secChUaMobile /
-+ * secChUaPlatform on ctx; without this the CJS build would ignore the
-+ * fingerprint and always claim Chrome 130 on Windows. Mirrors the ESM build.
-+ */
-+function secChUaHeaders(ctx) {
-+    var _a, _b, _c;
-+    return {
-+        "sec-ch-ua": (_a = ctx.secChUa) !== null && _a !== void 0 ? _a : '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
-+        "sec-ch-ua-mobile": (_b = ctx.secChUaMobile) !== null && _b !== void 0 ? _b : "?0",
-+        "sec-ch-ua-platform": (_c = ctx.secChUaPlatform) !== null && _c !== void 0 ? _c : '"Windows"',
-+    };
-+}
- async function loadLoginPage(ctx) {
-     const response = await utils.request(ctx, "https://id.zalo.me/account?continue=https%3A%2F%2Fchat.zalo.me%2F", {
-         headers: {
-@@ -22,9 +36,7 @@ async function loadLoginPage(ctx) {
-             "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
-             "cache-control": "max-age=0",
-             priority: "u=0, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+            ...secChUaHeaders(ctx),
-             "sec-fetch-dest": "document",
-             "sec-fetch-mode": "navigate",
-             "sec-fetch-site": "same-site",
-@@ -50,9 +62,7 @@ async function getLoginInfo(ctx, version) {
-             "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
-             "content-type": "application/x-www-form-urlencoded",
-             priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+            ...secChUaHeaders(ctx),
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-origin",
-@@ -76,9 +86,7 @@ async function verifyClient(ctx, version) {
-             "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
-             "content-type": "application/x-www-form-urlencoded",
-             priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+            ...secChUaHeaders(ctx),
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-origin",
-@@ -101,9 +109,7 @@ async function generate(ctx, version) {
-             "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
-             "content-type": "application/x-www-form-urlencoded",
-             priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+            ...secChUaHeaders(ctx),
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-origin",
-@@ -130,9 +136,7 @@ async function waitingScan(ctx, version, code, signal) {
-             "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
-             "content-type": "application/x-www-form-urlencoded",
-             priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+            ...secChUaHeaders(ctx),
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-origin",
-@@ -169,9 +173,7 @@ async function waitingConfirm(ctx, version, code, signal) {
-             "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
-             "content-type": "application/x-www-form-urlencoded",
-             priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+            ...secChUaHeaders(ctx),
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-origin",
-@@ -200,9 +202,7 @@ async function checkSession(ctx) {
-             accept: "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
-             "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
-             priority: "u=0, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+            ...secChUaHeaders(ctx),
-             "sec-fetch-dest": "document",
-             "sec-fetch-mode": "navigate",
-             "sec-fetch-site": "same-origin",
-@@ -220,9 +220,7 @@ async function getUserInfo(ctx) {
-             accept: "*/*",
-             "accept-language": "vi-VN,vi;q=0.9,fr-FR;q=0.8,fr;q=0.7,en-US;q=0.6,en;q=0.5",
-             priority: "u=1, i",
--            "sec-ch-ua": '"Chromium";v="130", "Google Chrome";v="130", "Not?A_Brand";v="99"',
--            "sec-ch-ua-mobile": "?0",
--            "sec-ch-ua-platform": '"Windows"',
-+            ...secChUaHeaders(ctx),
-             "sec-fetch-dest": "empty",
-             "sec-fetch-mode": "cors",
-             "sec-fetch-site": "same-site",
-diff --git a/node_modules/zca-js/dist/cjs/apis/logoutV2.cjs b/node_modules/zca-js/dist/cjs/apis/logoutV2.cjs
-new file mode 100644
-index 0000000..53cedb4
---- /dev/null
-+++ b/node_modules/zca-js/dist/cjs/apis/logoutV2.cjs
-@@ -0,0 +1,83 @@
-+'use strict';
-+
-+var ZaloApiError = require('../Errors/ZaloApiError.cjs');
-+var utils = require('../utils.cjs');
-+
-+// CONFIRMED live 2026-09-19 against a real account. Mirrors Zalo Web's own
-+// `ServiceURL.logoutV2(imei, compId?)` (commandId 12743, POST
-+// /api/v2/login/logOut), reverse-engineered from the production webpack
-+// bundle:
-+//   static logoutV2(e,t=void 0){
-+//     const a = _.b.getDevDomainV3() + "/api/v2/login/logOut?" + this._getCommonParams();
-+//     let s = { time, imei: e, computer_name, language };
-+//     if (t !== void 0) s.compId = t;
-+//     return this._post(a, "params=" + encodeURIComponent(encodeAES(JSON.stringify(s))), null, 12743);
-+//   }
-+//
-+// DOMAIN — resolved by trial (each guess live-tested against a real
-+// account):
-+//   1. `zpwServiceMap.aext` (aextra-wpa.chat.zalo.me) — the accessor
-+//      `getListDevice` uses. DISPROVEN: real HTTP 404.
