@moxxy/plugin-channel-whatsapp 0.27.0

package/dist/socket.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket.d.ts","sourceRoot":"","sources":["../src/socket.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE3D;;;;;GAKG;AAEH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACnD;AAED,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,YAAY,GAAG,MAAM,GAAG,SAAS,CAAC;IAClE,uEAAuE;IACvE,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;CACpE;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,GAAG,IAAI,CAAC;IACnE,UAAU,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI,CAAC;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnE,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,sDAAsD;IACtD,aAAa,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9D,uEAAuE;IACvE,GAAG,IAAI,IAAI,CAAC;CACb;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;CACxC;AAED,yEAAyE;AACzE,MAAM,MAAM,qBAAqB,GAAG,CAClC,IAAI,EAAE,4BAA4B,KAC/B,OAAO,CAAC,cAAc,CAAC,CAAC;AAE7B;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAMhE;AAED,uFAAuF;AACvF,eAAO,MAAM,aAAa;;;;;CAKhB,CAAC"}

package/dist/socket.js

@@ -0,0 +1,22 @@
+/**
+ * Extract the WhatsApp disconnect status code from a close error (Baileys
+ * throws Boom errors: `err.output.statusCode`). Pure so the reconnect policy is
+ * unit-testable. Returns null when no code can be found (treated as retriable).
+ */
+export function disconnectStatusCode(err) {
+    if (typeof err !== 'object' || err === null)
+        return null;
+    const output = err.output;
+    if (typeof output !== 'object' || output === null)
+        return null;
+    const code = output.statusCode;
+    return typeof code === 'number' && Number.isFinite(code) ? code : null;
+}
+/** WhatsApp disconnect reasons the channel branches on (Baileys' DisconnectReason). */
+export const WA_DISCONNECT = {
+    loggedOut: 401,
+    forbidden: 403,
+    connectionReplaced: 440,
+    restartRequired: 515,
+};
+//# sourceMappingURL=socket.js.map

package/dist/socket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"socket.js","sourceRoot":"","sources":["../src/socket.ts"],"names":[],"mappings":"AAqEA;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,MAAM,GAAI,GAA4B,CAAC,MAAM,CAAC;IACpD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,IAAI,GAAI,MAAmC,CAAC,UAAU,CAAC;IAC7D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,SAAS,EAAE,GAAG;IACd,SAAS,EAAE,GAAG;IACd,kBAAkB,EAAE,GAAG;IACvB,eAAe,EAAE,GAAG;CACZ,CAAC"}

