@moxxy/plugin-channel-whatsapp 0.27.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Moxxy (moxxy.ai)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/auth-state.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Baileys auth-state persistence behind a swappable storage adapter.
+ *
+ * Baileys' multi-device auth is a ROTATING key store (signal sessions, pre-keys,
+ * sender keys, app-state sync keys) plus a creds record — dozens of small files
+ * that churn constantly. That churn is why the moxxy VAULT is the wrong home for
+ * it (the vault is an encrypted, tagged, human-curated secret store, not a
+ * high-write key-value backend); instead the state lives in a dedicated
+ * directory under the moxxy home with tight modes (dir 0700, files 0600).
+ * TRADE-OFF (recorded in TECH_DEBT + the PR): unlike vault entries, these files
+ * are NOT encrypted at rest — anyone with file access to the moxxy home can
+ * hijack the linked WhatsApp session. The {@link WhatsAppAuthStorage} interface
+ * exists precisely so an encrypted backend can be swapped in later without
+ * touching the channel.
+ */
+export interface WhatsAppAuthStorage {
+    read(key: string): Promise<string | null>;
+    write(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+    /** Wipe the whole store (logout / unpair). */
+    clear(): Promise<void>;
+}
+/** Signal key ids contain `/` and `:`; map every key to one safe flat filename. */
+export declare function sanitizeAuthKey(key: string): string;
+/**
+ * The default storage backend: one JSON file per key under `dir`, created 0700
+ * with 0600 files so the signal identity is at least owner-only on disk.
+ */
+export declare function createFileAuthStorage(dir: string): WhatsAppAuthStorage;
+/** True when a linked-device credential record exists (i.e. paired before). */
+export declare function hasStoredCreds(storage: WhatsAppAuthStorage): Promise<boolean>;
+/**
+ * The tiny slice of Baileys this module needs — injected so unit tests never
+ * import the real package, and so the production wiring (`baileys-socket.ts`)
+ * can hand in the lazily-imported module.
+ */
+export interface BaileysAuthBridge {
+    initAuthCreds(): Record<string, unknown>;
+    readonly BufferJSON: {
+        readonly reviver: (key: string, value: unknown) => unknown;
+        readonly replacer: (key: string, value: unknown) => unknown;
+    };
+    /** `proto.Message.AppStateSyncKeyData.fromObject` — revives that one typed key
+     *  category the way Baileys' own `useMultiFileAuthState` does. Optional so a
+     *  fake bridge in tests can skip it. */
+    readonly reviveAppStateSyncKey?: (value: unknown) => unknown;
+}
+export interface WhatsAppAuthState {
+    /** Shaped exactly like Baileys' `AuthenticationState` (creds + keys store). */
+    readonly state: {
+        readonly creds: Record<string, unknown>;
+        readonly keys: {
+            get(type: string, ids: string[]): Promise<Record<string, unknown>>;
+            set(data: Record<string, Record<string, unknown | null>>): Promise<void>;
+        };
+    };
+    /** Persist the creds record; wire to the socket's `creds.update` event. */
+    saveCreds(): Promise<void>;
+}
+/**
+ * `useMultiFileAuthState` equivalent over a {@link WhatsAppAuthStorage} — the
+ * same creds + `<type>-<id>` key layout, serialized with Baileys' BufferJSON
+ * (signal keys are raw byte arrays), but with the storage backend swappable.
+ */
+export declare function createWhatsAppAuthState(storage: WhatsAppAuthStorage, bridge: BaileysAuthBridge): Promise<WhatsAppAuthState>;
+//# sourceMappingURL=auth-state.d.ts.map

package/dist/auth-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-state.d.ts","sourceRoot":"","sources":["../src/auth-state.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1C,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,8CAA8C;IAC9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CA8BtE;AAKD,+EAA+E;AAC/E,wBAAsB,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAEnF;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,QAAQ,CAAC,UAAU,EAAE;QACnB,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;QAC3D,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;KAC7D,CAAC;IACF;;4CAEwC;IACxC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CAC9D;AAED,MAAM,WAAW,iBAAiB;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACxC,QAAQ,CAAC,IAAI,EAAE;YACb,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YACnE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;SAC1E,CAAC;KACH,CAAC;IACF,2EAA2E;IAC3E,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,mBAAmB,EAC5B,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CA+C5B"}