-+//   2. `zpwServiceMap.zavi` (wpa.zaloapp.com) — DISPROVEN: reachable, but a
-+//      real API error ({error_code:102, "session key was improperly
-+//      submitted..."}) — `zaloapp.com` is a different registrable domain
-+//      from `zalo.me`, so the zpw_sek session cookie (scoped to `.zalo.me`)
-+//      never reached it.
-+//   3. `https://wpa.chat.zalo.me` (HARDCODED, not from zpwServiceMap) —
-+//      CONFIRMED CORRECT, live-tested 2026-09-19. Matches `getSettings.js`
-+//      in this same package (a genuinely working, authenticated,
-+//      hardcoded-domain call) and the known hardcoded PRE-login host this
-+//      package's `login.js` already uses. Live response:
-+//      `{"error_code":0,"error_message":"Successful.","data":1}`.
-+//   4. `https://stg-wpa.chat.zalo.me` — what the real production webpack
-+//      bundle's `getDevDomainV3()` singleton actually returned when called
-+//      live in-browser 2026-09-18 (via webpack-jsonp module-cache capture,
-+//      zero real requests made). CONFIRMED CORRECT end-to-end, live-tested
-+//      2026-09-19 via a real `logout --purge`: "Server session invalidated
-+//      for imei e239d3d5…", no fallback warning — a real authenticated
-+//      call against this domain, not just the direct-call capture. ACTIVE
-+//      BELOW. Candidate #3 above is left documented as the previously-
-+//      confirmed fallback in case this domain is ever retired/changed, but
-+//      is no longer needed.
-+//
-+// ENCRYPTION — the response body above is CONFIRMED to be plain JSON, not
-+// the usual AES-encrypted `data` field most zca-js API responses use.
-+// `utils.resolve()` defaults to `isEncrypted = true`, which tried to
-+// AES-decrypt the literal number `1` and, because crypto-js silently
-+// returns an empty string on bad ciphertext/padding rather than throwing,
-+// produced "Failed to parse response data: SyntaxError: Unexpected end of
-+// JSON input" (from `JSON.parse("")`) even though the call had already
-+// succeeded server-side. Fixed by passing `isEncrypted = false` to
-+// `utils.resolve()` here so `result.data` is used as-is.
-+//
-+// (Earlier iterations of this file also had a real bug where
-+// `utils.resolve(response)` was called without `await` — since it wraps
-+// an `async function`, that returned a pending Promise instead of the
-+// actual result, which silently broke a since-removed multi-candidate
-+// fallback loop. Not relevant now that the domain is confirmed and this
-+// is back to a single direct call, but noted here in case this file ever
-+// grows a retry/fallback again: always `await utils.resolve(...)`.)
-+const logoutV2Factory = utils.apiFactory()((api, ctx, utils) => {
-+    const serviceURL = utils.makeURL("https://stg-wpa.chat.zalo.me/api/v2/login/logOut");
-+    return async function logoutV2(compId = undefined) {
-+        const params = {
-+            time: Date.now(),
-+            imei: ctx.imei,
-+            computer_name: "Web",
-+            language: ctx.language || "vi"
-+        };
-+        if (compId !== undefined) params.compId = compId;
-+        const encryptedParams = utils.encodeAES(JSON.stringify(params));
-+        if (!encryptedParams) throw new ZaloApiError.ZaloApiError("Failed to encrypt message");
-+        const response = await utils.request(serviceURL, {
-+            method: "POST",
-+            body: new URLSearchParams({
-+                params: encryptedParams,
-+            }),
-+        });
-+        // isEncrypted = false — see the file header note above.
