## [v1.6.4] - 2026-07-12

### Added
- **Direct Chat URL** (#85): Added `/dashboard/chat/[jid]` route to open a chat directly by phone number. URL path syncs when selecting chat from list.

### Changed
- **Webhook Log Optimization**: Removed `raw: message` from webhook payload to reduce storage. Truncated `responseBody` to max 1KB. Added auto-cleanup that deletes logs older than 30 days and caps at 500 logs per webhook.

### Fixed
- **Reply Input Focus** (#84): Reply text box now automatically gains focus when clicking the reply arrow or using context menu reply.

## [v1.6.3] - 2026-06-30

### Added
- **Automated Deployment**: Added `start.sh` deployment script that features PM2 startup configuration, early port conflict checks, existing admin verification, and end-of-script security warnings for default `.env` credentials.
- **Recurring Schedules**: The Scheduler now supports recurring messages with interval options: Every X Minutes, Every X Hours, Specific Days of Week, or Custom Cron Expressions.
- **Scheduler JID Types**: Added a radio selector on the Scheduler UI to quickly target Personal chats, WhatsApp Groups, or Newsletters (Channels) without manually typing domain suffixes (`@s.whatsapp.net`, `@g.us`, `@newsletter`).
- **Media-only Auto Replies & Schedules**: Both Auto Reply and Scheduler features now allow sending messages containing only media (images, videos, documents) without requiring text content.

### Changed
- **UI Redesign**: Modernized the Session List table and redesigned application Error Pages for a cleaner and more professional user experience.
- **Scheduler UX Redesign**: The "Send At" form fields are now dynamically hidden or adjusted based on the selected schedule type (One-time vs. Recurring vs. Specific Days) for a cleaner and more intuitive experience.
- **Environment & PM2 Config**: Removed hardcoded `PORT` from `ecosystem.config.js` to strictly prioritize `.env` configs, and reorganized `.env.example`.
- **License**: Switched the project license to standard MIT.
- **Documentation**: Updated Swagger specs, `API_DOCUMENTATION.md`, and `UPDATE_GUIDE.md` to document the new `start.sh` workflow, session API responses, and the new schedule properties.

### Fixed
- **API Validation Error**: Fixed a backend validation bug that rejected POST/PUT requests to the Scheduler API with `400 Bad Request` if the text content was empty despite a media URL being provided.
- **Environment Loading**: Fixed a bug where environment variables were not loaded correctly in development mode.
- **React Hydration**: Resolved hydration mismatch bugs and TypeScript inference errors in error pages.

## [v1.6.2] - 2026-06-28

### Added
- **Webhook Logs & Test**: Added dedicated endpoints and popup dialog to test and view realtime webhook delivery logs with auto-refresh and load more pagination (#67).
- **Webhook Receiver Field**: Added explicit `receiver` field to `message.received` and `onMessageReceived` webhooks (#58).
- **GitHub Templates**: Added issue templates, PR template, `SECURITY.md`, `CODEOWNERS`, and `FUNDING.yml`.

### Changed
- **Chat Transitions**: Implemented seamless chat switching by keeping the UI mounted during message loading to prevent layout flickering.
- **Webhook Logs UI**: Redesigned to master-detail split layout, improved JSON payload viewing area, and resolved UI overflow/scrolling issues.
- **Docker Multi-stage Build**: Refactored `Dockerfile` for multi-stage build, adding `.dockerignore`, cleaning cache, and pruning dev dependencies.
- **Node Version**: Bumped Node version from 20-alpine to 26-alpine (#63, #64, #62).
- **React 19 Compat**: Added `--legacy-peer-deps` to Dockerfile `npm ci` for swagger-ui-react compatibility.
- **Docs UI**: Restyled code blocks on `/docs` page to clean minimalist (Stripe style).
- **Swagger Updates**: Bumped swagger to v1.6.1 and added complete webhook payload examples.
- **CI Workflows**: Cleaned up CI workflows, keeping only templates and dependabot.

### Fixed
- **Browser Tab Title**: Made metadata tab title dynamically follow the Application Name defined in system settings (#71).
- **Chat Auto-Focus**: Fixed chat input not automatically gaining focus on chat switch by resolving loading unmount conflict (#70).
- **Webhook Logs Issues**: Fixed dynamic system timezone configuration, stale closure polling bug, and constrained modal height.
- **Auth & Security**: Applied critical auth fixes and proper session resolution in test & logs endpoints.
- **Docs UI Bug**: Fixed code blocks being invisible on `/docs` page.
- **JID Suffix**: Stripped device suffix (`:47`) from own JID in webhook receiver/from.
- **Superadmin Webhooks**: Fixed webhooks created by superadmins not being triggered or displayed for session owners. Session owners can now also fully manage (edit, toggle, test, view logs, delete) webhooks created by superadmins on their sessions.

## [v1.6.1] - 2026-06-27

### Fixed
- **Webhook not fired for sent messages (#57)**: Explicit webhook dispatch added after `sendMessage()` in both `ChatService.sendTextMessage()` and `ChatService.sendMediaMessage()`. Also added to all API message routes (contact, location, poll, reply, sticker). No longer relies on fragile Baileys `messages.upsert` event.
- **Receiver info in webhook payload (#58)**: Added explicit `receiver` field to `message.sent` webhook for clarity.
- **Webhook empty key fields**: Fixed Baileys `WAMessage` vs `MessageKey` type mismatch — now correctly extracts `MessageKey` from returned `WAMessage` before passing to webhook.

### Changed
- **Swagger version**: Updated from v1.3.0 to v1.6.1, endpoint count corrected to 91.
- **Docs**: Added 15 webhook payload examples to `API_DOCUMENTATION.md` covering all event types (message.received, message.sent, message.status, message.deleted, message.edited, connection.update, group.update, group.participant, contact.update, status.update).

## [v1.6.0] - 2026-06-23

### Added
- **Inbox Page** (`/dashboard/inbox`): Dedicated user notifications reader with filters (All/Unread/Read), mark as read, delete, and click-to-action navigation.
- **Reply System**: Chat messages can now be replied to — reply bar shows preview of original message, quoted reply sent via Baileys `contextInfo`.
- **Right-Click Context Menu**: On message bubbles — Reply, Copy, Delete, and Info actions. On chat list items — Open Chat and Copy JID.
- **Label Badges in Chat List**: Colored dots displayed next to chat names showing assigned labels, always visible without hover.
- **Label Assignment from Chat List**: Hover label button on each chat row opens popover to toggle label assignments inline.
- **Label API by JID**: `GET /api/labels/[sessionId]/chats?jid=` endpoint to fetch labels assigned to a specific chat.
- **Keyboard Shortcuts**: In Chat Window — `Esc` to cancel reply, `?` to show shortcuts help.
- **Broadcast History Persistence**: Broadcast logs saved to DB with `BroadcastLog` and `BroadcastRecipient` tables. History tab with detail modal per broadcast.
- **SEO Optimization**: Full metadata (OG, Twitter, keywords, canonical), conditional `robots.ts`/`sitemap.ts` based on `NEXT_PUBLIC_ALLOW_INDEXING` env, JSON-LD-ready.
- **Notifications API `?jid=` support**: Fetch labels assigned to a specific chat JID.
- **Configurable Pagination Size**: `NEXT_PUBLIC_CHAT_PAGE_SIZE` env variable controls chats loaded per page (default 50).

