SHOAIB SUBSCRIPTION BOT — COMPLETE 80 MB SOURCE ZIP, BAILEYS SINGLE-SESSION FIX
31 October 2026

WHAT CHANGED (ONLY THESE APPLICATION FILES)
  baileys_bridge/server.mjs             — improved Baileys reconnect, event handling, correct /baileys-bridge URL routing, explicit QR reset
  baileys_bridge/single_session.mjs     — NEW: elect one WhatsApp session owner across Passenger workers; other workers forward authenticated status/send/reset calls through private Unix socket
  webhook/baileys_webhook.php          — cache failed text replies for safe retry; don't rerun order/billing logic on same message ID
  adminpanel/whatsapp_api.php          — optional Archive old session & Generate New QR action plus diagnostics

OTHER APPLICATION ROUTES / CONFIG
  Original .htaccess, PHP URLs, admin pages (except the above additions), database, Meta API, seller rules and npm package versions are retained from YOUR 80 MB ZIP.
  node_modules remains included. There is ONE npm dependency tree; three 'lsnode' processes are runtime workers, not three npm installs. DO NOT DELETE node_modules.

DEPLOY SAFELY
  1. BACK UP the live website AND database before deployment.
  2. In cPanel STOP the Baileys Node.js app BEFORE replacing files. Do not destroy the application.
  3. Ensure old Baileys lsnode workers are stopped before starting the new version. Check:
       ps -u "$(whoami)" -o pid,args | grep '[l]snode:.*baileys_bridge'
     If old processes remain, ask your host to stop ONLY the Baileys app workers. Do not kill Netflix/other Node applications.
  4. Merge this ZIP with existing public_html/bot.shoaibsubscription.pk folder. DO NOT replace the folder wholesale.
     Carefully preserve LIVE copies of:
       baileys_bridge/session/    (contains current WhatsApp credentials)
       baileys_bridge/.env        (if present on live hosting)
       storage/wa_providers.json
       storage/bot_runtime.json
       config/database.php, config/meta.php
     This full archival ZIP contains OLDER saved session and credentials from the source upload, which MUST NOT overwrite newer live files.
  5. cPanel Setup Node.js App: existing application root, URL and app.cjs startup file unchanged. START/RESTART app.
     Do not change PHP routes, .htaccess, bridge secret, port, or npm installation.
  6. Admin > WhatsApp API Providers > Refresh Bridge / QR Status.
     'connected' = linked. 'scan_qr' = scan fresh QR.
     If you logged out a device and see 'logged_out', tick confirmation and press
        Archive old session & Generate New QR.
     The existing session is ARCHIVED, not deleted. Do not use this button for temporary disconnects.
  7. Test outgoing message to your own opted-in number, then send Menu from TWO different WhatsApp numbers.

WHAT THE NEW SINGLE-SESSION GUARD DOES
  Passenger may start multiple HTTP workers. Only one worker owns the WhatsApp socket.
  All authenticated /status, /send and /reset-session calls reaching another worker proxy
  to the primary through a PRIVATE Unix socket. If the primary dies, a surviving worker
  can take over the lock after the stale owner is detected. A follower may briefly return
  'primary_worker_unavailable' during startup/failover; retry after a short interval.

IMPORTANT LIMITATIONS
  - A ZIP cannot remotely stop already-running hosting processes. Stop old worker(s) before updating.
  - A previously invalidated WhatsApp login MUST be re-linked via new QR.
  - Local code tests cannot prove that a cPanel Passenger host will keep a persistent websocket alive 24/7.
  - Do NOT publish this full ZIP: it includes the private WhatsApp session and config from YOUR source ZIP.
  - Baileys is unofficial WhatsApp connectivity; connection stability cannot be guaranteed.
  - No new SQL, npm install or Node app creation is required if the existing environment remains intact.
