fengx-baileys

v2.3.0

Published

a month ago

FengX Baileys: unified WhatsApp, Telegram Bot API/MTProto userbot, and Discord toolkit with rich messaging and guarded auth state.

MULTI-PLATFORM MESSAGING ENGINE

WhatsApp Protocol Core · Telegram Bot/Userbot · Discord Components

One package. Three messaging engines. One consistent developer surface.

[!IMPORTANT] FengX Baileys menggunakan protokol WhatsApp Web yang tidak resmi. Payload yang berhasil dibuat belum selalu dirender identik pada setiap versi WhatsApp, jenis akun, perangkat penerima, atau rollout server. Gunakan akun pengujian sebelum mengaktifkan surface eksperimental pada produksi.

01 — Identity

FengX Baileys adalah toolkit komunikasi lintas platform yang menggabungkan:

core WhatsApp berbasis arsitektur Baileys-compatible;
Rich AI Response dan native-flow interactive message;
Telegram Bot API dengan rich message helper;
Telegram MTProto user client dengan session terenkripsi;
Discord gateway, REST, polls, dan Components V2;
plugin utilitas siap pakai;
guarded auth state untuk mengurangi risiko clone dan pemakaian session tanpa izin.

Paket ini tidak hanya menyediakan tutorial. README ini juga berfungsi sebagai peta arsitektur, referensi API, panduan keamanan, matriks kapabilitas, catatan kompatibilitas, dan batasan operasional.

02 — Core Profile

| Layer | Engine | Fokus | |---|---|---| | WhatsApp | Baileys-compatible Web protocol | Socket, auth, media, groups, newsletter, interactive, protocol messages | | Telegram Bot | Bot API | Command bot, rich content, styled button, media poll, streaming draft | | Telegram User | MTProto / optional GramJS | Login nomor, OTP, 2FA, multi-session, encrypted session store | | Discord | Oceanic.js line | Gateway, REST, interactions, sharding, poll, Components V2 | | Security | Session Guard v2 | Encryption, deployment binding, lease, clone detection, rollback checks | | Extensions | FengX Plugins | AI, news, downloader, search, stalk, information, maker |

03 — Release 2.3.0

Motion Photo parent/child generator dan relay helper;
experimental Poll Add Option payload;
raw Group Message History notice dan uploaded-bundle surface;
Rich AI Response object API, array API, raw submessages, code, citation, table, media, map, LaTeX, dan content items;
native-flow compatibility layer untuk quick reply, URL, copy, call, form, list, dan carousel;
sender-hidden direct delivery dengan kontrol sinkronisasi perangkat pengirim;
Session Guard v2 untuk auth state terenkripsi dan deployment-bound.

Bot API rich message input;
Markdown/HTML rich helpers;
streaming rich draft;
styled button dan media-poll builder;
Live Photo payload support;
optional MTProto userbot;
AES-256-GCM encrypted user session store.

Discord

bundled client layer;
gateway dan REST access;
interactions dan sharding;
native poll builder;
Components V2 builders;
ESM/CommonJS subpath bridge.

04 — Installation

npm install fengx-baileys

Runtime minimum:

Node.js >= 20.18.1

Optional capabilities dapat memerlukan peer dependency berikut:

npm install sharp jimp link-preview-js better-sqlite3
npm install telegram
npm install @discordjs/voice

Instal hanya dependency opsional yang memang digunakan aplikasi.