### Changed
- **RAM Optimization — Session Reconnect Limit**: Max 3 reconnect attempts per session. After exceeding, session auto-stops and removes itself from memory manager.
- **Session Default STOPPED**: Newly created sessions no longer auto-init socket. Status set to `STOPPED`; user must click Start to connect.
- **Load Sessions Skip Idle**: `loadSessions()` skips restoring sessions without auth credentials (never connected before).
- **Memory Cleanup**: Instances removed from manager Map on LOGGED_OUT, STOPPED, or max-reconnect failure. No orphan instances in memory.
- **Anti-Delete Fix**: Session config `antiDelete` now correctly preserves original message content instead of always replacing with deleted marker.
- **Performance — Docs Page**: Replaced heavy `react-syntax-highlighter` (200KB+ bundle) with lightweight `<pre>` blocks + copy button.
- **Performance — Chat List Cursor Pagination**: Replaced OFFSET with cursor-based (`m1.timestamp < ?`). OFFSET broke with real-time updates. SQL now has proper `LIMIT ?` — no more fetching all messages.
- **Performance — Label Fetch N+1**: Chat list label dots now use 1 batch API call instead of N separate calls.
- **UI — Reply Button Position**: Own messages: reply button on left. Others' messages: reply button on right.
- **UI — English Only**: All remaining Indonesian strings translated to English across broadcast, labels, and bot-settings pages.
- **Chat Service**: `getChatsList` param `offset` → `before` (cursor string). Contacts/groups lookup limited to JIDs in result set.
- **Batch Label API**: `GET /api/labels/[sessionId]/chats` without params returns all assignments in 1 query.
- **Api Docs**: Endpoint count bumped from 64 to 68, new broadcast history endpoints documented.

### Fixed
- **Session Settings 405 Error**: Frontend was sending POST to a PATCH-only route; fixed method mismatch.
- **Label "No chats assigned" Bug**: Wrong API endpoint `/list/{id}` → fixed to `/chats?labelId={id}`.
- **Reply Bar Overflow**: Long replied messages no longer push the close (X) button out of view — added `overflow-hidden` and `w-full truncate`.
- **Notification Truncation**: Removed `line-clamp-2` from notification messages — full text now visible in inbox and popover.
- **Native `confirm()` Replaced**: Native browser confirm in ChatWindow delete replaced with shadcn `AlertDialog`.
- **Duplicate `canAccess` Declaration**: Fixed TypeScript build error in labels chats route.
- **Table Overflow on Mobile**: Changed `whitespace-nowrap` to `whitespace-normal` for responsive table cells.
- **Settings Route Mismatch**: Frontend `POST` → `PATCH` for bot settings save.
- **Chat List CPU Spike**: SQL query had no `LIMIT` — added directly with cursor pagination.
- **Build Error**: Restored needed `normalizeJid` import in chat service.
- **Favicon Disappeared**: Removed non-existent icon paths — Next.js auto-generates again.
- **Chat List Scroll Render & Glitch**: Fixed list items shuffling or displaying wrong/swapped contact names on scroll by supplying stable `key={chat.jid}` to item renderers.
- **Infinite Scroll Concurrency**: Added a `fetchingRef` lock during pagination to prevent duplicate parallel fetches and race conditions.
- **Search Debouncing**: Separated search text input from the query state to ensure the debouncing delay is properly respected before database querying.
- **Reply Message System**: Fixed missing message reply storage by extracting and storing `quoteId` from incoming and outgoing messages. Fixed recipient JID string parsing to prevent corrupted double domain serialization, enabling messages to be correctly received as replies.
- **Reply Scroll & Highlight**: Added a visual quote preview block inside message bubbles and interactive scroll-to-quote with highlight transition animation on click.

### Performance
- **Bundle Size**: Removed `react-syntax-highlighter` dependency — docs page loads significantly faster.
- **Session Memory**: Idle/disconnected sessions no longer hold socket instances in RAM.
- **Log Spam**: Infinite reconnect loop stopped — no more log flooding from disconnected sessions.

### Database
- **New Models**: `BroadcastLog`, `BroadcastRecipient` — persistent broadcast history with cascade delete.
- **Index**: Added `@@index([sessionId, remoteJid, timestamp])` on Message table for GROUP BY query performance.

---

### Added
- **Inbox Page** (`/dashboard/inbox`): Dedicated user notifications reader with filters (All/Unread/Read), mark as read, delete, and click-to-action navigation.
- **Reply System**: Chat messages can now be replied to — reply bar shows preview of original message, quoted reply sent via Baileys `contextInfo`.
- **Right-Click Context Menu**: On message bubbles — Reply, Copy, Delete, and Info actions. On chat list items — Open Chat and Copy JID.
- **Label Badges in Chat List**: Colored dots displayed next to chat names showing assigned labels, always visible without hover.
- **Label Assignment from Chat List**: Hover label button on each chat row opens popover to toggle label assignments inline.
- **Label API by JID**: `GET /api/labels/[sessionId]/chats?jid=` endpoint to fetch labels assigned to a specific chat.
- **Keyboard Shortcuts**: In Chat Window — `Esc` to cancel reply, `?` to show shortcuts help.
- **Broadcast History Persistence**: Broadcast logs saved to DB with `BroadcastLog` and `BroadcastRecipient` tables. History tab with detail modal per broadcast.
- **SEO Optimization**: Full metadata (OG, Twitter, keywords, canonical), conditional `robots.ts`/`sitemap.ts` based on `NEXT_PUBLIC_ALLOW_INDEXING` env, JSON-LD-ready.
- **Notifications API `?jid=` support**: Fetch labels assigned to a specific chat JID.

### Changed
- **RAM Optimization — Session Reconnect Limit**: Max 3 reconnect attempts per session. After exceeding, session auto-stops and removes itself from memory manager.
- **Session Default STOPPED**: Newly created sessions no longer auto-init socket. Status set to `STOPPED`; user must click Start to connect.
- **Load Sessions Skip Idle**: `loadSessions()` skips restoring sessions without auth credentials (never connected before).
- **Memory Cleanup**: Instances removed from manager Map on LOGGED_OUT, STOPPED, or max-reconnect failure. No orphan instances in memory.
- **Anti-Delete Fix**: Session config `antiDelete` now correctly preserves original message content instead of always replacing with deleted marker.
- **Performance — Docs Page**: Replaced heavy `react-syntax-highlighter` (200KB+ bundle) with lightweight `<pre>` blocks + copy button.
- **Performance — Chat List**: Virtuoso virtual scrolling, lazy media loading, IntersectionObserver for images/videos.
- **UI — Reply Button Position**: Own messages: reply button on left. Others' messages: reply button on right.
- **UI — English Only**: All remaining Indonesian strings translated to English across broadcast, labels, and bot-settings pages.
- **Api Docs**: Endpoint count bumped from 64 to 68, new broadcast history endpoints documented.
- **Unread Dot Style**: Notification indicator now uses proper `h-2 w-2` with `ring` for modern badge look.

### Fixed
- **Session Settings 405 Error**: Frontend was sending POST to a PATCH-only route; fixed method mismatch.
- **Label "No chats assigned" Bug**: Wrong API endpoint `/list/{id}` → fixed to `/chats?labelId={id}`.
- **Reply Bar Overflow**: Long replied messages no longer push the close (X) button out of view — added `overflow-hidden` and `w-full truncate`.
- **Notification Truncation**: Removed `line-clamp-2` from notification messages — full text now visible in inbox and popover.
- **Native `confirm()` Replaced**: Native browser confirm in ChatWindow delete replaced with shadcn `AlertDialog`.
- **Duplicate `canAccess` Declaration**: Fixed TypeScript build error in labels chats route.
- **Table Overflow on Mobile**: Changed `whitespace-nowrap` to `whitespace-normal` for responsive table cells.
- **Settings Route Mismatch**: Frontend `POST` → `PATCH` for bot settings save.