package/dist/auth-state.js

@@ -0,0 +1,99 @@
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+/** Signal key ids contain `/` and `:`; map every key to one safe flat filename. */
+export function sanitizeAuthKey(key) {
+    return key.replace(/[^a-zA-Z0-9._-]/g, '_').replace(/^\.+/, '_');
+}
+/**
+ * The default storage backend: one JSON file per key under `dir`, created 0700
+ * with 0600 files so the signal identity is at least owner-only on disk.
+ */
+export function createFileAuthStorage(dir) {
+    const fileFor = (key) => path.join(dir, `${sanitizeAuthKey(key)}.json`);
+    const ensureDir = async () => {
+        await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+    };
+    return {
+        async read(key) {
+            try {
+                return await fs.readFile(fileFor(key), 'utf8');
+            }
+            catch {
+                return null;
+            }
+        },
+        async write(key, value) {
+            await ensureDir();
+            const target = fileFor(key);
+            // Write-then-rename so a crash mid-write can't truncate the creds record;
+            // chmod explicitly because writeFile's mode option is masked by umask.
+            const tmp = `${target}.tmp`;
+            await fs.writeFile(tmp, value, { mode: 0o600 });
+            await fs.chmod(tmp, 0o600);
+            await fs.rename(tmp, target);
+        },
+        async delete(key) {
+            await fs.rm(fileFor(key), { force: true });
+        },
+        async clear() {
+            await fs.rm(dir, { recursive: true, force: true });
+        },
+    };
+}
+/** The creds record's storage key (every other key is `<type>-<id>`). */
+const CREDS_KEY = 'creds';
+/** True when a linked-device credential record exists (i.e. paired before). */
+export async function hasStoredCreds(storage) {
+    return (await storage.read(CREDS_KEY)) != null;
+}
+/**
+ * `useMultiFileAuthState` equivalent over a {@link WhatsAppAuthStorage} — the
+ * same creds + `<type>-<id>` key layout, serialized with Baileys' BufferJSON
+ * (signal keys are raw byte arrays), but with the storage backend swappable.
+ */
+export async function createWhatsAppAuthState(storage, bridge) {
+    const readJson = async (key) => {
+        const raw = await storage.read(key);
+        if (raw == null)
+            return null;
+        try {
+            return JSON.parse(raw, bridge.BufferJSON.reviver);
+        }
+        catch {
+            return null;
+        }
+    };
+    const writeJson = (key, value) => storage.write(key, JSON.stringify(value, bridge.BufferJSON.replacer));
+    const creds = (await readJson(CREDS_KEY)) ?? bridge.initAuthCreds();
+    return {
+        state: {
+            creds,
+            keys: {
+                async get(type, ids) {
+                    const data = {};
+                    await Promise.all(ids.map(async (id) => {
+                        let value = await readJson(`${type}-${id}`);
+                        if (type === 'app-state-sync-key' && value != null && bridge.reviveAppStateSyncKey) {
+                            value = bridge.reviveAppStateSyncKey(value);
+                        }
+                        if (value != null)
+                            data[id] = value;
+                    }));
+                    return data;
+                },
+                async set(data) {
+                    const tasks = [];
+                    for (const [category, entries] of Object.entries(data)) {
+                        for (const [id, value] of Object.entries(entries)) {
+                            const key = `${category}-${id}`;
+                            tasks.push(value == null ? storage.delete(key) : writeJson(key, value));
+                        }
+                    }
+                    await Promise.all(tasks);
+                },
+            },
+        },
+        saveCreds: () => writeJson(CREDS_KEY, creds),
+    };
+}
+//# sourceMappingURL=auth-state.js.map

