@moltflow/skills 1.1.0 → 1.3.0

package/SKILL.md

@@ -1,512 +1,505 @@
----
-name: WhatsApp Automation & A2A
-description: "MoltFlow — complete WhatsApp automation platform: sessions, messaging, groups, labels, webhooks, AI (voice transcription, RAG, style profiles, reply generation), agent-to-agent protocol (JSON-RPC, encryption), review collection (14+ language sentiment analysis), auth, API keys, and Stripe billing."
-metadata: {"openclaw":{"emoji":"📱","homepage":"https://moltflow.com","requires":{"env":["MOLTFLOW_API_KEY"]},"primaryEnv":"MOLTFLOW_API_KEY"}}
----
-
-# WhatsApp Automation & A2A
-
-MoltFlow provides a complete WhatsApp automation API with managed sessions, group monitoring, AI-powered replies, agent-to-agent communication, review collection, and Stripe billing.
-
-## When to use
-
-Use this skill when you need to:
-- Connect and manage WhatsApp sessions (QR pairing, start/stop)
-- Send text messages, list chats, read message history
-- Monitor groups for leads or keywords
-- Manage contact labels (WhatsApp Business sync)
-- Configure webhooks for real-time events
-- Transcribe voice messages (Whisper AI)
-- Manage RAG knowledge base (upload docs, semantic search)
-- Train style profiles and generate AI replies
-- Discover and message other AI agents (A2A JSON-RPC 2.0)
-- Manage encryption keys (X25519-AES256GCM)
-- Collect reviews via sentiment analysis (14+ languages)
-- Export testimonials (JSON/HTML)
-- Manage API keys, usage tracking, billing (Stripe)
-
-## Setup
-
-Env vars:
-- `MOLTFLOW_API_KEY` (required) — API key from moltflow.com dashboard
-- `MOLTFLOW_API_URL` (optional) — defaults to `https://api.moltflow.com`
-
-Authentication: `X-API-Key: $MOLTFLOW_API_KEY` header or `Authorization: Bearer $TOKEN` (JWT from login).
-
-Base URL: `https://api.moltflow.com/api/v2`
-
----
-
-## 1. Sessions
-
-```bash
-# List all sessions
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/sessions
-
-# Create new session
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"name": "Main Line"}' \
-  https://api.moltflow.com/api/v2/sessions
-
-# Get session details
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/sessions/{session_id}
-
-# Delete session
-curl -X DELETE -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/sessions/{session_id}
-```
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/sessions` | GET | List sessions |
-| `/sessions` | POST | Create session |
-| `/sessions/{id}` | GET | Get session details |
-| `/sessions/{id}` | DELETE | Delete session |
-
-## 2. Messages
-
-```bash
-# Send text message
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"session_id": "uuid", "chat_id": "1234567890@c.us", "message": "Hello!"}' \
-  https://api.moltflow.com/api/v2/messages/send
-
-# List chats for a session
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/messages/chats/{session_id}
-
-# Get chat messages
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/messages/chat/{session_id}/{chat_id}
-```
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/messages/send` | POST | Send text message |
-| `/messages/chats/{session_id}` | GET | List chats |
-| `/messages/chat/{session_id}/{chat_id}` | GET | Get messages in chat |
-| `/messages/{message_id}` | GET | Get single message |
-
-## 3. Groups
-
-```bash
-# List monitored groups
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/groups
-
-# List available WhatsApp groups
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/groups/available/{session_id}
-
-# Add group to monitor
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"session_id": "uuid", "wa_group_id": "123456@g.us", "monitor_mode": "first_message"}' \
-  https://api.moltflow.com/api/v2/groups
-
-# Update monitoring settings
-curl -X PATCH -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"monitor_mode": "keyword", "monitor_keywords": ["looking for", "need help"]}' \
-  https://api.moltflow.com/api/v2/groups/{group_id}
-```
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/groups` | GET | List monitored groups |
-| `/groups/available/{session_id}` | GET | List available WhatsApp groups |
-| `/groups` | POST | Add group to monitoring |
-| `/groups/{id}` | GET | Get group details |
-| `/groups/{id}` | PATCH | Update monitoring settings |
-| `/groups/{id}` | DELETE | Remove from monitoring |
-
-## 4. Labels
-
-```bash
-# Create label (color must be hex #RRGGBB)
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"name": "VIP", "color": "#00FF00"}' \
-  https://api.moltflow.com/api/v2/labels
-
-# Sync label to WhatsApp Business
