zaileys 4.14.0 → 4.15.0

package/README.md

@@ -15,7 +15,7 @@
 
 <div align="center">
   <a href="https://github.com/zeative/zaileys/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="License: MIT"></a>
-  <a href="https://discord.gg/KBHhTTVUc5"><img alt="Discord" src="https://img.shields.io/discord/1105833273415962654?logo=discord&label=discord&link=https%3A%2F%2Fgithub.com%2Fzeative%2Fzaileys"></a>
+  <a href="https://discord.gg/HUcQe4xGr3"><img alt="Discord" src="https://img.shields.io/discord/1105833273415962654?logo=discord&label=discord&link=https%3A%2F%2Fgithub.com%2Fzeative%2Fzaileys"></a>
   <a href="https://chat.whatsapp.com/GlQfvc83mSH3F6ov06vuCt"><img alt="WhatsApp" src="https://img.shields.io/badge/WhatsApp-Group-25D366?logo=whatsapp&logoColor=white"></a>
   <a href="https://github.com/zeative/zaileys"><img src="https://img.shields.io/github/stars/zeative/zaileys" alt="GitHub Stars"></a>
   <a href="https://github.com/zeative/zaileys"><img src="https://img.shields.io/github/forks/zeative/zaileys" alt="GitHub Forks"></a>
@@ -40,7 +40,7 @@
 [What you can build](#what-you-can-build) &nbsp;•&nbsp;
 [Storage](#storage) &nbsp;•&nbsp;
 [Runtimes](#runtime-support) &nbsp;•&nbsp;
-[Docs](https://zeative.github.io/zaileys/)
+[Docs](https://zaileys.kejaa.id)
 
 </div>
 
@@ -49,7 +49,7 @@
 <br>
 
 > [!NOTE]
-> This README is a **high-level overview**. The complete API reference, guides, and recipes live in the documentation site at **<https://zeative.github.io/zaileys/>**. Runnable code lives in [`examples/`](./examples).
+> This README is a **high-level overview**. The complete API reference, guides, and recipes live in the documentation site at **<https://zaileys.kejaa.id>**. Runnable code lives in [`examples/`](./examples).
 
 ---
 
@@ -110,10 +110,11 @@ export const POST = client.webhook()
 | Login | QR / pairing code, no approval | Permanent token |
 | Ban risk | Exists | None (sanctioned) |
 | Groups / channels / polls | ✅ | ❌ |
+| Commands, plugins, broadcast, scheduled sends | ✅ | ❌ (need the WhatsApp Web connection) |
 | Templates / OTP / marketing | ❌ | ✅ |
 | Message users who never texted you | ✅ any number | ✅ via approved templates |
 
-Pick your provider → **[Choose Your Provider](https://zeative.github.io/zaileys/providers)** · **[Official Cloud API guide](https://zeative.github.io/zaileys/official)**.
+Pick your provider → **[Choose Your Provider](https://zaileys.kejaa.id/providers)** · **[Official Cloud API guide](https://zaileys.kejaa.id/cloud/overview)**.
 
 ## Build with AI
 
@@ -130,7 +131,7 @@ to fix errors. Install it straight from this repo:
 npx skills add zeative/zaileys        # add -g for a global install
 ```
 
-The suite has an orchestrator that auto-routes plus focused scaffold, debug, and review skills. See the full guide → **[zeative.github.io/zaileys/skill](https://zeative.github.io/zaileys/skill/)**.
+The suite has an orchestrator that auto-routes plus focused scaffold, debug, and review skills. See the full guide → **[zaileys.kejaa.id/ai](https://zaileys.kejaa.id/ai)**.
 
 ## Why Zaileys
 
@@ -140,9 +141,9 @@ The suite has an orchestrator that auto-routes plus focused scaffold, debug, and
 - **Rich & interactive out of the box** — native buttons, lists, carousels, and Meta-AI-style rich responses written as plain markdown.
 - **Auto lifecycle** — QR or pairing-code login, auto-reconnect with backoff, clean logout, optional `ignoreMe`.
 - **Pluggable storage** — independent `AuthStore` and `MessageStore` interfaces with `file`, `memory`, `sqlite`, `redis`, `postgres`, and `convex` adapters.
-- **Batteries included** — command framework, broadcast with rate limiting, scheduled sends, and lazy media processing (image/video/audio/sticker).
+- **Batteries included** — command framework, broadcast with rate limiting, and scheduled sends (WhatsApp Web only), plus lazy media processing (image/video/audio/sticker) on both providers.
 - **Runs everywhere** — dual ESM/CJS with `.d.ts` + `.d.cts` types; verified on Node, Bun, Deno, and Termux.
-- **Modern foundation** — Baileys `7.0.0-rc13` (includes the CVE-2026-48063 spoofing patch), built and type-checked with the native (Go) TypeScript 7 compiler.
+- **Modern foundation** — Baileys `7.0.0-rc14` (includes the CVE-2026-48063 spoofing patch), built and type-checked with the native (Go) TypeScript 7 compiler.
 
 ## Install
 
@@ -201,24 +202,16 @@ client.on('button-click', (ctx) => console.log('tapped:', ctx.buttonId))
 Toggle `{ rich: true }` and write ordinary markdown — fenced code (syntax-highlighted), tables, images, and `:::` directives for products, suggestions, and more.
 