package/dist/auth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-state.js","sourceRoot":"","sources":["../src/auth-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAyBlC,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACnE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,KAAK,IAAmB,EAAE;QAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,GAAG;YACZ,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK;YACpB,MAAM,SAAS,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,GAAG,GAAG,GAAG,MAAM,MAAM,CAAC;YAC5B,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,SAAS,GAAG,OAAO,CAAC;AAE1B,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA4B;IAC/D,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,IAAI,CAAC;AACjD,CAAC;AAgCD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA4B,EAC5B,MAAyB;IAEzB,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAoB,EAAE;QACvD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,KAAc,EAAiB,EAAE,CAC/D,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAExE,MAAM,KAAK,GACR,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAoC,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;IAE5F,OAAO;QACL,KAAK,EAAE;YACL,KAAK;YACL,IAAI,EAAE;gBACJ,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG;oBACjB,MAAM,IAAI,GAA4B,EAAE,CAAC;oBACzC,MAAM,OAAO,CAAC,GAAG,CACf,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;wBACnB,IAAI,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;wBAC5C,IAAI,IAAI,KAAK,oBAAoB,IAAI,KAAK,IAAI,IAAI,IAAI,MAAM,CAAC,qBAAqB,EAAE,CAAC;4BACnF,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;wBAC9C,CAAC;wBACD,IAAI,KAAK,IAAI,IAAI;4BAAE,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC;oBACtC,CAAC,CAAC,CACH,CAAC;oBACF,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,KAAK,CAAC,GAAG,CAAC,IAAI;oBACZ,MAAM,KAAK,GAAoB,EAAE,CAAC;oBAClC,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;4BAClD,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,EAAE,EAAE,CAAC;4BAChC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;wBAC1E,CAAC;oBACH,CAAC;oBACD,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;aACF;SACF;QACD,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC;KAC7C,CAAC;AACJ,CAAC"}

package/dist/baileys-socket.d.ts

@@ -0,0 +1,10 @@
+import type { WhatsAppSocketFactory } from './socket.js';
+/**
+ * The production {@link WhatsAppSocketFactory}: lazily imports Baileys (a heavy
+ * dependency tree — protobufjs, libsignal — that must NOT load at plugin
+ * discovery time, only when the channel actually starts; same lesson as the
+ * desktop-host eager-import boot crash), builds the swappable auth state, and
+ * adapts the socket down to the narrow contract the channel uses.
+ */
+export declare const openBaileysSocket: WhatsAppSocketFactory;
+//# sourceMappingURL=baileys-socket.d.ts.map

package/dist/baileys-socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baileys-socket.d.ts","sourceRoot":"","sources":["../src/baileys-socket.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAMV,qBAAqB,EAEtB,MAAM,aAAa,CAAC;AAErB;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,qBAyC/B,CAAC"}