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  "https://api.moltflow.com/api/v2/labels/{label_id}/sync?session_id={session_id}"
-
-# Import labels from WhatsApp Business
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  "https://api.moltflow.com/api/v2/labels/sync-from-whatsapp?session_id={session_id}"
-```
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/labels` | GET | List labels |
-| `/labels` | POST | Create label |
-| `/labels/business-check` | GET | Check WhatsApp Business status |
-| `/labels/{id}` | GET / PATCH / DELETE | Get, update, delete label |
-| `/labels/{id}/sync` | POST | Sync to WhatsApp Business |
-| `/labels/sync-from-whatsapp` | POST | Import from WhatsApp |
-
-## 5. Webhooks
-
-```bash
-# Create webhook
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"url": "https://your-server.com/webhook", "events": ["message.received", "lead.detected"]}' \
-  https://api.moltflow.com/api/v2/webhooks
-
-# Test webhook
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/webhooks/{webhook_id}/test
-```
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/webhooks` | GET | List webhooks |
-| `/webhooks` | POST | Create webhook |
-| `/webhooks/{id}` | GET / PATCH / DELETE | Get, update, delete |
-| `/webhooks/{id}/test` | POST | Send test payload |
-
-**Webhook events:** `message.received`, `message.sent`, `message.delivered`, `message.read`, `lead.detected`, `session.connected`, `session.disconnected`, `group.message`
-
----
-
-## 6. AI — Voice Transcription
-
-```bash
-# Queue voice message for transcription
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -d '{"message_id": "uuid-of-voice-message"}' \
-  https://api.moltflow.com/api/v2/ai/voice/transcribe
-
-# Check transcription status
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/ai/voice/status/{task_id}
-
-# Get transcript
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/ai/messages/{message_id}/transcript
-```
-
-## 7. AI — Knowledge Base (RAG)
-
-```bash
-# Upload document (PDF or TXT, max 10MB)
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -F "file=@manual.pdf" \
-  https://api.moltflow.com/api/v2/ai/knowledge/ingest
-
-# Search knowledge base
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -d '{"query": "return policy", "top_k": 5}' \
-  https://api.moltflow.com/api/v2/ai/knowledge/search
-
-# List knowledge sources
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/ai/knowledge/sources
-
-# Delete knowledge source
-curl -X DELETE -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/ai/knowledge/{source_id}
-```
-
-## 8. AI — Style Profiles (Learn Mode)
-
-```bash
-# Train style profile from message history
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -d '{"contact_id": "optional-contact-jid"}' \
-  https://api.moltflow.com/api/v2/ai/style/train
-
-# Check training status
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/ai/style/status/{task_id}
-
-# Get / list / delete style profiles
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/ai/style/profiles
-```
-
-## 9. AI — Reply Generation
-
-```bash
-# Generate AI reply (uses RAG + style)
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -d '{"contact_id": "jid", "context": "customer question", "use_rag": true, "apply_style": true}' \
-  https://api.moltflow.com/api/v2/ai/ai/generate-reply
-
-# Preview AI reply (no usage tracking)
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  "https://api.moltflow.com/api/v2/ai/ai/preview?contact_id=jid&context=question&use_rag=true&apply_style=true"
-```
-
-### AI API Reference
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/ai/voice/transcribe` | POST | Queue voice transcription |
-| `/ai/voice/status/{task_id}` | GET | Check transcription status |
-| `/ai/messages/{id}/transcript` | GET | Get transcript |
-| `/ai/knowledge/ingest` | POST | Upload document (PDF/TXT) |
-| `/ai/knowledge/search` | POST | Semantic search |
-| `/ai/knowledge/sources` | GET | List knowledge sources |
-| `/ai/knowledge/{id}` | DELETE | Delete source |
-| `/ai/style/train` | POST | Train style profile |
-| `/ai/style/status/{task_id}` | GET | Training status |
-| `/ai/style/profile` | GET | Get style profile |
-| `/ai/style/profiles` | GET | List all profiles |
-| `/ai/style/profile/{id}` | DELETE | Delete profile |
-| `/ai/ai/generate-reply` | POST | Generate AI reply |
-| `/ai/ai/preview` | GET | Preview reply (no tracking) |
-
----
-
-## 10. A2A — Agent-to-Agent Protocol
-
-**Requires Business plan.** Uses JSON-RPC 2.0 over HTTPS with X25519-AES256GCM encryption.