### Performance
- **Bundle Size**: Removed `react-syntax-highlighter` dependency — docs page loads significantly faster.
- **Session Memory**: Idle/disconnected sessions no longer hold socket instances in RAM.
- **Log Spam**: Infinite reconnect loop stopped — no more log flooding from disconnected sessions.

### Database
- **New Models**: `BroadcastLog`, `BroadcastRecipient` — persistent broadcast history with cascade delete.
- **Index**: Added `@@index([sessionId, remoteJid, timestamp])` on Message table for GROUP BY query performance.

---

## [v1.5.5] - 2026-06-03

### Added
- **Message Editing**: Introduced a new endpoint `PATCH /api/messages/[sessionId]/[jid]/[messageId]` to edit sent text messages.

### Changed
- **Cleaned Deprecated Endpoints**: Removed over 45 deprecated legacy endpoints from the codebase. Regenerated the Swagger specification and `API_DOCUMENTATION.md` so that it accurately reflects the 81 active routes.

### Fixed
- **Webhook Management**: Fixed a bug where webhooks could not be edited or deleted. The backend now robustly queries sessions using both internal CUIDs and external string identifiers to resolve lookups.
- **Timezone Settings Alignment**: Fixed an issue where the Timezone configuration set in the WebApp settings was not visually respected by the Scheduler list or Navbar Real-time Clock (which previously fell back to the browser's local timezone). Both now strictly adhere to the system-configured timezone.

---

## [v1.5.4] - 2026-05-21

### Added
- **Docker Integration**: Added a multi-stage `Dockerfile` to package and build the Next.js web application.
- **Dynamic Timezone Settings**: Replaced hardcoded timezone selections in settings with dynamically generated list options fetched using browser `Intl` APIs.
- **Modals for Editing Operations**: Shifted editing interfaces (for webhooks, scheduler, labels, and auto-replies) from inline forms to modal dialog popups (`Dialog` components) for cleaner and decoupled creation/modification workflows.

### Fixed
- **Security Hardening**:
  - Prevented IDOR (Insecure Direct Object Reference) exploits across Webhooks (PUT/DELETE), Scheduler (PUT), and System Monitor GET endpoints by enforcing session ownership constraints.
  - Eliminated raw SQL querying (`queryRawUnsafe`) inside the Anti-Spam module, replacing it with secure, type-safe Prisma Client APIs.
- **Media Messaging with Captions**: Patched Baileys media sending by downloading web-based media URLs to buffers and passing them with appropriate normalized caption metadata.
- **UI/UX Refinements**:
  - Redesigned the topbar Session Selector dropdown with connection status badges, visual styling, and mobile responsiveness.
  - Restricted navigation visibility on the Sidebar to hide menu items that are not permitted for the user's role.
  - Fixed unbalanced JSX tags in bot settings page and type safety issues in navigation item filters.

---

## [v1.5.3.3] - 2026-04-19

### Fixed
- **Newsletter Media Native Patch**: Migrated from custom manual `patch-baileys.js` script to the standardized `patch-package` system. This makes the newsletter media unencrypted download fix (which resolves the persistent "HTTP 400 Bad Request" when downloading WhatsApp Channel media) native to the package manager, ensuring it safely persists across future `npm install` or deployment cycles.

---

## [v1.5.3.2] - 2026-04-19

### Fixed
- **[CRITICAL] Newsletter Media Upload Endpoint Failure**: Fixed an insidious ES6 Arrow Function scope binding bug in Baileys (`arguments[1].newsletter`) that caused Newsletter media payloads to bypass the `/newsletter/newsletter-*` CDN routes. All uploads are now guaranteed to travel through the unencrypted Channel CDN pipeline instead of the standard encrypted pathways, eliminating the `400 Bad Request` downloads.
- **Mobile Client PNG Crash Recovery**: Added rigid server-side validation to the Media API, strictly blocking PNGs/non-JPEG formats on WhatsApp Channels. The API now gracefully returns an explicit UI error notification since the mobile WhatsApp UI natively crashes/rejects non-JPEG payloads injected directly to the channel unencrypted CDN.
- **Webhook Connection Destructuring Error**: Removed unstable `sock.requestMediaConn()` function calls causing `500 Server Error` webhook panics during media retrieval failovers.

---

## [v1.5.3.1] - 2026-04-18

### Fixed
- **Newsletter Media Webhook Crash**: Fixed a critical issue where sending unencrypted media to a WhatsApp Newsletter would crash the webhook (`Cannot derive from empty media key`) by securely downloading the unencrypted file straight from the WhatsApp MMG servers using its `directPath`.
- **Newsletter Media (Error 479) & Silent Failure**: Overhauled the Baileys patch script to fully implement official PR `#2434` fixes for WhatsApp Newsletters. The robust RegEx-powered `postinstall` patch now correctly redirects uploads to `/newsletter/newsletter-*` paths, appends `server_thumb_gen=1`, enforces `url: null` for unencrypted objects, maps proper thumbnail hashes, and sets `mediatype` nodes. This fully resolves the mysterious "Error 479" ACK rejections and silent failures when sending media to channels.

---

## [v1.5.3] - 2026-04-08
### Added
- **WhatsApp Communities Support**: Added `isCommunity` and `linkedParentJid` to Group metadata schema, including automatic recognition and storage of Community structures during Group synchronization.
- **Advanced Webhook Events**: Added `group.update`, `group.participant`, `message.edited`, and `message.deleted` events for real-time tracking of precise WhatsApp actions.
- **Drag and Drop Media**: Added intuitive Drag and Drop overlay to the Chat Window for instant image, video, audio, and document uploads.
- **Media Download Enhancements**: Enhanced Media layout in Chat Window with "Download" buttons and an interactive "Downloading..." notification toaster UI.
- **Shared Session Webhooks**: Webhooks are now universally dispatched to all users with shared `SessionAccess`, instead of only the original session owner.
- **Labels Chat Assignment**: Enhanced Labels page with expandable cards showing assigned chats, and a contact picker to assign/unassign chats from labels.
- **Label Chats API**: New `GET /api/labels/[sessionId]/chats?labelId=` endpoint to fetch chats assigned to a label with contact name enrichment.

### Changed
- **Beautiful Console Logger**: Replaced all standard `console.log` and `console.error` calls across the core backend engine with a custom colored `logger` module.

### Fixed
- **Dashboard Webhooks UI**: Added missing `message.edited`, `message.deleted`, and `group.participant` events to the available webhook subscriptions list.
- **Initial Sync Message Disappearance**: Fixed a bug where initial messages in newly created chats were skipped when wrapped inside protocol messages (like edit/revoke types).
- **Missing Group Names in Chat List**: `ChatService.getChatsList` now natively fetches from the `Group` model so group chats don't appear as blank phone numbers.
- **Chat History Pagination**: Fixed a UI bug where the Chat Window would load the oldest 100 messages instead of newest ones. Corrected `.us` vs `.net` JID mismatches for real-time WebSockets.
- **Dashboard Disconnect Stats**: Perfected System Monitor Disconnected counts to properly group anything other than `CONNECTED` (e.g. `LOGGED_OUT`, `SCAN_QR`) as disconnected, accurately pulling from DB history when offline.
- **Pushed Names in Private Chats**: Prevented sender push names from rendering above chat bubbles in private Direct Messages (now strictly restricted to Group Chats).
- **Mobile Responsiveness Enhancements**: 
    - Replaced `<p>` with `<SheetDescription>` in mobile nav to fix Radix UI accessibility warnings.
    - Hidden clock and divider on small screens, reduced session selector width.
    - Made Session Detail Page Header responsive with flex-wrap for mobile.
- **Contacts Page Pagination**: Replaced unreasonable limit options (up to 3000) with 10/25/50/100/Show All options limit API parameters.

