@softtynet/zca-js 2.2.7 → 2.2.8

package/README.md

@@ -1,54 +1,72 @@
-# ZCA-JS (Forked Version)
+# @softtynet/zca-js — Softtynet Zalo API SDK for Node.js & Bun
 
-> [!NOTE]
-> **This is a forked version of the original [zca-js](https://github.com/RFS-ADRENO/zca-js) project by RFS-ADRENO.** This package (`@softtynet/zca-js`) is maintained separately for quick hotfixes.
-> 
-> This is an unofficial Zalo API for personal account. It work by simulating the browser to interact with Zalo Web.
+<p align="left">
+  <a href="https://www.npmjs.com/package/@softtynet/zca-js"><img src="https://img.shields.io/npm/v/@softtynet/zca-js.svg?label=%40softtynet%2Fzca-js&color=0068ff" alt="npm version" /></a>
+  <a href="https://github.com/softtyos/zca-js"><img src="https://img.shields.io/badge/Maintained%20by-Softtynet%20Co.%2C%20Ltd.-0a7cff" alt="Maintained by Softtynet" /></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-green.svg" alt="License: MIT" /></a>
+</p>
+
+**`@softtynet/zca-js`** là bộ thư viện Zalo API nâng cao dành cho Node.js / TypeScript / Bun, được phát triển, tối ưu hoá và duy trì bởi **Softtynet Co., Ltd.** nhằm đáp ứng các bài toán tích hợp chuyên sâu: **Đồng bộ dữ liệu đa thiết bị (Offline Catch-up & Mobile Backup Sync `ZDB4.0`)**, **Tín hiệu Gọi Thoại & Gọi Video (Voice / Video Call Signaling)**, và **Xử lý WebSocket thời gian thực độ tin cậy cao**.
 
 > [!WARNING]
-> Using this API could get your account locked or banned. We are not responsible for any issues that may happen. Use it at your own risk.
+> Đây là thư viện tương tác không chính thức thông qua giao thức Zalo Web / Zalo PC dành cho tài khoản cá nhân. Vui lòng sử dụng có trách nhiệm và tuân thủ quy định an toàn tài khoản.
+
+---
+
+## Mục lục
+
+- [Điểm nổi bật trên phiên bản Softtynet (`@softtynet/zca-js`)](#-điểm-nổi-bật-trên-phiên-bản-softtynet-softtynetzca-js)
+- [Cài đặt](#-cài-đặt)
+- [Tài liệu chuyên sâu](#-tài-liệu-chuyên-sâu)
+- [Hướng dẫn sử dụng nhanh](#-hướng-dẫn-sử-dụng-nhanh)
+  - [1. Đăng nhập & Lưu phiên](#1-đăng-nhập--lưu-phiên)
+  - [2. Lắng nghe tin nhắn thời gian thực](#2-lắng-nghe-tin-nhắn-thời-gian-thực)
+  - [3. Đồng bộ bù tin nhắn khi Offline (Catch-up Sync)](#3-đồng-bộ-bù-tin-nhắn-khi-offline-catch-up-sync)
+  - [4. Đồng bộ lịch sử sao lưu từ Điện thoại (`ZDB4.0`)](#4-đồng-bộ-lịch-sử-sao-lưu-từ-điện-thoại-zdb40)
+  - [5. Khởi tạo Cuộc gọi Thoại & Gọi Video](#5-khởi-tạo-cuộc-gọi-thoại--gọi-video)
+  - [6. Gửi tin nhắn & Sticker](#6-gửi-tin-nhắn--sticker)
+- [Kiểm định & Chạy thử nghiệm](#-kiểm-định--chạy-thử-nghiệm)
+- [Nguồn gốc & Ghi nhận (Credits & Attribution)](#-nguồn-gốc--ghi-nhận-credits--attribution)
+- [Giấy phép (License)](#-giấy-phép-license)
 
 ---
 
-## Table of Contents
-
--   [Installation](#installation)
-    - [Migrate to V2](#migrate-to-v2)
--   [Documentation](#documentation)
--   [Basic Usages](#basic-usages)
-    -   [Login](#login)
-    -   [Listen for new messages](#listen-for-new-messages)
-    -   [Synchronize Messages from Mobile](#synchronize-messages-from-mobile)
-    -   [Send a message](#send-a-message)
-    -   [Get/Send a sticker](#getsend-a-sticker)
--   [Example](#example)
--   [Projects & Useful Resources](#projects--useful-resources)
--   [Contributing](#contributing)
--   [License](#license)
--   [Support Us](#support-us)
-
-## Installation
+## 🚀 Điểm nổi bật trên phiên bản Softtynet (`@softtynet/zca-js`)
+
+So với phiên bản cộng đồng tiêu chuẩn, **`@softtynet/zca-js`** bổ sung các phân hệ cốt lõi đã được kiểm định trực tiếp trên máy chủ Zalo thật:
+
+| Phân hệ | Tính năng trên `@softtynet/zca-js` |
+| :--- | :--- |
+| **Đồng bộ bù khi Offline (Catch-up Sync)** | Hỗ trợ [`api.preloadConversations()`](src/apis/preloadConversations.ts) (`cmd 10053`), kéo hàng đợi tin nhắn cá nhân & nhóm qua [`api.listener.requestOldMessages()`](src/apis/listen.ts) (`cmd 510` / `511`, cả `subCmd 0` & `1`), kèm cờ phân trang `hasMore`, tách biệt sự kiện thu hồi `undo` và đồng bộ trạng thái đã đọc `unread_cleared` (`cmd 504` / `524`). |
+| **Đồng bộ sao lưu từ Điện thoại (`ZDB4.0`)** | Hỗ trợ trọn vẹn chu trình [`api.requestSyncFromPhone()`](src/apis/requestSyncFromPhone.ts) (`cmd 12000`), [`api.cancelPullMobile()`](src/apis/cancelPullMobile.ts) (`cmd 12700`), sự kiện `sync_event` (`user_confirm`, `syncmsg_info`, `transfer_after_login`), tải gói `.db.crypt` qua [`api.getSyncData()`](src/apis/getSyncData.ts) và giải mã RSA-2048 PKCS#1 v1.5 + AES-256-CBC đa khối 64KB + đọc mục lục SQLite (`parseZdbHeader`). |
+| **Ánh xạ ID ẩn danh (Noised / Global ID)** | Hỗ trợ [`api.getNoisedIds()`](src/apis/getNoisedIds.ts) (`cmd 12390` kèm cơ chế tự động fallback sang `zwid.api.zalo.me`) và [`api.decryptGids()`](src/apis/decryptGids.ts) (`cmd 12054`) để ánh xạ tên file SQLite `3_<me>_<peer>.db` về User ID / Group ID thật. |
+| **Gọi Thoại & Gọi Video (Signaling 2 bước)** | Hỗ trợ [`api.sendVoiceCall()`](src/apis/sendVoiceCall.ts) (`cmd 11300` + `11301`), [`api.cancelVoiceCall()`](src/apis/cancelVoiceCall.ts) (`cmd 11305`), [`api.endVoiceCall()`](src/apis/endVoiceCall.ts) (`cmd 11306`) và sự kiện `call_event` chuẩn giao thức C++ `ZaloCall` cho cả **Gọi Thoại (`CallType.Audio = 1`)** lẫn **Gọi Video (`CallType.Video = 3`, H.264)**. |
+| **Độ ổn định & Bảo vệ bộ nhớ** | Tự động giải phóng bộ nhớ `uploadCallbacks` sau 5 phút trong [`uploadAttachment`](src/apis/uploadAttachment.ts), xử lý phản hồi rỗng hợp lệ (`error_code === 0, data === ""`) và bảo toàn độ chính xác chuỗi UID 19 chữ số. |
+
+---
+
+## 📦 Cài đặt
 
 ```bash
-bun add zca-js # or npm install zca-js
+npm install @softtynet/zca-js
+# hoặc dùng Bun
+bun add @softtynet/zca-js
 ```
 