-+        return await utils.resolve(response, undefined, false);
-+    };
-+});
-+
-+exports.logoutV2Factory = logoutV2Factory;
-diff --git a/node_modules/zca-js/dist/cjs/apis/sendBankCard.cjs b/node_modules/zca-js/dist/cjs/apis/sendBankCard.cjs
-index a2ad818..3726a37 100644
---- a/node_modules/zca-js/dist/cjs/apis/sendBankCard.cjs
-+++ b/node_modules/zca-js/dist/cjs/apis/sendBankCard.cjs
-@@ -13,6 +13,20 @@ require('../models/Reminder.cjs');
- require('../models/ZBusiness.cjs');
- var utils = require('../utils.cjs');
- 
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in the ESM build; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- const sendBankCardFactory = utils.apiFactory()((api, _, utils) => {
-     const serviceURL = utils.makeURL(`${api.zpwServiceMap.zimsg[0]}/api/transfer/card`);
-     /**
-@@ -26,11 +40,12 @@ const sendBankCardFactory = utils.apiFactory()((api, _, utils) => {
-      */
-     return async function sendBankCard(payload, threadId, type = Enum.ThreadType.User) {
-         var _a;
-+        const cliMsgId = Date.now().toString();
-         const params = {
-             binBank: payload.binBank,
-             numAccBank: payload.numAccBank,
-             nameAccBank: ((_a = payload.nameAccBank) === null || _a === void 0 ? void 0 : _a.toUpperCase()) || "---",
--            cliMsgId: Date.now().toString(),
-+            cliMsgId: cliMsgId,
-             tsMsg: Date.now(),
-             destUid: threadId,
-             destType: type === Enum.ThreadType.Group ? 1 : 0,
-@@ -44,7 +59,9 @@ const sendBankCardFactory = utils.apiFactory()((api, _, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, cliMsgId);
-+        return resolved;
-     };
- });
- 
-diff --git a/node_modules/zca-js/dist/cjs/apis/sendCard.cjs b/node_modules/zca-js/dist/cjs/apis/sendCard.cjs
-index b953268..0cdbbbc 100644
---- a/node_modules/zca-js/dist/cjs/apis/sendCard.cjs
-+++ b/node_modules/zca-js/dist/cjs/apis/sendCard.cjs
-@@ -13,6 +13,20 @@ require('../models/Reminder.cjs');
- require('../models/ZBusiness.cjs');
- var utils = require('../utils.cjs');
- 
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in the ESM build; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- const sendCardFactory = utils.apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [Enum.ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/forward`),
-@@ -66,7 +80,9 @@ const sendCardFactory = utils.apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
- 
-diff --git a/node_modules/zca-js/dist/cjs/apis/sendLink.cjs b/node_modules/zca-js/dist/cjs/apis/sendLink.cjs
-index 00293a9..d3b7346 100644
---- a/node_modules/zca-js/dist/cjs/apis/sendLink.cjs
-+++ b/node_modules/zca-js/dist/cjs/apis/sendLink.cjs
-@@ -13,6 +13,20 @@ require('../models/Reminder.cjs');
- require('../models/ZBusiness.cjs');
- var utils = require('../utils.cjs');
- 
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in the ESM build; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- const sendLinkFactory = utils.apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [Enum.ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.chat[0]}/api/message/link`, {
-@@ -33,6 +47,7 @@ const sendLinkFactory = utils.apiFactory()((api, ctx, utils) => {
-      */
-     return async function sendLink(options, threadId, type = Enum.ThreadType.User) {
-         var _a;
-+        const clientId = Date.now();
-         const res = await api.parseLink(options.link);
-         const params = {
-             msg: options.msg && options.msg.trim()
-@@ -48,7 +63,7 @@ const sendLinkFactory = utils.apiFactory()((api, ctx, utils) => {
-             type: 2, // 0
-             media: JSON.stringify(res.data.media),
-             ttl: (_a = options.ttl) !== null && _a !== void 0 ? _a : 0,
--            clientId: Date.now(),
-+            clientId: clientId,
-         };
-         if (type == Enum.ThreadType.Group) {
-             params.grid = threadId;
-@@ -68,7 +83,9 @@ const sendLinkFactory = utils.apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
- 
-diff --git a/node_modules/zca-js/dist/cjs/apis/sendMessage.cjs b/node_modules/zca-js/dist/cjs/apis/sendMessage.cjs
-index a6f4bab..6967ff3 100644
---- a/node_modules/zca-js/dist/cjs/apis/sendMessage.cjs
-+++ b/node_modules/zca-js/dist/cjs/apis/sendMessage.cjs
-@@ -21,6 +21,18 @@ const attachmentUrlType = {
-     video: "asyncfile/msg?",
-     others: "asyncfile/msg?",
- };
-+/**
-+ * Record on the send response the clientId that was actually sent.
