npm - @agent-native/core - Versions diffs - 0.79.16 → 0.79.18 - Mend

@agent-native/core 0.79.16 → 0.79.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (344) hide show

package/dist/integrations/adapters/telegram.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"telegram.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"~~AAKA~~,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AAuBrB;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,eAAe,~~CAwQjD~~"}
1	+ {"version":3,"file":"telegram.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AAuBrB;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAqQjD"}

package/dist/integrations/adapters/telegram.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import { getHeader } from "h3";
+import { resolveSecret } from "../../server/credential-provider.js";
 import { readBody } from "../../server/h3-helpers.js";
 /** Telegram's max message length */
 const TELEGRAM_MAX_LENGTH = 4096;
@@ -67,7 +68,7 @@ export function telegramAdapter() {
             return { handled: false };
         },
         async verifyWebhook(event) {
-            const secret = process.env.TELEGRAM_WEBHOOK_SECRET;
+            const secret = await resolveSecret("TELEGRAM_WEBHOOK_SECRET");
             if (!secret) {
                 if (shouldRefuseWhenSecretMissing()) {
                     if (!_telegramUnverifiedWarned) {
@@ -82,7 +83,7 @@ export function telegramAdapter() {
                     console.warn("[telegram] TELEGRAM_WEBHOOK_SECRET not set — accepting webhook without verification (dev mode)");
                 }
                 // Dev mode: still require the bot token to be configured at all.
-                return !!process.env.TELEGRAM_BOT_TOKEN;
+                return !!(await resolveSecret("TELEGRAM_BOT_TOKEN"));
             }
             const headerSecret = getHeader(event, "x-telegram-bot-api-secret-token");
             if (!headerSecret)
@@ -135,7 +136,7 @@ export function telegramAdapter() {
             };
         },
         async sendResponse(message, context) {
-            const token = process.env.TELEGRAM_BOT_TOKEN;
+            const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
             if (!token) {
                 console.error("[telegram] TELEGRAM_BOT_TOKEN not configured");
                 return;
@@ -177,7 +178,7 @@ export function telegramAdapter() {
             }
         },
         async sendMessageToTarget(message, target) {
-            const token = process.env.TELEGRAM_BOT_TOKEN;
+            const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
             if (!token) {
                 console.error("[telegram] TELEGRAM_BOT_TOKEN not configured");
                 return;
@@ -216,11 +217,12 @@ export function telegramAdapter() {
             return { text: normalized, platformContext: { parse_mode: "Markdown" } };
         },
         async getStatus(_baseUrl) {
-            const hasToken = !!process.env.TELEGRAM_BOT_TOKEN;
+            const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
+            const hasToken = !!token;
             let botName;
             if (hasToken) {
                 try {
-                    const res = await fetch(`https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/getMe`);
+                    const res = await fetch(`https://api.telegram.org/bot${token}/getMe`);
                     const data = (await res.json());
                     if (data.ok) {
                         botName = data.result?.username;
@@ -237,9 +239,7 @@ export function telegramAdapter() {
                     hasToken,
                     botUsername: botName,
                 },
-                error: !hasToken
-                    ? "Set TELEGRAM_BOT_TOKEN in your environment"
-                    : undefined,
+                error: !hasToken ? "Save TELEGRAM_BOT_TOKEN in settings" : undefined,
             };
         },
     };

package/dist/integrations/adapters/telegram.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"telegram.js","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAG/B,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAStD,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;;;GAMG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;QAEjB,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,oBAAoB;oBAC3B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,uGAAuG;iBAC1G;gBACD;oBACE,GAAG,EAAE,yBAAyB;oBAC9B,KAAK,EAAE,yBAAyB;oBAChC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,6HAA6H;iBAChI;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,qEAAqE;YACrE,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,uCAAuC;YACvC,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACnC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBACjC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;YACD,qDAAqD;YACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,6BAA6B,EAAE,EAAE,CAAC;oBACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBAC/B,yBAAyB,GAAG,IAAI,CAAC;wBACjC,OAAO,CAAC,KAAK,CACX,+EAA+E;4BAC7E,sGAAsG,CACzG,CAAC;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAC/B,yBAAyB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,IAAI,CACV,gGAAgG,CACjG,CAAC;gBACJ,CAAC;gBACD,iEAAiE;gBACjE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1C,CAAC;YAED,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YACzE,IAAI,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAEhC,yBAAyB;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC3C,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAC1B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,wEAAwE;YACxE,mEAAmE;YACnE,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,CAAC,SAAiB,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,0BAA0B;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,6BAA6B;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YAEnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAE1B,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,EAAE,SAAS;gBACf,UAAU,EACR,IAAI,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1B,eAAe,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,IAAI,EAAE,EAAE;oBAChB,YAAY,EAAE,IAAI,EAAE,QAAQ;iBAC7B;gBACD,SAAS,EAAE,OAAO,CAAC,IAAI,GAAG,IAAI;aAC/B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,MAAM;4BACf,IAAI,EAAE,KAAK;4BACX,UAAU,EAAE,UAAU;yBACvB,CAAC;qBACH,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,0CAA0C;wBAC1C,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACxC,MAAM,KAAK,CAAC,+BAA+B,KAAK,cAAc,EAAE;gCAC9D,MAAM,EAAE,MAAM;gCACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gCAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oCACnB,OAAO,EAAE,MAAM;oCACf,IAAI,EAAE,KAAK;iCACZ,CAAC;6BACH,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;wBACnE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAA4B;oBACpC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,IAAI,EAAE,KAAK;iBACZ,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,SAAS,CAAC;gBAC5C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;oBACnE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,yEAAyE;YACzE,+CAA+C;YAC/C,wEAAwE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;QAC3E,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAElD,IAAI,OAA2B,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CACtE,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;wBACZ,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAClC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE;oBACP,QAAQ;oBACR,WAAW,EAAE,OAAO;iBACrB;gBACD,KAAK,EAAE,CAAC,QAAQ;oBACd,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getHeader } from \"h3\";\n\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { readBody } from \"../../server/h3-helpers.js\";\nimport type {\n PlatformAdapter,\n IncomingMessage,\n OutgoingMessage,\n IntegrationStatus,\n OutboundTarget,\n} from \"../types.js\";\n\n/** Telegram's max message length /\nconst TELEGRAM_MAX_LENGTH = 4096;\n\n/\n One-shot warning flag — log once per process when accepting unverified\n * webhooks (M6 in the webhook security audit).\n /\nlet _telegramUnverifiedWarned = false;\n\n/\n Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose secret is\n * unset — otherwise an attacker can drive the agent loop with arbitrary\n * messages (C2 in the webhook security audit).\n /\nfunction shouldRefuseWhenSecretMissing(): boolean {\n if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n return process.env.NODE_ENV === \"production\";\n}\n\n/\n Create a Telegram platform adapter.