-### Migrate to V2
+### Cấu hình `imageMetadataGetter` (Khi gửi ảnh từ đường dẫn file)
 
-Since official version 2.0.0, `zca-js` has removed sharp dependency for image metadata extraction. It now requires users to provide their own `imageMetadataGetter` function when initializing the `Zalo` class if they want to send images/gifs by file path.
-
-Example of custom `imageMetadataGetter` using `sharp`:
+Từ kiến trúc V2, thư viện tách rời phụ thuộc xử lý ảnh để giữ dung lượng gọn nhẹ. Nếu ứng dụng của bạn gửi ảnh/GIF từ file nội bộ, hãy truyền hàm `imageMetadataGetter` (ví dụ dùng `sharp`):
 
 ```bash
-bun add sharp # or npm install sharp
+npm install sharp
 ```
 
-```javascript
-import { Zalo } from "zca-js";
+```ts
+import { Zalo } from "@softtynet/zca-js";
 import sharp from "sharp";
 import fs from "node:fs";
 
-async function imageMetadataGetter(filePath) {
+async function imageMetadataGetter(filePath: string) {
     const data = await fs.promises.readFile(filePath);
     const metadata = await sharp(data).metadata();
     return {
@@ -58,80 +76,75 @@ async function imageMetadataGetter(filePath) {
     };
 }
 
-const zalo = new Zalo({
-    imageMetadataGetter,
-});
+const zalo = new Zalo({ imageMetadataGetter });
 ```
 
 ---
 
-## Documentation
+## 📚 Tài liệu chuyên sâu
 
-- [API Documentation](https://zca-js.tdung.com)
-- [Hướng dẫn Tích hợp: Đồng bộ Tin nhắn Đa Thiết bị (`ZDB4.0`) & Gọi Thoại / Video](docs/INTEGRATION_GUIDE_SYNC_AND_CALL.md)
-- [Kế hoạch & Hướng dẫn Dịch ngược Zalo bằng REA (`morluto/rea`)](docs/REA_REVERSE_ENGINEERING_PLAN.md)
+- **[Hướng dẫn Tích hợp: Đồng bộ Tin nhắn Đa Thiết bị (`ZDB4.0`) & Gọi Thoại / Video](docs/INTEGRATION_GUIDE_SYNC_AND_CALL.md)** — Tài liệu đầy đủ kèm sơ đồ kiến trúc và code mẫu tích hợp thực tế của Softtynet.
+- **[Kế hoạch & Hướng dẫn Dịch ngược Zalo bằng REA (`morluto/rea`)](docs/REA_REVERSE_ENGINEERING_PLAN.md)** — Tài liệu quy trình phân tích tĩnh Binary C++ (`ZaloCall`, `libzdatabase.dylib`) và ASAR.
+- **[API Reference Cơ bản](https://zca-js.tdung.com)** — Tra cứu danh mục các API cơ bản.
 
 ---
 
-## Basic Usages
+## ⚡ Hướng dẫn sử dụng nhanh
 
-### Login
+### 1. Đăng nhập & Lưu phiên
 
-```javascript
-import { Zalo } from "zca-js";
+```ts
+import { Zalo } from "@softtynet/zca-js";
 
-const zalo = new Zalo();
+const zalo = new Zalo({ selfListen: true });
 const api = await zalo.loginQR();
+console.log("Đã đăng nhập với UID:", api.getOwnId());
 ```
 
-### Listen for new messages
+### 2. Lắng nghe tin nhắn thời gian thực
 
-```javascript
-import { Zalo, ThreadType } from "zca-js";
+```ts
+import { Zalo, ThreadType } from "@softtynet/zca-js";
 
-const zalo = new Zalo();
+const zalo = new Zalo({ selfListen: true });
 const api = await zalo.loginQR();
 
 api.listener.on("message", (message) => {
     const isPlainText = typeof message.data.content === "string";
+    if (!isPlainText) return;
 
-    switch (message.type) {
-        case ThreadType.User: {
-            if (isPlainText) {
-                // received plain text direct message
-            }
-            break;
-        }
-        case ThreadType.Group: {
-            if (isPlainText) {
-                // received plain text group message
-            }
-            break;
-        }
+    if (message.type === ThreadType.User) {
+        console.log(`[Cá nhân] ${message.data.dName}: ${message.data.content}`);
+    } else if (message.type === ThreadType.Group) {
+        console.log(`[Nhóm ${message.threadId}] ${message.data.dName}: ${message.data.content}`);
     }
 });
 