05 — Export Map

| Import path | Fungsi | |---|---| | fengx-baileys | Root ESM API dan default WhatsApp socket factory | | fengx-baileys/telegram | Telegram Bot API bridge | | fengx-baileys/telegram/userbot | Telegram MTProto user client | | fengx-baileys/discord | Discord client bridge | | fengx-baileys/discord/components-v2 | Discord Components V2 helpers | | fengx-baileys/fengx | FengX plugin registry | | fengx-baileys/plugins | Alias plugin registry | | fengx-baileys/WAProto | Generated protobuf exports | | fengx-baileys/engine-requirements | Runtime capability checks |

06 — WhatsApp Quick Start

import makeWASocket, {
  DisconnectReason,
  useMultiFileAuthState,
  fetchLatestBaileysVersion
} from 'fengx-baileys'

async function startSocket() {
  const { state, saveCreds } = await useMultiFileAuthState('./session')
  const { version } = await fetchLatestBaileysVersion()

  const sock = makeWASocket({
    version,
    auth: state
  })

  sock.ev.on('creds.update', saveCreds)

  sock.ev.on('connection.update', ({ connection, lastDisconnect, qr }) => {
    if (qr) console.log('QR tersedia')
    if (connection === 'open') console.log('FengX connected')

    if (connection === 'close') {
      const statusCode = lastDisconnect?.error?.output?.statusCode
      if (statusCode !== DisconnectReason.loggedOut) startSocket()
    }
  })

  sock.ev.on('messages.upsert', async ({ messages }) => {
    const message = messages[0]
    const jid = message?.key?.remoteJid
    if (!jid || message.key.fromMe) return

    await sock.sendMessage(jid, { text: 'FengX Baileys online.' })
  })

  return sock
}

const sock = await startSocket()

[!NOTE] Contoh di atas menunjukkan pola dasar. Pada produksi, tambahkan reconnect backoff, logger, message deduplication, graceful shutdown, rate control, dan error boundary.

07 — Standard Message Surface

await sock.sendMessage(jid, { text: 'Plain text' })

await sock.sendMessage(jid, {
  image: imageBuffer,
  caption: 'Image caption'
})

await sock.sendMessage(jid, {
  video: videoBuffer,
  caption: 'Video caption'
})

await sock.sendMessage(jid, {
  document: documentBuffer,
  mimetype: 'application/pdf',
  fileName: 'report.pdf'
})

await sock.sendMessage(jid, {
  poll: {
    name: 'Pilih mode',
    values: ['Stable', 'Experimental'],
    selectableCount: 1
  }
})

Edit, delete, reaction, dan forward:

const sent = await sock.sendMessage(jid, { text: 'Draft' })

await sock.sendMessage(jid, {
  text: 'Final',
  edit: sent.key
})

await sock.sendMessage(jid, {
  react: { text: '⚡', key: sent.key }
})

await sock.sendMessage(jid, {
  delete: sent.key
})

08 — Native Flow

FengX Baileys menyediakan compatibility input yang mengubah bentuk sederhana menjadi interactive native-flow payload.

await sock.sendMessage(jid, {
  text: 'FengX Control',
  footer: 'Select an action',
  nativeFlow: {
    messageVersion: 1,
    buttons: [
      { id: 'status', text: 'System Status' },
      { url: 'https://example.com', text: 'Open Dashboard' },
      { copy: 'FENGX-2026', text: 'Copy Access Code' }
    ]
  }
})

List section:

await sock.sendMessage(jid, {
  text: 'Module Registry',
  nativeFlow: {
    buttons: [
      {
        text: 'Choose Module',
        sections: [
          {
            title: 'Messaging',
            rows: [
              { id: 'wa', title: 'WhatsApp Core' },
              { id: 'tg', title: 'Telegram Engine' },
              { id: 'dc', title: 'Discord Engine' }
            ]
          }
        ]
      }
    ]
  }
})

Carousel:

await sock.sendMessage(jid, {
  text: 'FengX Modules',
  cards: [
    {
      image: imageA,
      caption: 'WhatsApp Protocol Core',
      nativeFlow: { buttons: [{ id: 'open_wa', text: 'Open' }] }
    },
    {
      image: imageB,
      caption: 'Telegram Engine',
      nativeFlow: { buttons: [{ id: 'open_tg', text: 'Open' }] }
    }
  ]
})

[!WARNING] Legacy template/button payload dapat tidak dirender pada client terbaru. Compatibility layer memprioritaskan migrasi ke interactive native-flow, tetapi hasil akhir tetap dipengaruhi client dan server.