\n \n Required env vars:\n * - TELEGRAM_BOT_TOKEN — Bot token from @BotFather\n \n Optional env vars:\n * - TELEGRAM_WEBHOOK_SECRET — Secret token for webhook verification\n /\nexport function telegramAdapter(): PlatformAdapter {\n return {\n platform: \"telegram\",\n label: \"Telegram\",\n\n getRequiredEnvKeys(): EnvKeyConfig[] {\n return [\n {\n key: \"TELEGRAM_BOT_TOKEN\",\n label: \"Telegram Bot Token\",\n required: true,\n helpText:\n \"From @BotFather after `/newbot` — the long token Telegram gives you (looks like `123456:ABC-DEF...`).\",\n },\n {\n key: \"TELEGRAM_WEBHOOK_SECRET\",\n label: \"Telegram Webhook Secret\",\n required: false,\n helpText:\n \"Optional. Any random string — Telegram will echo it on every webhook so dispatch can verify the request came from Telegram.\",\n },\n ];\n },\n\n async handleVerification(\n event: H3Event,\n ): Promise<{ handled: boolean; response?: unknown }> {\n // Pre-read the raw body once and cache on the event context. h3 v2's\n // request body stream can only be consumed once; without this, the\n // later `parseIncomingMessage` call throws \"Body has already been read\"\n // because something upstream (signature check, dedupe, etc.) drains it.\n // Mirrors the Slack adapter's pattern.\n try {\n if (!event.context.__rawBody) {\n const body = await readBody(event);\n event.context.__rawBody = body;\n }\n } catch {\n // If we can't pre-read, parseIncomingMessage will surface the error\n }\n // Telegram has no challenge; we never short-circuit.\n return { handled: false };\n },\n\n async verifyWebhook(event: H3Event): Promise<boolean> {\n const secret = process.env.TELEGRAM_WEBHOOK_SECRET;\n if (!secret) {\n if (shouldRefuseWhenSecretMissing()) {\n if (!_telegramUnverifiedWarned) {\n _telegramUnverifiedWarned = true;\n console.error(\n \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — refusing webhook in production. \" +\n \"Set TELEGRAM_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n );\n }\n return false;\n }\n if (!_telegramUnverifiedWarned) {\n _telegramUnverifiedWarned = true;\n console.warn(\n \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — accepting webhook without verification (dev mode)\",\n );\n }\n // Dev mode: still require the bot token to be configured at all.\n return !!process.env.TELEGRAM_BOT_TOKEN;\n }\n\n const headerSecret = getHeader(event, \"x-telegram-bot-api-secret-token\");\n if (!headerSecret) return false;\n\n // Timing-safe comparison\n try {\n const crypto = await import(\"node:crypto\");\n return crypto.timingSafeEqual(\n Buffer.from(secret),\n Buffer.from(headerSecret),\n );\n } catch {\n return false;\n }\n },\n\n async parseIncomingMessage(\n event: H3Event,\n ): Promise<IncomingMessage \| null> {\n // Use the pre-cached raw body if available (set by handleVerification).\n // Falls back to readBody for paths that bypass handleVerification.\n const body = (event.context.__rawBody as any) ?? (await readBody(event));\n if (!body) return null;\n\n // Handle regular messages\n const message = body.message \|\| body.edited_message;\n if (!message) return null;\n\n // Only process text messages\n const text = message.text?.trim();\n if (!text) return null;\n\n // Ignore bot commands that we don't handle (e.g., /start is fine)\n // Remove /start command prefix if present\n const cleanText =\n text === \"/start\"\n ? \"Hello! I'm ready to chat.\"\n : text.replace(/^\\/\\w+\\s/, \"\").trim() \|\| text;\n\n const chat = message.chat;\n const from = message.from;\n\n return {\n platform: \"telegram\",\n externalThreadId: String(chat.id),\n text: cleanText,\n senderName:\n from?.first_name + (from?.last_name ? ` ${from.last_name}` : \"\"),\n senderId: String(from?.id),\n platformContext: {\n chatId: chat.id,\n chatType: chat.type,\n messageId: message.message_id,\n rawText: text,\n fromId: from?.id,\n fromUsername: from?.username,\n },\n timestamp: message.date * 1000,\n };\n },\n\n async sendResponse(\n message: OutgoingMessage,\n context: IncomingMessage,\n ): Promise<void> {\n const token = process.env.TELEGRAM_BOT_TOKEN;\n if (!token) {\n console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n return;\n }\n\n const chatId = context.platformContext.chatId;\n const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n\n for (const chunk of chunks) {\n try {\n const res = await fetch(\n `https://api.telegram.org/bot${token}/sendMessage`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n chat_id: chatId,\n text: chunk,\n parse_mode: \"Markdown\",\n }),\n },\n );\n const data = (await res.json()) as {\n ok: boolean;\n description?: string;\n };\n if (!data.ok) {\n // Retry without Markdown if parsing fails\n if (data.description?.includes(\"parse\")) {\n await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n chat_id: chatId,\n text: chunk,\n }),\n });\n } else {\n console.error(\"[telegram] sendMessage error:\", data.description);\n }\n }\n } catch (err) {\n console.error(\"[telegram] Failed to send message:\", err);\n }\n }\n },\n\n async sendMessageToTarget(\n message: OutgoingMessage,\n target: OutboundTarget,\n ): Promise<void> {\n const token = process.env.TELEGRAM_BOT_TOKEN;\n if (!token) {\n console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n return;\n }\n\n const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n for (const chunk of chunks) {\n const body: Record<string, unknown> = {\n chat_id: target.destination,\n text: chunk,\n };\n if (target.threadRef) {\n body.message_thread_id = target.threadRef;\n }\n\n try {\n const res = await fetch(\n `https://api.telegram.org/bot${token}/sendMessage`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(body),\n },\n );\n const data = (await res.json()) as {\n ok: boolean;\n description?: string;\n };\n if (!data.ok) {\n throw new Error(data.description \|\| \"sendMessage failed\");\n }\n } catch (err) {\n console.error(\"[telegram] Failed to send proactive message:\", err);\n throw err;\n }\n }\n },\n\n formatAgentResponse(text: string): OutgoingMessage {\n // Telegram's legacy Markdown uses single asterisks for bold, not double.\n // `[text](url)` is already supported natively.\n // 's' flag (dotAll) so `.` matches newlines — bold text can span lines.\n const normalized = text.replace(/\\\\(.+?)\\\\/gs, \"$1\");\n return { text: normalized, platformContext: { parse_mode: \"Markdown\" } };\n },\n\n async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n const hasToken = !!process.env.TELEGRAM_BOT_TOKEN;\n\n let botName: string \| undefined;\n if (hasToken) {\n try {\n const res = await fetch(\n `https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/getMe`,\n );\n const data = (await res.json()) as {\n ok: boolean;\n result?: { username?: string };\n };\n if (data.ok) {\n botName = data.result?.username;\n }\n } catch {}\n }\n\n return {\n platform: \"telegram\",\n label: \"Telegram\",\n enabled: false, // overridden by plugin\n configured: hasToken,\n details: {\n hasToken,\n botUsername: botName,\n },\n error: !hasToken\n ? \"Set TELEGRAM_BOT_TOKEN in your environment\"\n : undefined,\n };\n },\n };\n}\n\n/** Split a message into chunks that fit within the platform's limit */\nfunction splitMessage(text: string, maxLength: number): string[] {\n if (text.length <= maxLength) return [text];\n const chunks: string[] = [];\n let remaining = text;\n while (remaining.length > 0) {\n if (remaining.length <= maxLength) {\n chunks.push(remaining);\n break;\n }\n let splitIdx = remaining.lastIndexOf(\"\\n\", maxLength);\n if (splitIdx <= 0) splitIdx = remaining.lastIndexOf(\" \", maxLength);\n if (splitIdx <= 0) splitIdx = maxLength;\n chunks.push(remaining.slice(0, splitIdx));\n remaining = remaining.slice(splitIdx).trimStart();\n }\n return chunks;\n}\n"]}