-api.listener.start();
+api.listener.start({ retryOnClose: true });
 ```
 
 > [!IMPORTANT]
-> Only one web listener can run per account at a time. If you open Zalo in the browser while the listener is active, the listener will be automatically stopped.
+> Mỗi tài khoản Zalo chỉ duy trì một kết nối WebSocket Web tại một thời điểm. Nếu bạn mở thêm tab Zalo Web trên trình duyệt, kết nối WebSocket cũ sẽ nhận sự kiện `duplicate_connection`.
 
-### Synchronize Messages & Offline Catch-up
+### 3. Đồng bộ bù tin nhắn khi Offline (Catch-up Sync)
 
-`zca-js` supports both **offline message catch-up** (when reconnecting or restarting your app) and **full mobile backup synchronization** (`ZDB4.0`) from the Zalo mobile app:
-
-#### 1. Catch Up Missed Messages After Reconnect / Restart
-```javascript
-import { Zalo, ThreadType } from "zca-js";
+```ts
+import { ThreadType } from "@softtynet/zca-js";
 
+// 1. Lấy nhanh các tin nhắn mới nhất & danh sách đã đọc qua HTTP (cmd 10053)
 const preload = await api.preloadConversations();
-console.log(`Preloaded ${preload.messages.length} latest messages`);
+console.log(`Preloaded: ${preload.messages.length} tin nhắn, ${preload.unreadCleared.length} trạng thái đã đọc`);
 
+// 2. Nhận tin nhắn từ hàng đợi WebSocket (cmd 510 & 511)
 api.listener.on("old_messages", (messages, type, hasMore) => {
-    console.log(`Received ${messages.length} queued offline messages (type=${type}, hasMore=${hasMore})`);
+    console.log(`Nhận ${messages.length} tin nhắn cũ (type=${type}, hasMore=${hasMore})`);
+    if (hasMore && messages.length > 0) {
+        const lastMsgId = messages[messages.length - 1].data.msgId;
+        api.listener.requestOldMessages(type, lastMsgId);
+    }
 });
 
+// 3. Kích hoạt kéo hàng đợi ngay khi nhận khoá giải mã WebSocket
 api.listener.on("cipher_key", () => {
     api.listener.requestOldMessages(ThreadType.User);
     api.listener.requestOldMessages(ThreadType.Group);
@@ -140,155 +153,122 @@ api.listener.on("cipher_key", () => {
 api.listener.start({ retryOnClose: true });
 ```
 
-#### 2. Trigger Mobile Backup Sync (`pull_mobile_msg`)
-```javascript
-import { SyncEventType, decryptWithPrivateKey, deriveZdbAesKey, decryptZdbBuffer } from "zca-js";
+### 4. Đồng bộ lịch sử sao lưu từ Điện thoại (`ZDB4.0`)
+
+```ts
+import fs from "node:fs";
+import {
+    SyncEventType,
+    decryptWithPrivateKey,
+    deriveZdbAesKey,
+    decryptZdbBuffer,
+    parseZdbHeader,
+} from "@softtynet/zca-js";
 
 let privateKey = "";
 
 api.listener.on("sync_event", async (event) => {
     if (event.type === SyncEventType.USER_CONFIRM) {
-        console.log("User confirmed sync on phone, waiting for backup upload...");
+        console.log("Người dùng đã bấm xác nhận trên điện thoại, đang chờ tải gói sao lưu...");
     } else if (event.type === SyncEventType.SYNCMSG_INFO) {
         const res = await api.getSyncData({ ...event.data, savePath: "./sync_data" });
         if (res.success && res.data && privateKey) {
             const rawRsa = decryptWithPrivateKey(privateKey, res.data.encrypted_key);
             const aesKey = deriveZdbAesKey(rawRsa);
-            console.log("Downloaded backup:", res.data.file_path, "AES key length:", aesKey.length);
+            const zdbPlain = decryptZdbBuffer(fs.readFileSync(res.data.file_path), aesKey);
+            const toc = parseZdbHeader(zdbPlain);
+            console.log(`Giải mã thành công ZDB4.0 (${toc.entries.length} hội thoại SQLite):`, toc.entries.slice(0, 5));
         }
     }
 });
 
-api.listener.on("connected", async () => {
-    const session = await api.requestSyncFromPhone();
+api.listener.on("cipher_key", async () => {
+    const session = await api.requestSyncFromPhone({ pcName: "Web" });
     privateKey = session.privateKey;
-    console.log("Please tap 'Sync now' on your phone!");
+    console.log("Vui lòng mở điện thoại và bấm 'Đồng bộ ngay' trên thông báo Zalo!");
 });
-
-api.listener.start();
 ```
 
-### Voice / Video Call Signaling
+### 5. Khởi tạo Cuộc gọi Thoại & Gọi Video
 
-```javascript
-import { CallType } from "zca-js";
+```ts
+import { CallType } from "@softtynet/zca-js";
 
-// Ring a user's phone (Audio or Video call)
-const call = await api.sendVoiceCall("target_user_id", { callType: CallType.Audio });
-console.log("Ringing callId:", call.callId, "session:", call.sessId);
-
-// Cancel ringing or end an active call
-await api.cancelVoiceCall("target_user_id", call.callId);
-```
+const targetUid = "5249661060655759359"; // Chuỗi UID 19 chữ số
 
-### Send a message
-
-```javascript
-import { Zalo, ThreadType } from "zca-js";
-
-const zalo = new Zalo();
-const api = await zalo.loginQR();
+// Gọi Video (CallType.Video = 3, tự động đính kèm H.264 payload 97)
+const videoCall = await api.sendVoiceCall(targetUid, {
+    callType: CallType.Video,
+});
+console.log("Đang đổ chuông Video:", videoCall.callId, videoCall.rtpServer);
 
-// Echo bot
-api.listener.on("message", (message) => {
-    const isPlainText = typeof message.data.content === "string";
-    if (message.isSelf || !isPlainText) return;
-
-    switch (message.type) {
-        case ThreadType.User: {
-            api.sendMessage(
-                {
-                    msg: "echo: " + message.data.content,
-                    quote: message.data, // the message to reply to (optional)
-                },
-                message.threadId,
-                message.type, // ThreadType.User
-            );
-            break;
-        }
-        case ThreadType.Group: {
-            api.sendMessage(
-                {
-                    msg: "echo: " + message.data.content,
-                    quote: message.data, // the message to reply to (optional)
-                },
-                message.threadId,
-                message.type, // ThreadType.Group
-            );
-            break;
-        }
-    }
+// Huỷ cuộc gọi khi đang đổ chuông
+await api.cancelVoiceCall(targetUid, videoCall.callId, {
+    callType: CallType.Video,
 });
 
-api.listener.start();
+// Hoặc gọi Thoại (CallType.Audio = 1)
+const audioCall = await api.sendVoiceCall(targetUid, {
+    callType: CallType.Audio,
+});
+await api.cancelVoiceCall(targetUid, audioCall.callId);
 ```
 