---

## [v1.5.3-beta.3] - 2026-04-08

### Fixed
- **Dashboard Webhooks UI**: Added missing `message.edited`, `message.deleted`, and `group.participant` events to the available webhook subscriptions list to ensure full parity with the actual events triggered by the backend engine.

---

## [v1.5.3-beta.2] - 2026-04-03

### Added
- **WhatsApp Communities Support**:
    - Added `isCommunity` and `linkedParentJid` to Group metadata schema.
    - Automatic recognition and storage of Community structures during Group synchronization.
- **Advanced Webhook Events**:
    - Added `group.update` event (triggered on subject, description, or group picture changes).
    - Added `group.participant` event (triggered when users join, leave, or are promoted/demoted).
    - Added `message.edited` and `message.deleted` (revoke) events for real-time tracking of message modifications.
- **Drag and Drop Media**:
    - Added intuitive Drag and Drop overlay to the Chat Window for instant image, video, audio, and document uploads.
- **Media Download Enhancements**:
    - Enhanced Media layout in Chat Window with generic "Download" buttons for Images, Videos, Audio, and Documents.
    - Added an interactive "Downloading..." notification toaster UI.
- **Shared Session Webhooks**:
    - Webhooks are now universally dispatched to all users with shared `SessionAccess`, instead of only the original session owner.

### Fixed
- **Initial Sync Message Disappearance**:
    - Fixed a bug where initial messages in newly created chats were completely skipped because Baileys wrapped them inside protocol messages (like edit/revoke types). 
- **Missing Group Names in Chat List**:
    - Fixed an issue where group chats appeared as blank phone numbers in the Chat List dashboard. `ChatService.getChatsList` now natively fetches from the `Group` model for accurate subject rendering.
- **Chat History Pagination**:
    - Fixed a UI bug where the Chat Window would load the **oldest 100 messages** instead of the newest ones (`orderBy` timestamp was ascending). Newest messages now load reliably.
    - Corrected real-time WebSocket `.us` vs `.net` JID inconsistencies so incoming messages snap exactly into active windows.
- **Dashboard Disconnect Stats**:
    - Perfected System Monitor Disconnected counts: Everything *other* than `CONNECTED` (e.g. `LOGGED_OUT`, `SCAN_QR`) is now logically grouped as disconnected.
- **Pushed Names in Private Chats**:
    - Prevented sender push names from rendering above chat bubbles in private Direct Messages (now strictly restricted to Group Chats).

---

## [v1.5.3-beta.1] - 2026-03-22

### Fixed
- **SheetContent Accessibility Warning**: Replaced `<p>` with `<SheetDescription>` in mobile nav to fix Radix `aria-describedby` warning.
- **Navbar Overflow on Mobile**: Hidden clock and divider on small screens, reduced session selector width.
- **Session Detail Page Header**: Made responsive with flex-wrap for mobile.
- **Disconnect Stats Returning Zeros**: System monitor API now queries real DB counts even when session is offline.
- **Contacts Page Pagination**: Replaced unreasonable limit options (up to 3000) with 10/25/50/100/Show All. API now supports `limit=all`.

### Added
- **Labels Chat Assignment**: Enhanced Labels page with expandable cards showing assigned chats, contact picker to assign/unassign chats from labels.
- **Label Chats API**: New `GET /api/labels/[sessionId]/chats?labelId=` endpoint to fetch chats assigned to a label with contact name enrichment.

### Changed
- **Beautiful Console Logger**: Replaced all standard `console.log`, `console.warn`, and `console.error` calls across the core WhatsApp engine, socket server, background jobs, and utility modules with a custom colored `logger`. This makes server logs much more readable and debugging significantly easier.

---

## [v1.5.2.1] - 2026-03-22

### Fixed
- **Mobile Sidebar Navigation Out of Sync**:
    - Synced mobile sidebar (`mobile-nav.tsx`) to match desktop sidebar (`sidebar-nav.tsx`).
    - Added missing pages: **Labels**, **Bot Profile**, **Session Access**.
    - Moved **Sessions / QR** from Administration to Main group.
    - Moved **Auto Reply** from Messaging to Automation group.
    - Fixed icon mismatches (Auto Reply now uses `MessageCircleReply` icon on both mobile and desktop).

---

## [v1.5.2] - 2026-03-20

### Added
- **Session Access Sharing**:
    - Session owners can now grant access to other registered users, allowing them to view and use the session without full ownership.
    - New Dashboard page (`/dashboard/sessions/access`) to manage shared access per session.
    - Quick "Share" button on each session card in Session Manager for fast access.
    - New API endpoints:
        - `GET /api/sessions/{sessionId}/access` — List users with shared access.
        - `POST /api/sessions/{sessionId}/access` — Grant access by email.
        - `DELETE /api/sessions/{sessionId}/access` — Revoke access by userId.
    - Sidebar navigation entry "Session Access" added under Administration group.
    - Security: Only session owners and SUPERADMINs can manage access. Prevents self-grant, owner-grant, and SUPERADMIN-grant.
    - Revoke access action requires AlertDialog confirmation for safety.
- **Broadcast Progress Monitoring**:
    - Real-time progress panel on Broadcast page showing Sent / Failed / Waiting counts.
    - Live animated progress bar with percentage indicator.
    - Current recipient tracking and error log display for failed messages.
    - Socket.IO `broadcast.progress` event emission from both broadcast API routes.
- **Profile Management Page** (`/dashboard/profile`):
    - View and edit WhatsApp Display Name, Status (About), and Profile Picture.
    - New API routes: `GET /api/profile/[sessionId]`, `PUT .../name`, `PUT .../status`, `PUT/DELETE .../picture`.
- **Labels Management Page** (`/dashboard/labels`):
    - Create, view, and delete WhatsApp labels from the dashboard.
- **Chat Service Module** (`src/modules/whatsapp/chat.service.ts`):
    - Centralized chat logic (getChatsList, getMessages, sendTextMessage, sendMediaMessage) to eliminate code duplication across Server Actions and API routes.
- **JID Normalization Utility**:
    - New `normalizeJid()` function in `jid-utils.ts` that standardizes `@c.us` → `@s.whatsapp.net`.
    - Applied consistently across Message storage, Contact upsert, and ChatService queries.

### Fixed
- **Chat List Not Syncing**:
    - Fixed JID mismatch between Contact table (`@c.us`/`@lid`) and Message table (`@s.whatsapp.net`) that caused chats to not appear.
    - Socket.IO `message.update` now serializes `timestamp` as ISO string instead of raw `Date` object.
    - Added `useRef`-based JID tracking in ChatList for reliable new-chat detection via socket events.
    - Added 800ms delay before refetching messages after send to allow Baileys to process `messages.upsert`.
- **Session Stats Showing 0**:
    - Fixed System Monitor API (`/api/system/monitor/[sessionId]`) to resolve session slug to database CUID before counting Contacts, Chats, and Messages.
- **Profile Page "Failed to load"**:
    - Implemented missing backend API routes for fetching WhatsApp profile data (name, status, picture) via Baileys socket methods.
- **Duplicate Sidebar Links**:
    - Removed redundant navigation entries for Auto Reply, Broadcasts, Contacts, and Groups.
- **Labels Page Syntax Errors**:
    - Fixed escaped backtick characters and missing imports that prevented the Labels page from compiling.