 ```typescript
-await client.send(jid).text(
-  [
-    '*Daily brief* ☕',
-    '',
-    '```ts',
-    "const client = new Client()",
-    '```',
-    '',
-    ':::suggest',
-    'See changelog | Upgrade guide',
-    ':::',
-  ].join('\n'),
-  { rich: true, title: '📰 zaileys' },
-)
+// The message contains backticks, so write it as a plain string with \n line breaks.
+const brief = "*Daily brief* ☕\n\n```ts\nconst client = new Client()\n```\n\n:::suggest\nSee changelog | Upgrade guide\n:::"
+
+await client.send(jid).text(brief, { rich: true, title: '📰 zaileys' })
 ```
 
 ### Commands, broadcast & schedule
 
+These run on the WhatsApp Web provider; on the Cloud API, handle `text` events and send in a loop instead.
+
 ```typescript
 const client = new Client({ commandPrefix: ['/', '!'] })
 client.command('ping', (ctx) => ctx.reply('pong 🏓'))
@@ -281,8 +274,14 @@ Package managers: **npm**, **pnpm**, **yarn**, and **bun** are all supported.
 
 ## Documentation
 
-- 🌐 [**zeative.github.io/zaileys**](https://zeative.github.io/zaileys/) — full documentation site: guides, API reference, recipes
-- 🤖 [**AI Skill**](https://zeative.github.io/zaileys/skill/) — official Claude Code / `npx skills` skill
+- 🌐 [**zaileys.kejaa.id**](https://zaileys.kejaa.id) — the documentation site
+  - [Quickstart](https://zaileys.kejaa.id/quickstart) — a working bot in about five minutes
+  - [Guides](https://zaileys.kejaa.id/messaging/text) — messaging, media, buttons, commands, groups, storage
+  - [Cloud API](https://zaileys.kejaa.id/cloud/overview) — webhook, templates, limits
+  - [Recipes](https://zaileys.kejaa.id/recipes/auto-reply) — complete bots you can copy
+  - [Reference](https://zaileys.kejaa.id/reference/client) — every method, option, and event
+  - [Feature matrix](https://zaileys.kejaa.id/feature-matrix) — what works on which provider
+- 🤖 [**Build with AI**](https://zaileys.kejaa.id/ai) — official Claude Code / `npx skills` skill
 - 📦 [**examples/**](./examples) — runnable bots: quickstart, interactive buttons, AIRich, storage adapters, broadcast
 - 🔀 [**MIGRATION.md**](./MIGRATION.md) — upgrading from v3.x to v4.0.0 (breaking changes, side-by-side snippets)
 - 🤝 [**CONTRIBUTING.md**](./CONTRIBUTING.md) — dev setup, tests, commit convention, release flow

package/dist/auth/adapters/file.d.ts

@@ -4,13 +4,24 @@ export interface FileAuthStoreOptions {
 }
 export declare class FileAuthStore implements AuthStoreBundle {
     private readonly basePath;
+    /** Where credentials live, so callers can keep that directory out of reach of media loading. */
+    get directory(): string;
+    private readonly resolvedBase;
     private closed;
     constructor(options?: FileAuthStoreOptions);
+    /** Independent of the caller's validation: nothing this store touches may escape its base. */
+    private assertContained;
     readonly signal: AuthStore;
     readonly creds: AuthCredsStore;
     private credsPath;
+    /** Newest `creds.revoked-*.json`, or undefined when nothing was ever quarantined. */
+    private newestBackup;
     private signalDir;
     private signalPath;
+    /**
+     * Durable replace: the bytes are flushed before the rename, so a crash mid-write leaves either the
+     * old file or the new one — never a truncated `creds.json`, which reads as a lost session.
+     */
     private atomicWrite;
     private assertOpen;
 }