1	+ {"version":3,"file":"telegram.js","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAG/B,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAStD,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;;;GAMG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;QAEjB,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,oBAAoB;oBAC3B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,uGAAuG;iBAC1G;gBACD;oBACE,GAAG,EAAE,yBAAyB;oBAC9B,KAAK,EAAE,yBAAyB;oBAChC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,6HAA6H;iBAChI;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,qEAAqE;YACrE,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,uCAAuC;YACvC,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACnC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBACjC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;YACD,qDAAqD;YACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,6BAA6B,EAAE,EAAE,CAAC;oBACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBAC/B,yBAAyB,GAAG,IAAI,CAAC;wBACjC,OAAO,CAAC,KAAK,CACX,+EAA+E;4BAC7E,sGAAsG,CACzG,CAAC;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAC/B,yBAAyB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,IAAI,CACV,gGAAgG,CACjG,CAAC;gBACJ,CAAC;gBACD,iEAAiE;gBACjE,OAAO,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YACzE,IAAI,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAEhC,yBAAyB;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC3C,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAC1B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,wEAAwE;YACxE,mEAAmE;YACnE,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,CAAC,SAAiB,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,0BAA0B;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,6BAA6B;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YAEnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAE1B,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,EAAE,SAAS;gBACf,UAAU,EACR,IAAI,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1B,eAAe,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,IAAI,EAAE,EAAE;oBAChB,YAAY,EAAE,IAAI,EAAE,QAAQ;iBAC7B;gBACD,SAAS,EAAE,OAAO,CAAC,IAAI,GAAG,IAAI;aAC/B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,CAAC;YACxD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,MAAM;4BACf,IAAI,EAAE,KAAK;4BACX,UAAU,EAAE,UAAU;yBACvB,CAAC;qBACH,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,0CAA0C;wBAC1C,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACxC,MAAM,KAAK,CAAC,+BAA+B,KAAK,cAAc,EAAE;gCAC9D,MAAM,EAAE,MAAM;gCACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gCAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oCACnB,OAAO,EAAE,MAAM;oCACf,IAAI,EAAE,KAAK;iCACZ,CAAC;6BACH,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;wBACnE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,CAAC;YACxD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAA4B;oBACpC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,IAAI,EAAE,KAAK;iBACZ,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,SAAS,CAAC;gBAC5C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;oBACnE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,yEAAyE;YACzE,+CAA+C;YAC/C,wEAAwE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;QAC3E,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC;YAEzB,IAAI,OAA2B,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,KAAK,QAAQ,CAAC,CAAC;oBACtE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;wBACZ,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAClC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE;oBACP,QAAQ;oBACR,WAAW,EAAE,OAAO;iBACrB;gBACD,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,SAAS;aACrE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getHeader } from \"h3\";\n\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { resolveSecret } from \"../../server/credential-provider.js\";\nimport { readBody } from \"../../server/h3-helpers.js\";\nimport type {\n PlatformAdapter,\n IncomingMessage,\n OutgoingMessage,\n IntegrationStatus,\n OutboundTarget,\n} from \"../types.js\";\n\n/** Telegram's max message length /\nconst TELEGRAM_MAX_LENGTH = 4096;\n\n/\n One-shot warning flag — log once per process when accepting unverified\n * webhooks (M6 in the webhook security audit).\n /\nlet _telegramUnverifiedWarned = false;\n\n/\n Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose secret is\n * unset — otherwise an attacker can drive the agent loop with arbitrary\n * messages (C2 in the webhook security audit).\n /\nfunction shouldRefuseWhenSecretMissing(): boolean {\n if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n return process.env.NODE_ENV === \"production\";\n}\n\n/\n Create a Telegram platform adapter.\n \n Required env vars:\n * - TELEGRAM_BOT_TOKEN — Bot token from @BotFather\n \n Optional env vars:\n * - TELEGRAM_WEBHOOK_SECRET — Secret token for webhook verification\n /\nexport function telegramAdapter(): PlatformAdapter {\n return {\n platform: \"telegram\",\n label: \"Telegram\",\n\n getRequiredEnvKeys(): EnvKeyConfig[] {\n return [\n {\n key: \"TELEGRAM_BOT_TOKEN\",\n label: \"Telegram Bot Token\",\n required: true,\n helpText:\n \"From @BotFather after `/newbot` — the long token Telegram gives you (looks like `123456:ABC-DEF...`).\",\n },\n {\n key: \"TELEGRAM_WEBHOOK_SECRET\",\n label: \"Telegram Webhook Secret\",\n required: false,\n helpText:\n \"Optional. Any random string — Telegram will echo it on every webhook so dispatch can verify the request came from Telegram.\",\n },\n ];\n },\n\n async handleVerification(\n event: H3Event,\n ): Promise<{ handled: boolean; response?: unknown }> {\n // Pre-read the raw body once and cache on the event context. h3 v2's\n // request body stream can only be consumed once; without this, the\n // later `parseIncomingMessage` call throws \"Body has already been read\"\n // because something upstream (signature check, dedupe, etc.) drains it.\n // Mirrors the Slack adapter's pattern.\n try {\n if (!event.context.__rawBody) {\n const body = await readBody(event);\n event.context.__rawBody = body;\n }\n } catch {\n // If we can't pre-read, parseIncomingMessage will surface the error\n }\n // Telegram has no challenge; we never short-circuit.\n return { handled: false };\n },\n\n async verifyWebhook(event: H3Event): Promise<boolean> {\n const secret = await resolveSecret(\"TELEGRAM_WEBHOOK_SECRET\");\n if (!secret) {\n if (shouldRefuseWhenSecretMissing()) {\n if (!_telegramUnverifiedWarned) {\n _telegramUnverifiedWarned = true;\n console.error(\n \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — refusing webhook in production. \" +\n \"Set TELEGRAM_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n );\n }\n return false;\n }\n if (!_telegramUnverifiedWarned) {\n _telegramUnverifiedWarned = true;\n console.warn(\n \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — accepting webhook without verification (dev mode)\",\n );\n }\n // Dev mode: still require the bot token to be configured at all.\n return !!(await resolveSecret(\"TELEGRAM_BOT_TOKEN\"));\n }\n\n const headerSecret = getHeader(event, \"x-telegram-bot-api-secret-token\");\n if (!headerSecret) return false;\n\n // Timing-safe comparison\n try {\n const crypto = await import(\"node:crypto\");\n return crypto.timingSafeEqual(\n Buffer.from(secret),\n Buffer.from(headerSecret),\n );\n } catch {\n return false;\n }\n },\n\n async parseIncomingMessage(\n event: H3Event,\n ): Promise<IncomingMessage \| null> {\n // Use the pre-cached raw body if available (set by handleVerification).\n // Falls back to readBody for paths that bypass handleVerification.\n const body = (event.context.__rawBody as any) ?? (await readBody(event));\n if (!body) return null;\n\n // Handle regular messages\n const message = body.message \|\| body.edited_message;\n if (!message) return null;\n\n // Only process text messages\n const text = message.text?.trim();\n if (!text) return null;\n\n // Ignore bot commands that we don't handle (e.g., /start is fine)\n // Remove /start command prefix if present\n const cleanText =\n text === \"/start\"\n ? \"Hello! I'm ready to chat.\"\n : text.replace(/^\\/\\w+\\s/, \"\").trim() \|\| text;\n\n const chat = message.chat;\n const from = message.from;\n\n return {\n platform: \"telegram\",\n externalThreadId: String(chat.id),\n text: cleanText,\n senderName:\n from?.first_name + (from?.last_name ? ` ${from.last_name}` : \"\"),\n senderId: String(from?.id),\n platformContext: {\n chatId: chat.id,\n chatType: chat.type,\n messageId: message.message_id,\n rawText: text,\n fromId: from?.id,\n fromUsername: from?.username,\n },\n timestamp: message.date * 1000,\n };\n },\n\n async sendResponse(\n message: OutgoingMessage,\n context: IncomingMessage,\n ): Promise<void> {\n const token = await resolveSecret(\"TELEGRAM_BOT_TOKEN\");\n if (!token) {\n console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n return;\n }\n\n const chatId = context.platformContext.chatId;\n const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n\n for (const chunk of chunks) {\n try {\n const res = await fetch(\n `https://api.telegram.org/bot${token}/sendMessage`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n chat_id: chatId,\n text: chunk,\n parse_mode: \"Markdown\",\n }),\n },\n );\n const data = (await res.json()) as {\n ok: boolean;\n description?: string;\n };\n if (!data.ok) {\n // Retry without Markdown if parsing fails\n if (data.description?.includes(\"parse\")) {\n await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n chat_id: chatId,\n text: chunk,\n }),\n });\n } else {\n console.error(\"[telegram] sendMessage error:\", data.description);\n }\n }\n } catch (err) {\n console.error(\"[telegram] Failed to send message:\", err);\n }\n }\n },\n\n async sendMessageToTarget(\n message: OutgoingMessage,\n target: OutboundTarget,\n ): Promise<void> {\n const token = await resolveSecret(\"TELEGRAM_BOT_TOKEN\");\n if (!token) {\n console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n return;\n }\n\n const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n for (const chunk of chunks) {\n const body: Record<string, unknown> = {\n chat_id: target.destination,\n text: chunk,\n };\n if (target.threadRef) {\n body.message_thread_id = target.threadRef;\n }\n\n try {\n const res = await fetch(\n `https://api.telegram.org/bot${token}/sendMessage`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(body),\n },\n );\n const data = (await res.json()) as {\n ok: boolean;\n description?: string;\n };\n if (!data.ok) {\n throw new Error(data.description \|\| \"sendMessage failed\");\n }\n } catch (err) {\n console.error(\"[telegram] Failed to send proactive message:\", err);\n throw err;\n }\n }\n },\n\n formatAgentResponse(text: string): OutgoingMessage {\n // Telegram's legacy Markdown uses single asterisks for bold, not double.