npm - @agent-native/core - Versions diffs - 0.79.17 → 0.79.19 - Mend

@agent-native/core 0.79.17 → 0.79.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (355) hide show

package/dist/integrations/adapters/slack.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/slack.ts"],"names":[],"mappings":"~~AAIA~~,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AAOrB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,IAAI,eAAe,CA4U9C"}
1	+ {"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/slack.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AAOrB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,IAAI,eAAe,CA4U9C"}

package/dist/integrations/adapters/slack.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import { createError, getHeader, readRawBody } from "h3";
+import { resolveSecret } from "../../server/credential-provider.js";
 /** Slack's max message length */
 const SLACK_MAX_LENGTH = 4000;
 const SLACK_SECTION_TEXT_MAX_LENGTH = 3000;
@@ -62,7 +63,7 @@ export function slackAdapter() {
             return { handled: false };
         },
         async verifyWebhook(event) {
-            const signingSecret = process.env.SLACK_SIGNING_SECRET;
+            const signingSecret = await resolveSecret("SLACK_SIGNING_SECRET");
             if (!signingSecret)
                 return false;
             const signature = getHeader(event, "x-slack-signature");
@@ -154,7 +155,7 @@ export function slackAdapter() {
             // redundant and added an extra chunk that we then had to overwrite.
             // We just set the native status and return null so sendResponse posts
             // the final reply as a fresh message.
-            const token = process.env.SLACK_BOT_TOKEN;
+            const token = await resolveSecret("SLACK_BOT_TOKEN");
             if (!token)
                 return null;
             const channelId = incoming.platformContext.channelId;
@@ -168,7 +169,7 @@ export function slackAdapter() {
             return null;
         },
         async sendResponse(message, context, opts) {
-            const token = process.env.SLACK_BOT_TOKEN;
+            const token = await resolveSecret("SLACK_BOT_TOKEN");
             if (!token) {
                 console.error("[slack] SLACK_BOT_TOKEN not configured");
                 return;
@@ -246,7 +247,7 @@ export function slackAdapter() {
             }
         },
         async sendMessageToTarget(message, target) {
-            const token = process.env.SLACK_BOT_TOKEN;
+            const token = await resolveSecret("SLACK_BOT_TOKEN");
             if (!token) {
                 console.error("[slack] SLACK_BOT_TOKEN not configured");
                 return;
@@ -290,8 +291,8 @@ export function slackAdapter() {
             };
         },
         async getStatus(_baseUrl) {
-            const hasToken = !!process.env.SLACK_BOT_TOKEN;
-            const hasSecret = !!process.env.SLACK_SIGNING_SECRET;
+            const hasToken = !!(await resolveSecret("SLACK_BOT_TOKEN"));
+            const hasSecret = !!(await resolveSecret("SLACK_SIGNING_SECRET"));
             const configured = hasToken && hasSecret;
             return {
                 platform: "slack",
@@ -303,7 +304,7 @@ export function slackAdapter() {
                     hasSecret,
                 },
                 error: !configured
-                    ? "Set SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET in your environment"
+                    ? "Save SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET in settings"
                     : undefined,
             };
         },