package/dist/auth/adapters/memory.d.ts

@@ -1,6 +1,7 @@
 import type { AuthCredsStore, AuthStore, AuthStoreBundle } from '../types.js';
 export declare class MemoryAuthStore implements AuthStoreBundle {
     private credsBlob;
+    private credsBackup;
     private readonly signalMap;
     private closed;
     readonly signal: AuthStore;

package/dist/auth/adapters/postgres.d.ts

@@ -4,6 +4,8 @@ export interface PostgresAuthStoreOptions {
     pool?: PgPoolLike;
     connectionString?: string;
     max?: number;
+    /** Prefix for this store's tables, so several sessions can share one database. Default none. */
+    tablePrefix?: string;
 }
 export declare class PostgresAuthStore implements AuthStoreBundle {
     private readonly externalPool;
@@ -13,6 +15,7 @@ export declare class PostgresAuthStore implements AuthStoreBundle {
     private resolvedPool;
     private readyPromise;
     private closed;
+    private readonly rewrite;
     constructor(options: PostgresAuthStoreOptions);
     private ensureReady;
     readonly signal: AuthStore;

package/dist/auth/adapters/redis.d.ts

@@ -16,6 +16,8 @@ export declare class RedisAuthStore implements AuthStoreBundle {
     readonly signal: AuthStore;
     readonly creds: AuthCredsStore;
     private credsKey;
+    /** Quarantine key: keeps the last credentials recoverable after an erase. */
+    private credsBackupKey;
     private signalKey;
     private indexKey;
     private ensureReady;

package/dist/auth/adapters/sqlite.d.ts

@@ -2,6 +2,8 @@ import type { AuthCredsStore, AuthStore, AuthStoreBundle } from '../types.js';
 export interface SqliteAuthStoreOptions {
     database: string | Buffer;
     readonly?: boolean;
+    /** Prefix for this store's tables, so several sessions can share one database file. Default none. */
+    tablePrefix?: string;
 }
 export declare class SqliteAuthStore implements AuthStoreBundle {
     private readonly options;
@@ -9,6 +11,7 @@ export declare class SqliteAuthStore implements AuthStoreBundle {
     private prepared;
     private readyPromise;
     private closed;
+    private readonly rewrite;
     constructor(options: SqliteAuthStoreOptions);
     readonly creds: AuthCredsStore;
     readonly signal: AuthStore;

package/dist/auth/types.d.ts

@@ -9,11 +9,23 @@ export interface AuthStore {
     delete<K extends AuthStoreKey>(type: K, ids: readonly string[]): Promise<void>;
     clear(): Promise<void>;
     close(): Promise<void>;
+    /**
+     * Undo `close()` so a disconnected client can connect again. Optional: without it the client
+     * reports that the adapter cannot be reused and a new Client must be built.
+     */
+    reopen?(): Promise<void>;
 }
 export interface AuthCredsStore {
     readCreds(): Promise<AuthenticationCreds | undefined>;
     writeCreds(creds: AuthenticationCreds): Promise<void>;
     deleteCreds(): Promise<void>;
+    /**
+     * Move the current credentials aside so an erase stays recoverable. Optional: a third-party
+     * adapter without it simply skips the snapshot. Called before every destructive path.
+     */
+    backupCreds?(): Promise<void>;
+    /** Read back the newest snapshot written by {@link backupCreds}. */
+    readBackupCreds?(): Promise<AuthenticationCreds | undefined>;
 }
 export interface AuthStoreBundle {
     readonly creds: AuthCredsStore;

package/dist/automation/errors.d.ts

@@ -1,4 +1,4 @@
-export type AutomationErrorCode = 'NOT_CONNECTED' | 'RATE_LIMIT_INVALID' | 'TASK_FAILED' | 'SCHEDULE_INVALID' | 'STORE_UNAVAILABLE' | 'PRESENCE_FAILED';
+export type AutomationErrorCode = 'NOT_CONNECTED' | 'RATE_LIMIT_INVALID' | 'TASK_FAILED' | 'SCHEDULE_INVALID' | 'STORE_UNAVAILABLE' | 'PRESENCE_FAILED' | 'QUEUE_FULL' | 'QUEUE_TIMEOUT';
 export declare class ZaileysAutomationError extends Error {
     readonly code: AutomationErrorCode;
     readonly cause?: unknown;