-### Get/Send a sticker
-
-```javascript
-api.getStickers("hello").then(async (stickerIds) => {
-    // Get the first sticker
+### 6. Gửi tin nhắn & Sticker
+
+```ts
+// Trả lời tin nhắn văn bản
+await api.sendMessage(
+    {
+        msg: "Xin chào từ hệ thống Softtynet!",
+        quote: message.data,
+    },
+    message.threadId,
+    message.type,
+);
+
+// Tìm và gửi Sticker
+const stickerIds = await api.getStickers("xin chào");
+if (stickerIds.length > 0) {
     const stickerObject = await api.getStickersDetail(stickerIds[0]);
-    api.sendMessageSticker(
-        stickerObject,
-        message.threadId,
-        message.type, // ThreadType.User or ThreadType.Group
-    );
-});
+    await api.sendMessageSticker(stickerObject, message.threadId, message.type);
+}
 ```
 
 ---
 
-## Example
-
-See [examples](examples) folder for more details.
-
----
+## 🧪 Kiểm định & Chạy thử nghiệm
 
-## Projects & Useful Resources
+Dự án đi kèm bộ kiểm định 2 lớp trong thư mục [`test/`](test):
 
-<div align="center">
+1. **Kiểm định tự động (Offline / Unit Verification Suite)**:
+   ```bash
+   npm run test:verify
+   ```
+   Kiểm tra tự động toàn bộ 6 hạng mục: `preloadConversations`, `requestSyncFromPhone` / `pullMobile` / `cancelPullMobile`, `getNoisedIds` / `decryptGids`, giải mã `RSA-2048` + `ZDB4.0` đa khối 64KB, `sendVoiceCall` (Audio & Video) / `cancelVoiceCall` / `endVoiceCall`, và các sự kiện WebSocket (`510`, `511`, `504`, `601`).
 
-| Repository | Description |
-|    :---    |    :---     |
-| [**ZaloDataExtractor**](https://github.com/JustKemForFun/ZaloDataExtractor) | A browser `Extension` to extract IMEI, cookies, and user agent from Zalo Web. |
-| [**MultiZlogin**](https://github.com/ChickenAI/multizlogin) | A multi-account Zalo management system that lets you log in to and manage multiple accounts simultaneously, with proxy and webhook integration. |
-| [**n8n-nodes-zalo-tools**](https://github.com/ChickenAI/zalo-node) | N8N node for personal Zalo account. |
-| [**Zalo-F12**](https://github.com/ElectroHeavenVN/Zalo-F12) | A collection of JavaScript code snippets to paste into DevTools to change how Zalo Web/PC works. |
-| [**Zalo-F12-Tools**](https://github.com/JustKemForFun/Zalo-F12-Tools) | Toggle hidden modes for Zalo Web. |
+2. **Kiểm định trực tiếp trên tài khoản Zalo thật (Live Verification Suite)**:
+   ```bash
+   # Chạy toàn bộ 6 bước (Quét QR -> Preload -> ZNoise -> OldMessages -> Đồng bộ ZDB4.0 từ ĐT -> Voice/Video Call)
+   npm run test:live
 