package/package.json

@@ -0,0 +1,99 @@
+{
+  "name": "@moxxy/plugin-channel-whatsapp",
+  "version": "0.27.0",
+  "description": "WhatsApp channel for moxxy via Baileys (UNOFFICIAL WhatsApp Web protocol — violates WhatsApp's Terms of Service; the linked number can be banned, use a secondary number). QR device-link pairing, JID allow-list, voice-note transcription, dedicated isolated runner.",
+  "keywords": [
+    "moxxy",
+    "agent",
+    "channel",
+    "whatsapp",
+    "baileys",
+    "bot"
+  ],
+  "homepage": "https://moxxy.ai",
+  "bugs": {
+    "url": "https://github.com/moxxy-ai/moxxy/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/moxxy-ai/moxxy.git",
+    "directory": "packages/plugin-channel-whatsapp"
+  },
+  "author": "Michal Makowski <michal.makowski97@gmail.com>",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "moxxy": {
+    "plugin": {
+      "entry": "./dist/index.js",
+      "kind": "cli"
+    },
+    "requirements": [
+      {
+        "kind": "plugin",
+        "name": "@moxxy/plugin-vault",
+        "hint": "whatsapp resolves the vault from the service registry for its consent receipt + owner JID + allow-list; @moxxy/plugin-vault must load first"
+      }
+    ],
+    "setup": {
+      "title": "WhatsApp channel (UNOFFICIAL API — read this first)",
+      "description": "This channel uses Baileys, an UNOFFICIAL WhatsApp Web client. Automating a personal account violates WhatsApp's Terms of Service and CAN GET THE PHONE NUMBER PERMANENTLY BANNED. Strongly consider a secondary number. Pairing itself happens later via QR (moxxy whatsapp setup).",
+      "fields": [
+        {
+          "key": "tosAcknowledged",
+          "label": "Type 'yes' to acknowledge the ToS/ban risk (anything else keeps the channel disabled)",
+          "kind": "secret",
+          "vaultKey": "whatsapp_tos_acknowledged",
+          "required": true
+        },
+        {
+          "key": "allowedJids",
+          "label": "Extra allowed WhatsApp JIDs (comma-separated, e.g. 15551234567@s.whatsapp.net) — your own Note-to-Self chat is always allowed",
+          "kind": "string",
+          "required": false,
+          "placeholder": "15551234567@s.whatsapp.net"
+        }
+      ]
+    }
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.4.0",
+    "@whiskeysockets/baileys": "^6.7.21",
+    "qrcode": "^1.5.4",
+    "zod": "^3.24.0",
+    "@moxxy/core": "0.27.0",
+    "@moxxy/channel-kit": "0.27.0",
+    "@moxxy/plugin-vault": "0.27.0",
+    "@moxxy/sdk": "0.27.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "@types/qrcode": "^1.5.5",
+    "typescript": "^5.7.3",
+    "vitest": "^2.1.8",
+    "@moxxy/mode-default": "0.27.0",
+    "@moxxy/testing": "0.0.45",
+    "@moxxy/tsconfig": "0.0.0",
+    "@moxxy/vitest-preset": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist .turbo"
+  }
+}

package/src/auth-state.test.ts

@@ -0,0 +1,103 @@
+import { promises as fs } from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import {
+  createFileAuthStorage,
+  createWhatsAppAuthState,
+  hasStoredCreds,
+  sanitizeAuthKey,
+  type BaileysAuthBridge,
+  type WhatsAppAuthStorage,
+} from './auth-state.js';
+