### Changed
- **Auth System (`api-auth.ts`)**:
    - `canAccessSession()` now checks `SessionAccess` records in addition to ownership.
    - `getAccessibleSessions()` now returns both owned and shared sessions for non-SUPERADMIN users.
    - New `isSessionOwner()` helper to distinguish ownership from shared access (used for protecting management endpoints).
- **Socket.IO Debug Logging**: Added detailed `[Socket]` console logs for `message.update` emissions showing keyId, remoteJid, and fromMe for easier debugging.
- **ChatWindow**: Media send now uses the same delayed-refresh pattern as text send for consistency.

### Database
- **New Model**: `SessionAccess` — many-to-many relationship between `User` and `Session` with cascade delete and unique `[sessionId, userId]` constraint.

---

## [v1.5.2-beta.2] - 2026-03-20

### Added
- **Session Access Sharing**:
    - Session owners can now grant access to other registered users, allowing them to view and use the session without full ownership.
    - New Dashboard page (`/dashboard/sessions/access`) to manage shared access per session.
    - New API endpoints:
        - `GET /api/sessions/{sessionId}/access` — List users with shared access.
        - `POST /api/sessions/{sessionId}/access` — Grant access by email.
        - `DELETE /api/sessions/{sessionId}/access` — Revoke access by userId.
    - Sidebar navigation entry "Session Access" added under Administration group.
    - Security: Only session owners and SUPERADMINs can manage access. Prevents self-grant, owner-grant, and SUPERADMIN-grant.
    - Revoke access action requires AlertDialog confirmation for safety.

### Changed
- **Auth System (`api-auth.ts`)**:
    - `canAccessSession()` now checks `SessionAccess` records in addition to ownership.
    - `getAccessibleSessions()` now returns both owned and shared sessions for non-SUPERADMIN users.
    - New `isSessionOwner()` helper to distinguish ownership from shared access (used for protecting management endpoints).

### Database
- **New Model**: `SessionAccess` — many-to-many relationship between `User` and `Session` with cascade delete and unique `[sessionId, userId]` constraint.

---

## [v1.5.2-beta.1] - 2026-03-15

### Added
- **Broadcast Progress Monitoring**:
    - Real-time progress panel on Broadcast page showing Sent / Failed / Waiting counts.
    - Live animated progress bar with percentage indicator.
    - Current recipient tracking and error log display for failed messages.
    - Socket.IO `broadcast.progress` event emission from both broadcast API routes.
- **Profile Management Page** (`/dashboard/profile`):
    - View and edit WhatsApp Display Name, Status (About), and Profile Picture.
    - New API routes: `GET /api/profile/[sessionId]`, `PUT .../name`, `PUT .../status`, `PUT/DELETE .../picture`.
- **Labels Management Page** (`/dashboard/labels`):
    - Create, view, and delete WhatsApp labels from the dashboard.
- **Chat Service Module** (`src/modules/whatsapp/chat.service.ts`):
    - Centralized chat logic (getChatsList, getMessages, sendTextMessage, sendMediaMessage) to eliminate code duplication across Server Actions and API routes.
- **JID Normalization Utility**:
    - New `normalizeJid()` function in `jid-utils.ts` that standardizes `@c.us` → `@s.whatsapp.net`.
    - Applied consistently across Message storage, Contact upsert, and ChatService queries.

### Fixed
- **Chat List Not Syncing**:
    - Fixed JID mismatch between Contact table (`@c.us`/`@lid`) and Message table (`@s.whatsapp.net`) that caused chats to not appear.
    - Socket.IO `message.update` now serializes `timestamp` as ISO string instead of raw `Date` object.
    - Added `useRef`-based JID tracking in ChatList for reliable new-chat detection via socket events.
    - Added 800ms delay before refetching messages after send to allow Baileys to process `messages.upsert`.
- **Session Stats Showing 0**:
    - Fixed System Monitor API (`/api/system/monitor/[sessionId]`) to resolve session slug to database CUID before counting Contacts, Chats, and Messages.
- **Profile Page "Failed to load"**:
    - Implemented missing backend API routes for fetching WhatsApp profile data (name, status, picture) via Baileys socket methods.
- **Duplicate Sidebar Links**:
    - Removed redundant navigation entries for Auto Reply, Broadcasts, Contacts, and Groups.
- **Labels Page Syntax Errors**:
    - Fixed escaped backtick characters and missing imports that prevented the Labels page from compiling.

### Changed
- **Socket.IO Debug Logging**: Added detailed `[Socket]` console logs for `message.update` emissions showing keyId, remoteJid, and fromMe for easier debugging.
- **ChatWindow**: Media send now uses the same delayed-refresh pattern as text send for consistency.

---

## [v1.5.1] - 2026-03-03

### Added
- **Global System Resource Monitoring**:
    - Centralized "System Monitor" dashboard for Superadmins to track CPU (Live & Per-core), RAM, Disk, and Network health.
    - Detailed process-level memory tracking (Heap/RSS) for the Node.js application.
- **Per-Session Health Monitoring**: 
    - Live Baileys socket ping/latency and connection uptime integrated directly into Session Detail pages.
- **Anti-Ban Protection (Anti-Spam Rate Limit)**:
    - High-performance message queue system to prevent WhatsApp account bans.
    - Configurable per-session thresholds, randomized delays, and FIFO message sequence management.
- **Improved Administration UI**:
    - Added security warnings on login/dashboard if Public Registration is enabled.
    - Sidebar navigation overhaul for better feature grouping (Messaging, Automation, Administration).
    - New dashboard controls for Command Prefix and Max Sticker Duration.
- **WhatsApp Pairing Code Connection**:
    - Support for linking WhatsApp accounts via 8-character pairing codes as an alternative to QR scanning.
    - Integrated "Link with Phone Number" UI in Session Detail page with one-click copy support.
    - Optimized browser identification for maximum compatibility with WhatsApp's pairing system.
- **Message View & Media Download**:
    - Fixed individual chat message visibility issues by standardizing API response structures.
    - Added one-click Media Download buttons for Image, Video, Audio, and Document messages in the Chat Window.
- **Standardization**: RESTful API path parameter standardization using `[sessionId]` and a consistent `{ status, message, data }` response format.

### Changed
- **SEO & Accessibility**: Introduced `NEXT_PUBLIC_ALLOW_INDEXING` toggle to control global search engine crawling (Default: noindex).
- **Alert System Overhaul**: Replaced intrusive browser `alert()` and `confirm()` calls with modern Sonner Toasts and Radix UI dialogs.
- **Mobile-First Responsiveness**: Comprehensive design update for 12+ dashboard pages to ensure flawless mobile viewing (tabs, headers, and grids).
- **Socket Reliability**: Refactored socket status detection for always-accurate "CONNECTED" reporting via readyState investigation.

### Fixed
- **Next.js 15 Compatibility**: Resolved critical TypeScript errors with Promise-wrapped route params.
- **JID Normalization**: Standardized mapping of `@lid` (Linked Device) to phone `@s.whatsapp.net` across Webhooks, Store, and UI.
- **JID Encoding**: Fixed 404 router errors caused by unencoded `@` symbols in API documentation examples.
- **Anti-Spam Stability**: Fixed socket wrapper preservation during session re-initialization.