-</div>
+   # Chỉ test nhanh Gọi Thoại + Gọi Video tới 1 UID bạn bè
+   npm run test:live -- --only-call --call <UID_BAN_BE>
+   ```
 
 ---
 
-## Contributing
-
-We welcome contributions from the community! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details on how to:
-
-- 🐛 Report bugs and issues
-- ✨ Suggest new features
-- 🔧 Submit code contributions
-- 📚 Improve documentation
-- 🧪 Add or improve tests
-- 🔒 Report security vulnerabilities
+## 🤝 Nguồn gốc & Ghi nhận (Credits & Attribution)
 
-For more information, please read our [Code of Conduct](CODE_OF_CONDUCT.md) and [Security Policy](SECURITY.md) before participating.
-
----
+Dự án **`@softtynet/zca-js`** được phát triển, nâng cấp và duy trì bởi **Softtynet Co., Ltd.** ([`softtyos/zca-js`](https://github.com/softtyos/zca-js)), kế thừa nền tảng mã nguồn mở từ dự án gốc:
 
-## License
+- **Dự án gốc**: [RFS-ADRENO/zca-js](https://github.com/RFS-ADRENO/zca-js)
+- **Tác giả nền tảng gốc**: RFS-ADRENO, truong9c2208, JustKemForFun cùng các thành viên đóng góp từ cộng đồng mã nguồn mở.
 
-This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
+Chúng tôi trân trọng cảm ơn các tác giả của dự án gốc đã xây dựng nền tảng ban đầu cho cộng đồng JavaScript/TypeScript.
 
 ---
 
-## **Support Us**
+## 📄 Giấy phép (License)
 
-- ⭐ **Star our repositories** if you find them useful!  
-- 🔄 **Share** with your network to help us grow  
-- 💡 **Contribute** your ideas and code    
-- ☕ **A coffee**:
-    - [Buy Me a Coffee](https://ko-fi.com/grosse)
-    - [Paypal](https://www.paypal.com/paypalme/dungto213)
-    - [VietQR](https://github.com/user-attachments/assets/e1f319d6-9d11-4082-8248-55b55e645caa)
-    - [Momo](https://me.momo.vn/gMIMulsaUqsbf6iAiXt3)
+Phát hành theo giấy phép [MIT License](LICENSE).

package/dist/cjs/update.cjs

@@ -3,10 +3,10 @@
 var semver = require('semver');
 var utils = require('./utils.cjs');
 
-const VERSION = "2.2.0";
-const NPM_REGISTRY = "https://registry.npmjs.org/zca-js";
+const VERSION = "2.2.7";
+const NPM_REGISTRY = "https://registry.npmjs.org/@softtynet/zca-js";
 async function checkUpdate(ctx) {
-    var _a, _b;
+    var _a, _b, _c;
     if (!ctx.options.checkUpdate)
         return;
     const _options = Object.assign({}, (utils.isBun
@@ -22,12 +22,14 @@ async function checkUpdate(ctx) {
     const data = await response.json().catch(() => null);
     if (!data)
         return;
-    const latestVersion = data["dist-tags"].latest;
+    const latestVersion = (_c = data["dist-tags"]) === null || _c === void 0 ? void 0 : _c.latest;
+    if (!latestVersion)
+        return;
     if (semver.compare(VERSION, latestVersion) === -1) {
-        utils.logger(ctx).info(`A new version of zca-js is available: ${latestVersion}`);
+        utils.logger(ctx).info(`A new version of @softtynet/zca-js is available: ${latestVersion}`);
     }
     else {
-        utils.logger(ctx).info("zca-js is up to date");
+        utils.logger(ctx).info("@softtynet/zca-js is up to date");
     }
 }
 

package/dist/update.js

@@ -1,9 +1,9 @@
 import { compare } from "semver";
 import { isBun, logger } from "./utils.js";
-const VERSION = "2.2.0";
-const NPM_REGISTRY = "https://registry.npmjs.org/zca-js";
+const VERSION = "2.2.7";
+const NPM_REGISTRY = "https://registry.npmjs.org/@softtynet/zca-js";
 export async function checkUpdate(ctx) {
-    var _a, _b;
+    var _a, _b, _c;
     if (!ctx.options.checkUpdate)
         return;
     const _options = Object.assign({}, (isBun
@@ -19,11 +19,13 @@ export async function checkUpdate(ctx) {
     const data = await response.json().catch(() => null);
     if (!data)
         return;
-    const latestVersion = data["dist-tags"].latest;
+    const latestVersion = (_c = data["dist-tags"]) === null || _c === void 0 ? void 0 : _c.latest;
+    if (!latestVersion)
+        return;
     if (compare(VERSION, latestVersion) === -1) {
-        logger(ctx).info(`A new version of zca-js is available: ${latestVersion}`);
+        logger(ctx).info(`A new version of @softtynet/zca-js is available: ${latestVersion}`);
     }
     else {
-        logger(ctx).info("zca-js is up to date");
+        logger(ctx).info("@softtynet/zca-js is up to date");
     }
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@softtynet/zca-js",
-    "version": "2.2.7",
-    "description": "Unofficial Zalo API for JavaScript",
+    "version": "2.2.8",
+    "description": "Bộ thư viện Zalo API nâng cao phát triển bởi Softtynet (Đồng bộ tin nhắn đa thiết bị ZDB4.0, Catch-up Sync, Voice & Video Call Signaling)",
     "main": "dist/index.js",
     "type": "module",
     "exports": {
@@ -19,7 +19,6 @@
         "build": "npm run build:clean && npm run build:esm && npm run build:cjs",
         "test:verify": "npx tsx test/verify_upgrades.ts",
         "test:live": "npx tsx test/verify_live.ts",
-        "test:feat": "npm run test/feat.ts",
         "prettier": "prettier --write .",
         "lint": "eslint .",
         "lint:fix": "eslint . --fix",
@@ -27,21 +26,25 @@
     },
     "repository": {
         "type": "git",
-        "url": "git+https://github.com/RFS-ADRENO/zca-js.git"
+        "url": "git+https://github.com/softtyos/zca-js.git"
     },
-    "homepage": "https://github.com/RFS-ADRENO/zca-js",
+    "homepage": "https://github.com/softtyos/zca-js",
     "bugs": {
-        "url": "https://github.com/RFS-ADRENO/zca-js/issues"
+        "url": "https://github.com/softtyos/zca-js/issues"
     },
     "engines": {
         "node": ">=18.0.0"
     },
     "keywords": [
-        "chatbot",
         "zalo",
-        "api"
+        "zalo-api",
+        "zca-js",
+        "softtynet",
+        "zalo-sync",
+        "zalo-call",
+        "chatbot"
     ],
-    "author": "RFS-ADRENO, truong9c2208, JustKemForFun",
+    "author": "Softtynet Co., Ltd. (Based on zca-js by RFS-ADRENO)",
     "license": "MIT",
     "dependencies": {
         "crypto-js": "^4.2.0",

package/CODE_OF_CONDUCT.md

@@ -1,163 +0,0 @@
-# Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our
-community a harassment-free experience for everyone, regardless of age, body
-size, visible or invisible disability, ethnicity, sex characteristics, gender
-identity and expression, level of experience, education, socio-economic status,
-nationality, personal appearance, race, religion, or sexual identity
-and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming,
-diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment for our
-community include:
-
-* Demonstrating empathy and kindness toward other people
-* Being respectful of differing opinions, viewpoints, and experiences
-* Giving and gracefully accepting constructive feedback
-* Accepting responsibility and apologizing to those affected by our mistakes,
-  and learning from the experience
-* Focusing on what is best not just for us as individuals, but for the
-  overall community
-
-Examples of unacceptable behavior include:
-
-* The use of sexualized language or imagery, and sexual attention or
-  advances of any kind
-* Trolling, insulting or derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or email
-  address, without their explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