+// A trivial bridge: identity JSON (no Buffer categories), fresh creds counter.
+function fakeBridge(): BaileysAuthBridge {
+  let n = 0;
+  return {
+    initAuthCreds: () => ({ me: `creds-${n++}` }),
+    BufferJSON: { reviver: (_k, v) => v, replacer: (_k, v) => v },
+  };
+}
+
+describe('sanitizeAuthKey', () => {
+  it('flattens signal key ids into safe filenames', () => {
+    expect(sanitizeAuthKey('pre-key-42')).toBe('pre-key-42');
+    expect(sanitizeAuthKey('session-15551234567:1.0')).toBe('session-15551234567_1.0');
+    expect(sanitizeAuthKey('../escape')).toBe('__escape');
+  });
+});
+
+describe('createWhatsAppAuthState (over an in-memory storage)', () => {
+  function memStorage(): WhatsAppAuthStorage & { map: Map<string, string> } {
+    const map = new Map<string, string>();
+    return {
+      map,
+      async read(k) {
+        return map.get(k) ?? null;
+      },
+      async write(k, v) {
+        map.set(k, v);
+      },
+      async delete(k) {
+        map.delete(k);
+      },
+      async clear() {
+        map.clear();
+      },
+    };
+  }
+
+  it('creates fresh creds when none stored, and persists them via saveCreds', async () => {
+    const storage = memStorage();
+    const { state, saveCreds } = await createWhatsAppAuthState(storage, fakeBridge());
+    expect(state.creds).toEqual({ me: 'creds-0' });
+    await saveCreds();
+    expect(storage.map.has('creds')).toBe(true);
+    expect(await hasStoredCreds(storage)).toBe(true);
+  });
+
+  it('round-trips key set/get and honors null-delete', async () => {
+    const storage = memStorage();
+    const { state } = await createWhatsAppAuthState(storage, fakeBridge());
+    await state.keys.set({ 'pre-key': { '1': { k: 'v' }, '2': { k: 'w' } } });
+    expect(await state.keys.get('pre-key', ['1', '2'])).toEqual({ '1': { k: 'v' }, '2': { k: 'w' } });
+
+    await state.keys.set({ 'pre-key': { '1': null } });
+    expect(await state.keys.get('pre-key', ['1', '2'])).toEqual({ '2': { k: 'w' } });
+  });
+
+  it('reuses stored creds on the next init', async () => {
+    const storage = memStorage();
+    const bridge = fakeBridge();
+    const first = await createWhatsAppAuthState(storage, bridge);
+    await first.saveCreds();
+    const second = await createWhatsAppAuthState(storage, bridge);
+    expect(second.state.creds).toEqual({ me: 'creds-0' });
+  });
+});
+
+describe('createFileAuthStorage', () => {
+  let dir: string;
+  beforeEach(async () => {
+    dir = await fs.mkdtemp(path.join(os.tmpdir(), 'wa-auth-'));
+  });
+  afterEach(async () => {
+    await fs.rm(dir, { recursive: true, force: true });
+  });
+
+  it('writes 0600 files and clears the whole dir', async () => {
+    const storage = createFileAuthStorage(path.join(dir, 'auth'));
+    await storage.write('creds', '{"x":1}');
+    expect(await storage.read('creds')).toBe('{"x":1}');
+    expect(await hasStoredCreds(storage)).toBe(true);
+
+    const file = path.join(dir, 'auth', 'creds.json');
+    const mode = (await fs.stat(file)).mode & 0o777;
+    expect(mode).toBe(0o600);
+
+    await storage.clear();
+    expect(await storage.read('creds')).toBeNull();
+    expect(await hasStoredCreds(storage)).toBe(false);
+  });
+});