-
-### Bootstrap & encryption
-
-```bash
-# Get full configuration
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/agent/bootstrap
-
-# Get your public key (auto-generates if none)
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/agent/public-key
-
-# Rotate keypair
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/agent/rotate-keys
-```
-
-### Discover agents
-
-```bash
-# Resolve phone to MoltFlow agent
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/agents/resolve/+1234567890
-
-# List peers
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/agents/peers
-
-# Update trust level (discovered, verified, blocked)
-curl -X PATCH -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"trust_level": "verified"}' \
-  https://api.moltflow.com/api/v2/agents/peers/{peer_id}/trust
-```
-
-### Send A2A messages (JSON-RPC 2.0)
-
-```bash
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "jsonrpc": "2.0",
-    "method": "agent.message.send",
-    "params": {
-      "phone": "+1234567890",
-      "message": {"parts": [{"text": "Hello from my agent!"}]}
-    },
-    "id": "1"
-  }' \
-  https://api.moltflow.com/api/v2/a2a
-```
-
-### Content policy
-
-```bash
-# Get policy settings
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/a2a-policy/settings
-
-# Update policy
-curl -X PUT -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"block_api_keys": true, "block_credit_cards": true, "block_emails": false}' \
-  https://api.moltflow.com/api/v2/a2a-policy/settings
-
-# Test content against policy
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -H "Content-Type: application/json" \
-  -d '{"content": "My API key is sk-abc123"}' \
-  https://api.moltflow.com/api/v2/a2a-policy/test
-```
-
-### A2A API Reference
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/agent/bootstrap` | GET | Full onboarding config |
-| `/agent/public-key` | GET | Get X25519 public key |
-| `/agent/rotate-keys` | POST | Rotate keypair |
-| `/agent/peer/{tenant_id}/public-key` | GET | Peer's public key |
-| `/agents/resolve/{phone}` | GET | Resolve phone to agent |
-| `/agents/peers` | GET | List discovered peers |
-| `/agents/peers/{id}/trust` | PATCH | Update trust level |
-| `/a2a` | POST | JSON-RPC 2.0 endpoint |
-| `/a2a-policy/settings` | GET/PUT | Get/update policy |
-| `/a2a-policy/rules` | POST | Add custom filter rule |
-| `/a2a-policy/test` | POST | Test content against policy |
-| `/a2a-policy/stats` | GET | Blocking statistics |
-
-**JSON-RPC methods:** `agent.message.send`, `group.getContext`, `agent.group.create`, `agent.group.invite`, `agent.group.list`, `webhook_manager`
-
-**Trust levels:** `discovered` → `verified` → `blocked`
-
-**Encryption:** X25519-AES256GCM, ECDH key exchange, HKDF-SHA256, 32-byte keys (base64)
-
----
-
-## 11. Reviews — Sentiment Analysis & Testimonials
-
-```bash
-# Create review collector
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -d '{
-    "name": "Customer Feedback",
-    "session_id": "uuid-of-whatsapp-session",
-    "source_type": "groups",
-    "min_positive_words": 3,
-    "min_sentiment_score": 0.6,
-    "include_keywords": ["great", "excellent"],
-    "languages": []
-  }' \
-  https://api.moltflow.com/api/v2/reviews/collectors
-
-# Trigger manual scan
-curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/reviews/collectors/{id}/run
-
-# List reviews
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  "https://api.moltflow.com/api/v2/reviews?approved_only=false&limit=50"
-
-# Approve review
-curl -X PATCH -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  -d '{"is_approved": true}' \
-  https://api.moltflow.com/api/v2/reviews/{id}
-
-# Export testimonials as HTML
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  "https://api.moltflow.com/api/v2/reviews/testimonials/export?format=html"
-```
-
-### Reviews API Reference
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/reviews/collectors` | GET/POST | List/create collectors |
-| `/reviews/collectors/{id}` | GET/PATCH/DELETE | Manage collector |
-| `/reviews/collectors/{id}/run` | POST | Trigger scan |
-| `/reviews` | GET | List reviews |
-| `/reviews/stats` | GET | Review statistics |
-| `/reviews/{id}` | GET/PATCH/DELETE | Manage review |
-| `/reviews/testimonials/export` | GET | Export (format=json/html) |
-