package/dist/integrations/adapters/slack.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"slack.js","sourceRoot":"","sources":["../../../src/integrations/adapters/slack.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAWzD,iCAAiC;AACjC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,OAAO;QAEd,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,iBAAiB;oBACxB,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,iGAAiG;iBACpG;gBACD;oBACE,GAAG,EAAE,sBAAsB;oBAC3B,KAAK,EAAE,sBAAsB;oBAC7B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,qFAAqF;iBACxF;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,kEAAkE;YAClE,uEAAuE;YACvE,oEAAoE;YACpE,2DAA2D;YAC3D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBACvC,8DAA8D;oBAC9D,mEAAmE;oBACnE,8DAA8D;oBAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACvD,IAAI,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC;YAEjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;YAChE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAE3C,2DAA2D;YAC3D,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAEzD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7C,MAAM,iBAAiB,GACrB,KAAK;gBACL,MAAM;qBACH,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC;qBACnC,MAAM,CAAC,UAAU,CAAC;qBAClB,MAAM,CAAC,KAAK,CAAC,CAAC;YAEnB,yBAAyB;YACzB,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAC/B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,iCAAiC;YACjC,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAEnC,4BAA4B;YAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;gBACxB,IAAI,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAEpB,sBAAsB;gBACtB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;oBAAE,OAAO,IAAI,CAAC;gBACzD,mCAAmC;gBACnC,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB;oBACpE,OAAO,IAAI,CAAC;gBAEd,+CAA+C;gBAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAEvB,+EAA+E;gBAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,SAAS;oBAAE,OAAO,IAAI,CAAC;gBAE5B,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrC,MAAM,gBAAgB,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAEpD,OAAO;oBACL,QAAQ,EAAE,OAAO;oBACjB,gBAAgB;oBAChB,IAAI,EAAE,SAAS;oBACf,UAAU,EAAE,CAAC,CAAC,IAAI;oBAClB,QAAQ,EAAE,CAAC,CAAC,IAAI;oBAChB,eAAe,EAAE;wBACf,SAAS,EAAE,CAAC,CAAC,OAAO;wBACpB,QAAQ,EAAE,QAAQ;wBAClB,SAAS,EAAE,CAAC,CAAC,EAAE;wBACf,MAAM,EAAE,OAAO,CAAC,OAAO;wBACvB,OAAO,EAAE,OAAO,CAAC,QAAQ;qBAC1B;oBACD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;iBAC/C,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,yBAAyB,CAC7B,QAAyB;YAEzB,gEAAgE;YAChE,sEAAsE;YACtE,kEAAkE;YAClE,oEAAoE;YACpE,sEAAsE;YACtE,sCAAsC;YACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,SAAmB,CAAC;YAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAkB,CAAC;YAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAEzC,sEAAsE;YACtE,qEAAqE;YACrE,mCAAmC;YACnC,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB,EACxB,IAAkC;YAElC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,SAAmB,CAAC;YAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,QAAkB,CAAC;YAC5D,MAAM,MAAM,GAAI,OAAO,CAAC,eAAuB,EAAE,MAEpC,CAAC;YACd,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;YAE5C,wEAAwE;YACxE,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACpE,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,QAAQ,EAAE,CAAC;oBACb,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAEnC,MAAM,WAAW,GACf,MAAM;gBACN,mBAAmB,CAAC,UAAU,EAAE;oBAC9B,iBAAiB,EAAG,OAAO,CAAC,eAAuB;wBACjD,EAAE,iBAAiB;iBACtB,CAAC,CAAC;YAEL,MAAM,QAAQ,GAA4B;gBACxC,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,WAAW;gBACnB,YAAY,EAAE,KAAK;gBACnB,YAAY,EAAE,KAAK;gBACnB,MAAM,EAAE,IAAI;aACb,CAAC;YAEF,IAAI,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,gDAAgD;oBAChD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,mCAAmC,EAAE;wBACnE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,KAAK,EAAE;4BAChC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC;qBAC1D,CAAC,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;wBACxD,2DAA2D;wBAC3D,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACxD,CAAC;gBAED,8DAA8D;gBAC9D,sDAAsD;gBACtD,IAAI,QAAQ,EAAE,CAAC;oBACb,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBAED,uEAAuE;gBACvE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC/B,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;wBAC1C,OAAO,EAAE,SAAS;wBAClB,IAAI,EAAE,KAAK;wBACX,YAAY,EAAE,KAAK;wBACnB,YAAY,EAAE,KAAK;wBACnB,MAAM,EAAE,IAAI;qBACb,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;gBACtD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAA4B;oBACpC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,IAAI,EAAE,KAAK;iBACZ,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS;oBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBAExD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,wCAAwC,EACxC;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,KAAK,EAAE;4BAChC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;oBACnE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;oBAC3D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;oBAChE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CACjB,IAAY,EACZ,IAAqC;YAErC,OAAO;gBACL,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBACjC,eAAe,EAAE,IAAI,EAAE,iBAAiB;oBACtC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE;oBAC/C,CAAC,CAAC,EAAE;aACP,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACrD,MAAM,UAAU,GAAG,QAAQ,IAAI,SAAS,CAAC;YAEzC,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU;gBACV,OAAO,EAAE;oBACP,QAAQ;oBACR,SAAS;iBACV;gBACD,KAAK,EAAE,CAAC,UAAU;oBAChB,CAAC,CAAC,kEAAkE;oBACpE,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,IAAI,uBAAuB,GAAG,KAAK,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,yBAAyB,CAAC,OAAY;IAC7C,MAAM,MAAM,GACV,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,QAAQ,GACZ,OAAO,OAAO,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3E,MAAM,cAAc,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAErE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,6CAA6C;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,uBAAuB,GAAG,IAAI,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,6HAA6H;gBAC3H,gHAAgH,CACnH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,8BAA8B;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,8BAA8B;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAc;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,wEAAwE;IACxE,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY,EAAE,SAAiB;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,GAAG,SAAS,GAAG,SAAS;YAAE,MAAM;QACzC,KAAK,IAAI,SAAS,CAAC;QACnB,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE/D,4BAA4B;QAC5B,IAAI,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,0BAA0B;YAC1B,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,SAAS,oBAAoB,CAAC,IAAY,EAAE,SAAiB;IAC3D,OAAO,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;4EAK4E;AAC5E,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,OAAO,CACL,OAAO;SACJ,OAAO,CAAC,0BAA0B,EAAE,SAAS,CAAC;QAC/C,sEAAsE;QACtE,sEAAsE;SACrE,OAAO,CAAC,oCAAoC,EAAE,MAAM,CAAC;QACtD,oEAAoE;QACpE,gEAAgE;QAChE,sEAAsE;QACtE,iEAAiE;QACjE,gDAAgD;SAC/C,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,MAAc;IAEd,aAAa,CAAC,mDAAmD,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,QAAQ;YACnB,MAAM;SACP,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,IAAoC;IAEpC,MAAM,aAAa,GAAG,YAAY,CAChC,IAAI,IAAI,iBAAiB,EACzB,6BAA6B,CAC9B,CAAC;IACF,MAAM,MAAM,GAAU,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE;oBAC9D,GAAG,EAAE,IAAI,CAAC,iBAAiB;oBAC3B,SAAS,EAAE,sBAAsB;iBAClC;aACF;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CACtB,KAAa,EACb,SAAiB,EACjB,QAA4B,EAC5B,IAA6B;IAE7B,MAAM,SAAS,GACb,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAK,IAAI,CAAC,MAAoB,CAAC,MAAM,GAAG,CAAC,CAAC;IACtE,IACE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,SAAS,EACV,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAA4B;QACvC,GAAG,IAAI;QACP,OAAO,EAAE,SAAS;KACnB,CAAC;IACF,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,wCAAwC,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,IAAiB;IAEjB,MAAM,UAAU,GACd,OAAO,eAAe,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;YACtB,GAAG,IAAI;YACP,MAAM,EAAE,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM;SAC1C,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { createError, getHeader, readRawBody } from \"h3\";\n\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport type {\n PlatformAdapter,\n IncomingMessage,\n OutgoingMessage,\n IntegrationStatus,\n OutboundTarget,\n} from \"../types.js\";\n\n/** Slack's max message length /\nconst SLACK_MAX_LENGTH = 4000;\nconst SLACK_SECTION_TEXT_MAX_LENGTH = 3000;\nconst SLACK_API_TIMEOUT_MS = 10_000;\n\n/\n Create a Slack platform adapter.\n \n Required env vars:\n * - SLACK_BOT_TOKEN — Bot user OAuth token (xoxb-...)\n * - SLACK_SIGNING_SECRET — Used to verify webhook signatures\n \n Optional env vars:\n * - SLACK_ALLOWED_TEAM_IDS — Comma-separated list of Slack workspace\n * `team_id` values (e.g. \"T012ABCDEF,T034GHIJKL\") that this deployment\n * accepts events from. Required in production and strongly recommended\n * to prevent cross-workspace event injection (H1 in the webhook audit):\n * the global `SLACK_SIGNING_SECRET` is the same key for every workspace\n * the app is installed to, so without an allowlist any installed\n * workspace can drive the agent. When unset the adapter accepts events\n * from any workspace in development, but rejects events in production.\n * - SLACK_ALLOWED_API_APP_IDS — Comma-separated list of Slack app IDs\n * (`api_app_id`) to additionally pin events to. Useful when the same\n * signing secret rotation surfaces multiple app installs.\n /\nexport function slackAdapter(): PlatformAdapter {\n return {\n platform: \"slack\",\n label: \"Slack\",\n\n getRequiredEnvKeys(): EnvKeyConfig[] {\n return [\n {\n key: \"SLACK_BOT_TOKEN\",\n label: \"Slack Bot Token\",\n required: true,\n helpText:\n \"In your Slack app's left nav: OAuth & Permissions → Bot User OAuth Token (starts with `xoxb-`).\",\n },\n {\n key: \"SLACK_SIGNING_SECRET\",\n label: \"Slack Signing Secret\",\n required: true,\n helpText:\n \"In your Slack app's left nav: Basic Information → App Credentials → Signing Secret.\",\n },\n ];\n },\n\n async handleVerification(\n event: H3Event,\n ): Promise<{ handled: boolean; response?: unknown }> {\n // Slack sends url_verification when first setting up the webhook.\n // readRawBodyCached caches the raw bytes on event.context.__rawBody so\n // subsequent verifyWebhook + parseIncomingMessage calls re-use them\n // without re-stringifying a parsed body (M2 in the audit).\n const body = await readRawBodyCached(event);\n try {\n const parsed = JSON.parse(body);\n if (parsed.type === \"url_verification\") {\n // Slack's URL verifier expects the raw challenge value in the\n // response body. Returning JSON works for some clients but the app\n // settings verifier rejects it as not matching the challenge.\n return { handled: true, response: parsed.challenge };\n }\n } catch {}\n return { handled: false };\n },\n\n async verifyWebhook(event: H3Event): Promise<boolean> {\n const signingSecret = process.env.SLACK_SIGNING_SECRET;\n if (!signingSecret) return false;\n\n const signature = getHeader(event, \"x-slack-signature\");\n const timestamp = getHeader(event, \"x-slack-request-timestamp\");\n if (!signature \|\| !timestamp) return false;\n\n // Reject requests older than 5 minutes (replay protection)\n const ts = parseInt(timestamp, 10);\n if (Math.abs(Date.now() / 1000 - ts) > 300) return false;\n\n const body = await readRawBodyCached(event);\n const crypto = await import(\"node:crypto\");\n const basestring = `v0:${timestamp}:${body}`;\n const expectedSignature =\n \"v0=\" +\n crypto\n .createHmac(\"sha256\", signingSecret)\n .update(basestring)\n .digest(\"hex\");\n\n // Timing-safe comparison\n try {\n return crypto.timingSafeEqual(\n Buffer.from(signature),\n Buffer.from(expectedSignature),\n );\n } catch {\n return false;\n }\n },\n\n async parseIncomingMessage(\n event: H3Event,\n ): Promise<IncomingMessage \| null> {\n const raw = await readRawBodyCached(event);\n let payload: any;\n try {\n payload = JSON.parse(raw);\n } catch {\n return null;\n }\n\n // H1 (webhook audit): cross-workspace event injection. The global\n // SLACK_SIGNING_SECRET is the same key for every workspace this Slack\n // app is installed to — without a per-tenant allowlist any installed\n // workspace can drive the agent. We enforce SLACK_ALLOWED_TEAM_IDS\n // here AFTER the signature has already been verified by the webhook\n // handler, so this is purely a tenant-isolation gate (not a forgery\n // defense). When unset in production we surface a one-time warning\n // recommending it be configured.\n enforceWorkspaceAllowlist(payload);\n\n // Handle Events API wrapper\n if (payload.type === \"event_callback\") {\n const e = payload.event;\n if (!e) return null;\n\n // Ignore bot messages\n if (e.bot_id \|\| e.subtype === \"bot_message\") return null;\n // Ignore message edits and deletes\n if (e.subtype === \"message_changed\" \|\| e.subtype === \"message_deleted\")\n return null;\n\n // Handle both direct messages and app_mentions\n const text = e.text?.trim();\n if (!text) return null;\n\n // Remove bot mention from text (e.g., \"<@U123> do something\" → \"do something\")\n const cleanText = text.replace(/<@[A-Z0-9]+>/g, \"\").trim();\n if (!cleanText) return null;\n\n // Thread ID: use thread_ts if in a thread, otherwise message ts\n const threadTs = e.thread_ts \|\| e.ts;\n const externalThreadId = `${e.channel}:${threadTs}`;\n\n return {\n platform: \"slack\",\n externalThreadId,\n text: cleanText,\n senderName: e.user,\n senderId: e.user,\n platformContext: {\n channelId: e.channel,\n threadTs: threadTs,\n messageTs: e.ts,\n teamId: payload.team_id,\n eventId: payload.event_id,\n },\n timestamp: Math.floor(parseFloat(e.ts) 1000),\n };\n }\n\n return null;\n },\n\n async postProcessingPlaceholder(\n incoming: IncomingMessage,\n ): Promise<{ placeholderRef: string } \| null> {\n // No placeholder reply in the thread — Slack's native assistant\n // status bar (\"agent-native is thinking…\", below the composer) is the\n // loading affordance. A second visible \"Working on it…\" reply was\n // redundant and added an extra chunk that we then had to overwrite.\n // We just set the native status and return null so sendResponse posts\n // the final reply as a fresh message.\n const token = process.env.SLACK_BOT_TOKEN;\n if (!token) return null;\n\n const channelId = incoming.platformContext.channelId as string;\n const threadTs = incoming.platformContext.threadTs as string;\n if (!channelId \|\| !threadTs) return null;\n\n // Best-effort: flip the native AI-assistant \"is thinking…\" status bar\n // in the channel input area. Requires `assistant:write` scope on the\n // app — otherwise silently no-ops.\n setSlackAssistantStatus(token, channelId, threadTs, \"is thinking…\");\n return null;\n },\n\n async sendResponse(\n message: OutgoingMessage,\n context: IncomingMessage,\n opts?: { placeholderRef?: string },\n ): Promise<void> {\n const token = process.env.SLACK_BOT_TOKEN;\n if (!token) {\n console.error(\"[slack] SLACK_BOT_TOKEN not configured\");\n return;\n }\n\n const channelId = context.platformContext.channelId as string;\n const threadTs = context.platformContext.threadTs as string;\n const blocks = (message.platformContext as any)?.blocks as\n \| unknown[]\n \| undefined;\n const placeholderRef = opts?.placeholderRef;\n\n // Block-rich path: split text into chunks but render the FIRST chunk as\n // blocks (so we keep the in-place edit + button) and any overflow as\n // plain follow-up posts. The vast majority of replies fit in one block.