package/dist/baileys-socket.js

@@ -0,0 +1,93 @@
+import { createWhatsAppAuthState } from './auth-state.js';
+/**
+ * The production {@link WhatsAppSocketFactory}: lazily imports Baileys (a heavy
+ * dependency tree — protobufjs, libsignal — that must NOT load at plugin
+ * discovery time, only when the channel actually starts; same lesson as the
+ * desktop-host eager-import boot crash), builds the swappable auth state, and
+ * adapts the socket down to the narrow contract the channel uses.
+ */
+export const openBaileysSocket = async ({ storage, logger }) => {
+    const baileys = (await import('@whiskeysockets/baileys'));
+    const makeWASocket = baileys.makeWASocket ?? baileys.default?.makeWASocket ?? baileys.default;
+    if (typeof makeWASocket !== 'function') {
+        throw new Error('@whiskeysockets/baileys: could not resolve makeWASocket export');
+    }
+    const proto = baileys.proto ?? baileys.default?.proto;
+    const bridge = {
+        initAuthCreds: baileys.initAuthCreds,
+        BufferJSON: baileys.BufferJSON,
+        ...(proto?.Message?.AppStateSyncKeyData
+            ? {
+                reviveAppStateSyncKey: (value) => proto.Message.AppStateSyncKeyData.fromObject(value),
+            }
+            : {}),
+    };
+    const { state, saveCreds } = await createWhatsAppAuthState(storage, bridge);
+    const sock = makeWASocket({
+        auth: state,
+        // The channel renders the QR itself (terminal QR / desktop panel status file).
+        printQRInTerminal: false,
+        logger: silentBaileysLogger(),
+        // Don't mark the linked device "online": keeps phone notifications working
+        // and keeps this client's footprint minimal (it is a bot, not a presence).
+        markOnlineOnConnect: false,
+        // No history backfill — the channel only reacts to live inbound messages;
+        // syncing message history would be both wasteful and a privacy liability.
+        syncFullHistory: false,
+        shouldSyncHistoryMessage: () => false,
+        generateHighQualityLinkPreview: false,
+        browser: ['moxxy', 'Desktop', '1.0.0'],
+    });
+    sock.ev.on('creds.update', () => {
+        void saveCreds().catch((err) => {
+            logger?.warn?.('whatsapp: failed to persist creds update', { err: String(err) });
+        });
+    });
+    return adaptBaileysSocket(sock, baileys, logger);
+};
+function adaptBaileysSocket(sock, baileys, logger) {
+    const downloadMediaMessage = baileys.downloadMediaMessage ?? baileys.default?.downloadMediaMessage;
+    return {
+        userJid: () => sock.user?.id ?? null,
+        onConnectionUpdate: (cb) => sock.ev.on('connection.update', (u) => cb(u)),
+        onMessages: (cb) => sock.ev.on('messages.upsert', (u) => cb(u)),
+        sendText: async (jid, text) => {
+            const sent = (await sock.sendMessage(jid, { text }));
+            return sent?.key ? { key: sent.key } : null;
+        },
+        editText: async (jid, key, text) => {
+            await sock.sendMessage(jid, { text, edit: key });
+        },
+        downloadMedia: async (message) => {
+            if (typeof downloadMediaMessage !== 'function') {
+                throw new Error('@whiskeysockets/baileys: downloadMediaMessage export missing');
+            }
+            const buf = (await downloadMediaMessage(message, 'buffer', {}, { logger: silentBaileysLogger(), reuploadRequest: sock.updateMediaMessage }));
+            return new Uint8Array(buf);
+        },
+        end: () => {
+            try {
+                sock.end(undefined);
+            }
+            catch (err) {
+                logger?.debug?.('whatsapp: socket end threw', { err: String(err) });
+            }
+        },
+    };
+}
+/** Minimal Baileys ILogger that swallows everything (moxxy has its own logger). */
+function silentBaileysLogger() {
+    const noop = () => undefined;
+    const self = {
+        level: 'silent',
+        trace: noop,
+        debug: noop,
+        info: noop,
+        warn: noop,
+        error: noop,
+        fatal: noop,
+    };
+    self.child = () => self;
+    return self;
+}
+//# sourceMappingURL=baileys-socket.js.map

package/dist/baileys-socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baileys-socket.js","sourceRoot":"","sources":["../src/baileys-socket.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAA0B,MAAM,iBAAiB,CAAC;AAWlF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA0B,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IACpF,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAA6B,CAAC;IACtF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,OAAO,EAAE,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;IAC9F,IAAI,OAAO,YAAY,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC;IACtD,MAAM,MAAM,GAAsB;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB;YACrC,CAAC,CAAC;gBACE,qBAAqB,EAAE,CAAC,KAAc,EAAE,EAAE,CACxC,KAAK,CAAC,OAAQ,CAAC,mBAAoB,CAAC,UAAU,CAAC,KAAgC,CAAC;aACnF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE5E,MAAM,IAAI,GAAG,YAAY,CAAC;QACxB,IAAI,EAAE,KAAc;QACpB,+EAA+E;QAC/E,iBAAiB,EAAE,KAAK;QACxB,MAAM,EAAE,mBAAmB,EAAW;QACtC,2EAA2E;QAC3E,2EAA2E;QAC3E,mBAAmB,EAAE,KAAK;QAC1B,0EAA0E;QAC1E,0EAA0E;QAC1E,eAAe,EAAE,KAAK;QACtB,wBAAwB,EAAE,GAAG,EAAE,CAAC,KAAK;QACrC,8BAA8B,EAAE,KAAK;QACrC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QAC9B,KAAK,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtC,MAAM,EAAE,IAAI,EAAE,CAAC,0CAA0C,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,SAAS,kBAAkB,CACzB,IAAiB,EACjB,OAAsB,EACtB,MAA6B;IAE7B,MAAM,oBAAoB,GACxB,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACxE,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI;QACpC,kBAAkB,EAAE,CAAC,EAAE,EAAE,EAAE,CACzB,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,EAAE,CAAC,CAAuB,CAAC,CAAC;QAC9E,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CACjB,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,EAAE,CAAC,CAAqB,CAAC,CAAC;QAC1E,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAuC,CAAC;YAC3F,OAAO,IAAI,EAAE,GAAG,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAA2B,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,CAAC;QACD,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACjC,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/B,IAAI,OAAO,oBAAoB,KAAK,UAAU,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,oBAAoB,CACrC,OAAgB,EAChB,QAAQ,EACR,EAAE,EACF,EAAE,MAAM,EAAE,mBAAmB,EAAW,EAAE,eAAe,EAAE,IAAI,CAAC,kBAAkB,EAAE,CACrF,CAAW,CAAC;YACb,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QACD,GAAG,EAAE,GAAG,EAAE;YACR,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,EAAE,KAAK,EAAE,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,SAAS,mBAAmB;IAC1B,MAAM,IAAI,GAAG,GAAS,EAAE,CAAC,SAAS,CAAC;IACnC,MAAM,IAAI,GAA4B;QACpC,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;QACX,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,IAAI;QACX,KAAK,EAAE,IAAI;KACZ,CAAC;IACF,IAAI,CAAC,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/channel/turn-runner.d.ts