-+ *
-+ * The send endpoint returns only `{msgId}`, so without this the caller has
-+ * no way to learn the cliMsgId Zalo now holds for the message -- guessing it
-+ * with a second Date.now() is off by however long the encrypt + POST took.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- function prepareQMSGAttach(quote) {
-     const quoteData = quote;
-     if (typeof quoteData.content == "string")
-@@ -189,12 +201,16 @@ const sendMessageFactory = utils.apiFactory()((api, ctx, utils$1) => {
-             }
-         }
-         const isMentionsValid = mentionsFinal.length > 0 && isGroupMessage;
-+        // Hoisted so the caller can learn which clientId went on the wire.
-+        // Zalo echoes this back as the message's cliMsgId, and `msg react`,
-+        // `msg undo` and quote-replies all need that exact value.
-+        const clientId = Date.now();
-         const params = quote
-             ? {
-                 toid: isGroupMessage ? undefined : threadId,
-                 grid: isGroupMessage ? threadId : undefined,
-                 message: msg,
--                clientId: Date.now(),
-+                clientId,
-                 mentionInfo: isMentionsValid ? JSON.stringify(mentionsFinal) : undefined,
-                 qmsgOwner: quote.uidFrom,
-                 qmsgId: quote.msgId,
-@@ -210,7 +226,7 @@ const sendMessageFactory = utils.apiFactory()((api, ctx, utils$1) => {
-             }
-             : {
-                 message: msg,
--                clientId: Date.now(),
-+                clientId,
-                 mentionInfo: isMentionsValid ? JSON.stringify(mentionsFinal) : undefined,
-                 imei: isGroupMessage ? undefined : ctx.imei,
-                 ttl: ttl !== null && ttl !== void 0 ? ttl : 0,
-@@ -237,6 +253,7 @@ const sendMessageFactory = utils.apiFactory()((api, ctx, utils$1) => {
-         return {
-             url: finalServiceUrl.toString(),
-             body: new URLSearchParams({ params: encryptedParams }),
-+            clientId: String(clientId),
-         };
-     }
-     async function handleAttachment({ msg, attachments, mentions, quote, ttl, urgency }, threadId, type) {
-@@ -395,6 +412,9 @@ const sendMessageFactory = utils.apiFactory()((api, ctx, utils$1) => {
-                 body: formData.getBuffer(),
-                 headers: formData.getHeaders(),
-                 fileType: "gif",
-+                // Retained so the caller can learn which clientId went on the
-+                // wire; the params object itself is encrypted past this point.
-+                clientId: params.clientId,
-             });
-         }
-         const responses = [];
-@@ -405,6 +425,9 @@ const sendMessageFactory = utils.apiFactory()((api, ctx, utils$1) => {
-                 }, data.query || {})),
-                 body: data.body,
-                 headers: data.fileType == "gif" ? data.headers : {},
-+                // send() reads url/body/headers only, so this rides along
-+                // untouched and lets sendMessage() stamp the response.
-+                clientId: data.clientId != undefined ? data.clientId : data.params && data.params.clientId,
-             });
-         }
-         return responses;
-@@ -447,17 +470,28 @@ const sendMessageFactory = utils.apiFactory()((api, ctx, utils$1) => {
-                 // send message and attachment separately
-                 await handleMessage(message, threadId, type).then(async (data) => {
-                     responses.message = (await send(data))[0];
-+                    stampClientId(responses.message, data.clientId);
-                 });
-                 msg = "";
-                 mentions = undefined;
-             }
-             const handledData = await handleAttachment({ msg, mentions, attachments, quote, ttl, styles, urgency }, threadId, type);
--            responses.attachment = await send(handledData);
-+            // Stamp the attachment responses too. Upstream stamps only
-+            // responses.message, and for a single jpg/jpeg/png/webp canBeDesc
-+            // is true so the caption folds into the attachment and
-+            // responses.message stays null -- leaving an attachment send with
-+            // NO cliMsgId anywhere, which makes `msg undo` unable to recall it
-+            // at all. send() is Promise.all over the input array, so the
-+            // results are index-aligned with handledData.