\n // `[text](url)` is already supported natively.\n // 's' flag (dotAll) so `.` matches newlines — bold text can span lines.\n const normalized = text.replace(/\\\\(.+?)\\\\/gs, \"$1\");\n return { text: normalized, platformContext: { parse_mode: \"Markdown\" } };\n },\n\n async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n const token = await resolveSecret(\"TELEGRAM_BOT_TOKEN\");\n const hasToken = !!token;\n\n let botName: string \| undefined;\n if (hasToken) {\n try {\n const res = await fetch(`https://api.telegram.org/bot${token}/getMe`);\n const data = (await res.json()) as {\n ok: boolean;\n result?: { username?: string };\n };\n if (data.ok) {\n botName = data.result?.username;\n }\n } catch {}\n }\n\n return {\n platform: \"telegram\",\n label: \"Telegram\",\n enabled: false, // overridden by plugin\n configured: hasToken,\n details: {\n hasToken,\n botUsername: botName,\n },\n error: !hasToken ? \"Save TELEGRAM_BOT_TOKEN in settings\" : undefined,\n };\n },\n };\n}\n\n/** Split a message into chunks that fit within the platform's limit */\nfunction splitMessage(text: string, maxLength: number): string[] {\n if (text.length <= maxLength) return [text];\n const chunks: string[] = [];\n let remaining = text;\n while (remaining.length > 0) {\n if (remaining.length <= maxLength) {\n chunks.push(remaining);\n break;\n }\n let splitIdx = remaining.lastIndexOf(\"\\n\", maxLength);\n if (splitIdx <= 0) splitIdx = remaining.lastIndexOf(\" \", maxLength);\n if (splitIdx <= 0) splitIdx = maxLength;\n chunks.push(remaining.slice(0, splitIdx));\n remaining = remaining.slice(splitIdx).trimStart();\n }\n return chunks;\n}\n"]}

package/dist/integrations/adapters/whatsapp.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"whatsapp.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/whatsapp.ts"],"names":[],"mappings":"~~AAIA~~,OAAO,KAAK,EACV,eAAe,EAIhB,MAAM,aAAa,CAAC;AAsBrB;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI,eAAe,~~CA0PjD~~"}
1	+ {"version":3,"file":"whatsapp.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/whatsapp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EAIhB,MAAM,aAAa,CAAC;AAsBrB;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI,eAAe,CA4PjD"}

package/dist/integrations/adapters/whatsapp.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import { getQuery, getHeader, readRawBody as h3ReadRawBody } from "h3";
+import { resolveSecret } from "../../server/credential-provider.js";
 /** WhatsApp's max message length */
 const WHATSAPP_MAX_LENGTH = 4096;
 /**
@@ -82,7 +83,7 @@ export function whatsappAdapter() {
             const mode = query["hub.mode"];
             const token = query["hub.verify_token"];
             const challenge = query["hub.challenge"];
-            const expected = process.env.WHATSAPP_VERIFY_TOKEN;
+            const expected = await resolveSecret("WHATSAPP_VERIFY_TOKEN");
             if (mode === "subscribe" && expected && typeof token === "string") {
                 // Timing-safe compare so an attacker can't measure character-wise
                 // mismatch latency (H6 in the webhook security audit).
@@ -103,7 +104,7 @@ export function whatsappAdapter() {
             return { handled: false };
         },
         async verifyWebhook(event) {
-            const appSecret = process.env.WHATSAPP_APP_SECRET;
+            const appSecret = await resolveSecret("WHATSAPP_APP_SECRET");
             if (!appSecret) {
                 if (shouldRefuseWhenSecretMissing()) {
                     if (!_whatsappUnverifiedWarned) {
@@ -118,7 +119,7 @@ export function whatsappAdapter() {
                     console.warn("[whatsapp] WHATSAPP_APP_SECRET not set — accepting webhook without verification (dev mode)");
                 }
                 // Dev mode: still require the access token to be configured at all.
-                return !!process.env.WHATSAPP_ACCESS_TOKEN;
+                return !!(await resolveSecret("WHATSAPP_ACCESS_TOKEN"));
             }
             const signature = getHeader(event, "x-hub-signature-256");
             if (!signature)
@@ -186,8 +187,8 @@ export function whatsappAdapter() {
             };
         },
         async sendResponse(message, context) {
-            const accessToken = process.env.WHATSAPP_ACCESS_TOKEN;
-            const phoneNumberId = process.env.WHATSAPP_PHONE_NUMBER_ID;
+            const accessToken = await resolveSecret("WHATSAPP_ACCESS_TOKEN");
+            const phoneNumberId = await resolveSecret("WHATSAPP_PHONE_NUMBER_ID");
             if (!accessToken || !phoneNumberId) {
                 console.error("[whatsapp] WHATSAPP_ACCESS_TOKEN or WHATSAPP_PHONE_NUMBER_ID not configured");
                 return;
@@ -224,9 +225,9 @@ export function whatsappAdapter() {
             return { text, platformContext: {} };
         },
         async getStatus(_baseUrl) {
-            const hasAccessToken = !!process.env.WHATSAPP_ACCESS_TOKEN;
-            const hasVerifyToken = !!process.env.WHATSAPP_VERIFY_TOKEN;
-            const hasPhoneNumberId = !!process.env.WHATSAPP_PHONE_NUMBER_ID;
+            const hasAccessToken = !!(await resolveSecret("WHATSAPP_ACCESS_TOKEN"));
+            const hasVerifyToken = !!(await resolveSecret("WHATSAPP_VERIFY_TOKEN"));
+            const hasPhoneNumberId = !!(await resolveSecret("WHATSAPP_PHONE_NUMBER_ID"));
             const configured = hasAccessToken && hasVerifyToken && hasPhoneNumberId;
             return {
                 platform: "whatsapp",
@@ -239,7 +240,7 @@ export function whatsappAdapter() {
                     hasPhoneNumberId,
                 },
                 error: !configured
-                    ? "Set WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID"
+                    ? "Save WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID in settings"
                     : undefined,
             };
         },

package/dist/integrations/adapters/whatsapp.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"whatsapp.js","sourceRoot":"","sources":["../../../src/integrations/adapters/whatsapp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,IAAI,aAAa,EAAE,MAAM,IAAI,CAAC;AAUvE,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;;GAKG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;QAEjB,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,uBAAuB;oBAC9B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,yHAAyH;iBAC5H;gBACD;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,uBAAuB;oBAC9B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,wIAAwI;iBAC3I;gBACD;oBACE,GAAG,EAAE,0BAA0B;oBAC/B,KAAK,EAAE,0BAA0B;oBACjC,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,uGAAuG;iBAC1G;gBACD;oBACE,GAAG,EAAE,qBAAqB;oBAC1B,KAAK,EAAE,qBAAqB;oBAC5B,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,2HAA2H;iBAC9H;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,MAAM,CAAC;YAEjD,qEAAqE;YACrE,kEAAkE;YAClE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,yCAAyC;YACzC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,2EAA2E;gBAC7E,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YAED,uCAAuC;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAEnD,IAAI,IAAI,KAAK,WAAW,IAAI,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAClE,kEAAkE;gBAClE,uDAAuD;gBACvD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;wBAC3C,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;4BACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;wBAChD,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,eAAe;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAClD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,6BAA6B,EAAE,EAAE,CAAC;oBACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBAC/B,yBAAyB,GAAG,IAAI,CAAC;wBACjC,OAAO,CAAC,KAAK,CACX,2EAA2E;4BACzE,kGAAkG,CACrG,CAAC;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAC/B,yBAAyB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,IAAI,CACV,4FAA4F,CAC7F,CAAC;gBACJ,CAAC;gBACD,oEAAoE;gBACpE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAC7C,CAAC;YAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;YAC1D,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAE7B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,iBAAiB,GACrB,SAAS;gBACT,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEpE,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAC/B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,sEAAsE;YACtE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,+CAA+C;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YAE1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,4BAA4B;YAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe;YAE1C,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,gBAAgB,EAAE,IAAI;gBACtB,IAAI;gBACJ,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;gBAClC,QAAQ,EAAE,IAAI;gBACd,eAAe,EAAE;oBACf,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe;oBAC9C,kBAAkB,EAAE,KAAK,CAAC,QAAQ,EAAE,oBAAoB;oBACxD,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,IAAI;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B;gBACD,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI;aAClD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACtD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAC3D,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CACX,6EAA6E,CAC9E,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,oCAAoC,aAAa,WAAW,EAC5D;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,WAAW,EAAE;4BACtC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,iBAAiB,EAAE,UAAU;4BAC7B,cAAc,EAAE,YAAY;4BAC5B,EAAE;4BACF,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;yBACtB,CAAC;qBACH,CACF,CAAC;oBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;wBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;wBAChD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAC3D,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAC3D,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAChE,MAAM,UAAU,GAAG,cAAc,IAAI,cAAc,IAAI,gBAAgB,CAAC;YAExE,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU;gBACV,OAAO,EAAE;oBACP,cAAc;oBACd,cAAc;oBACd,gBAAgB;iBACjB;gBACD,KAAK,EAAE,CAAC,UAAU;oBAChB,CAAC,CAAC,gFAAgF;oBAClF,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getQuery, getHeader, readRawBody as h3ReadRawBody } from \"h3\";\n\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport type {\n PlatformAdapter,\n IncomingMessage,\n OutgoingMessage,\n IntegrationStatus,\n} from \"../types.js\";\n\n/** WhatsApp's max message length /\nconst WHATSAPP_MAX_LENGTH = 4096;\n\n/\n One-shot warning flag — log once per process when accepting unverified\n * webhooks (M6 in the webhook security audit).\n /\nlet _whatsappUnverifiedWarned = false;\n\n/\n Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose signature can't\n * be verified (C2 in the webhook security audit).\n /\nfunction shouldRefuseWhenSecretMissing(): boolean {\n if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n return process.env.NODE_ENV === \"production\";\n}\n\n/\n Create a WhatsApp Cloud API platform adapter.\n \n Required env vars:\n * - WHATSAPP_ACCESS_TOKEN — Permanent access token from Meta\n * - WHATSAPP_VERIFY_TOKEN — Custom token for webhook verification\n * - WHATSAPP_PHONE_NUMBER_ID — Phone number ID from Meta dashboard\n \n Optional env vars:\n * - WHATSAPP_APP_SECRET — App secret for signature verification\n /\nexport function whatsappAdapter(): PlatformAdapter {\n return {\n platform: \"whatsapp\",\n label: \"WhatsApp\",\n\n getRequiredEnvKeys(): EnvKeyConfig[] {\n return [\n {\n key: \"WHATSAPP_ACCESS_TOKEN\",\n label: \"WhatsApp Access Token\",\n required: true,\n helpText:\n \"From your Meta app → WhatsApp → API Setup → Permanent access token. Generate one under System Users for production use.\",\n },\n {\n key: \"WHATSAPP_VERIFY_TOKEN\",\n label: \"WhatsApp Verify Token\",\n required: true,\n helpText:\n \"Any random string you choose. You'll paste the same value into Meta's webhook configuration so Meta can confirm dispatch owns the URL.\",\n },\n {\n key: \"WHATSAPP_PHONE_NUMBER_ID\",\n label: \"WhatsApp Phone Number ID\",\n required: true,\n helpText:\n \"From your Meta app → WhatsApp → API Setup. The numeric Phone number ID (not the actual phone number).\",\n },\n {\n key: \"WHATSAPP_APP_SECRET\",\n label: \"WhatsApp App Secret\",\n required: false,\n helpText:\n \"Optional. From Meta App Dashboard → Basic Settings → App Secret. Enables HMAC signature verification on inbound webhooks.\",\n },\n ];\n },\n\n async handleVerification(\n event: H3Event,\n ): Promise<{ handled: boolean; response?: unknown }> {\n const method = event.node?.req?.method \|\| \"POST\";\n\n // For POST flows, pre-cache the raw body so verifyWebhook (HMAC) and\n // parseIncomingMessage don't both try to consume the request body\n // stream — h3 v2's body stream is consume-once, so a second read\n // hangs (M3 in the webhook security audit). Reads raw bytes; never\n // re-stringifies a parsed body, since Meta computes HMAC over the\n // exact bytes it sent (M2 in the audit).\n if (method === \"POST\") {\n try {\n await readRawBody(event);\n } catch {\n // Surfaces in verifyWebhook / parseIncomingMessage if it actually matters.\n }\n return { handled: false };\n }\n\n // GET: WhatsApp's challenge handshake.\n const query = getQuery(event);\n const mode = query[\"hub.mode\"];\n const token = query[\"hub.verify_token\"];\n const challenge = query[\"hub.challenge\"];\n const expected = process.env.WHATSAPP_VERIFY_TOKEN;\n\n if (mode === \"subscribe\" && expected && typeof token === \"string\") {\n // Timing-safe compare so an attacker can't measure character-wise\n // mismatch latency (H6 in the webhook security audit).\n const a = Buffer.from(String(token));\n const b = Buffer.from(String(expected));\n if (a.length === b.length) {\n try {\n const crypto = await import(\"node:crypto\");\n if (crypto.timingSafeEqual(a, b)) {\n return { handled: true, response: challenge };\n }\n } catch {\n // fall through\n }\n }\n }\n\n return { handled: false };\n },\n\n async verifyWebhook(event: H3Event): Promise<boolean> {\n const appSecret = process.env.WHATSAPP_APP_SECRET;\n if (!appSecret) {\n if (shouldRefuseWhenSecretMissing()) {\n if (!_whatsappUnverifiedWarned) {\n _whatsappUnverifiedWarned = true;\n console.error(\n \"[whatsapp] WHATSAPP_APP_SECRET not set — refusing webhook in production. \" +\n \"Set WHATSAPP_APP_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n );\n }\n return false;\n }\n if (!_whatsappUnverifiedWarned) {\n _whatsappUnverifiedWarned = true;\n console.warn(\n \"[whatsapp] WHATSAPP_APP_SECRET not set — accepting webhook without verification (dev mode)\",\n );\n }\n // Dev mode: still require the access token to be configured at all.\n return !!process.env.WHATSAPP_ACCESS_TOKEN;\n }\n\n const signature = getHeader(event, \"x-hub-signature-256\");\n if (!signature) return false;\n\n const body = await readRawBody(event);\n const crypto = await import(\"node:crypto\");\n const expectedSignature =\n \"sha256=\" +\n crypto.createHmac(\"sha256\", appSecret).update(body).digest(\"hex\");\n\n try {\n return crypto.timingSafeEqual(\n Buffer.from(signature),\n Buffer.from(expectedSignature),\n );\n } catch {\n return false;\n }\n },\n\n async parseIncomingMessage(\n event: H3Event,\n ): Promise<IncomingMessage \| null> {\n // Always read via the cached raw body so HMAC and parse see identical\n // bytes — h3 v2's body stream is consume-once, and re-stringifying a\n // parsed body breaks Meta's signature check (M2/M3 in the audit).\n const raw = await readRawBody(event);\n if (!raw) return null;\n let body: any;\n try {\n body = JSON.parse(raw);\n } catch {\n return null;\n }\n if (!body) return null;\n\n // WhatsApp Cloud API webhook payload structure\n const entry = body.entry?.[0];\n if (!entry) return null;\n\n const changes = entry.changes?.[0];\n if (!changes \|\| changes.field !== \"messages\") return null;\n\n const value = changes.value;\n const message = value?.messages?.[0];\n if (!message) return null;\n\n // Only handle text messages\n if (message.type !== \"text\") return null;\n const text = message.text?.body?.trim();\n if (!text) return null;\n\n const contact = value.contacts?.