@@ -0,0 +1,58 @@
+import type { newTurnId } from '@moxxy/core';
+import type { ClientSession as Session } from '@moxxy/sdk';
+import type { WaMessageKey, WhatsAppSocket } from '../socket.js';
+/**
+ * Streaming strategy (justified against the Baileys API):
+ *
+ * WhatsApp supports true message edits (a MESSAGE_EDIT protocol send —
+ * `sendMessage(jid, { text, edit: key })`, stable in Baileys since 6.5), so the
+ * channel streams the way Telegram/Slack do: send ONE message on the first
+ * frame, then edit it in place — the user watches a single message grow instead
+ * of a flood of partials that can't be assembled. Two WhatsApp-specific
+ * adjustments:
+ *
+ *  - `editFrameMs` defaults to 3000 (vs 1000 elsewhere): every edit is a full
+ *    outbound protocol message, and high-frequency automated edits are exactly
+ *    the anomalous traffic that gets numbers flagged on an UNOFFICIAL client.
+ *    Fewer, chunkier edits keep the visible behavior close to a human editing
+ *    a message. (WhatsApp's ~15-minute edit window is irrelevant at turn scale.)
+ *
+ *  - overflow splitting happens ONLY on the final frame: while streaming, the
+ *    frame is truncated to {@link WHATSAPP_MAX_MESSAGE_CHARS}; the final flush
+ *    edits the streamed message to the first chunk and sends the tail chunks as
+ *    follow-up messages (mirrors Telegram's split-tails). If a FINAL edit fails
+ *    (edit rejected / message gone), the sink falls back to sending the chunks
+ *    as new messages so the reply is never silently lost.
+ */
+export declare const WHATSAPP_MAX_MESSAGE_CHARS = 4000;
+export declare const DEFAULT_EDIT_FRAME_MS = 3000;
+/** Split text into ≤maxLen chunks, preferring newline then space boundaries. */
+export declare function splitWhatsAppText(text: string, maxLen?: number): string[];
+export interface TurnRunnerLogger {
+    warn?(msg: string, meta?: Record<string, unknown>): void;
+}
+export interface RunWhatsAppTurnDeps {
+    readonly session: Session;
+    readonly socket: WhatsAppSocket;
+    readonly editFrameMs: number;
+    /** Record an outbound message id (echo/loop protection in the gate). */
+    readonly recordSentId: (key: WaMessageKey | null | undefined) => void;
+    readonly logger?: TurnRunnerLogger;
+}
+export interface RunWhatsAppTurnOptions {
+    readonly jid: string;
+    readonly text: string;
+    readonly model?: string | undefined;
+    readonly controller: AbortController;
+    /** Pre-minted turn id; the channel records it as an own-turn id (#8). */
+    readonly turnId: ReturnType<typeof newTurnId>;
+}
+/**
+ * Drive a single WhatsApp turn end-to-end: subscribe the frame pump to THIS
+ * turn's events (turnId-filtered — `session.log` fans out to every listener, so
+ * a concurrent turn on the same Session would otherwise stream into this chat,
+ * AGENTS.md invariant #8), run the turn, flush the final frame, unwind in
+ * `finally`.
+ */
+export declare function runWhatsAppTurn(deps: RunWhatsAppTurnDeps, opts: RunWhatsAppTurnOptions): Promise<void>;
+//# sourceMappingURL=turn-runner.d.ts.map