-+            const sentAttachments = await send(handledData);
-+            sentAttachments.forEach((r, i) => stampClientId(r, handledData[i] && handledData[i].clientId));
-+            responses.attachment = sentAttachments;
-             msg = "";
-         }
-         if (msg.length > 0) {
-             const handledData = await handleMessage(message, threadId, type);
-             responses.message = (await send(handledData))[0];
-+            stampClientId(responses.message, handledData.clientId);
-         }
-         return responses;
-     };
-diff --git a/node_modules/zca-js/dist/cjs/apis/sendSticker.cjs b/node_modules/zca-js/dist/cjs/apis/sendSticker.cjs
-index 077ab16..b2a8ece 100644
---- a/node_modules/zca-js/dist/cjs/apis/sendSticker.cjs
-+++ b/node_modules/zca-js/dist/cjs/apis/sendSticker.cjs
-@@ -13,6 +13,20 @@ require('../models/Reminder.cjs');
- require('../models/ZBusiness.cjs');
- var utils = require('../utils.cjs');
- 
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in the ESM build; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- const sendStickerFactory = utils.apiFactory()((api, ctx, utils$1) => {
-     const serviceURL = {
-         [Enum.ThreadType.User]: utils$1.makeURL(`${api.zpwServiceMap.chat[0]}/api/message/sticker`, {
-@@ -44,11 +58,12 @@ const sendStickerFactory = utils.apiFactory()((api, ctx, utils$1) => {
-         if (!sticker.type)
-             throw new ZaloApiError.ZaloApiError("Missing sticker type");
-         const isGroupMessage = type === Enum.ThreadType.Group;
-+        const clientId = Date.now();
-         const params = {
-             stickerId: sticker.id,
-             cateId: sticker.cateId,
-             type: sticker.type,
--            clientId: Date.now(),
-+            clientId: clientId,
-             imei: ctx.imei,
-             zsource: 101,
-             toid: isGroupMessage ? undefined : threadId,
-@@ -64,7 +79,9 @@ const sendStickerFactory = utils.apiFactory()((api, ctx, utils$1) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils$1.resolve(response);
-+        const resolved = await utils$1.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
- 
-diff --git a/node_modules/zca-js/dist/cjs/apis/sendVideo.cjs b/node_modules/zca-js/dist/cjs/apis/sendVideo.cjs
-index d779710..e62770b 100644
---- a/node_modules/zca-js/dist/cjs/apis/sendVideo.cjs
-+++ b/node_modules/zca-js/dist/cjs/apis/sendVideo.cjs
-@@ -13,6 +13,20 @@ require('../models/Reminder.cjs');
- require('../models/ZBusiness.cjs');
- var utils = require('../utils.cjs');
- 
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in the ESM build; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- const sendVideoFactory = utils.apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [Enum.ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/forward`),
-@@ -125,7 +139,9 @@ const sendVideoFactory = utils.apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
- 
-diff --git a/node_modules/zca-js/dist/cjs/apis/sendVoice.cjs b/node_modules/zca-js/dist/cjs/apis/sendVoice.cjs
-index f371e14..134dcdf 100644
---- a/node_modules/zca-js/dist/cjs/apis/sendVoice.cjs
-+++ b/node_modules/zca-js/dist/cjs/apis/sendVoice.cjs
-@@ -13,6 +13,20 @@ require('../models/Reminder.cjs');
- require('../models/ZBusiness.cjs');
- var utils = require('../utils.cjs');
- 
-+/**
-+ * Hand the caller the clientId that went on the wire.
-+ *
-+ * Zalo's send responses carry only {msgId}, but `undo` and `deleteMessage`
-+ * both require the cliMsgId, which is client-generated and not derivable
-+ * from a msgId. Without this a message of this kind can be sent and then
-+ * never recalled. Mirrors the helper in the ESM build; kept local so a
-+ * zca-js bump that breaks one file cannot break the others.
-+ */
-+function stampClientId(response, clientId) {
-+    if (!response || typeof response != "object" || clientId == undefined)
-+        return;
-+    response.cliMsgId = String(clientId);
-+}
- const sendVoiceFactory = utils.apiFactory()((api, ctx, utils) => {
-     const serviceURL = {
-         [Enum.ThreadType.User]: utils.makeURL(`${api.zpwServiceMap.file[0]}/api/message/forward`),
-@@ -80,7 +94,9 @@ const sendVoiceFactory = utils.apiFactory()((api, ctx, utils) => {
-                 params: encryptedParams,
-             }),
-         });
--        return utils.resolve(response);
-+        const resolved = await utils.resolve(response);
-+        stampClientId(resolved, clientId);
-+        return resolved;
-     };
- });
-