-  professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of
-acceptable behavior and will take appropriate and fair corrective action in
-response to any behavior that they deem inappropriate, threatening, offensive,
-or harmful.
-
-Community leaders have the right and responsibility to remove, edit, or reject
-comments, commits, code, wiki edits, issues, and other contributions that are
-not aligned to this Code of Conduct, and will communicate reasons for moderation
-decisions when appropriate.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when
-an individual is officially representing the community in public spaces.
-Examples of representing our community include using an official e-mail address,
-posting via an official social media account, or acting as an appointed
-representative at an online or offline event.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported to the community leaders responsible for enforcement through:
-- **GitHub Issues**: Create a private issue with the `[CONDUCT]` label
-- **GitHub Discussions**: Use the "Community" category for general concerns
-- **Direct Contact**: Reach out to any team member through GitHub
-- **Team Members**:
-  - [@RFS-ADRENO](https://github.com/RFS-ADRENO)
-  - [@truong9c2208](https://github.com/truong9c2208)
-  - [@JustKemForFun](https://github.com/JustKemForFun)
-
-All complaints will be reviewed and investigated promptly and fairly by the team.
-
-All community leaders are obligated to respect the privacy and security of the
-reporter of any incident.
-
-## Enforcement Guidelines
-
-Community leaders will follow these Community Impact Guidelines in determining
-the consequences for any action they deem in violation of this Code of Conduct:
-
-### 1. Correction
-
-**Community Impact**: Use of inappropriate language or other behavior deemed
-unprofessional or unwelcome in the community.
-
-**Consequence**: A private, written warning from community leaders, providing
-clarity around the nature of the violation and an explanation of why the
-behavior was inappropriate. A public apology may be requested.
-
-### 2. Warning
-
-**Community Impact**: A violation through a single incident or series
-of actions.
-
-**Consequence**: A warning with consequences for continued behavior. No
-interaction with the people involved, including unsolicited interaction with
-those enforcing the Code of Conduct, for a specified period of time. This
-includes avoiding interactions in community spaces as well as external channels
-like social media. Violating these terms may lead to a temporary or
-permanent ban.
-
-### 3. Temporary Ban
-
-**Community Impact**: A serious violation of community standards, including
-sustained inappropriate behavior.
-
-**Consequence**: A temporary ban from any sort of interaction or public
-communication with the community for a specified period of time. No public or
-private interaction with the people involved, including unsolicited interaction
-with those enforcing the Code of Conduct, is allowed during this period.
-Violating these terms may lead to a permanent ban.
-
-### 4. Permanent Ban
-
-**Community Impact**: Demonstrating a pattern of violation of community
-standards, including sustained inappropriate behavior,  harassment of an
-individual, or aggression toward or disparagement of classes of individuals.
-
-**Consequence**: A permanent ban from any sort of public interaction within
-the community.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage],
-version 2.0, available at
-https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
-
-Community Impact Guidelines were inspired by [Mozilla's code of conduct
-enforcement ladder](https://github.com/mozilla/diversity).
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see the FAQ at
-https://www.contributor-covenant.org/faq. Translations are available at
-https://www.contributor-covenant.org/translations.
-
-## Special Considerations for zca-js
-
-Given that zca-js is an unofficial API library for Zalo, we have additional
-guidelines specific to our project:
-
-### Responsible Usage
-
-* **Respect Zalo's Terms of Service**: While this is an unofficial library,
-  users should be aware of and respect Zalo's terms of service
-* **Account Safety**: Do not encourage or provide guidance on circumventing
-  Zalo's security measures
-* **Privacy**: Respect user privacy and do not share personal information
-  obtained through the API
-* **Rate Limiting**: Encourage responsible usage that doesn't overload Zalo's
-  servers
-
-### Technical Discussions
-
-* **Security**: When discussing security-related topics, use appropriate
-  channels and follow responsible disclosure practices
-* **Bugs and Issues**: Report bugs and issues through proper channels
-* **Documentation**: Help improve documentation and examples for the community
-
----
-
-**Note**: This Code of Conduct is a living document and may be updated as our
-community grows and evolves. 

package/CONTRIBUTING.md

@@ -1,470 +0,0 @@
-# Contributing to zca-js
-
-Thank you for your interest in contributing to zca-js! This project is maintained by the community and we welcome all contributions.
-
-## Table of Contents
-
-- [Code of Conduct](#code-of-conduct)
-- [Getting Started](#getting-started)
-- [Development Setup](#development-setup)
-- [How to Contribute](#how-to-contribute)
-- [Pull Request Process](#pull-request-process)
-- [Code Style Guidelines](#code-style-guidelines)
-- [Testing Guidelines](#testing-guidelines)
-- [Documentation Guidelines](#documentation-guidelines)
-- [Security Guidelines](#security-guidelines)
-- [Release Process](#release-process)
-- [Getting Help](#getting-help)
-
-## Code of Conduct
-
-This project adheres to our [Code of Conduct](CODE_OF_CONDUCT.md). By participating, you agree to abide by these rules.
-
-## Getting Started
-
-### Prerequisites
-
-- Node.js >= 18.0.0
-- Bun (recommended) or npm
-- Git
-
-### Fork and Clone
-
-1. Fork this repository
-2. Clone your fork:
-   ```bash
-   git clone https://github.com/YOUR_USERNAME/zca-js.git
-   cd zca-js
-   ```
-3. Add upstream remote:
-   ```bash
-   git remote add upstream https://github.com/RFS-ADRENO/zca-js.git
-   ```
-
-## Development Setup
-
-### Install Dependencies
-
-```bash
-# Using Bun (recommended)
-bun install
-
-# Or using npm
-npm install
-```
-
-### Build Project
-
-```bash
-# Build both ESM and CJS
-bun run build
-
-# Build ESM only
-bun run build:esm
-
-# Build CJS only
-bun run build:cjs
-```
-
-### Run Tests
-
-```bash
-# Run feature tests
-bun run test:feat
-
-# Run specific test file
-bun run test/test.ts
-```
-
-### Code Formatting
-
-```bash
-# Format code with Prettier
-bun run prettier
-```
-
-## How to Contribute
-
-### Types of Contributions
-
-We welcome the following types of contributions:
-
-- 🐛 **Bug Reports**: Report bugs and issues
-- ✨ **Feature Requests**: Suggest new features
-- 🔧 **Code Contributions**: Fix bugs and add features
-- 📚 **Documentation**: Improve docs and examples
-- 🧪 **Tests**: Add or improve tests
-- 🔒 **Security**: Report security vulnerabilities
-- 🌐 **Translations**: Translate docs to other languages
-
-### Before You Start
-
-1. **Check existing issues**: Search for existing issues before creating new ones
-2. **Discuss major changes**: Create an issue to discuss major changes
-3. **Follow the roadmap**: Check the current roadmap and priorities
-
-## Pull Request Process
-
-### Creating a Pull Request
-
-1. **Create a feature branch**:
-   ```bash
-   git checkout -b feature/your-feature-name
-   # or
-   git checkout -b fix/your-bug-fix
-   ```
-
-2. **Make your changes**:
-   - Follow code style guidelines
-   - Add tests for new functionality
-   - Update documentation if needed
-
-3. **Test your changes**:
-   ```bash
-   bun run build
-   bun run test:feat
-   ```
-
-4. **Commit your changes**:
-   ```bash
-   git add .
-   git commit -m "feat: add new API method for group management"
-   ```
-
-5. **Push to your fork**:
-   ```bash
-   git push origin feature/your-feature-name
-   ```
-
-6. **Create a Pull Request**:
-   - Use the provided PR template
-   - Link related issues
-   - Provide clear description of changes
-
-### PR Review Process
-
-1. **Automated checks** must pass
-2. **Code review** by at least one maintainer
-3. **Security review** for security-related changes
-4. **Documentation review** for API changes
-5. **Final approval** before merge
-
-## Code Style Guidelines
-
-### TypeScript Guidelines
-
-- Use TypeScript strict mode
-- Prefer interfaces over types for object shapes
-- Use meaningful variable and function names
-- Add JSDoc comments for public APIs
-- Use async/await over Promises when possible
-
-### Code Organization
-
-The project follows a modular structure for better maintainability and organization:
-
-```
-zca-js/
-├── src/                           # Source code directory
-│   ├── apis/                      # API methods (100+ files)
-│   │   ├── sendMessage.ts         # Core messaging functionality
-│   │   ├── login.ts               # Authentication methods
-│   │   ├── loginQR.ts             # QR code login
-│   │   ├── listen.ts              # Event listening
-│   │   ├── sendVideo.ts           # Video sending
-│   │   ├── sendVoice.ts           # Voice sending
-│   │   ├── sendSticker.ts         # Sticker sending
-│   │   ├── createGroup.ts         # Group management
-│   │   ├── addReaction.ts         # Message reactions
-│   │   ├── uploadAttachment.ts    # File uploads
-│   │   └── ...                    # 90+ other API methods
-│   ├── models/                    # TypeScript interfaces and types
-│   │   ├── Message.ts             # Message interface
-│   │   ├── Attachment.ts          # File attachment types
-│   │   ├── Reaction.ts            # Reaction types
-│   │   ├── FriendEvent.ts         # Friend event types
-│   │   ├── GroupEvent.ts          # Group event types
-│   │   ├── Typing.ts              # Typing indicators
-│   │   ├── SeenMessage.ts         # Message seen events
-│   │   ├── DeliveredMessage.ts    # Message delivery events
-│   │   ├── Undo.ts                # Undo functionality
-│   │   ├── Enum.ts                # Enumerations
-│   │   └── index.ts               # Model exports
-│   ├── Errors/                    # Error handling
-│   │   ├── ZaloApiError.ts        # Custom API error class
-│   │   └── index.ts               # Error exports
-│   ├── context.ts                 # Context management and state
-│   ├── utils.ts                   # Utility functions and helpers
-│   ├── zalo.ts                    # Main Zalo class implementation
-│   ├── update.ts                  # Update checking functionality
-│   └── index.ts                   # Public API exports
-├── examples/                      # Usage examples
-│   └── echobot.ts                 # Echo bot example
-├── test/                          # Test files
-│   ├── feat.ts                    # Feature tests
-│   ├── feat.test.ts               # Feature test suite
-│   ├── test.ts                    # General tests
-│   └── a.png                      # Test assets
-├── .github/                       # GitHub configuration
-│   └── ISSUE_TEMPLATE/            # Issue templates
-├── .dev/                          # Development tools (developer generated)
-├── dist/                          # Build output (generated)
-├── node_modules/                  # Dependencies (generated)
-├── package.json                   # Project configuration
-├── tsconfig.json                  # TypeScript configuration
-├── rollup.config.js               # Build configuration
-├── README.md                      # Project documentation
-├── CONTRIBUTING.md                # Contribution guidelines
-├── SECURITY.md                    # Security policy
-├── CODE_OF_CONDUCT.md             # Community guidelines
-└── LICENSE                        # MIT License
-```
-
-### Key Directories Explained
-
-- **`src/apis/`**: Contains all API method implementations (~100 files)
-
-- **`src/models/`**: TypeScript interfaces and type definitions
-  - Core data structures for messages, events, and API responses
-  - Ensures type safety across the application
-
-- **`src/Errors/`**: Custom error handling
-  - `ZaloApiError.ts`: Handles API-specific errors
-  - Provides consistent error handling across the library
-
-- **`examples/`**: Usage examples and demonstrations
-  - `echobot.ts`: Complete example of a Zalo bot implementation
-
-- **`test/`**: Test suites and test assets
-  - Feature tests for core functionality
-  - Integration tests for API methods
-
-### Naming Conventions
-
-- **Files**: camelCase (e.g., `sendMessage.ts`)
-- **Classes**: PascalCase (e.g., `ZaloApiError`)
-- **Functions**: camelCase (e.g., `sendMessage`)
-- **Constants**: UPPER_SNAKE_CASE (e.g., `API_BASE_URL`)
-- **Interfaces**: PascalCase with `I` prefix (e.g., `IMessage`)
-
-### Error Handling
-
-```typescript
-// Good
-try {
-  const result = await api.sendMessage(message);
-  return result;
-} catch (error) {
-  if (error instanceof ZaloApiError) {
-      throw error;
-  }
-  throw new ZaloApiError(`Failed to send message: ${error.message}`);
-}
-
-// Bad
-try {
-  const result = await api.sendMessage(message);
-  return result;
-} catch (error) {
-  console.error(error);
-  return null;
-}
-```
-
-## Testing Guidelines
-
-### Test Structure
-
-```typescript
-describe('API Method', () => {
-  beforeEach(() => {
-    // Setup
-  });
-
-  afterEach(() => {
-    // Cleanup
-  });
-
-  it('should handle success case', async () => {
-    // Test implementation
-  });
-
-  it('should handle error case', async () => {
-    // Test error handling
-  });
-});
-```
-
-### Testing Best Practices
-
-- Test both success and failure scenarios
-- Mock external dependencies
-- Use descriptive test names
-- Keep tests independent
-- Test edge cases and error conditions
-
-### Running Tests
-
-```bash
-# Run all tests
-bun run test:feat
-
-# Run specific test
-bun run test/test.ts
-
-# Run with coverage (if available)
-bun run test:coverage
-```
-
-## Documentation Guidelines
-
-### API Documentation
-
-- Document all public methods with JSDoc
-- Include parameter types and descriptions
-- Provide usage examples
-- Document error conditions
-
-```typescript
-/**
- * Sends a message to a specific thread