package/dist/channel/turn-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-runner.d.ts","sourceRoot":"","sources":["../../src/channel/turn-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,OAAO,KAAK,EAAE,aAAa,IAAI,OAAO,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEjE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAE1C,gFAAgF;AAChF,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,MAAmC,GAC1C,MAAM,EAAE,CAcV;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,KAAK,IAAI,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC;CAC/C;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwEf"}

package/dist/channel/turn-runner.js

@@ -0,0 +1,130 @@
+import { FramePump, PlainTurnRenderer, driveTurn, subscribeTurn } from '@moxxy/channel-kit';
+/**
+ * Streaming strategy (justified against the Baileys API):
+ *
+ * WhatsApp supports true message edits (a MESSAGE_EDIT protocol send —
+ * `sendMessage(jid, { text, edit: key })`, stable in Baileys since 6.5), so the
+ * channel streams the way Telegram/Slack do: send ONE message on the first
+ * frame, then edit it in place — the user watches a single message grow instead
+ * of a flood of partials that can't be assembled. Two WhatsApp-specific
+ * adjustments:
+ *
+ *  - `editFrameMs` defaults to 3000 (vs 1000 elsewhere): every edit is a full
+ *    outbound protocol message, and high-frequency automated edits are exactly
+ *    the anomalous traffic that gets numbers flagged on an UNOFFICIAL client.
+ *    Fewer, chunkier edits keep the visible behavior close to a human editing
+ *    a message. (WhatsApp's ~15-minute edit window is irrelevant at turn scale.)
+ *
+ *  - overflow splitting happens ONLY on the final frame: while streaming, the
+ *    frame is truncated to {@link WHATSAPP_MAX_MESSAGE_CHARS}; the final flush
+ *    edits the streamed message to the first chunk and sends the tail chunks as
+ *    follow-up messages (mirrors Telegram's split-tails). If a FINAL edit fails
+ *    (edit rejected / message gone), the sink falls back to sending the chunks
+ *    as new messages so the reply is never silently lost.
+ */
+export const WHATSAPP_MAX_MESSAGE_CHARS = 4000;
+export const DEFAULT_EDIT_FRAME_MS = 3000;
+/** Split text into ≤maxLen chunks, preferring newline then space boundaries. */
+export function splitWhatsAppText(text, maxLen = WHATSAPP_MAX_MESSAGE_CHARS) {
+    if (text.length <= maxLen)
+        return [text];
+    const chunks = [];
+    let rest = text;
+    while (rest.length > maxLen) {
+        const window = rest.slice(0, maxLen);
+        let cut = window.lastIndexOf('\n');
+        if (cut < maxLen * 0.5)
+            cut = window.lastIndexOf(' ');
+        if (cut < maxLen * 0.5)
+            cut = maxLen;
+        chunks.push(rest.slice(0, cut));
+        rest = rest.slice(cut).replace(/^[\n ]/, '');
+    }
+    if (rest.length > 0)
+        chunks.push(rest);
+    return chunks;
+}
+/**
+ * Drive a single WhatsApp turn end-to-end: subscribe the frame pump to THIS
+ * turn's events (turnId-filtered — `session.log` fans out to every listener, so
+ * a concurrent turn on the same Session would otherwise stream into this chat,
+ * AGENTS.md invariant #8), run the turn, flush the final frame, unwind in
+ * `finally`.
+ */
+export async function runWhatsAppTurn(deps, opts) {
+    const { session, socket, editFrameMs, recordSentId, logger } = deps;
+    const { jid, text, model, controller, turnId } = opts;
+    const renderer = new PlainTurnRenderer();
+    const sendChunks = async (chunks) => {
+        let firstKey = null;
+        for (const chunk of chunks) {
+            try {
+                const sent = await socket.sendText(jid, chunk);
+                recordSentId(sent?.key);
+                if (!firstKey && sent?.key)
+                    firstKey = sent.key;
+            }
+            catch (err) {
+                logger?.warn?.('whatsapp send failed', { err: String(err) });
+            }
+        }
+        return firstKey;
+    };
+    const pump = new FramePump({
+        editFrameMs,
+        frame: (final) => {
+            const snapshot = renderer.snapshot();
+            if (final || snapshot.length <= WHATSAPP_MAX_MESSAGE_CHARS)
+                return snapshot;
+            // Streaming frame: hold to one editable message; overflow waits for the
+            // final flush, whose full text differs from this so a last flush is
+            // guaranteed to deliver the tails.
+            return `${snapshot.slice(0, WHATSAPP_MAX_MESSAGE_CHARS - 1)}…`;
+        },
+        emptyFinalText: '(no output)',
+        sink: {
+            send: async (t) => sendChunks(splitWhatsAppText(t)),
+            edit: async (key, t, final) => {
+                const chunks = splitWhatsAppText(t);
+                try {
+                    await socket.editText(jid, key, chunks[0]);
+                }
+                catch (err) {
+                    logger?.warn?.('whatsapp edit failed', { err: String(err), final });
+                    if (final) {
+                        // Never lose the final reply to a failed edit — resend it whole.
+                        await sendChunks(chunks);
+                        return;
+                    }
+                    return;
+                }
+                if (final && chunks.length > 1)
+                    await sendChunks(chunks.slice(1));
+            },
+        },
+    });
+    const unsubscribe = subscribeTurn(session, turnId, (event) => {
+        if (renderer.accept(event))
+            pump.scheduleEdit();
+    });
+    try {
+        await driveTurn(session, {
+            turnId,
+            prompt: text,
+            ...(model ? { model } : {}),
+            signal: controller.signal,
+        });
+        await pump.flush(true);
+    }
+    catch (err) {
+        logger?.warn?.('whatsapp turn failed', {
+            err: err instanceof Error ? err.message : String(err),
+        });
+        await sendChunks([`Turn failed: ${err instanceof Error ? err.message : String(err)}`]);
+    }
+    finally {
+        unsubscribe();
+        pump.dispose();
+    }
+}
+//# sourceMappingURL=turn-runner.js.map