package/dist/automation/presence.d.ts

@@ -15,12 +15,20 @@ export declare class PresenceModule {
     private readonly throttleEnabled;
     private readonly minIntervalMs;
     private readonly now;
+    /** Bounded: one entry per chat ever messaged would otherwise live for the process's lifetime. */
     private readonly lastSent;
+    private readonly pendingClears;
     constructor(getSocket: () => AutomationSocketLike | undefined, throttle?: PresenceThrottleOptions, clock?: PresenceClock);
     protected requireSocket(): AutomationSocketLike;
     private throttled;
     private update;
+    /**
+     * Resolves the socket when the timer fires rather than capturing it, so a reconnect does not get
+     * a burst of presence updates aimed at a dead socket. Handles are tracked so dispose() can cancel.
+     */
     private scheduleClear;
+    /** Cancels every outstanding auto-clear. Called on disconnect. */
+    dispose(): void;
     online(): Promise<void>;
     offline(): Promise<void>;
     typing(jid: string, ms?: number): Promise<void>;

package/dist/automation/queue.d.ts

@@ -6,7 +6,10 @@ export declare class TaskQueue {
     private readonly concurrency;
     private readonly retry;
     private readonly sleep;
+    /** Bounded backlog: an unbounded queue plus a hung task retains every caller's closure forever. */
     private readonly pending;
+    private readonly maxPending;
+    private readonly taskTimeoutMs;
     private active;
     private idleWaiters;
     constructor(options?: TaskQueueOptions, clock?: TaskQueueClock);
@@ -14,5 +17,7 @@ export declare class TaskQueue {
     onIdle(): Promise<void>;
     private pump;
     private settleIdle;
+    /** A task with no deadline parks its concurrency slot forever on a half-open socket. */
+    private withDeadline;
     private execute;
 }

package/dist/automation/rate-limiter.d.ts

@@ -9,6 +9,7 @@ export declare class RateLimiter {
     private readonly perJidRatePerMs?;
     private readonly perJidCapacity?;
     private readonly global;
+    /** Bounded: a refilled bucket is indistinguishable from a fresh one, so retaining it is waste. */
     private readonly perJid;
     constructor(options: RateLimiterOptions, clock?: RateLimiterClock);
     acquire(jid?: string): Promise<void>;

package/dist/automation/schedule.d.ts

@@ -32,11 +32,17 @@ export declare class Scheduler {
     private readonly acquire;
     private readonly memory;
     private readonly timers;
+    private readonly failures;
     constructor(deps: SchedulerDeps);
     scheduleAt(date: Date, build: (b: MessageBuilder<'init'>) => MessageBuilder<'content-set'>): Promise<ScheduleHandle>;
     loadPending(): Promise<void>;
     dispose(): void;
     private cancel;
+    /**
+     * Node clamps a setTimeout delay above 2^31-1 ms (~24.8 days) to 1, so a job scheduled months out
+     * would fire almost immediately — for a broadcast, an instant mass-send. Long waits are re-armed
+     * in chunks instead.
+     */
     private arm;
     private fire;
     private persist;

package/dist/automation/types.d.ts

@@ -8,6 +8,10 @@ export type RetryPolicy = {
     backoffMs: (attempt: number) => number;
 };
 export type TaskQueueOptions = {
+    /** Reject new work past this backlog instead of growing without bound. Default 10000. */
+    maxPending?: number;
+    /** Per-task deadline; a hung task otherwise parks its concurrency slot forever. Default 120000. */
+    taskTimeoutMs?: number;
     concurrency?: number;
     retry?: RetryPolicy;
 };