-**Supported languages (14+):** English, Spanish, Portuguese, French, German, Italian, Dutch, Russian, Arabic, Hebrew, Chinese, Japanese, Korean, Hindi, Turkish
-
-**Collector fields:** `name`, `session_id`, `source_type` (all/groups/chats/selected), `min_positive_words` (1-10), `min_sentiment_score` (0.0-1.0), `include_keywords`, `exclude_keywords`, `languages`
-
----
-
-## 12. Auth & API Keys
-
-```bash
-# Login
-curl -X POST -d '{"email": "user@example.com", "password": "..."}' \
-  https://api.moltflow.com/api/v2/auth/login
-
-# Get current user
-curl -H "Authorization: Bearer $TOKEN" \
-  https://api.moltflow.com/api/v2/auth/me
-
-# Create API key
-curl -X POST -H "Authorization: Bearer $TOKEN" \
-  -d '{"name": "Production Key", "expires_in_days": 90}' \
-  https://api.moltflow.com/api/v2/api-keys
-
-# Revoke key
-curl -X DELETE -H "Authorization: Bearer $TOKEN" \
-  https://api.moltflow.com/api/v2/api-keys/{id}
-
-# Rotate key
-curl -X POST -H "Authorization: Bearer $TOKEN" \
-  https://api.moltflow.com/api/v2/api-keys/{id}/rotate
-```
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/auth/login` | POST | Login (email/password), returns JWT |
-| `/auth/refresh` | POST | Refresh token |
-| `/auth/me` | GET | Current user + tenant |
-| `/auth/magic-link/request` | POST | Request magic link |
-| `/api-keys` | GET/POST | List/create API keys |
-| `/api-keys/{id}` | GET/DELETE | Get/revoke key |
-| `/api-keys/{id}/rotate` | POST | Rotate key |
-
-## 13. Usage & Billing
-
-```bash
-# Current period usage
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  https://api.moltflow.com/api/v2/usage/current
-
-# Daily breakdown
-curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
-  "https://api.moltflow.com/api/v2/usage/daily?days=30"
-
-# List plans
-curl https://api.moltflow.com/api/v2/billing/plans
-
-# Create checkout session
-curl -X POST -H "Authorization: Bearer $TOKEN" \
-  -d '{"plan": "pro", "cycle": "monthly", "success_url": "https://...", "cancel_url": "https://..."}' \
-  https://api.moltflow.com/api/v2/billing/checkout
-
-# Billing portal
-curl -H "Authorization: Bearer $TOKEN" \
-  https://api.moltflow.com/api/v2/billing/portal
-```
-
-| Endpoint | Method | Description |
-|----------|--------|-------------|
-| `/usage/current` | GET | Current period usage + limits |
-| `/usage/history` | GET | Historical usage |
-| `/usage/daily` | GET | Daily breakdown |
-| `/billing/plans` | GET | Available plans |
-| `/billing/subscription` | GET | Current subscription |
-| `/billing/checkout` | POST | Stripe checkout session |
-| `/billing/portal` | GET | Stripe billing portal |
-| `/billing/cancel` | POST | Cancel subscription |
-
----
-
-## Notes
-
-- All messages include anti-spam compliance (typing indicators, random delays)
-- Rate limits by plan: Free 10/min, Starter 60/min, Pro 300/min, Business 1000/min
-- Sessions require QR code pairing on first connect
-- Use E.164 phone format without `+` where required
-- AI features require Pro plan or above
-- A2A protocol requires Business plan
-- AI reply generation includes safety: input sanitization, intent verification, output filtering, PII/secrets detection
-- Content policy filters secrets (API keys, tokens) and PII (SSN, credit cards)
-- API keys use name + expires_in_days (no scopes param); raw key shown only once at creation
-- Respect WhatsApp opt-in, business hours, and opt-out requests
-
-<!-- FILEMAP:BEGIN -->
-```text
-[moltflow file map]|root: .
-|.:{SKILL.md,package.json}
-|scripts:{quickstart.py,a2a_client.py,discover_agent.py,send_message.py,admin.py,ai_config.py,reviews.py}
-```
-<!-- FILEMAP:END -->
+---
+name: "WhatsApp Automation & A2A"
+description: "MoltFlow — complete WhatsApp automation platform: sessions, messaging, groups, labels, webhooks, AI-powered replies, auto-feedback collection, intention detection, lead management, anti-spam safeguards, agent-to-agent protocol (JSON-RPC, encryption), and configurable rules."
+metadata: {"openclaw":{"emoji":"📱","homepage":"https://waiflow.app","requires":{"env":["MOLTFLOW_API_KEY"]},"primaryEnv":"MOLTFLOW_API_KEY"}}
+---
+
+# WhatsApp Automation & A2A
+
+MoltFlow provides a complete WhatsApp automation API with managed sessions, group monitoring, AI-powered replies, auto-feedback collection, intention detection, lead management, and agent-to-agent communication.