package/dist/channel/turn-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turn-runner.js","sourceRoot":"","sources":["../../src/channel/turn-runner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAI5F;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAE1C,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,SAAiB,0BAA0B;IAE3C,IAAI,IAAI,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,OAAO,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG;YAAE,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,GAAG,GAAG,MAAM,GAAG,GAAG;YAAE,GAAG,GAAG,MAAM,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAChC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO,MAAM,CAAC;AAChB,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAyB,EACzB,IAA4B;IAE5B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACpE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAEtD,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAC;IAEzC,MAAM,UAAU,GAAG,KAAK,EAAE,MAA6B,EAAgC,EAAE;QACvF,IAAI,QAAQ,GAAwB,IAAI,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAC/C,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACxB,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,GAAG;oBAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,EAAE,IAAI,EAAE,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,SAAS,CAAe;QACvC,WAAW;QACX,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,0BAA0B;gBAAE,OAAO,QAAQ,CAAC;YAC5E,wEAAwE;YACxE,oEAAoE;YACpE,mCAAmC;YACnC,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,0BAA0B,GAAG,CAAC,CAAC,GAAG,CAAC;QACjE,CAAC;QACD,cAAc,EAAE,aAAa;QAC7B,IAAI,EAAE;YACJ,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;gBAC9C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,EAAE,IAAI,EAAE,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;oBACpE,IAAI,KAAK,EAAE,CAAC;wBACV,iEAAiE;wBACjE,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;wBACzB,OAAO;oBACT,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACpE,CAAC;SACF;KACF,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;QAC3D,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,OAAO,EAAE;YACvB,MAAM;YACN,MAAM,EAAE,IAAI;YACZ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,CAAC,sBAAsB,EAAE;YACrC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,CAAC,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACzF,CAAC;YAAS,CAAC;QACT,WAAW,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;AACH,CAAC"}