package/dist/builder/builder.d.ts

@@ -2,6 +2,7 @@ import { type AnyMessageContent, type MiscMessageGenerationOptions, type WAMessa
 import { type ButtonsContentOptions } from './content/buttons.js';
 import { type CarouselCard } from './content/carousel.js';
 import { type AIRichOptions } from './content/airich.js';
+import { type HtmlAppOptions } from './content/html-app.js';
 import { type BuilderInternalState } from './state.js';
 import type { AlbumItem, AudioOptions, BuilderState, ButtonDef, DocumentOptions, EventOptions, GroupInviteOptions, GroupStatusOptions, GroupStatusRepostOptions, GroupStatusSource, ImageOptions, InteractiveButton, ListOptions, LocationOptions, MediaSource, PollOptions, ProductOptions, StickerOptions, TemplateOptions, VideoNoteOptions, VideoOptions } from './types.js';
 export interface BuilderSocketLike {
@@ -29,6 +30,7 @@ export declare class MessageBuilder<State extends BuilderState> {
     static create(socket: BuilderSocketLike, recipient: string, resolveRecipient?: (raw: string) => Promise<string>, recordSent?: (message: WAMessage) => void, inheritDisappearing?: (jid: string) => number | undefined): MessageBuilder<'init'>;
     to(this: MessageBuilder<'init'>, recipient: string): MessageBuilder<'init'>;
     text(this: MessageBuilder<'init'>, content: string, opts?: TextOptions): MessageBuilder<'content-set'>;
+    htmlApp(this: MessageBuilder<'init'>, html: string, opts?: HtmlAppOptions): MessageBuilder<'content-set'>;
     image(this: MessageBuilder<'init'>, src: MediaSource, opts?: ImageOptions): MessageBuilder<'content-set'>;
     videoNote(this: MessageBuilder<'init'>, src: MediaSource, opts?: VideoNoteOptions): MessageBuilder<'content-set'>;
     video(this: MessageBuilder<'init'>, src: MediaSource, opts?: VideoOptions): MessageBuilder<'content-set'>;
@@ -74,4 +76,11 @@ export declare class MessageBuilder<State extends BuilderState> {
     /** Relay skips baileys' contextInfo pass, so mentions and mentionAll are applied to the unwrapped node here. */
     private applyRelayMentions;
     private sendRelay;
+    /**
+     * Re-sends the card as an edit of itself. Without it the recipient gets WhatsApp's
+     * "can't verify the security of this media" prompt and has to tap Download before the page renders.
+     * The edit must sit inside `botForwardedMessage` like the original, otherwise it lands as its own
+     * broken message instead of replacing the card.
+     */
+    private relayIdenticalEdit;
 }

package/dist/builder/content/airich.d.ts

@@ -28,6 +28,11 @@ export type AIRichPart = {
 } | {
     type: 'tip';
     text: string;
+} | {
+    type: 'html';
+    html: string;
+    trustedSources?: string[];
+    height?: number;
 } | {
     type: 'suggest';
     prompts: string | string[];
@@ -77,4 +82,6 @@ export type AIRichOptions = {
     footer?: string;
     sources?: Array<[profileUrl: string, url: string, text: string]>;
 };
+/** Android renders no other primitive; Web, Desktop and iOS map it to an empty section. */
+export declare const AI_RICH_HTML_PRIMITIVE = "GenAIaeacdsnwHtmlPrimitive";
 export declare const buildAIRichContent: (parts: AIRichPart[], opts?: AIRichOptions) => AnyMessageContent;

package/dist/builder/content/buttons.d.ts

@@ -4,6 +4,8 @@ export declare const RELAY_CONTENT_KEY = "__zaileysRelayMessage";
 export declare const RELAY_MEDIA_KEY = "__zaileysHeaderMedia";
 /** Marks relay content that may only target a group jid; the value is the method label used in the error. */
 export declare const RELAY_REQUIRE_GROUP_KEY = "__zaileysRequireGroupJid";
+/** Asks `sendRelay` to follow the message with an identical edit, which renders it without the download prompt. */
+export declare const RELAY_BYPASS_DOWNLOAD_KEY = "__zaileysBypassDownload";
 /** Carries a downloaded media buffer that `sendRelay` re-uploads and injects into the status envelope. */
 export declare const RELAY_STATUS_MEDIA_KEY = "__zaileysStatusMedia";
 export type StatusMedia = {

