@awangxcode/qiro-baileys 0.0.0-stage → 7.0.0-rc16

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Rajeh Taher/WhiskeySockets
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/QIRO-BAILEYS-RC16.md

@@ -0,0 +1,25 @@
+# Qiro Baileys RC16 — MessageBuilder hardening
+
+RC16 is the next **unpublished release candidate** for `@awangxcode/qiro-baileys`. It builds on the RC15 source line based on WhiskeySockets/Baileys `7.0.0-rc14`.
+
+## Scope of this candidate
+
+This candidate focuses on local payload construction and validation. The socket, session, pairing, reconnect, and message transport source files are not modified by the RC16 changes; no production session needs to be migrated to adopt these builder refinements.
+
+- Make `checkNativeFlowButtons` handle malformed JavaScript/untyped inputs without throwing while inspecting them. It reports invalid list, item, name, platform, or `params` shapes as validation errors.
+- Validate native-flow `params` as plain records and validate section titles, row shapes, and optional row text fields before serialization.
+- Convert circular/non-serializable button parameters into a clear `TypeError` rather than exposing a low-level `JSON.stringify` exception.
+- Reject malformed absolute URLs and URLs containing embedded credentials when `Button.addUrl` is called, before a payload is built.
+- Make carousel batch additions atomic: if any supplied card is invalid, none of the cards from that batch are added.
+- Make text guard helpers reject non-string runtime values with a consistent, descriptive error.
+- Add regression tests for malformed runtime inputs, unsafe URL credentials, serialization failures, and carousel batch atomicity.
+
+## Compatibility and scope limits
+
+These changes harden local payload assembly. They do not change the core Socket/session/pairing implementation from RC15 and do not claim that WhatsApp will accept or render every native-flow, carousel, or AIRich variant. Server-side feature flags and device/client support remain outside this library's control.
+
+## Verification status
+
+The RC15 baseline was previously built and installed from an npm tarball in an isolated directory; baseline MessageBuilder smoke checks passed. RC16 adds new validation behavior and regression tests. Full dependency installation and a build/test run could not be completed in the offline preparation environment, so this archive is a source candidate, not a verified binary release. Build and run the targeted MessageBuilder Jest suite in a compatible environment before publishing. If Jest crashes on a particular Termux host with `illegal hardware instruction`, report that separately from source compilation status rather than treating it as a passing test.
+
+If publishing after the RC16 build and focused test gates pass, publish with the `next` dist-tag so existing consumers of `latest` do not automatically move to this candidate.