---

## [v1.5.1-beta.3] - 2026-03-03

### Changed
- **SEO Accessibility**: Introduced `NEXT_PUBLIC_ALLOW_INDEXING` setting handling global HTML page bots indexing (Default: noindex/nofollow).
- **Admin Dashboard Layout**: Added proactive visual warnings on Dashboard entry for Superadmins alerting when Public Registration is globally enabled to safeguard deployment environments.
- **Improved Auth Consistency**: Standardized RESTful authentication validation, blocking users from listing user data or inspecting elements belonging to unowned session IDs via endpoints like `/api/contacts/route`.

---

## [v1.5.1-beta.2] - 2026-03-02

### Added
- **Global System Resource Monitoring**:
    - New Dashboard page (`/dashboard/system-monitor`) for Superadmins to monitor host server health.
    - Real-time CPU Load (Total & Per-Core breakdown).
    - System RAM vs Node.js Process Memory (Heap/RSS) tracking.
    - Network Traffic monitoring (Live RX/TX bytes per second).
    - Disk Usage tracking for all mounted partitions.
    - Automatic 3-second polling for live updates.
- **Per-Session Health Monitoring**:
    - Integrated real-time metrics into the Session Detail page.
    - **Connection Ping**: Monitors Baileys socket state and latency.
    - **Session Uptime**: Displays exactly how long the session has been connected.
    - **Message Store Stats**: Placeholders for tracking in-memory Baileys store (Contacts, Chats, Messages).
- **Administration & UI Features**:
    - Added "System Monitor" to the sidebar navigation (restricted to SUPERADMIN).
    - Replaced the "Auto Reply" quick action card on the Dashboard with "System Monitor".
    - Consolidated mobile menu navigation to precisely match the desktop sidebar's appearance and icon layout.

### Optimized
- **Mobile-First Responsiveness**:
    - Long system details like OS Distro and Session Uptime now automatically truncate with ellipsis to prevent screen overflow on narrow devices.
    - **Battery & Memory Optimization**: The System Monitor page uses the `Visibility API` to instantly pause real-time polling (every 3s) whenever the browser tab is hidden or minimized, preserving battery life and background resources.

### Fixed
- **Next.js 15 Compatibility**: Fixed TypeScript errors related to `Promise`-wrapped `params` in dynamic API routes.
- **Auth Logic**: Standardized backend auth to use `@/lib/api-auth` across all new monitoring endpoints.
- **Socket Reliability**: Improved socket state detection for `CONNECTED` sessions by accessing the underlying `ws.readyState`.

### Technical
- **New Dependencies**: Added `systeminformation` for OS metrics and `@radix-ui/react-progress` for UI components.
- **UI Components**: Manually implemented `src/components/ui/progress.tsx` due to environment-specific CLI issues.

---

## [v1.5.1-beta.1] - 2026-03-02

### Added
- **Anti-Ban Protection (Anti-Spam Rate Limit)**:
    - Per-session message queue system to prevent WhatsApp from detecting spam and banning accounts.
    - Configurable **Messages Threshold**, **Time Window**, **Min Delay**, and **Max Delay** via Bot Settings.
    - FIFO queue ensures messages are sent in order with randomized delays between sends.
    - Applies to **all** outgoing messages universally: bot replies, auto-replies, broadcasts, scheduled messages, and API calls.
    - Detailed console logging with queue status, message types, delay info, and estimated send times:
        - `📥 QUEUED` — Message enters the queue with position number.
        - `⏳ DELAY` — Rate limit reached, showing delay duration and queue depth.
        - `✅ SENDING/INSTANT` — Message dispatched with total wait time.
    - Config cached for 10 seconds to avoid excessive database queries.
    - Uses raw SQL queries for maximum compatibility (no Prisma client regeneration required).
- **Configurable Bot Command Prefix**:
    - New setting in Bot Settings to change the bot command prefix (default `#`, max 3 characters).
    - `command-handler.ts` now reads prefix from database instead of hardcoded value.
    - Menu command dynamically displays the configured prefix.
- **Max Sticker Duration UI**:
    - Added slider control (3–30 seconds) in Bot Settings for `maxStickerDuration`.
    - Previously only configurable via database — now accessible in the dashboard.

### Changed
- **Alert System Overhaul**:
    - Replaced native `alert()` in Broadcast page with `toast.error()` from Sonner.
    - Replaced native `confirm()` in Media page with AlertDialog for file deletion.
    - Added AlertDialog confirmation for API key regeneration in Webhooks page.
- **Mobile Responsiveness**:
    - Applied responsive design patterns across 12 dashboard pages: Groups, Scheduler, Auto Reply, Broadcast, Sticker, Users, Notifications, Webhooks, Settings, Bot Settings, API Docs, and Contacts.
    - Headers wrap on mobile (`flex-col sm:flex-row`), form grids stack (`grid-cols-1 sm:grid-cols-2`), dialog widths constrained, font sizes adjusted.
- **API Documentation Refactor**:
    - Standardized all response schemas in `API_DOCUMENTATION.md` to reflect the new `{ status: boolean, message: string, data: object }` format instead of the legacy `{ success: boolean }`.
    - Enriched the Session GET documentation to show `botConfig`, `webhooks`, and `_count` relationships.

### Fixed
- **API Quick Reference Bug**: Fixed completely outdated REST API endpoints in the Python and Node.js examples (e.g., changing `/api/chat/send` to `/api/messages/{sessionId}/{jid}/send`).
- **JID Encoding in Docs**: Added explicit `@` symbol URL encoding (`%40s.whatsapp.net`) to code examples to prevent 404 router errors.
- **Swagger UI Warning**: Suppressed `UNSAFE_componentWillReceiveProps` console warning from `ModelCollapse` component in Swagger UI page.
- **Anti-Spam Reliability**: Fixed socket wrapping being lost on reconnection — now wraps `sendMessage` inline in `init()` so it persists across session reconnects.
- **Prisma Schema**: Added `prefix`, `antiSpamEnabled`, `spamLimit`, `spamInterval`, `spamDelayMin`, `spamDelayMax` fields to `BotConfig` model.

---

## [v1.5.0] - 2026-02-26

### Added
- **Collapsible Sidebar**:
    - Desktop sidebar can now be minimized to icon-only mode (260px ↔ 72px).
    - Tooltips on each menu item when collapsed for quick identification.
    - Collapse state persisted in `localStorage` across page navigations.
    - Smooth CSS transitions on width, brand logo, and user footer.
    - New `SidebarProvider` context and `SidebarShell` client component architecture.
- **Chat UI Overhaul**:
    - **Search Bar**: Filter chats by name or phone number in real-time.
    - **WhatsApp-style List**: Borderless items with hover states, left accent on selected chat.
    - **Smart Previews**: Message preview up to 45 characters, media type icons (📎 Image, Video, etc.).
    - **Relative Time Labels**: Shows "Yesterday", "Mon", "Feb 12" instead of raw timestamps.
    - **Date Separators**: "Today", "Yesterday", or full date between message groups.
    - **Rounded Bubbles**: WhatsApp-style message bubbles with tail shape and inline timestamps.
    - **Dotted Background**: Subtle dot pattern in chat window for visual depth.
    - **Mobile Back Button**: Integrated back button in chat header for mobile navigation.
    - **Colored Attachment Menu**: Each media type has a distinct color icon.
- **Media Management Page** (`/dashboard/media`):
    - Per-user access control — users only see media from their own sessions.
    - Grouped view: files organized by **Session** → **Sender/From** (collapsible sections).
    - Sender info enriched from database (pushName, senderJid via batch keyId lookup).
    - Stats cards: total storage size, file count, images, and media breakdown.
    - Search and filter by type, filename, session, or sender name.
    - Grid view with image thumbnails and file metadata.
    - Multi-select and bulk delete with per-group "Select All".
    - Full-screen image preview modal.
    - SUPERADMIN sees all sessions' media; other users see only their own.
- **Media Security API**:
    - `GET /api/media` — List media files with sender metadata, filtered by session ownership.
    - `GET /api/media/[filename]` — Serve media with session ownership check.
    - `DELETE /api/media` — Bulk delete with per-file session ownership verification.
- **Shared JID Utilities**: New `src/lib/jid-utils.ts` module with `resolveToPhoneJid()`, `batchResolveToPhoneJid()`, and `isLidJid()` for consistent JID handling across the entire codebase.
- **Tooltip UI Component**: Added `@radix-ui/react-tooltip` dependency and `src/components/ui/tooltip.tsx`.

