What changed, dated — only things that actually shipped.
A WhatsApp Business number can now be connected (phone number ID + permanent system token from the Meta developer panel — never a password). WhatsApp is a messaging channel, not a publishing one: incoming messages land in the inbox, fire the dm.received webhook for your own chatbot, and can be answered by keyword rules or via the reply endpoint within the free 24-hour service window.
Duplicate webhook deliveries from Meta can no longer trigger an automation twice (comments and DMs are deduplicated at the database level). Automated replies now appear in the inbox conversation. GET /health became a deep check: it returns 503 when the database is unreachable or the publish queue has stalled, so an uptime monitor catches a dead worker too.
Automation rules can now be edited in place (name, keywords, replies) from the panel and PATCH /api/flows/{id}; per-account rhythm rules are editable from the panel; the queue shows chain progress per post. Rate limiting per IP (429 with Retry-After) and a per-workspace storage quota (413) are enforced, and server errors can notify the operator via a Slack/Discord webhook.
scheduledFor: "auto" lets the server pick the publish slot from the channel's rhythm, isolated per API key. A chain array attaches post-publish steps: cross-post the same content or publish a follow-up N minutes after the post goes live.
New webhook events dm.received and comment.received close the agent loop: your own AI reads the inbox and answers through the reply endpoint. An MCP server ships in the repo. Automation button links now pass through /r/<code> and clicks are counted per rule.
post.published, post.failed and account.expired are delivered to your endpoint with an HMAC signature. Three attempts per event; an endpoint disables itself after 20 consecutive failures.
Uploaded files can be reused without re-uploading; scheduled posts can be rescheduled and their captions edited from the panel and the API.
followGate now checks Meta's is_user_follow_business flag when the button is tapped. If the flag is missing, the link is sent anyway — a real follower is never left waiting.
The v1 API: accounts, presigned media uploads, scheduled posts across seven platforms, comment-to-DM automations, idempotency keys.