[0];\n const from = message.from; // Phone number\n\n return {\n platform: \"whatsapp\",\n externalThreadId: from,\n text,\n senderName: contact?.profile?.name,\n senderId: from,\n platformContext: {\n phoneNumberId: value.metadata?.phone_number_id,\n displayPhoneNumber: value.metadata?.display_phone_number,\n messageId: message.id,\n from,\n timestamp: message.timestamp,\n },\n timestamp: parseInt(message.timestamp, 10) 1000,\n };\n },\n\n async sendResponse(\n message: OutgoingMessage,\n context: IncomingMessage,\n ): Promise<void> {\n const accessToken = process.env.WHATSAPP_ACCESS_TOKEN;\n const phoneNumberId = process.env.WHATSAPP_PHONE_NUMBER_ID;\n if (!accessToken \|\| !phoneNumberId) {\n console.error(\n \"[whatsapp] WHATSAPP_ACCESS_TOKEN or WHATSAPP_PHONE_NUMBER_ID not configured\",\n );\n return;\n }\n\n const to = context.senderId;\n const chunks = splitMessage(message.text, WHATSAPP_MAX_LENGTH);\n\n for (const chunk of chunks) {\n try {\n const res = await fetch(\n `https://graph.facebook.com/v21.0/${phoneNumberId}/messages`,\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${accessToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n messaging_product: \"whatsapp\",\n recipient_type: \"individual\",\n to,\n type: \"text\",\n text: { body: chunk },\n }),\n },\n );\n if (!res.ok) {\n const data = await res.json().catch(() => ({}));\n console.error(\"[whatsapp] sendMessage error:\", data);\n }\n } catch (err) {\n console.error(\"[whatsapp] Failed to send message:\", err);\n }\n }\n },\n\n formatAgentResponse(text: string): OutgoingMessage {\n return { text, platformContext: {} };\n },\n\n async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n const hasAccessToken = !!process.env.WHATSAPP_ACCESS_TOKEN;\n const hasVerifyToken = !!process.env.WHATSAPP_VERIFY_TOKEN;\n const hasPhoneNumberId = !!process.env.WHATSAPP_PHONE_NUMBER_ID;\n const configured = hasAccessToken && hasVerifyToken && hasPhoneNumberId;\n\n return {\n platform: \"whatsapp\",\n label: \"WhatsApp\",\n enabled: false, // overridden by plugin\n configured,\n details: {\n hasAccessToken,\n hasVerifyToken,\n hasPhoneNumberId,\n },\n error: !configured\n ? \"Set WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID\"\n : undefined,\n };\n },\n };\n}\n\n/*\n Read the raw request body as a string and cache it on the event context.\n \n Reads raw bytes from the request stream, NEVER `JSON.stringify`s a parsed\n * body — Meta's signature is computed over the exact bytes Meta sent\n * (M2/M3 in the webhook security audit). h3 v2's body stream is consume-once\n * so we cache the raw string after the first read.\n */\nasync function readRawBody(event: H3Event): Promise<string> {\n const cached = event.context.__rawBody;\n if (typeof cached === \"string\") return cached;\n const raw = (await h3ReadRawBody(event)) ?? \"\";\n event.context.__rawBody = raw;\n return raw;\n}\n\nfunction splitMessage(text: string, maxLength: number): string[] {\n if (text.length <= maxLength) return [text];\n const chunks: string[] = [];\n let remaining = text;\n while (remaining.length > 0) {\n if (remaining.length <= maxLength) {\n chunks.push(remaining);\n break;\n }\n let splitIdx = remaining.lastIndexOf(\"\\n\", maxLength);\n if (splitIdx <= 0) splitIdx = remaining.lastIndexOf(\" \", maxLength);\n if (splitIdx <= 0) splitIdx = maxLength;\n chunks.push(remaining.slice(0, splitIdx));\n remaining = remaining.slice(splitIdx).trimStart();\n }\n return chunks;\n}\n"]}
1	+ {"version":3,"file":"whatsapp.js","sourceRoot":"","sources":["../../../src/integrations/adapters/whatsapp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,IAAI,aAAa,EAAE,MAAM,IAAI,CAAC;AAGvE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAQpE,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;;GAKG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;QAEjB,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,uBAAuB;oBAC9B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,yHAAyH;iBAC5H;gBACD;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,uBAAuB;oBAC9B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,wIAAwI;iBAC3I;gBACD;oBACE,GAAG,EAAE,0BAA0B;oBAC/B,KAAK,EAAE,0BAA0B;oBACjC,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,uGAAuG;iBAC1G;gBACD;oBACE,GAAG,EAAE,qBAAqB;oBAC1B,KAAK,EAAE,qBAAqB;oBAC5B,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,2HAA2H;iBAC9H;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,MAAM,CAAC;YAEjD,qEAAqE;YACrE,kEAAkE;YAClE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,yCAAyC;YACzC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,2EAA2E;gBAC7E,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YAED,uCAAuC;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,CAAC;YAE9D,IAAI,IAAI,KAAK,WAAW,IAAI,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAClE,kEAAkE;gBAClE,uDAAuD;gBACvD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;wBAC3C,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;4BACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;wBAChD,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,eAAe;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,CAAC;YAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,6BAA6B,EAAE,EAAE,CAAC;oBACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBAC/B,yBAAyB,GAAG,IAAI,CAAC;wBACjC,OAAO,CAAC,KAAK,CACX,2EAA2E;4BACzE,kGAAkG,CACrG,CAAC;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAC/B,yBAAyB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,IAAI,CACV,4FAA4F,CAC7F,CAAC;gBACJ,CAAC;gBACD,oEAAoE;gBACpE,OAAO,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;YAC1D,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAE7B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,iBAAiB,GACrB,SAAS;gBACT,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEpE,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAC/B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,sEAAsE;YACtE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,+CAA+C;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YAE1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,4BAA4B;YAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe;YAE1C,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,gBAAgB,EAAE,IAAI;gBACtB,IAAI;gBACJ,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;gBAClC,QAAQ,EAAE,IAAI;gBACd,eAAe,EAAE;oBACf,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe;oBAC9C,kBAAkB,EAAE,KAAK,CAAC,QAAQ,EAAE,oBAAoB;oBACxD,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,IAAI;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B;gBACD,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI;aAClD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,CAAC;YACtE,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CACX,6EAA6E,CAC9E,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,oCAAoC,aAAa,WAAW,EAC5D;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,WAAW,EAAE;4BACtC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,iBAAiB,EAAE,UAAU;4BAC7B,cAAc,EAAE,YAAY;4BAC5B,EAAE;4BACF,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;yBACtB,CAAC;qBACH,CACF,CAAC;oBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;wBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;wBAChD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC;YACxE,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC;YACxE,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAC7C,0BAA0B,CAC3B,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,cAAc,IAAI,cAAc,IAAI,gBAAgB,CAAC;YAExE,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU;gBACV,OAAO,EAAE;oBACP,cAAc;oBACd,cAAc;oBACd,gBAAgB;iBACjB;gBACD,KAAK,EAAE,CAAC,UAAU;oBAChB,CAAC,CAAC,6FAA6F;oBAC/F,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getQuery, getHeader, readRawBody as h3ReadRawBody } from \"h3\";\n\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { resolveSecret } from \"../../server/credential-provider.js\";\nimport type {\n PlatformAdapter,\n IncomingMessage,\n OutgoingMessage,\n IntegrationStatus,\n} from \"../types.js\";\n\n/** WhatsApp's max message length /\nconst WHATSAPP_MAX_LENGTH = 4096;\n\n/\n One-shot warning flag — log once per process when accepting unverified\n * webhooks (M6 in the webhook security audit).\n /\nlet _whatsappUnverifiedWarned = false;\n\n/\n Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose signature can't\n * be verified (C2 in the webhook security audit).\n /\nfunction shouldRefuseWhenSecretMissing(): boolean {\n if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n return process.env.NODE_ENV === \"production\";\n}\n\n/\n Create a WhatsApp Cloud API platform adapter.\n \n Required env vars:\n * - WHATSAPP_ACCESS_TOKEN — Permanent access token from Meta\n * - WHATSAPP_VERIFY_TOKEN — Custom token for webhook verification\n * - WHATSAPP_PHONE_NUMBER_ID — Phone number ID from Meta dashboard\n \n Optional env vars:\n * - WHATSAPP_APP_SECRET — App secret for signature verification\n /\nexport function whatsappAdapter(): PlatformAdapter {\n return {\n platform: \"whatsapp\",\n label: \"WhatsApp\",\n\n getRequiredEnvKeys(): EnvKeyConfig[] {\n return [\n {\n key: \"WHATSAPP_ACCESS_TOKEN\",\n label: \"WhatsApp Access Token\",\n required: true,\n helpText:\n \"From your Meta app → WhatsApp → API Setup → Permanent access token. Generate one under System Users for production use.