+
+## When to use
+
+Use this skill when you need to:
+- Connect and manage WhatsApp sessions (QR pairing, start/stop)
+- Send text messages, list chats, read message history
+- Monitor groups for leads or keywords
+- Manage contact labels (WhatsApp Business sync)
+- Configure webhooks for real-time events
+- Transcribe voice messages (Whisper AI)
+- Manage RAG knowledge base (upload docs, semantic search)
+- Train style profiles and generate AI replies
+- Discover and message other AI agents (A2A JSON-RPC 2.0)
+- Manage encryption keys (X25519-AES256GCM)
+- Collect reviews via sentiment analysis (14+ languages)
+- Export testimonials (JSON/HTML)
+- Manage API keys, usage tracking, billing (Stripe)
+
+## Setup
+
+Env vars:
+- `MOLTFLOW_API_KEY` (required) — API key from waiflow.app dashboard
+- `MOLTFLOW_API_URL` (optional) — defaults to `https://apiv2.waiflow.app`
+
+Authentication: `X-API-Key: $MOLTFLOW_API_KEY` header or `Authorization: Bearer $TOKEN` (JWT from login).
+
+Base URL: `https://apiv2.waiflow.app/api/v2`
+
+---
+
+## 1. Sessions
+
+```bash
+# List all sessions
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/sessions
+
+# Create new session
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"name": "Main Line"}' \
+  https://apiv2.waiflow.app/api/v2/sessions
+
+# Get session details
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/sessions/{session_id}
+
+# Delete session
+curl -X DELETE -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/sessions/{session_id}
+```
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/sessions` | GET | List sessions |
+| `/sessions` | POST | Create session |
+| `/sessions/{id}` | GET | Get session details |
+| `/sessions/{id}` | DELETE | Delete session |
+
+## 2. Messages
+
+```bash
+# Send text message
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"session_id": "uuid", "chat_id": "1234567890@c.us", "message": "Hello!"}' \
+  https://apiv2.waiflow.app/api/v2/messages/send
+
+# List chats for a session
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/messages/chats/{session_id}
+
+# Get chat messages
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/messages/chat/{session_id}/{chat_id}
+```
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/messages/send` | POST | Send text message |
+| `/messages/chats/{session_id}` | GET | List chats |
+| `/messages/chat/{session_id}/{chat_id}` | GET | Get messages in chat |
+| `/messages/{message_id}` | GET | Get single message |
+
+## 3. Groups
+
+```bash
+# List monitored groups
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/groups
+
+# List available WhatsApp groups
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/groups/available/{session_id}
+
+# Add group to monitor
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"session_id": "uuid", "wa_group_id": "123456@g.us", "monitor_mode": "first_message"}' \
+  https://apiv2.waiflow.app/api/v2/groups
+
+# Update monitoring settings
+curl -X PATCH -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"monitor_mode": "keyword", "monitor_keywords": ["looking for", "need help"]}' \
+  https://apiv2.waiflow.app/api/v2/groups/{group_id}
+```
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/groups` | GET | List monitored groups |
+| `/groups/available/{session_id}` | GET | List available WhatsApp groups |
+| `/groups` | POST | Add group to monitoring |
+| `/groups/{id}` | GET | Get group details |
+| `/groups/{id}` | PATCH | Update monitoring settings |
+| `/groups/{id}` | DELETE | Remove from monitoring |
+
+## 4. Labels
+
+```bash
+# Create label (color must be hex #RRGGBB)
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"name": "VIP", "color": "#00FF00"}' \
+  https://apiv2.waiflow.app/api/v2/labels
+
+# Sync label to WhatsApp Business
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  "https://apiv2.waiflow.app/api/v2/labels/{label_id}/sync?session_id={session_id}"
+
+# Import labels from WhatsApp Business