package/src/auth-state.ts

@@ -0,0 +1,161 @@
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+
+/**
+ * Baileys auth-state persistence behind a swappable storage adapter.
+ *
+ * Baileys' multi-device auth is a ROTATING key store (signal sessions, pre-keys,
+ * sender keys, app-state sync keys) plus a creds record — dozens of small files
+ * that churn constantly. That churn is why the moxxy VAULT is the wrong home for
+ * it (the vault is an encrypted, tagged, human-curated secret store, not a
+ * high-write key-value backend); instead the state lives in a dedicated
+ * directory under the moxxy home with tight modes (dir 0700, files 0600).
+ * TRADE-OFF (recorded in TECH_DEBT + the PR): unlike vault entries, these files
+ * are NOT encrypted at rest — anyone with file access to the moxxy home can
+ * hijack the linked WhatsApp session. The {@link WhatsAppAuthStorage} interface
+ * exists precisely so an encrypted backend can be swapped in later without
+ * touching the channel.
+ */
+export interface WhatsAppAuthStorage {
+  read(key: string): Promise<string | null>;
+  write(key: string, value: string): Promise<void>;
+  delete(key: string): Promise<void>;
+  /** Wipe the whole store (logout / unpair). */
+  clear(): Promise<void>;
+}
+
+/** Signal key ids contain `/` and `:`; map every key to one safe flat filename. */
+export function sanitizeAuthKey(key: string): string {
+  return key.replace(/[^a-zA-Z0-9._-]/g, '_').replace(/^\.+/, '_');
+}
+
+/**
+ * The default storage backend: one JSON file per key under `dir`, created 0700
+ * with 0600 files so the signal identity is at least owner-only on disk.
+ */
+export function createFileAuthStorage(dir: string): WhatsAppAuthStorage {
+  const fileFor = (key: string): string => path.join(dir, `${sanitizeAuthKey(key)}.json`);
+  const ensureDir = async (): Promise<void> => {
+    await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+  };
+  return {
+    async read(key) {
+      try {
+        return await fs.readFile(fileFor(key), 'utf8');
+      } catch {
+        return null;
+      }
+    },
+    async write(key, value) {
+      await ensureDir();
+      const target = fileFor(key);
+      // Write-then-rename so a crash mid-write can't truncate the creds record;
+      // chmod explicitly because writeFile's mode option is masked by umask.
+      const tmp = `${target}.tmp`;
+      await fs.writeFile(tmp, value, { mode: 0o600 });
+      await fs.chmod(tmp, 0o600);
+      await fs.rename(tmp, target);
+    },
+    async delete(key) {
+      await fs.rm(fileFor(key), { force: true });
+    },
+    async clear() {
+      await fs.rm(dir, { recursive: true, force: true });
+    },
+  };
+}
+
+/** The creds record's storage key (every other key is `<type>-<id>`). */
+const CREDS_KEY = 'creds';
+
+/** True when a linked-device credential record exists (i.e. paired before). */
+export async function hasStoredCreds(storage: WhatsAppAuthStorage): Promise<boolean> {
+  return (await storage.read(CREDS_KEY)) != null;
+}
+
+/**
+ * The tiny slice of Baileys this module needs — injected so unit tests never
+ * import the real package, and so the production wiring (`baileys-socket.ts`)
+ * can hand in the lazily-imported module.
+ */
+export interface BaileysAuthBridge {
+  initAuthCreds(): Record<string, unknown>;
+  readonly BufferJSON: {
+    readonly reviver: (key: string, value: unknown) => unknown;
+    readonly replacer: (key: string, value: unknown) => unknown;
+  };
+  /** `proto.Message.AppStateSyncKeyData.fromObject` — revives that one typed key
+   *  category the way Baileys' own `useMultiFileAuthState` does. Optional so a
+   *  fake bridge in tests can skip it. */
+  readonly reviveAppStateSyncKey?: (value: unknown) => unknown;
+}
+
+export interface WhatsAppAuthState {
+  /** Shaped exactly like Baileys' `AuthenticationState` (creds + keys store). */
+  readonly state: {
+    readonly creds: Record<string, unknown>;
+    readonly keys: {
+      get(type: string, ids: string[]): Promise<Record<string, unknown>>;
+      set(data: Record<string, Record<string, unknown | null>>): Promise<void>;
+    };
+  };
+  /** Persist the creds record; wire to the socket's `creds.update` event. */
+  saveCreds(): Promise<void>;
+}
+
+/**
+ * `useMultiFileAuthState` equivalent over a {@link WhatsAppAuthStorage} — the
+ * same creds + `<type>-<id>` key layout, serialized with Baileys' BufferJSON
+ * (signal keys are raw byte arrays), but with the storage backend swappable.
+ */
+export async function createWhatsAppAuthState(
+  storage: WhatsAppAuthStorage,
+  bridge: BaileysAuthBridge,
+): Promise<WhatsAppAuthState> {
+  const readJson = async (key: string): Promise<unknown> => {
+    const raw = await storage.read(key);
+    if (raw == null) return null;
+    try {
+      return JSON.parse(raw, bridge.BufferJSON.reviver);
+    } catch {
+      return null;
+    }
+  };
+  const writeJson = (key: string, value: unknown): Promise<void> =>
+    storage.write(key, JSON.stringify(value, bridge.BufferJSON.replacer));
+
+  const creds =
+    ((await readJson(CREDS_KEY)) as Record<string, unknown> | null) ?? bridge.initAuthCreds();
+
+  return {
+    state: {
+      creds,
+      keys: {
+        async get(type, ids) {
+          const data: Record<string, unknown> = {};
+          await Promise.all(
+            ids.map(async (id) => {
+              let value = await readJson(`${type}-${id}`);
+              if (type === 'app-state-sync-key' && value != null && bridge.reviveAppStateSyncKey) {
+                value = bridge.reviveAppStateSyncKey(value);
+              }
+              if (value != null) data[id] = value;
+            }),
+          );
+          return data;
+        },
+        async set(data) {
+          const tasks: Promise<void>[] = [];
+          for (const [category, entries] of Object.entries(data)) {
+            for (const [id, value] of Object.entries(entries)) {
+              const key = `${category}-${id}`;
+              tasks.push(value == null ? storage.delete(key) : writeJson(key, value));
+            }
+          }
+          await Promise.all(tasks);
+        },
+      },
+    },
+    saveCreds: () => writeJson(CREDS_KEY, creds),
+  };
+}