package/dist/channel/voice-handler.d.ts

@@ -0,0 +1,27 @@
+import type { ClientSession as Session } from '@moxxy/sdk';
+import type { WaInboundMessage, WhatsAppSocket } from '../socket.js';
+export interface VoiceHandlerDeps {
+    readonly session: Session;
+    readonly socket: WhatsAppSocket;
+    /** Reply into the originating chat (records sent ids for echo protection). */
+    readonly reply: (jid: string, text: string) => Promise<void>;
+    readonly logger?: {
+        warn?(msg: string, meta?: Record<string, unknown>): void;
+    };
+}
+export interface VoiceHandlerInput {
+    readonly jid: string;
+    readonly mimeType: string;
+    /** The raw upsert message — Baileys needs it to decrypt/download the media. */
+    readonly raw: WaInboundMessage;
+}
+/**
+ * Handle an inbound voice note / audio message that already passed the gate
+ * (pairing + allow-list + declared-size cap): require an active Transcriber
+ * (guidance reply when none — mirror of the Telegram voice handler), download
+ * via Baileys' media pipeline, re-check the size cap on the REAL bytes, then
+ * transcribe. Returns the transcript for the caller to run as a normal user
+ * turn, or null when the message was fully handled (guidance/error reply sent).
+ */
+export declare function transcribeVoiceMessage(deps: VoiceHandlerDeps, input: VoiceHandlerInput): Promise<string | null>;
+//# sourceMappingURL=voice-handler.d.ts.map

package/dist/channel/voice-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"voice-handler.d.ts","sourceRoot":"","sources":["../../src/channel/voice-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,IAAI,OAAO,EAAE,MAAM,YAAY,CAAC;AAE3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;KAAE,CAAC;CAChF;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoDxB"}

package/dist/channel/voice-handler.js

@@ -0,0 +1,55 @@
+import { MAX_AUDIO_BYTES } from '../message-gate.js';
+/**
+ * Handle an inbound voice note / audio message that already passed the gate
+ * (pairing + allow-list + declared-size cap): require an active Transcriber
+ * (guidance reply when none — mirror of the Telegram voice handler), download
+ * via Baileys' media pipeline, re-check the size cap on the REAL bytes, then
+ * transcribe. Returns the transcript for the caller to run as a normal user
+ * turn, or null when the message was fully handled (guidance/error reply sent).
+ */
+export async function transcribeVoiceMessage(deps, input) {
+    const { session, socket, reply, logger } = deps;
+    const { jid, mimeType, raw } = input;
+    const transcriber = session.transcribers.tryGetActive();
+    if (!transcriber) {
+        await reply(jid, 'Heard a voice note, but no speech-to-text backend is configured. Install ' +
+            '@moxxy/plugin-stt-whisper and run `moxxy login openai` (or set OPENAI_API_KEY) ' +
+            'to enable voice input.');
+        return null;
+    }
+    let bytes;
+    try {
+        bytes = await socket.downloadMedia(raw);
+    }
+    catch (err) {
+        logger?.warn?.('whatsapp voice download failed', {
+            err: err instanceof Error ? err.message : String(err),
+        });
+        await reply(jid, 'Could not download that voice note.');
+        return null;
+    }
+    if (bytes.byteLength > MAX_AUDIO_BYTES) {
+        await reply(jid, `That audio is too large to transcribe (limit ${MAX_AUDIO_BYTES / (1024 * 1024)}MB).`);
+        return null;
+    }
+    let transcript;
+    try {
+        transcript = (await transcriber.transcribe(bytes, { mimeType })).text.trim();
+    }
+    catch (err) {
+        logger?.warn?.('whatsapp voice transcription failed', {
+            err: err instanceof Error ? err.message : String(err),
+        });
+        await reply(jid, `Transcription failed: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+    if (!transcript) {
+        await reply(jid, 'Could not transcribe the voice note (got empty text).');
+        return null;
+    }
+    // Echo what was heard so the user can spot misrecognitions before the agent
+    // acts on it (same contract as the Telegram voice handler).
+    await reply(jid, `heard: ${transcript}`);
+    return transcript;
+}
+//# sourceMappingURL=voice-handler.js.map

package/dist/channel/voice-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"voice-handler.js","sourceRoot":"","sources":["../../src/channel/voice-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAkBrD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAsB,EACtB,KAAwB;IAExB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IAErC,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,KAAK,CACT,GAAG,EACH,2EAA2E;YACzE,iFAAiF;YACjF,wBAAwB,CAC3B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,CAAC,gCAAgC,EAAE;YAC/C,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,GAAG,eAAe,EAAE,CAAC;QACvC,MAAM,KAAK,CACT,GAAG,EACH,gDAAgD,eAAe,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,CAAC,MAAM,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,IAAI,EAAE,CAAC,qCAAqC,EAAE;YACpD,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,KAAK,CAAC,GAAG,EAAE,uDAAuD,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,KAAK,CAAC,GAAG,EAAE,UAAU,UAAU,EAAE,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC;AACpB,CAAC"}