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  "https://apiv2.waiflow.app/api/v2/labels/sync-from-whatsapp?session_id={session_id}"
+```
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/labels` | GET | List labels |
+| `/labels` | POST | Create label |
+| `/labels/business-check` | GET | Check WhatsApp Business status |
+| `/labels/{id}` | GET / PATCH / DELETE | Get, update, delete label |
+| `/labels/{id}/sync` | POST | Sync to WhatsApp Business |
+| `/labels/sync-from-whatsapp` | POST | Import from WhatsApp |
+
+## 5. Webhooks
+
+```bash
+# List webhooks
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/webhooks
+
+# Test webhook
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/webhooks/{webhook_id}/test
+```
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/webhooks` | GET | List webhooks |
+| `/webhooks` | POST | Create webhook |
+| `/webhooks/{id}` | GET / PATCH / DELETE | Get, update, delete |
+| `/webhooks/{id}/test` | POST | Send test payload |
+
+**Webhook events:** `message.received`, `message.sent`, `message.delivered`, `message.read`, `lead.detected`, `session.connected`, `session.disconnected`, `group.message`
+
+---
+
+## 6. AI — Voice Transcription
+
+```bash
+# Queue voice message for transcription
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -d '{"message_id": "uuid-of-voice-message"}' \
+  https://apiv2.waiflow.app/api/v2/ai/voice/transcribe
+
+# Check transcription status
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/ai/voice/status/{task_id}
+
+# Get transcript
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/ai/messages/{message_id}/transcript
+```
+
+## 7. AI — Knowledge Base (RAG)
+
+```bash
+# Search knowledge base
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -d '{"query": "return policy", "top_k": 5}' \
+  https://apiv2.waiflow.app/api/v2/ai/knowledge/search
+
+# List knowledge sources
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/ai/knowledge/sources
+
+# Delete knowledge source
+curl -X DELETE -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/ai/knowledge/{source_id}
+```
+
+## 8. AI — Style Profiles (Learn Mode)
+
+```bash
+# Train style profile from message history
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -d '{"contact_id": "optional-contact-jid"}' \
+  https://apiv2.waiflow.app/api/v2/ai/style/train
+
+# Check training status
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/ai/style/status/{task_id}
+
+# Get / list / delete style profiles
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/ai/style/profiles
+```
+
+## 9. AI — Reply Generation
+
+```bash
+# Generate AI reply (uses RAG + style)
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -d '{"contact_id": "jid", "context": "customer question", "use_rag": true, "apply_style": true}' \
+  https://apiv2.waiflow.app/api/v2/ai/ai/generate-reply
+
+# Preview AI reply (no usage tracking)
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  "https://apiv2.waiflow.app/api/v2/ai/ai/preview?contact_id=jid&context=question&use_rag=true&apply_style=true"
+```
+
+### AI API Reference
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/ai/voice/transcribe` | POST | Queue voice transcription |
+| `/ai/voice/status/{task_id}` | GET | Check transcription status |
+| `/ai/messages/{id}/transcript` | GET | Get transcript |
+| `/ai/knowledge/ingest` | POST | Ingest document |
+| `/ai/knowledge/search` | POST | Semantic search |
+| `/ai/knowledge/sources` | GET | List knowledge sources |
+| `/ai/knowledge/{id}` | DELETE | Delete source |
+| `/ai/style/train` | POST | Train style profile |
+| `/ai/style/status/{task_id}` | GET | Training status |
+| `/ai/style/profile` | GET | Get style profile |
+| `/ai/style/profiles` | GET | List all profiles |
+| `/ai/style/profile/{id}` | DELETE | Delete profile |
+| `/ai/ai/generate-reply` | POST | Generate AI reply |
+| `/ai/ai/preview` | GET | Preview reply (no tracking) |
+
+---
+
+## 10. A2A — Agent-to-Agent Protocol
+
+**Requires Business plan.** Uses JSON-RPC 2.0 over HTTPS with X25519-AES256GCM encryption.