package/dist/builder/content/html-app.d.ts

@@ -0,0 +1,26 @@
+import type { AnyMessageContent } from 'baileys';
+export type HtmlAppDevice = 'android' | 'ios' | 'web' | 'desktop' | 'unknown';
+export type HtmlAppOptions = {
+    /** From baileys' `getDevice(messageId)`. Anything but `android` takes the fallback. */
+    device?: HtmlAppDevice;
+    /** Where non-Android clients open the page instead. Required unless the device is android. */
+    fallbackUrl?: string;
+    fallbackButtonText?: string;
+    /** Rendered above the card, and as the body of the fallback message. */
+    text?: string;
+    footer?: string;
+    trustedSources?: string[];
+    /** Pins the page height so the host stops re-measuring a bubble whose height follows its width. */
+    height?: number;
+    /**
+     * Follows the card with an identical edit so it renders immediately instead of behind WhatsApp's
+     * "can't verify the security of this media" prompt. Costs one extra relay and one re-render, so a
+     * page running an animation restarts once. Defaults to on.
+     */
+    bypassDownload?: boolean;
+};
+/**
+ * Only WhatsApp Android renders an inline HTML primitive. Every other client drops the section and
+ * leaves an empty bubble, so they get a webview button to the same page instead.
+ */
+export declare const buildHtmlAppContent: (html: string, opts?: HtmlAppOptions) => AnyMessageContent;

package/dist/builder/index.d.ts

@@ -2,5 +2,7 @@ export * from './types.js';
 export * from './errors.js';
 export { MessageBuilder, type BuilderSocketLike, type TextOptions } from './builder.js';
 export { EditBuilder } from './edit-builder.js';
+export { buildHtmlAppContent, type HtmlAppDevice, type HtmlAppOptions, } from './content/html-app.js';
+export { AI_RICH_HTML_PRIMITIVE, type AIRichPart } from './content/airich.js';
 export { deleteMessage, reactToMessage, forwardMessage, pinMessage, type DeleteOptions, type PinOptions, } from './mutations.js';
 export { isJid, resolveUsername, type UsernameResolveSocketLike, } from './username-resolve.js';

package/dist/builder/media-loader.d.ts

@@ -6,6 +6,20 @@ export type LoadedMedia = {
 };
 export type LoadMediaOptions = {
     timeoutMs?: number;
+    /** Hard ceiling on bytes read from a URL or file. Default 64 MB. */
+    maxBytes?: number;
+    /** Treat a plain string as a filesystem path. Default `true` — set false for URL-only input. */
+    allowLocalPaths?: boolean;
+    /** Allow fetching loopback/RFC1918/link-local addresses. Default `false`. */
+    allowPrivateNetwork?: boolean;
+    /** Extra directories a local path may not resolve into, on top of the auth directory. */
+    deniedDirs?: readonly string[];
 };
 export declare const detectMimeFromBuffer: (buffer: Buffer) => Promise<string>;
-export declare const loadMedia: (src: MediaSource, options?: LoadMediaOptions) => Promise<LoadedMedia>;
+/**
+ * Process-wide defaults under every `loadMedia` call. The builders load media deep inside content
+ * helpers that never see a Client, so security policy is set once here; a per-call option wins.
+ */
+export declare const configureMediaLoading: (next: LoadMediaOptions) => void;
+export declare const getMediaLoadingDefaults: () => Readonly<LoadMediaOptions>;
+export declare const loadMedia: (src: MediaSource, callOptions?: LoadMediaOptions) => Promise<LoadedMedia>;

package/dist/client/client.d.ts

@@ -33,10 +33,12 @@ export declare class Client extends TypedEventEmitter<ClientEventMap> {
     private readonly machine;
     private reconnectStrategy;
     private readonly authGuard;
+    private readonly clearAuthReasons;
     private readonly operationGuard;
     private readonly presenceThrottle;
     private readonly scheduleLimiter;
     private authExhausted;
+    private storesClosedByDisconnect;
     /** Each chat's disappearing timer, learned from inbound messages so outbound sends can inherit it. */
     private readonly chatExpiration;
     private _socket;
@@ -197,5 +199,12 @@ export declare class Client extends TypedEventEmitter<ClientEventMap> {
     downloadMedia(key: WAMessageKey): Promise<MediaDownloadResult | null>;
     private lookupQuoted;
     private handleClose;
+    /**
+     * disconnect() still releases connections, so a script that disconnects can exit. Reconnecting
+     * re-opens what it closed; before this, connect() after disconnect() failed with STORE_CLOSED.
+     */
+    private reopenStores;
+    /** Snapshot the credentials before any erase, so a wrong wipe stays recoverable. */
+    private quarantineCreds;
     private rejectPendingConnect;
 }