\",\n },\n {\n key: \"WHATSAPP_VERIFY_TOKEN\",\n label: \"WhatsApp Verify Token\",\n required: true,\n helpText:\n \"Any random string you choose. You'll paste the same value into Meta's webhook configuration so Meta can confirm dispatch owns the URL.\",\n },\n {\n key: \"WHATSAPP_PHONE_NUMBER_ID\",\n label: \"WhatsApp Phone Number ID\",\n required: true,\n helpText:\n \"From your Meta app → WhatsApp → API Setup. The numeric Phone number ID (not the actual phone number).\",\n },\n {\n key: \"WHATSAPP_APP_SECRET\",\n label: \"WhatsApp App Secret\",\n required: false,\n helpText:\n \"Optional. From Meta App Dashboard → Basic Settings → App Secret. Enables HMAC signature verification on inbound webhooks.\",\n },\n ];\n },\n\n async handleVerification(\n event: H3Event,\n ): Promise<{ handled: boolean; response?: unknown }> {\n const method = event.node?.req?.method \|\| \"POST\";\n\n // For POST flows, pre-cache the raw body so verifyWebhook (HMAC) and\n // parseIncomingMessage don't both try to consume the request body\n // stream — h3 v2's body stream is consume-once, so a second read\n // hangs (M3 in the webhook security audit). Reads raw bytes; never\n // re-stringifies a parsed body, since Meta computes HMAC over the\n // exact bytes it sent (M2 in the audit).\n if (method === \"POST\") {\n try {\n await readRawBody(event);\n } catch {\n // Surfaces in verifyWebhook / parseIncomingMessage if it actually matters.\n }\n return { handled: false };\n }\n\n // GET: WhatsApp's challenge handshake.\n const query = getQuery(event);\n const mode = query[\"hub.mode\"];\n const token = query[\"hub.verify_token\"];\n const challenge = query[\"hub.challenge\"];\n const expected = await resolveSecret(\"WHATSAPP_VERIFY_TOKEN\");\n\n if (mode === \"subscribe\" && expected && typeof token === \"string\") {\n // Timing-safe compare so an attacker can't measure character-wise\n // mismatch latency (H6 in the webhook security audit).\n const a = Buffer.from(String(token));\n const b = Buffer.from(String(expected));\n if (a.length === b.length) {\n try {\n const crypto = await import(\"node:crypto\");\n if (crypto.timingSafeEqual(a, b)) {\n return { handled: true, response: challenge };\n }\n } catch {\n // fall through\n }\n }\n }\n\n return { handled: false };\n },\n\n async verifyWebhook(event: H3Event): Promise<boolean> {\n const appSecret = await resolveSecret(\"WHATSAPP_APP_SECRET\");\n if (!appSecret) {\n if (shouldRefuseWhenSecretMissing()) {\n if (!_whatsappUnverifiedWarned) {\n _whatsappUnverifiedWarned = true;\n console.error(\n \"[whatsapp] WHATSAPP_APP_SECRET not set — refusing webhook in production. \" +\n \"Set WHATSAPP_APP_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n );\n }\n return false;\n }\n if (!_whatsappUnverifiedWarned) {\n _whatsappUnverifiedWarned = true;\n console.warn(\n \"[whatsapp] WHATSAPP_APP_SECRET not set — accepting webhook without verification (dev mode)\",\n );\n }\n // Dev mode: still require the access token to be configured at all.\n return !!(await resolveSecret(\"WHATSAPP_ACCESS_TOKEN\"));\n }\n\n const signature = getHeader(event, \"x-hub-signature-256\");\n if (!signature) return false;\n\n const body = await readRawBody(event);\n const crypto = await import(\"node:crypto\");\n const expectedSignature =\n \"sha256=\" +\n crypto.createHmac(\"sha256\", appSecret).update(body).digest(\"hex\");\n\n try {\n return crypto.timingSafeEqual(\n Buffer.from(signature),\n Buffer.from(expectedSignature),\n );\n } catch {\n return false;\n }\n },\n\n async parseIncomingMessage(\n event: H3Event,\n ): Promise<IncomingMessage \| null> {\n // Always read via the cached raw body so HMAC and parse see identical\n // bytes — h3 v2's body stream is consume-once, and re-stringifying a\n // parsed body breaks Meta's signature check (M2/M3 in the audit).\n const raw = await readRawBody(event);\n if (!raw) return null;\n let body: any;\n try {\n body = JSON.parse(raw);\n } catch {\n return null;\n }\n if (!body) return null;\n\n // WhatsApp Cloud API webhook payload structure\n const entry = body.entry?.[0];\n if (!entry) return null;\n\n const changes = entry.changes?.[0];\n if (!changes \|\| changes.field !== \"messages\") return null;\n\n const value = changes.value;\n const message = value?.messages?.[0];\n if (!message) return null;\n\n // Only handle text messages\n if (message.type !== \"text\") return null;\n const text = message.text?.body?.trim();\n if (!text) return null;\n\n const contact = value.contacts?.[0];\n const from = message.from; // Phone number\n\n return {\n platform: \"whatsapp\",\n externalThreadId: from,\n text,\n senderName: contact?.profile?.name,\n senderId: from,\n platformContext: {\n phoneNumberId: value.metadata?.phone_number_id,\n displayPhoneNumber: value.metadata?.display_phone_number,\n messageId: message.id,\n from,\n timestamp: message.timestamp,\n },\n timestamp: parseInt(message.timestamp, 10) 1000,\n };\n },\n\n async sendResponse(\n message: OutgoingMessage,\n context: IncomingMessage,\n ): Promise<void> {\n const accessToken = await resolveSecret(\"WHATSAPP_ACCESS_TOKEN\");\n const phoneNumberId = await resolveSecret(\"WHATSAPP_PHONE_NUMBER_ID\");\n if (!accessToken \|\| !phoneNumberId) {\n console.error(\n \"[whatsapp] WHATSAPP_ACCESS_TOKEN or WHATSAPP_PHONE_NUMBER_ID not configured\",\n );\n return;\n }\n\n const to = context.senderId;\n const chunks = splitMessage(message.text, WHATSAPP_MAX_LENGTH);\n\n for (const chunk of chunks) {\n try {\n const res = await fetch(\n `https://graph.facebook.com/v21.0/${phoneNumberId}/messages`,\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${accessToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n messaging_product: \"whatsapp\",\n recipient_type: \"individual\",\n to,\n type: \"text\",\n text: { body: chunk },\n }),\n },\n );\n if (!res.ok) {\n const data = await res.json().catch(() => ({}));\n console.error(\"[whatsapp] sendMessage error:\", data);\n }\n } catch (err) {\n console.error(\"[whatsapp] Failed to send message:\", err);\n }\n }\n },\n\n formatAgentResponse(text: string): OutgoingMessage {\n return { text, platformContext: {} };\n },\n\n async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n const hasAccessToken = !!(await resolveSecret(\"WHATSAPP_ACCESS_TOKEN\"));\n const hasVerifyToken = !!(await resolveSecret(\"WHATSAPP_VERIFY_TOKEN\"));\n const hasPhoneNumberId = !!(await resolveSecret(\n \"WHATSAPP_PHONE_NUMBER_ID\",\n ));\n const configured = hasAccessToken && hasVerifyToken && hasPhoneNumberId;\n\n return {\n platform: \"whatsapp\",\n label: \"WhatsApp\",\n enabled: false, // overridden by plugin\n configured,\n details: {\n hasAccessToken,\n hasVerifyToken,\n hasPhoneNumberId,\n },\n error: !configured\n ? \"Save WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID in settings\"\n : undefined,\n };\n },\n };\n}\n\n/*\n Read the raw request body as a string and cache it on the event context.\n \n Reads raw bytes from the request stream, NEVER `JSON.stringify`s a parsed\n * body — Meta's signature is computed over the exact bytes Meta sent\n * (M2/M3 in the webhook security audit). h3 v2's body stream is consume-once\n * so we cache the raw string after the first read.\n */\nasync function readRawBody(event: H3Event): Promise<string> {\n const cached = event.context.__rawBody;\n if (typeof cached === \"string\") return cached;\n const raw = (await h3ReadRawBody(event)) ?? \"\";\n event.context.__rawBody = raw;\n return raw;\n}\n\nfunction splitMessage(text: string, maxLength: number): string[] {\n if (text.length <= maxLength) return [text];\n const chunks: string[] = [];\n let remaining = text;\n while (remaining.length > 0) {\n if (remaining.length <= maxLength) {\n chunks.push(remaining);\n break;\n }\n let splitIdx = remaining.lastIndexOf(\"\\n\", maxLength);\n if (splitIdx <= 0) splitIdx = remaining.lastIndexOf(\" \", maxLength);\n if (splitIdx <= 0) splitIdx = maxLength;\n chunks.push(remaining.slice(0, splitIdx));\n remaining = remaining.slice(splitIdx).trimStart();\n }\n return chunks;\n}\n"]}

package/dist/integrations/plugin.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/integrations/plugin.ts"],"names":[],"mappings":"~~AAwEA~~,OAAO,KAAK,EAEV,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AAGpB,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AA0F9D,KAAK,yBAAyB,GAAG;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;~~AAIF~~,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsFlC;AA+ND;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,yBAAyB,GAClC,cAAc,~~CA+nChB~~;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,gBAA6B,CAAC"}