- * @param message - The message object containing content and metadata
- * @param threadId - The ID of the thread to send the message to
- * @param threadType - The type of thread (User or Group)
- * @returns Promise<Message> - The sent message object
- * @throws {ZaloApiError} When the API request fails
- * @example
- * ```typescript
- * const message = await api.sendMessage(
- *   { msg: "Hello, world!" },
- *   "123456789",
- *   ThreadType.User
- * );
- * ```
- */
-async sendMessage(message: IMessage, threadId: string, threadType: ThreadType): Promise<Message>
-```
-
-### README Updates
-
-- Update README.md for new features
-- Add examples for new APIs
-- Update installation instructions if needed
-- Keep the table of contents updated
-
-## Security Guidelines
-
-### Security Best Practices
-
-- Never commit sensitive data (tokens, passwords, etc.)
-- Use environment variables for configuration
-- Validate all user inputs
-- Follow the principle of least privilege
-- Report security issues privately
-
-### Security Reporting
-
-If you discover a security vulnerability:
-
-1. **DO NOT** create a public issue
-2. Use the [SECURITY.md](SECURITY.md) reporting process
-3. Create a private issue with `[SECURITY]` label
-4. Contact team members directly for urgent issues
-
-### Code Security
-
-```typescript
-// Good - Validate inputs
-function sendMessage(content: string, threadId: string) {
-  if (!content || typeof content !== 'string') {
-    throw new ZaloApiError('Content must be a non-empty string');
-  }
-  if (!threadId || typeof threadId !== 'string') {
-    throw new ZaloApiError('ThreadId must be a non-empty string');
-  }
-  // Implementation
-}
-
-// Bad - No validation
-function sendMessage(content: any, threadId: any) {
-  // Implementation without validation
-}
-```
-
-## Release Process
-
-### Versioning
-
-We follow [Semantic Versioning](https://semver.org/):
-
-- **MAJOR**: Breaking changes
-- **MINOR**: New features (backward compatible)
-- **PATCH**: Bug fixes (backward compatible)
-
-### Release Checklist
-
-- [ ] All tests pass
-- [ ] Documentation is updated
-- [ ] Version is bumped in package.json
-- [ ] Build is successful
-- [ ] Release notes are prepared
-
-### Publishing
-
-```bash
-# Build the project
-bun run build
-
-# Run tests
-bun run test:feat
-
-# Publish to npm
-npm publish
-```
-
-## Getting Help
-
-### Communication Channels
-
-- **GitHub Issues**: For bug reports and feature requests
-- **GitHub Discussions**: For questions and general discussion
-- **Pull Requests**: For code contributions
-- **Security Issues**: Use `[SECURITY]` label
-
-### Team Members
-
-- [@RFS-ADRENO](https://github.com/RFS-ADRENO)
-- [@truong9c2208](https://github.com/truong9c2208)
-- [@JustKemForFun](https://github.com/JustKemForFun)
-
-### Resources
-
-- [API Documentation](https://zca-js.tdung.com)
-- [Examples](examples/)
-- [Security Policy](SECURITY.md)
-- [Code of Conduct](CODE_OF_CONDUCT.md)
-
-## Special Considerations for zca-js
-
-### Unofficial API Library
-
-> [!IMPORTANT]
-> ⚠️ zca-js is an unofficial API library for Zalo. Please be aware of:
-
-- **Account Risk**: Using this API may result in account suspension
-- **Terms of Service**: Respect Zalo's ToS in your contributions
-- **Rate Limiting**: Be mindful of API usage limits
-- **Privacy**: Protect user privacy and data
-
-### Responsible Development
-
-- Test changes thoroughly before submitting
-- Avoid introducing features that could harm users
-- Consider the impact on Zalo's infrastructure
-- Document any risks or limitations
-
----
-
-**Thank you for contributing to zca-js!** 🚀
-
-Your contributions help make this library better for the entire community. 

package/SECURITY.md

@@ -1,83 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-We actively maintain and provide security updates for the following versions:
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 2.0.x   | :white_check_mark: |
-| 1.x.x   | :x:                |
-| < 1.0   | :x:                |
-
-## Reporting a Vulnerability
-
-We take security vulnerabilities seriously. If you discover a security vulnerability in zca-js, please follow these steps:
-
-### 1. **DO NOT** create a public GitHub issue
-Security vulnerabilities should be reported privately to prevent potential exploitation.
-
-### 2. Report the vulnerability
-Send an email to the maintainers with the following information:
-- **Subject**: `[SECURITY] zca-js vulnerability report`
-- **Description**: Detailed description of the vulnerability
-- **Steps to reproduce**: Clear steps to reproduce the issue
-- **Impact assessment**: Potential impact of the vulnerability
-- **Suggested fix** (if available): Any suggestions for fixing the issue
-
-### 3. Response timeline
-- **Initial response**: Within 48 hours
-- **Status update**: Within 1 week
-- **Resolution**: As soon as possible, typically within 30 days
-
-## Security Considerations
-
-### Important Warnings
-
-⚠️ **This is an unofficial API library** that simulates browser interactions with Zalo Web. Please be aware of the following security considerations:
-
-1. **Account Risk**: Using this API may result in your Zalo account being locked or banned. Use at your own risk.
-
-2. **Authentication**: The library handles sensitive authentication data. Ensure proper security measures when storing or transmitting this information.
-
-3. **Rate Limiting**: Respect Zalo's rate limits to avoid triggering security measures.
-
-4. **Data Privacy**: Be mindful of user privacy and comply with relevant data protection regulations.
-
-### Best Practices
-
-1. **Environment Variables**: Store sensitive configuration in environment variables, not in code
-2. **HTTPS Only**: Always use HTTPS when transmitting data
-3. **Input Validation**: Validate all inputs before processing
-4. **Error Handling**: Implement proper error handling to avoid information disclosure
-5. **Regular Updates**: Keep the library updated to the latest version
-
-### Known Limitations
-
-- This library is not officially supported by Zalo
-- API endpoints and behavior may change without notice
-- No guarantee of service availability or stability
-- May break with Zalo Web updates
-
-## Security Updates
-
-Security updates will be released as patch versions (e.g., 2.0.1, 2.0.2) and will be clearly marked in the changelog.
-
-## Contact Information
-
-For security-related issues, please contact:
-- **GitHub Issues**: Create a private issue with the `[SECURITY]` label
-- **GitHub Discussions**: Use the "Security" category for general security questions
-- **Team Members**: 
-  - [@RFS-ADRENO](https://github.com/RFS-ADRENO)
-  - [@truong9c2208](https://github.com/truong9c2208)
-  - [@JustKemForFun](https://github.com/JustKemForFun)
-- **Alternative**: Contact any team member through GitHub for urgent security matters
-
-## Acknowledgments
-
-We appreciate security researchers and community members who responsibly disclose vulnerabilities. Contributors will be acknowledged in our security advisories unless they prefer to remain anonymous.
-
----
-
-**Note**: This security policy is subject to change. Please check back regularly for updates.