package/src/baileys-socket.ts

@@ -0,0 +1,154 @@
+import { createWhatsAppAuthState, type BaileysAuthBridge } from './auth-state.js';
+import type {
+  WaConnectionUpdate,
+  WaMessageKey,
+  WaMessagesUpsert,
+  WaSentMessage,
+  WhatsAppSocket,
+  WhatsAppSocketFactory,
+  WhatsAppSocketLogger,
+} from './socket.js';
+
+/**
+ * The production {@link WhatsAppSocketFactory}: lazily imports Baileys (a heavy
+ * dependency tree — protobufjs, libsignal — that must NOT load at plugin
+ * discovery time, only when the channel actually starts; same lesson as the
+ * desktop-host eager-import boot crash), builds the swappable auth state, and
+ * adapts the socket down to the narrow contract the channel uses.
+ */
+export const openBaileysSocket: WhatsAppSocketFactory = async ({ storage, logger }) => {
+  const baileys = (await import('@whiskeysockets/baileys')) as unknown as BaileysModule;
+  const makeWASocket = baileys.makeWASocket ?? baileys.default?.makeWASocket ?? baileys.default;
+  if (typeof makeWASocket !== 'function') {
+    throw new Error('@whiskeysockets/baileys: could not resolve makeWASocket export');
+  }
+  const proto = baileys.proto ?? baileys.default?.proto;
+  const bridge: BaileysAuthBridge = {
+    initAuthCreds: baileys.initAuthCreds,
+    BufferJSON: baileys.BufferJSON,
+    ...(proto?.Message?.AppStateSyncKeyData
+      ? {
+          reviveAppStateSyncKey: (value: unknown) =>
+            proto.Message!.AppStateSyncKeyData!.fromObject(value as Record<string, unknown>),
+        }
+      : {}),
+  };
+  const { state, saveCreds } = await createWhatsAppAuthState(storage, bridge);
+
+  const sock = makeWASocket({
+    auth: state as never,
+    // The channel renders the QR itself (terminal QR / desktop panel status file).
+    printQRInTerminal: false,
+    logger: silentBaileysLogger() as never,
+    // Don't mark the linked device "online": keeps phone notifications working
+    // and keeps this client's footprint minimal (it is a bot, not a presence).
+    markOnlineOnConnect: false,
+    // No history backfill — the channel only reacts to live inbound messages;
+    // syncing message history would be both wasteful and a privacy liability.
+    syncFullHistory: false,
+    shouldSyncHistoryMessage: () => false,
+    generateHighQualityLinkPreview: false,
+    browser: ['moxxy', 'Desktop', '1.0.0'],
+  });
+  sock.ev.on('creds.update', () => {
+    void saveCreds().catch((err: unknown) => {
+      logger?.warn?.('whatsapp: failed to persist creds update', { err: String(err) });
+    });
+  });
+
+  return adaptBaileysSocket(sock, baileys, logger);
+};
+
+function adaptBaileysSocket(
+  sock: BaileysSock,
+  baileys: BaileysModule,
+  logger?: WhatsAppSocketLogger,
+): WhatsAppSocket {
+  const downloadMediaMessage =
+    baileys.downloadMediaMessage ?? baileys.default?.downloadMediaMessage;
+  return {
+    userJid: () => sock.user?.id ?? null,
+    onConnectionUpdate: (cb) =>
+      sock.ev.on('connection.update', (u: unknown) => cb(u as WaConnectionUpdate)),
+    onMessages: (cb) =>
+      sock.ev.on('messages.upsert', (u: unknown) => cb(u as WaMessagesUpsert)),
+    sendText: async (jid, text) => {
+      const sent = (await sock.sendMessage(jid, { text })) as { key?: WaMessageKey } | undefined;
+      return sent?.key ? ({ key: sent.key } satisfies WaSentMessage) : null;
+    },
+    editText: async (jid, key, text) => {
+      await sock.sendMessage(jid, { text, edit: key });
+    },
+    downloadMedia: async (message) => {
+      if (typeof downloadMediaMessage !== 'function') {
+        throw new Error('@whiskeysockets/baileys: downloadMediaMessage export missing');
+      }
+      const buf = (await downloadMediaMessage(
+        message as never,
+        'buffer',
+        {},
+        { logger: silentBaileysLogger() as never, reuploadRequest: sock.updateMediaMessage },
+      )) as Buffer;
+      return new Uint8Array(buf);
+    },
+    end: () => {
+      try {
+        sock.end(undefined);
+      } catch (err) {
+        logger?.debug?.('whatsapp: socket end threw', { err: String(err) });
+      }
+    },
+  };
+}
+
+/** Minimal Baileys ILogger that swallows everything (moxxy has its own logger). */
+function silentBaileysLogger(): Record<string, unknown> {
+  const noop = (): void => undefined;
+  const self: Record<string, unknown> = {
+    level: 'silent',
+    trace: noop,
+    debug: noop,
+    info: noop,
+    warn: noop,
+    error: noop,
+    fatal: noop,
+  };
+  self.child = () => self;
+  return self;
+}
+
+// ---- Loosely-typed view of the dynamically imported module (the real types
+// stay out so this file compiles without deep Baileys type coupling; the
+// adapter boundary above is the single place the erasure happens). ----
+
+interface BaileysSock {
+  readonly user?: { id: string } | undefined;
+  readonly ev: { on(event: string, cb: (arg: never) => void): void };
+  sendMessage(jid: string, content: Record<string, unknown>): Promise<unknown>;
+  updateMediaMessage: unknown;
+  end(err: Error | undefined): void;
+}
+
+interface BaileysModule {
+  makeWASocket?: (config: Record<string, unknown>) => BaileysSock;
+  initAuthCreds: () => Record<string, unknown>;
+  BufferJSON: BaileysAuthBridge['BufferJSON'];
+  downloadMediaMessage?: (
+    message: never,
+    type: 'buffer',
+    options: Record<string, unknown>,
+    ctx: Record<string, unknown>,
+  ) => Promise<Buffer>;
+  proto?: BaileysProto;
+  default?: {
+    makeWASocket?: (config: Record<string, unknown>) => BaileysSock;
+    downloadMediaMessage?: BaileysModule['downloadMediaMessage'];
+    proto?: BaileysProto;
+  } & ((config: Record<string, unknown>) => BaileysSock);
+}
+
+interface BaileysProto {
+  Message?: {
+    AppStateSyncKeyData?: { fromObject(value: Record<string, unknown>): unknown };
+  };
+}