package/dist/client/types.d.ts

@@ -33,6 +33,31 @@ export interface ReconnectOptions {
     /** Fixed backoff applied when the disconnect reason is `rate-limited` (429). Default `300000`. */
     rateLimitedDelayMs?: number;
 }
+export interface SessionSafetyOptions {
+    /**
+     * Disconnect reasons permitted to erase stored credentials. Defaults to `['logged-out']` only —
+     * see {@link DEFAULT_CLEAR_AUTH_REASONS}. Pass the wider set to restore pre-4.15 behaviour.
+     */
+    clearAuthOn?: readonly DisconnectReasonDomain[];
+}
+export interface MediaOptions {
+    /** Byte ceiling for media read from a URL or file. Default 64 MB. */
+    maxBytes?: number;
+    /** Treat plain strings as filesystem paths. Default `true`; `false` = URLs, Buffers and `file:` URLs only. */
+    allowLocalPaths?: boolean;
+    /** Allow fetching loopback, RFC1918 and link-local addresses. Default `false`. */
+    allowPrivateNetwork?: boolean;
+    /** Extra directories media may never be read from. The auth directory is always protected. */
+    deniedDirs?: readonly string[];
+    /** Largest image the decoders accept, in pixels. Default 50 MP; lower it on small servers. */
+    maxImagePixels?: number;
+    /** ffmpeg processes at once. Each 1080p re-encode holds ~235 MB. Default 4. */
+    maxConcurrentFfmpeg?: number;
+    /** ffmpeg jobs allowed to wait for a slot before new ones are rejected. Default 64. */
+    maxQueuedFfmpeg?: number;
+    /** Longest an ffmpeg job may wait for a slot. Default 120000. */
+    ffmpegQueueTimeoutMs?: number;
+}
 export interface ClientOptions {
     /** Message transport: baileys (WhatsApp Web, default) or the official Meta Cloud API. */
     provider?: ProviderKind;
@@ -55,6 +80,13 @@ export interface ClientOptions {
     ignoreMe?: boolean;
     /** Bounds QR/pairing regeneration to avoid spam restriction. ON by default; `{ enabled: false }` to opt out. */
     authGuard?: AuthGuardOptions;
+    /** Guards the stored session. By default only an explicit logout may erase credentials. */
+    session?: SessionSafetyOptions;
+    /**
+     * Media loading and processing limits. Process-wide: they govern shared CPU, RAM and ffmpeg
+     * children, so with several clients in one process the last one constructed wins.
+     */
+    media?: MediaOptions;
     /** Spaces out sensitive group/community/newsletter operations. ON by default; `{ enabled: false }` to opt out. */
     operationGuard?: OperationGuardOptions;
     /** Drops duplicate presence (typing/recording/online) updates within a window. ON by default. */

package/dist/cloud/transport.d.ts

@@ -8,6 +8,7 @@ export interface CloudMe {
     id: string;
     name?: string;
 }
+export declare const assertMetaMediaHost: (raw: string) => void;
 export declare class CloudTransport implements Transport {
     readonly ev: EventEmitter<[never]>;
     readonly user: {

package/dist/cloud/types.d.ts

@@ -9,6 +9,11 @@ export interface CloudOptions {
     verifyToken?: string;
     /** Meta app secret; enables X-Hub-Signature-256 verification of webhook POSTs. */
     appSecret?: string;
+    /**
+     * Accept webhook POSTs that carry no verified signature. Off by default — without `appSecret`
+     * anyone who learns the endpoint URL can inject inbound events. Local development only.
+     */
+    allowUnsigned?: boolean;
     /** Graph API version, e.g. 'v23.0'. Defaults to the pinned stable version. */
     apiVersion?: string;
     /** Override the Graph API origin (tests / proxies). */

package/dist/cloud/webhook.d.ts

@@ -2,6 +2,11 @@ export type WebhookHandler = (req: Request) => Promise<Response>;
 export interface WebhookHandlerOptions {
     verifyToken?: string;
     appSecret?: string;
+    /**
+     * Accept POSTs without an `appSecret` to verify them. Off by default: an unverified endpoint lets
+     * anyone who learns the URL inject inbound messages. Only for local development.
+     */
+    allowUnsigned?: boolean;
     onPayload: (payload: unknown) => void;
 }
 /**