+
+### Bootstrap & encryption
+
+```bash
+# Get full configuration
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/agent/bootstrap
+
+# Get your public key (auto-generates if none)
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/agent/public-key
+
+# Rotate keypair
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/agent/rotate-keys
+```
+
+### Discover agents
+
+```bash
+# Resolve phone to MoltFlow agent
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/agents/resolve/+1234567890
+
+# List peers
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/agents/peers
+
+# Update trust level (discovered, verified, blocked)
+curl -X PATCH -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"trust_level": "verified"}' \
+  https://apiv2.waiflow.app/api/v2/agents/peers/{peer_id}/trust
+```
+
+### Send A2A messages (JSON-RPC 2.0)
+
+```bash
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "jsonrpc": "2.0",
+    "method": "agent.message.send",
+    "params": {
+      "phone": "+1234567890",
+      "message": {"parts": [{"text": "Hello from my agent!"}]}
+    },
+    "id": "1"
+  }' \
+  https://apiv2.waiflow.app/api/v2/a2a
+```
+
+### Content policy
+
+```bash
+# Get policy settings
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/a2a-policy/settings
+
+# Update policy
+curl -X PUT -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"block_api_keys": true, "block_credit_cards": true, "block_emails": false}' \
+  https://apiv2.waiflow.app/api/v2/a2a-policy/settings
+
+# Test content against policy
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -H "Content-Type: application/json" \
+  -d '{"content": "My API key is sk-abc123"}' \
+  https://apiv2.waiflow.app/api/v2/a2a-policy/test
+```
+
+### A2A API Reference
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/agent/bootstrap` | GET | Full onboarding config |
+| `/agent/public-key` | GET | Get X25519 public key |
+| `/agent/rotate-keys` | POST | Rotate keypair |
+| `/agent/peer/{tenant_id}/public-key` | GET | Peer's public key |
+| `/agents/resolve/{phone}` | GET | Resolve phone to agent |
+| `/agents/peers` | GET | List discovered peers |
+| `/agents/peers/{id}/trust` | PATCH | Update trust level |
+| `/a2a` | POST | JSON-RPC 2.0 endpoint |
+| `/a2a-policy/settings` | GET/PUT | Get/update policy |
+| `/a2a-policy/rules` | POST | Add custom filter rule |
+| `/a2a-policy/test` | POST | Test content against policy |
+| `/a2a-policy/stats` | GET | Blocking statistics |
+
+**JSON-RPC methods:** `agent.message.send`, `group.getContext`, `agent.group.create`, `agent.group.invite`, `agent.group.list`, `webhook_manager`
+
+**Trust levels:** `discovered` → `verified` → `blocked`
+
+**Encryption:** X25519-AES256GCM, ECDH key exchange, HKDF-SHA256, 32-byte keys (base64)
+
+---
+
+## 11. Reviews — Sentiment Analysis & Testimonials
+
+```bash
+# Create review collector
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -d '{
+    "name": "Customer Feedback",
+    "session_id": "uuid-of-whatsapp-session",
+    "source_type": "groups",
+    "min_positive_words": 3,
+    "min_sentiment_score": 0.6,
+    "include_keywords": ["great", "excellent"],
+    "languages": []
+  }' \
+  https://apiv2.waiflow.app/api/v2/reviews/collectors
+
+# Trigger manual scan
+curl -X POST -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/reviews/collectors/{id}/run
+
+# List reviews
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  "https://apiv2.waiflow.app/api/v2/reviews?approved_only=false&limit=50"
+
+# Approve review
+curl -X PATCH -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  -d '{"is_approved": true}' \
+  https://apiv2.waiflow.app/api/v2/reviews/{id}
+
+# Export testimonials as HTML
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  "https://apiv2.waiflow.app/api/v2/reviews/testimonials/export?format=html"
+```
+
+### Reviews API Reference
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/reviews/collectors` | GET/POST | List/create collectors |
+| `/reviews/collectors/{id}` | GET/PATCH/DELETE | Manage collector |
+| `/reviews/collectors/{id}/run` | POST | Trigger scan |
+| `/reviews` | GET | List reviews |
+| `/reviews/stats` | GET | Review statistics |
+| `/reviews/{id}` | GET/PATCH/DELETE | Manage review |
+| `/reviews/testimonials/export` | GET | Export (format=json/html) |
+
+**Supported languages (14+):** English, Spanish, Portuguese, French, German, Italian, Dutch, Russian, Arabic, Hebrew, Chinese, Japanese, Korean, Hindi, Turkish
+
+**Collector fields:** `name`, `session_id`, `source_type` (all/groups/chats/selected), `min_positive_words` (1-10), `min_sentiment_score` (0.0-1.0), `include_keywords`, `exclude_keywords`, `languages`
+
+---
+
+## 12. Auth & API Keys
+
+```bash
+# Login
+curl -X POST -d '{"email": "user@example.com", "password": "..."}' \
+  https://apiv2.waiflow.app/api/v2/auth/login
+
+# Get current user
+curl -H "Authorization: Bearer $TOKEN" \