### Security
- **Media Storage Hardened**: Moved media files from `public/media/` (publicly accessible) to `data/media/` (private, requires authentication to access via API).
- **Middleware Bypass Fixed**: Removed dangerous `pathname.startsWith("/media")` and `pathname.includes(".")` rules that allowed unauthenticated access to media files and any URL containing a dot.
- **Media API Secured**: `GET /api/media/[filename]` now requires `getAuthenticatedUser()` (session or API key). Added `path.resolve()` check to prevent directory traversal attacks.
- **Media Session Ownership**: All media endpoints enforce `canAccessSession()` — users can only view, serve, and delete media belonging to their own sessions.
- **Security Headers**: Added `X-Content-Type-Options: nosniff` and `Cache-Control: private` to media responses.
- **Default Catch-All**: Middleware now requires authentication for all unmatched routes instead of passing through.

### Fixed
- **Media Sender Collision**: Fixed an issue where WhatsApp `keyId` collisions across different sessions caused media files to be grouped under the wrong sender ("Unknown"). The grouping API now requires an exact match on both `sessionId` and `keyId`.
- **Media Grouping UI**: Cleaned up the 3-level media grouping UI (User > Session > Sender) to use distinct cards with better padding and clear visual hierarchy, replacing the messy nested indents.
- **JID Consistency (Webhooks)**: Webhook payloads (`from`, `sender`, `participant`) now always use `@s.whatsapp.net` format instead of `@lid`. Uses a three-tier resolution: inline `remoteJidAlt` → DB Contact lookup → fallback.
- **JID Consistency (Web UI)**: Chat list API now batch-resolves `@lid` JIDs to phone numbers before responding, ensuring the UI always displays `@s.whatsapp.net` format.
- **JID Consistency (Message Store)**: `processAndSaveMessage` now normalizes `remoteJid` and `senderJid` before writing to the database, preventing `@lid` from being stored.
- **Chat List Overflow**: Fixed long text in chat list items expanding horizontally; now properly truncated with ellipsis.
- **Session Path Parameter**: Renamed API route folder from `sessions/[id]` to `sessions/[sessionId]` for consistency with all other endpoints. Updated all 5 route handlers and API docs page.

### Changed
- **Dashboard Layout**: Lighter ambient background gradients, tighter padding on mobile (`p-3`), cleaner overall feel.
- **Webhook Refactor**: Removed duplicated `resolveToPhoneJid` and `isLidJid` from `webhook.ts` — now imports from shared `jid-utils.ts`.
- **API Docs Page**: Session endpoints now correctly show `[sessionId]` instead of `[id]` in path and parameter descriptions.

---

## [v1.4.1] - 2026-02-21

### Added
- **Registration Toggle**: Super Admins can now enable or disable new user registrations directly from the dashboard settings.
- **Dynamic Auth UI**: Login and Register pages now reflect the live registration status, gracefully hiding forms or links when registration is disabled by an administrator.

### Changed
- Registration API now respects the global `enableRegistration` setting flag.

## [v1.4.0] - 2026-02-21

### Added
- **Dashboard UI Overhaul**:
    - **Grouped Sidebar Navigation**: Organizes features into logical sections (Messaging, Contacts, Automation, Developer, Administration).
    - **Active Link Highlighting**: Sidebar now correctly highlights the current active page.
    - **Collapsible Groups**: Sidebar sections can now be collapsed/expanded for a cleaner workspace.
    - **Revamped Home Page**: Features 4 summary stat cards, a quick-actions grid, and improved session status cards with colored indicators.
    - **Modernized Layout**: Added backdrop-blur to the navbar, refined spacing, and updated all loading skeletons.
- **Star/Unstar Message**: `POST /api/messages/{sessionId}/{jid}/{messageId}/star` to star or unstar messages.
- **Message Search**: `GET /api/messages/{sessionId}/search` with full-text search, JID/type/sender filters, and pagination.

### Fixed
- **WhatsApp Web Group Replies**: Fixed an issue where quoted replies in group chats were silently dropped by WhatsApp Web's UI.
    - Resolved user-facing `sessionId` directly to the db CUID to ensure robust database lookups for the original message.
    - Mapped Linked Device IDs (`@lid`) back to standard phone number JIDs (`@s.whatsapp.net`) via the `Contact` table.
    - Enforced strict WA Web quote validation by perfectly mirroring the original message's `fromMe`, `messageTimestamp`, and `pushName`.
    - Always structured text quotes as `extendedTextMessage`.
- **API Consistency**: Refactored reply endpoints (`/api/messages/[sessionId]/[jid]/[messageId]/reply` and `/api/messages/[sessionId]/[jid]/reply`) to use the same `{ message: { text: ... }, mentions: [] }` format as the `/send` endpoint.
- **Auto Reply Bug**: Fixed `matchType` default in PUT endpoint — was `"exact"` (lowercase) but handler expects `"EXACT"` (uppercase), causing updated rules to silently stop matching.
- **Contacts Block/Unblock**: Added missing `decodeURIComponent(jid)` — JIDs with `%40` encoding were not being decoded.
- **Contacts GET Auth**: Replaced `auth()` with `getAuthenticatedUser()` + `canAccessSession()` to enable API key authentication and session-level access control.
- **Infrastructure**: Fixed Prisma binary target issues for better environment compatibility.

### Changed
- **Consistency**: Standardized `403` error messages to `"Forbidden - Cannot access this session"` across 11 route files.
- **Consistency**: Standardized validation order (auth → params → body) across all routes.
- **Cleanup**: Removed duplicate `messages/[jid]/read` route (use `chat/[jid]/read` instead).
- **Styling**: Switched sidebar from a shadow-based design to a more modern border-based aesthetic.

## [v1.3.0] - 2026-02-01

### Added
- **Granular Access Control**:
    - Introduced `BLACKLIST` mode for both Bot Commands and Auto Replies.
    - Added `botBlockedJids` and `autoReplyBlockedJids` to `BotConfig`.
    - Updated Dashboard "Bot Settings" to configure Blocked/Allowed JIDs visually.
- **Advanced Auto Reply Features**:
    - **Context Awareness**: Auto replies can now be scoped to `ALL`, `GROUP`, or `PRIVATE` chats via `triggerType`.
    - **Media Support**: Auto replies can now include media attachments (Images, Videos, Documents) via `mediaUrl` and `isMedia`.
- **Scheduler Enhancements**:
    - **Media Support**: Scheduled messages now support `image`, `video`, and `document` types.
    - **Smart JID Helpers**: Added UI dropdown to easily select recipient type (`@s.whatsapp.net`, `@g.us`, `@newsletter`).
- **Documentation**:
    - Comprehensive audit of `src/lib/swagger.ts` with complete examples for all endpoints.
    - Updated `USER_GUIDE.md` and `README.md` with new feature instructions.