1	+ {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/integrations/plugin.ts"],"names":[],"mappings":"AA0EA,OAAO,KAAK,EAEV,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AAGpB,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AA0F9D,KAAK,yBAAyB,GAAG;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAUF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsFlC;AA+ND;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,yBAAyB,GAClC,cAAc,CAyrChB;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,gBAA6B,CAAC"}

package/dist/integrations/plugin.js CHANGED Viewed

@@ -1,13 +1,15 @@
 import { defineEventHandler, setResponseStatus, getMethod, getQuery } from "h3";
 import { getRequestHeader } from "h3";
 import { createRemoteJWKSet, jwtVerify } from "jose";
-import { getOrgContext } from "../org/context.js";
+import { getOrgContext, resolveOrgIdForEmail } from "../org/context.js";
 import { loadResourcesForPrompt } from "../server/agent-chat-plugin.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { getSession } from "../server/auth.js";
 import { FRAMEWORK_ROUTE_PREFIX } from "../server/core-routes-plugin.js";
+import { resolveSecret } from "../server/credential-provider.js";
 import { getH3App, markDefaultPluginProvided, } from "../server/framework-request-handler.js";
 import { readBody } from "../server/h3-helpers.js";
+import { runWithRequestContext } from "../server/request-context.js";
 import { processA2AContinuationById, processDueA2AContinuations, } from "./a2a-continuation-processor.js";
 import { failA2AContinuation } from "./a2a-continuations-store.js";
 import { emailAdapter } from "./adapters/email.js";
@@ -407,7 +409,7 @@ export function createIntegrationsPlugin(options) {
         // init can leave us with an empty string forever. The getter
         // re-resolves on every webhook so freshly-set secrets work without
         // a redeploy.
-        const getApiKey = () => options?.apiKey ?? process.env.ANTHROPIC_API_KEY ?? "";
+        const getApiKey = () => options?.apiKey ?? "";
         // Build the system prompt
         const baseSystemPrompt = options?.systemPrompt ?? INTEGRATION_SYSTEM_PROMPT;
         // Resolve actions — auto-include call-agent so the integration agent can
@@ -451,6 +453,29 @@ export function createIntegrationsPlugin(options) {
                 orgId: orgCtx?.orgId ?? session.orgId ?? null,
             };
         }
+        function toCredentialContext(ctx, opts) {
+            return {
+                userEmail: ctx.ownerEmail,
+                ...(ctx.orgId ? { orgId: ctx.orgId } : {}),
+                ...(opts?.isIntegrationCaller ? { isIntegrationCaller: true } : {}),
+            };
+        }
+        async function credentialContextForIntegrationConfig(config) {
+            const ownerEmail = typeof config?.owner === "string" ? config.owner.trim() : "";
+            if (!ownerEmail)
+                return null;
+            const orgId = await resolveOrgIdForEmail(ownerEmail).catch(() => null);
+            return {
+                userEmail: ownerEmail,
+                ...(orgId ? { orgId } : {}),
+                isIntegrationCaller: true,
+            };
+        }
+        async function withCredentialContext(context, fn) {
+            if (!context)
+                return fn();
+            return runWithRequestContext(context, fn);
+        }
         async function requireRemoteDevice(event) {
             const token = extractBearerToken(getRequestHeader(event, "authorization"));
             const device = await authenticateRemoteDeviceToken(token);
@@ -503,12 +528,14 @@ export function createIntegrationsPlugin(options) {
                 setResponseStatus(event, 405);
                 return { error: "Method not allowed" };
             }
-            if (!(await requireSession(event)))
-                return { error: "unauthorized" };
             const baseUrl = getBaseUrl(event);
+            const ctx = await requireSessionContext(event);
+            if (!ctx)
+                return { error: "unauthorized" };
+            const credentialContext = toCredentialContext(ctx);
             const statuses = [];
             for (const adapter of adapters) {
-                const status = await adapter.getStatus(baseUrl);
+                const status = await withCredentialContext(credentialContext, () => adapter.getStatus(baseUrl));
                 const config = await getIntegrationConfig(adapter.platform);
                 status.enabled = !!config?.configData?.enabled;
                 status.webhookUrl = `${baseUrl}${P}/${adapter.platform}/webhook`;
@@ -1170,10 +1197,11 @@ export function createIntegrationsPlugin(options) {
             }
             // ─── GET /:platform/status ─────────────────────────────
             if (action === "status" && method === "GET") {
-                if (!(await requireSession(event)))
+                const ctx = await requireSessionContext(event);
+                if (!ctx)
                     return { error: "unauthorized" };
                 const baseUrl = getBaseUrl(event);
-                const status = await adapter.getStatus(baseUrl);
+                const status = await withCredentialContext(toCredentialContext(ctx), () => adapter.getStatus(baseUrl));
                 const config = await getIntegrationConfig(platform);
                 status.enabled = !!config?.configData?.enabled;
                 status.webhookUrl = `${baseUrl}${P}/${platform}/webhook`;
@@ -1228,13 +1256,14 @@ export function createIntegrationsPlugin(options) {
                     });
                     return "ok";
                 }
+                const config = await getIntegrationConfig(platform);
+                const credentialContext = await credentialContextForIntegrationConfig(config);
                 // Handle platform verification challenges (e.g. Slack url_verification)
                 // before checking enable state or parsing the message.
-                const verification = await adapter.handleVerification(event);
+                const verification = await withCredentialContext(credentialContext, () => adapter.handleVerification(event));
                 if (verification.handled) {
                     return verification.response ?? "ok";
                 }
-                const config = await getIntegrationConfig(platform);
                 if (!config?.configData?.enabled) {
                     setResponseStatus(event, 404);
                     return { error: `Integration ${platform} is not enabled` };
@@ -1244,12 +1273,12 @@ export function createIntegrationsPlugin(options) {
                 // hangs on streaming providers), and that means handleWebhook's
                 // own verifyWebhook step is bypassed. Without this call anyone
                 // could POST a forged Slack/Telegram/email payload.
-                const isValid = await adapter.verifyWebhook(event);
+                const isValid = await withCredentialContext(credentialContext, () => adapter.verifyWebhook(event));
                 if (!isValid) {
                     setResponseStatus(event, 401);
                     return { error: "Invalid webhook signature" };
                 }
-                const incoming = await adapter.parseIncomingMessage(event);
+                const incoming = await withCredentialContext(credentialContext, () => adapter.parseIncomingMessage(event));
                 if (!incoming) {
                     setResponseStatus(event, 200);
                     return "ok";
@@ -1309,10 +1338,15 @@ export function createIntegrationsPlugin(options) {
                 if (platform === "telegram") {
                     const baseUrl = getBaseUrl(event);
                     const webhookUrl = `${baseUrl}${P}/telegram/webhook`;
-                    const token = process.env.TELEGRAM_BOT_TOKEN;
+                    const ctx = await requireSessionContext(event);
+                    if (!ctx)
+                        return { error: "unauthorized" };
+                    const token = await withCredentialContext(toCredentialContext(ctx), () => resolveSecret("TELEGRAM_BOT_TOKEN"));
                     if (!token) {
                         setResponseStatus(event, 400);
-                        return { error: "TELEGRAM_BOT_TOKEN not configured" };
+                        return {
+                            error: "TELEGRAM_BOT_TOKEN not configured. Save it in settings.",
+                        };
                     }
                     try {
                         const res = await fetch(`https://api.telegram.org/bot${token}/setWebhook`, {