+  https://apiv2.waiflow.app/api/v2/auth/me
+
+# Create API key
+curl -X POST -H "Authorization: Bearer $TOKEN" \
+  -d '{"name": "Production Key", "expires_in_days": 90}' \
+  https://apiv2.waiflow.app/api/v2/api-keys
+
+# Revoke key
+curl -X DELETE -H "Authorization: Bearer $TOKEN" \
+  https://apiv2.waiflow.app/api/v2/api-keys/{id}
+
+# Rotate key
+curl -X POST -H "Authorization: Bearer $TOKEN" \
+  https://apiv2.waiflow.app/api/v2/api-keys/{id}/rotate
+```
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/auth/login` | POST | Login (email/password), returns JWT |
+| `/auth/refresh` | POST | Refresh token |
+| `/auth/me` | GET | Current user + tenant |
+| `/auth/magic-link/request` | POST | Request magic link |
+| `/api-keys` | GET/POST | List/create API keys |
+| `/api-keys/{id}` | GET/DELETE | Get/revoke key |
+| `/api-keys/{id}/rotate` | POST | Rotate key |
+
+## 13. Usage & Billing
+
+```bash
+# Current period usage
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  https://apiv2.waiflow.app/api/v2/usage/current
+
+# Daily breakdown
+curl -H "X-API-Key: $MOLTFLOW_API_KEY" \
+  "https://apiv2.waiflow.app/api/v2/usage/daily?days=30"
+
+# List plans
+curl https://apiv2.waiflow.app/api/v2/billing/plans
+
+# Create checkout session
+curl -X POST -H "Authorization: Bearer $TOKEN" \
+  -d '{"plan": "pro", "cycle": "monthly", "success_url": "https://...", "cancel_url": "https://..."}' \
+  https://apiv2.waiflow.app/api/v2/billing/checkout
+
+# Billing portal
+curl -H "Authorization: Bearer $TOKEN" \
+  https://apiv2.waiflow.app/api/v2/billing/portal
+```
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/usage/current` | GET | Current period usage + limits |
+| `/usage/history` | GET | Historical usage |
+| `/usage/daily` | GET | Daily breakdown |
+| `/billing/plans` | GET | Available plans |
+| `/billing/subscription` | GET | Current subscription |
+| `/billing/checkout` | POST | Stripe checkout session |
+| `/billing/portal` | GET | Stripe billing portal |
+| `/billing/cancel` | POST | Cancel subscription |
+
+---
+
+## Notes
+
+- All messages include anti-spam compliance (typing indicators, random delays)
+- Rate limits by plan: Free 10/min, Starter 60/min, Pro 300/min, Business 1000/min
+- Sessions require QR code pairing on first connect
+- Use E.164 phone format without `+` where required
+- AI features require Pro plan or above
+- A2A protocol requires Business plan
+- AI reply generation includes safety: input sanitization, intent verification, output filtering, PII/secrets detection
+- Content policy filters secrets (API keys, tokens) and PII (SSN, credit cards)
+- API keys use name + expires_in_days (no scopes param); raw key shown only once at creation
+- Respect WhatsApp opt-in, business hours, and opt-out requests
+
+<!-- FILEMAP:BEGIN -->
+```text
+[moltflow file map]|root: .
+|.:{SKILL.md,package.json}
+|scripts:{quickstart.py,a2a_client.py,send_message.py,admin.py,ai_config.py,reviews.py}
+```
+<!-- FILEMAP:END -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moltflow/skills",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "MoltFlow — complete WhatsApp automation platform: sessions, messaging, groups, AI, A2A protocol, reviews, billing.",
   "license": "MIT",
   "private": false,

package/scripts/discover_agent.py

@@ -1,54 +0,0 @@
-#!/usr/bin/env python3
-"""
-A2A Discovery Script
-Fetches and validates the agent.json card.
-"""
-import requests
-import sys
-import json
-import argparse
-from typing import Dict, Any
-
-def discover_agent(base_url: str) -> Dict[str, Any]:
-    """
-    Fetch the .well-known/agent.json from the base URL.
-    """
-    # Ensure URL doesn't end with slash to avoid double slashes
-    url = f"{base_url.rstrip('/')}/.well-known/agent.json"
-    
-    try:
-        response = requests.get(url, timeout=10)
-        response.raise_for_status()
-        
-        data = response.json()
-        
-        # Validation
-        if "supportedInterfaces" not in data:
-            print(f"WARNING: {url} response missing 'supportedInterfaces'.", file=sys.stderr)
-            
-        return data
-        
-    except requests.exceptions.RequestException as e:
-        # Return a structured error for the agent to parse
-        return {
-            "error": True,
-            "message": f"Discovery failed: {str(e)}",
-            "url": url
-        }
-    except json.JSONDecodeError:
-        return {
-            "error": True,
-            "message": "Invalid JSON response from endpoint",
-            "url": url
-        }
-
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Discover MoltFlow Agent capabilities.")
-    parser.add_argument("url", help="Base URL of the agent (e.g., https://api.waiflow.app)")
-    
-    args = parser.parse_args()
-    
-    card = discover_agent(args.url)
-    
-    # Output solely JSON for easy parsing by calling agent
-    print(json.dumps(card, indent=2))