package/src/channel/turn-runner.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest';
+import {
+  splitWhatsAppText,
+  WHATSAPP_MAX_MESSAGE_CHARS,
+} from './turn-runner.js';
+
+describe('splitWhatsAppText', () => {
+  it('returns a single chunk when under the cap', () => {
+    expect(splitWhatsAppText('hello')).toEqual(['hello']);
+  });
+
+  it('splits on newline boundaries when possible', () => {
+    const a = 'a'.repeat(30);
+    const b = 'b'.repeat(30);
+    const chunks = splitWhatsAppText(`${a}\n${b}`, 40);
+    expect(chunks).toEqual([a, b]);
+  });
+
+  it('never emits a chunk longer than maxLen', () => {
+    const text = 'x'.repeat(WHATSAPP_MAX_MESSAGE_CHARS * 2 + 123);
+    const chunks = splitWhatsAppText(text);
+    expect(chunks.length).toBeGreaterThan(1);
+    for (const c of chunks) expect(c.length).toBeLessThanOrEqual(WHATSAPP_MAX_MESSAGE_CHARS);
+    expect(chunks.join('')).toBe(text);
+  });
+
+  it('hard-splits a single word with no separators', () => {
+    const chunks = splitWhatsAppText('y'.repeat(90), 40);
+    expect(chunks.map((c) => c.length)).toEqual([40, 40, 10]);
+  });
+});