09 — Rich AI Response

Rich AI Response adalah first-class feature. API menerima object tunggal, array section, atau raw protobuf-compatible submessages.

await sock.sendMessage(jid, {
  richResponse: {
    text: 'Runtime inspection complete.',
    code: `const runtime = process.version\nconsole.log(runtime)`,
    language: 'javascript',
    botJid: '259786046210223@bot'
  }
})

Multi-section response:

await sock.sendMessage(jid, {
  richResponse: [
    { text: 'FengX system report' },
    {
      links: [
        {
          text: 'Documentation',
          title: 'Runtime Reference',
          url: 'https://example.com/docs'
        }
      ]
    },
    {
      title: 'Health',
      table: [
        ['Component', 'State'],
        ['Socket', 'Online'],
        ['Session Guard', 'Active']
      ]
    },
    { latex: ['E = mc^2'] },
    {
      map: {
        centerLatitude: -6.2,
        centerLongitude: 106.8,
        annotations: []
      }
    }
  ]
})

Supported rich primitives include:

| Primitive | Input | |---|---| | Text | text | | Code | code, language | | Citation/link | links | | Table | title, table | | Inline image | inlineImage, imageText | | Image grid | gridImages | | Inline video/GIF | inlineVideo | | Map | map | | LaTeX | latex | | Horizontal content items | items | | Raw protocol section | submessages |

Incoming rich payload dapat diekstrak dan dinormalisasi:

import {
  extractRichResponseMessage,
  decodeUnifiedResponse
} from 'fengx-baileys'

const raw = extractRichResponseMessage(message)
const unified = decodeUnifiedResponse(message)

10 — Sender-Hidden Delivery

Sender-hidden delivery mengirim direct message ke penerima sambil menghilangkan sinkronisasi tertentu ke perangkat tertaut milik akun pengirim.

import { sendSenderHiddenMessage } from 'fengx-baileys'

await sendSenderHiddenMessage(sock, userJid, {
  text: 'Private delivery surface'
})

Atau melalui policy input:

await sock.sendMessage(userJid, {
  text: 'Hidden from sender-linked devices',
  selfSync: 'omit'
})

Batasan desain:

hanya direct chat;
tidak ditujukan untuk group, status, newsletter, atau self-chat;
tidak menjamin penghapusan jejak pada server;
tidak boleh dianggap sebagai anonimisasi identitas pengirim;
recipient filtering dilakukan pada device target list, bukan melalui eksploitasi identifier.

11 — Session Guard v2

import { useGuardedMultiFileAuthState } from 'fengx-baileys'

const guarded = await useGuardedMultiFileAuthState('./session', {
  secret: process.env.FENGX_SESSION_MASTER_KEY,
  strict: true,
  bindDeployment: true,
  bindMachine: true,
  bindLocation: true
})

const sock = makeWASocket({ auth: guarded.state })
sock.ev.on('creds.update', guarded.saveCreds)

Core controls:

AES-256-GCM encrypted auth files;
scrypt and HKDF-SHA-256 key derivation;
authenticated context and manifest HMAC;
session, deployment, machine, path, and file binding;
local single-instance lease;
optional remote single-active lease;
optional external key provider for KMS, Vault, HSM, TPM agent, or workload identity;
optional monotonic write-counter anchor;
rollback/snapshot detection;
plaintext migration to guarded file format.

Expected layout:

session/
├── creds.eg2
├── keys-*.eg2
├── .fengx-guard-v2.json
└── .fengx-guard-v2.lease

Threat model:

Session Guard mengurangi risiko pencurian file, clone pasif, penggunaan deployment ganda, dan rollback. Session Guard tidak dapat menghentikan attacker yang sudah memiliki root access, process-memory access, runtime injection, atau kendali penuh terhadap host aktif.