### Fixed
- **Type Safety**: Resolved Prisma type definition conflicts in Auto Reply API route.
- **Stability**: Improvements to context-based message filtering logic.

## [v1.2.0] - 2026-01-18

### Added
- **Major API Refactoring & Standardization**: 
    - **RESTful Architecture**: Completely refactored core API modules to use standardized RESTful path parameters (`/api/{resource}/{sessionId}`) instead of inconsistent query/body params.
    - **Affected Modules**:
        - **Contacts**: `/api/contacts/{sessionId}`
        - **Labels**: `/api/labels/{sessionId}`
        - **Profile**: `/api/profile/{sessionId}`
        - **Scheduler**: `/api/scheduler/{sessionId}`
        - **Auto Replies**: `/api/autoreplies/{sessionId}`
        - **Groups**: `/api/groups/{sessionId}`
        - **Webhooks**: `/api/webhooks/{sessionId}`
    - **Frontend Updates**: Updated all corresponding Dashboard pages (Contacts, Scheduler, Auto Reply, Groups) to consume these new endpoints.
- **Real-time Chat Sync**:
    - Implemented Socket.IO integration for instant message updates in Chat Window and Chat List.
    - Removed legacy polling mechanisms for better performance.
    - Added auto-scroll to bottom functionality for new messages.
- **Media Sending Support**:
    - Added UI for sending Images, Videos, Audio, Documents, and Stickers via a new attachment menu.
    - Implemented new API endpoint `POST /api/messages/{sessionId}/{jid}/media`.
- **Session Manager V2**:
    - Refactored Session Manager UI to a modern Grid Layout.
    - Added support for **Custom Session IDs** during creation.
    - Improved status indicators and navigation controls.
- **Landing Page Overhaul**:
    - Redesigned landing page with SaaS-style UI, features grid, and tech stack showcase.
    - Added Dynamic Version display, Privacy Policy, and Terms of Service pages.
- **Documentation**:
    - Enhanced Sidebar with accordion navigation and search.
    - Updated `API_DOCUMENTATION.md` and `swagger.ts` with new Media API endpoint.
- **Public API Enhancements**:
    - Added `fileUrl`, `sender` (object), and `remoteJidAlt` to webhook payloads.
    - Webhooks now include detailed `quoted` message information with auto-resolved media URLs.

### Fixed
- **Chat History Sorting**: Fixed `/api/chat/[sessionId]/[jid]` to correctly fetch the latest 100 messages chronologically.
- **Session Reliability**: Fixed issues with session restarting, stopping, and logout loops.
- **Logout Logic**: Explicit logout now correctly cleans up credentials.
- **Webhook Syntax**: Resolved a critical syntax error (duplicate code block) in `src/lib/webhook.ts` that caused build failures.
- **Robustness**: Improved `extractQuotedMessage` helper to handle various message types (Group, Private) accurately.

## [beta-v1.1.0.1] - 2026-01-15

### Added
- **Contact Management**: 
    - **Contact List Page**: New Dashboard page (`/dashboard/contacts`) to view, filter, and manage synced contacts.
    - **Features**: Search by Name/JID, Session Filtering, and Configurable Pagination Limits (5 to 3000 items per page).
    - **Database**: Enhanced `Contact` model to store `lid`, `verifiedName`, `remoteJidAlt`, `profilePic`, and raw `data`.
- **UI Enhancements**:
- **Enhanced Messaging Engine**:
    - **Duplicate Filter**: Implemented robust detection to prevent duplicate message processing and auto-replies.
    - **Junk Filter**: Automatically ignores empty messages and technical protocol messages (e.g., key distribution, reactions) to keep the logs clean.
- **Improved UI Inputs**:
    - **Multiline Support**: Auto Reply and Scheduler now use Textarea inputs, allowing for longer, multi-line messages.
- **Bug Fixes**:
    - **Media Access**: Fixed middleware configuration to ensure public media files are accessible.
### Fixed
- **Build Stability**: Resolved improper UI module imports (`Table`, `Pagination`) and missing type overrides for Prisma schema changes.
- **Backend Logic**: Fixed duplicate imports in dashboard pages.

## [1.1.0] - 2026-01-13

### Added
- **Webhook Enhancements**:
    - **Raw Data**: Added `raw` field to webhook payload containing the full Baileys message object.
    - **Media Support**: Added automatic media downloading (Images, Video, etc.). Webhook now includes `fileUrl` pointing to the saved file in `public/media`.
    - **Enriched Participant Data**: For group messages, the `sender` and `participant` fields are now objects containing detailed info (`id`, `phoneNumber`, `admin`).
    - **Standardized Fields**: Added `from` (Chat JID), `sender` (Participant/User), `isGroup`, and `remoteJidAlt` (extracted from message key) fields.
- **API Response Enrichment**:
    - **Chat History API**: `/api/chat/[sessionId]/[jid]` now returns enriched `sender` details for group messages, matching the webhook format.

### Fixed
- **Webhook Logic**: Fixed issues where `from` and `sender` were ambiguous or incorrect. `from` now consistently refers to the Chat Room, and `sender` refers to the actual sender.
- **Async Handling**: Updated message store to safely handle asynchronous webhook operations without blocking.

## [1.0.7] - 2026-01-13

### Fixed
- **Frontend Webhooks**: Fixed an issue where the webhook list was empty. The dashboard now correctly matches both the Session String ID (`mysession`) and the Internal Database ID (CUID) when filtering webhooks.
## [1.0.6] - 2026-01-13

### Fixed
- **Auto Reply**: Fixed silent failure where Auto Reply would not run for new sessions due to missing `BotConfig`. Added automatic creation of default config for both new and existing sessions.
- **API `POST /api/sessions`**: Fixed issue where custom `sessionId` provided in request body was ignored. Now accepts `sessionId` correctly.
- **API `POST /api/webhooks`**: Fixed `500 Internal Server Error` when creating webhooks. The API now correctly resolves the session string ID to the database internal ID (CUID).
- **API `POST /api/system/check-updates`**: Fixed authentication issue. Now uses `getAuthenticatedUser` to allow access via API Key (previously restricted to Session Cookie only).
- **Frontend Session Selector**: Fixed issue where only "CONNECTED" sessions were listed. Now displays all sessions (Disconnected, Scanning QR, etc.) to allow management.
- **Frontend Webhooks Page**: Fixed page to respect the currently selected session in the navbar. Webhook list is now filtered by session, and creating a webhook attaches it to the active session.

### Added
- **Auto Update Check**: Implemented automatic update checking when entering the dashboard. A specific notification is created only if a new version is available.
- **Logging Configuration**: Added `BAILEYS_LOG_LEVEL` support in `.env` to configure WhatsApp Baileys logger verbosity (default: `error`).
- **Scripts**: Added `scripts/test_endpoints.sh` for verifying API endpoints via curl.

### Documentation
- **API Documentation**: Completely overwrote `docs/API_DOCUMENTATION.md` with comprehensive details for all endpoints (Chat, Groups, Broadcast, Spam, Sticker, Status, Scheduler, System). 
- **Environment**: Updated `.env.example` to include new logging configuration.