package/dist/connection/auth-adapter.d.ts

@@ -1,4 +1,10 @@
 import type { SignalKeyStore } from 'baileys';
 import type { AuthStore } from '../auth/types.js';
 import type { Logger } from '../client/types.js';
+/**
+ * `clear` is deliberately omitted. Every adapter's `signal.clear()` also erases credentials
+ * (AUTH-07), and baileys types `SignalKeyStore.clear` as optional — handing it over would let a
+ * future baileys release wipe a live session while merely resetting signal state. zaileys' own
+ * logout path calls `auth.signal.clear()` directly instead.
+ */
 export declare function signalKeyStoreFromAuthStore(store: AuthStore, _logger?: Logger): SignalKeyStore;

package/dist/connection/disconnect-reason.d.ts

@@ -2,5 +2,12 @@ export type DisconnectReasonDomain = 'logged-out' | 'connection-replaced' | 'for
 export declare function mapDisconnectReason(code: number | undefined): DisconnectReasonDomain;
 export declare function isFatalDisconnect(reason: DisconnectReasonDomain): boolean;
 export declare function isRateLimited(reason: DisconnectReasonDomain): boolean;
-export declare function shouldClearAuth(reason: DisconnectReasonDomain): boolean;
+/**
+ * Reasons allowed to erase stored credentials. Deliberately just `logged-out`: baileys defaults an
+ * unknown stream error and an unrecognised WS error to 500 (`bad-session`), and 440
+ * (`connection-replaced`) means the creds are valid and in use elsewhere — erasing on either
+ * destroys a working session over ordinary network noise.
+ */
+export declare const DEFAULT_CLEAR_AUTH_REASONS: readonly DisconnectReasonDomain[];
+export declare function shouldClearAuth(reason: DisconnectReasonDomain, allowed?: readonly DisconnectReasonDomain[]): boolean;
 export declare function shouldReconnect(reason: DisconnectReasonDomain): boolean;

package/dist/events/context.d.ts

@@ -190,6 +190,12 @@ export interface MessageContext {
     mentions: string[];
     links: string[];
     isFromMe: boolean;
+    /**
+     * Whether this context came from a message we actually stored. `false` means it was rebuilt from
+     * the sender's own `contextInfo` — the text, the author and `isFromMe` are the sender's claim, not
+     * proof. Require `verified` before trusting a quote for an authorization decision.
+     */
+    verified: boolean;
     isGroup: boolean;
     isNewsletter: boolean;
     isBroadcast: boolean;
@@ -236,6 +242,8 @@ export interface MentionAllContext extends MessageContext {
     members?: string[];
 }
 export interface BuildContextInput {
+    /** Defaults to true; set false when the context was rebuilt from unauthenticated `contextInfo`. */
+    verified?: boolean;
     message: WAMessage;
     key: WAMessageKey;
     channelId: string;

package/dist/events/guards.d.ts

@@ -1,4 +1,8 @@
-import type { WAMessage, MessageUpsertType } from 'baileys';
+import { type WAMessage, type MessageUpsertType } from 'baileys';
+/**
+ * Protocol messages that only ever originate from our own devices. WhatsApp does not authenticate
+ * the sender of these for us, so an ordinary contact can put one on the wire.
+ */
 export declare const SELF_ONLY_PROTOCOL_TYPES: readonly ["HISTORY_SYNC_NOTIFICATION", "APP_STATE_SYNC_KEY_SHARE", "LID_MIGRATION_MAPPING_SYNC", "PEER_DATA_OPERATION_REQUEST_RESPONSE_MESSAGE"];
 export type SelfOnlyProtocolType = (typeof SELF_ONLY_PROTOCOL_TYPES)[number];
 export interface UpsertPayload {

package/dist/events/pipeline.d.ts

@@ -24,6 +24,13 @@ export interface InboundPipelineContext {
     sendReply?: (target: string, content: string, opts: TextOptions | undefined, quoted: WAMessage) => Promise<WAMessageKey>;
     react?: (key: WAMessageKey, emoji: string) => Promise<WAMessageKey>;
     ignoreMe?: boolean;
+    /** Messages allowed to wait on LID resolution at once. Default 256. */
+    maxPendingResolutions?: number;
+    /**
+     * Weight budget for messages queued behind those; beyond it the overflow is shed. A plain message
+     * weighs 1, mentions and long text add to it. Default 20000.
+     */
+    maxQueuedResolutions?: number;
 }
 export interface BaileysEventSurface {
     on: (event: string, handler: (...args: unknown[]) => void) => void;