12 — Telegram Bot API

import {
  FengXTelegraf,
  richMarkdown,
  telegramStyledButton
} from 'fengx-baileys/telegram'

const bot = new FengXTelegraf(process.env.TELEGRAM_BOT_TOKEN)

bot.start(async (ctx) => {
  await ctx.reply('FengX Telegram online.')
})

bot.command('panel', async (ctx) => {
  const button = telegramStyledButton('System Status', {
    callbackData: 'status',
    style: 'primary'
  })

  await ctx.telegram.sendRichMessage(
    ctx.chat.id,
    richMarkdown('## FengX Control\n\n**Status:** Online'),
    { reply_markup: { inline_keyboard: [[button]] } }
  )
})

await bot.launch()

Token validation helper:

import { connectTelegram } from 'fengx-baileys'

const account = await connectTelegram(process.env.TELEGRAM_BOT_TOKEN)
console.log(account.username)

13 — Telegram MTProto User Client

User client tidak memakai token BotFather. Gunakan apiId, apiHash, nomor telepon, OTP, dan 2FA milik akun sendiri.

import {
  createTelegramUserbot,
  EncryptedTelegramSessionStore
} from 'fengx-baileys/telegram/userbot'

const sessionStore = new EncryptedTelegramSessionStore(
  './sessions/telegram-user.eg1',
  process.env.FENGX_TELEGRAM_SESSION_KEY
)

const user = await createTelegramUserbot({
  apiId: Number(process.env.TELEGRAM_API_ID),
  apiHash: process.env.TELEGRAM_API_HASH,
  phoneNumber: process.env.TELEGRAM_PHONE,
  sessionStore
})

await user.login({
  phoneCode: async () => readOtpFromTerminal(),
  password: async () => readTwoFactorPassword()
})

Security note: session MTProto setara dengan akses akun. Jangan log session string, OTP, password 2FA, atau encryption key.

14 — Discord

import { connectDiscord } from 'fengx-baileys/discord'

const identity = await connectDiscord(process.env.DISCORD_TOKEN)
console.log(identity?.tag)

Components V2:

import {
  discordContainer,
  discordTextDisplay,
  discordActionRow,
  discordButton,
  buildDiscordComponentsV2Message
} from 'fengx-baileys/discord'

const payload = buildDiscordComponentsV2Message([
  discordContainer([
    discordTextDisplay('## FengX Control'),
    discordActionRow([
      discordButton('Status', { customId: 'status', style: 2 })
    ])
  ], { accentColor: '#0f172a' })
])

[!NOTE] Discord core mengikuti Oceanic.js line. @discordjs/voice hanya dipakai sebagai optional voice dependency.

15 — FengX Plugins

Plugin registry tersedia melalui root export dan subpath khusus.

import { plugins, listPlugins } from 'fengx-baileys'

console.log(listPlugins())
const result = await plugins.cuaca('Jakarta')

Direct named import:

import {
  ai,
  cnbc,
  kompas,
  tiktok,
  yt,
  brave,
  cuaca,
  bmkg,
  brat
} from 'fengx-baileys'

Current plugin groups:

| Group | Scope | |---|---| | AI | General model wrappers and assistant endpoints | | News | Indonesian news providers | | Downloader | Social media and media extraction endpoints | | Search | Web, image, pin, recipe, manga, app, and content search | | Stalk | Public profile lookup endpoints | | Information | Weather, BMKG, and TV schedule | | Maker | Brat image/video generation |

External plugin endpoints dapat berubah, down, membatasi rate, atau mengubah response schema. Validasi response sebelum dipakai pada produksi.

16 — Boot Banner

import { printBootBanner } from 'fengx-baileys'

printBootBanner()

Auto-print saat import:

FENGX_BANNER=1 node index.js

17 — Controlled Message Test

import { testMessage } from 'fengx-baileys'

const report = await testMessage(sock, jid, {
  delay: 300,
  includeInteractive: true,
  includeLegacy: false,
  media: {}
})

console.table(report.results)

Gunakan hanya pada akun dan chat pengujian karena helper mengirim beberapa message surface secara berurutan.

18 — Project Layout

fengx-baileys/
├── WAProto/                 generated WhatsApp protobuf
├── fengx/
│   ├── config.js
│   └── plugins/             plugin registry and modules
├── lib/
│   ├── Socket/              WhatsApp socket layers
│   ├── Signal/              Signal protocol integration
│   ├── Telegram/            Bot API and MTProto adapters
│   ├── Discord/             gateway, REST, structures, components
│   ├── Store/               in-memory store and repositories
│   ├── Types/               public declarations
│   ├── Utils/               message, media, auth, rich, security helpers
│   └── index.js             root export surface
├── scripts/                 smoke and license checks
├── tests/                   TypeScript/API contract tests
├── engine-requirements.js
├── package.json
├── LICENSE
└── README.md

19 — Quality Gates

npm run check:syntax
npm run check:smoke
npm run check:types
npm run check:licenses
npm test
npm pack --dry-run

Validation scope:

| Check | Purpose | |---|---| | Syntax | Parse every JavaScript, MJS, and CJS file | | Smoke | Exercise payload builders, rich response, native flow, session guard, and bridges | | Types | Compile public TypeScript contracts | | License | Verify required third-party notices | | Pack | Confirm publish surface and package contents |

20 — Production Hardening

Recommended minimum controls:

Store auth/session outside public web roots.
Use a 32-byte-or-longer master key from a secret manager.
Run one active writer per WhatsApp session.
Add reconnect backoff and circuit breaking.
Redact message content, tokens, JIDs, OTPs, and session keys from logs.
Validate MIME, file size, URL scheme, and remote response before media processing.
Restrict plugin execution with timeout and output-size limits.
Separate test account from production account.
Pin package versions in production lockfiles.
Re-test protocol-sensitive surfaces after WhatsApp client changes.

21 — Compatibility Status

| Feature | Offline construction | Requires live credential | Protocol-sensitive | |---|---:|---:|---:| | Standard WhatsApp text/media | Yes | Yes | Moderate | | Native flow | Yes | Yes | High | | Rich AI Response | Yes | Yes | High | | Motion Photo | Yes | Yes | High | | Poll Add Option | Yes | Yes | High | | Group Message History bundle | Yes | Yes | Very high | | Sender-hidden delivery | Yes | Yes | High | | Session Guard encryption | Yes | No | Low | | Telegram Bot API helper | Yes | Yes | Moderate | | Telegram MTProto user client | Yes | Yes | Moderate | | Discord Components V2 | Yes | Yes | Moderate |

Offline success means the library can construct, encode, decode, or validate the payload locally. It does not guarantee server acceptance or visual rendering on every client.

22 — Known Boundaries

WhatsApp protocol behavior can change without package-side notice.
Interactive and AI-styled surfaces may be server-gated.
Group Message History requires a caller-provided uploaded encrypted bundle; automatic official-client bundle capture is not implemented.
Optional Telegram user client requires the telegram peer package.
Discord voice requires optional voice dependencies.
Third-party plugin endpoints are outside package control.
Local encryption cannot protect secrets from a fully compromised running host.

23 — Third-Party Notices

FengX Baileys includes, adapts, or interoperates with code and concepts from multiple open-source projects. Their original licenses and notices remain applicable to the relevant portions.

Baileys / WhiskeySockets contributors;
Telegraf Contributors;
Oceanic.js and Donovan Daniels;
libsignal-related components;
Lia Wynn and itsliaaa/baileys compatibility work;
additional dependencies listed in package.json and their respective licenses.

See LICENSE for consolidated attribution and licensing terms.

24 — License

MIT License.

Use, modify, and distribute the package under the conditions stated in LICENSE. Users remain responsible for platform terms, account safety, consent, data handling, and local law.

FENGX BAILEYS

PROTOCOL FIRST · SECURITY AWARE · MULTI-PLATFORM