\n const chunks = splitNonEmptyMessage(message.text, SLACK_MAX_LENGTH);\n const hasProvidedBlocks = Array.isArray(blocks) && blocks.length > 0;\n const firstChunk = chunks[0] ?? (hasProvidedBlocks ? \"Response\" : \"\");\n if (!firstChunk) {\n if (threadTs) {\n setSlackAssistantStatus(token, channelId, threadTs, \"\");\n }\n return;\n }\n const restChunks = chunks.slice(1);\n\n const finalBlocks =\n blocks ??\n buildResponseBlocks(firstChunk, {\n threadDeepLinkUrl: (message.platformContext as any)\n ?.threadDeepLinkUrl,\n });\n\n const baseBody: Record<string, unknown> = {\n channel: channelId,\n text: firstChunk,\n blocks: finalBlocks,\n unfurl_links: false,\n unfurl_media: false,\n mrkdwn: true,\n };\n\n try {\n if (placeholderRef) {\n // Replace the \"thinking…\" placeholder in place.\n const res = await slackApiFetch(\"https://slack.com/api/chat.update\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ ...baseBody, ts: placeholderRef }),\n });\n const data = (await res.json()) as {\n ok: boolean;\n error?: string;\n };\n if (!data.ok) {\n console.error(\"[slack] chat.update error:\", data.error);\n // Fall back to a fresh post so the user still sees a reply\n await postFresh(token, channelId, threadTs, baseBody);\n }\n } else {\n await postFresh(token, channelId, threadTs, baseBody);\n }\n\n // Clear the AI-assistant \"is thinking…\" status now that we've\n // delivered the final answer. Empty status clears it.\n if (threadTs) {\n setSlackAssistantStatus(token, channelId, threadTs, \"\");\n }\n\n // Overflow chunks (rare) — post as plain follow-ups in the same thread\n for (const chunk of restChunks) {\n await postFresh(token, channelId, threadTs, {\n channel: channelId,\n text: chunk,\n unfurl_links: false,\n unfurl_media: false,\n mrkdwn: true,\n });\n }\n } catch (err) {\n console.error(\"[slack] Failed to send message:\", err);\n throw err;\n }\n },\n\n async sendMessageToTarget(\n message: OutgoingMessage,\n target: OutboundTarget,\n ): Promise<void> {\n const token = process.env.SLACK_BOT_TOKEN;\n if (!token) {\n console.error(\"[slack] SLACK_BOT_TOKEN not configured\");\n return;\n }\n\n const chunks = splitNonEmptyMessage(message.text, SLACK_MAX_LENGTH);\n if (chunks.length === 0) return;\n for (const chunk of chunks) {\n const body: Record<string, unknown> = {\n channel: target.destination,\n text: chunk,\n };\n if (target.threadRef) body.thread_ts = target.threadRef;\n\n try {\n const res = await slackApiFetch(\n \"https://slack.com/api/chat.postMessage\",\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(body),\n },\n );\n const data = (await res.json()) as { ok: boolean; error?: string };\n if (!data.ok) {\n throw new Error(data.error \|\| \"chat.postMessage failed\");\n }\n } catch (err) {\n console.error(\"[slack] Failed to send proactive message:\", err);\n throw err;\n }\n }\n },\n\n formatAgentResponse(\n text: string,\n opts?: { threadDeepLinkUrl?: string },\n ): OutgoingMessage {\n return {\n text: markdownToSlackMrkdwn(text),\n platformContext: opts?.threadDeepLinkUrl\n ? { threadDeepLinkUrl: opts.threadDeepLinkUrl }\n : {},\n };\n },\n\n async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n const hasToken = !!process.env.SLACK_BOT_TOKEN;\n const hasSecret = !!process.env.SLACK_SIGNING_SECRET;\n const configured = hasToken && hasSecret;\n\n return {\n platform: \"slack\",\n label: \"Slack\",\n enabled: false, // overridden by plugin\n configured,\n details: {\n hasToken,\n hasSecret,\n },\n error: !configured\n ? \"Set SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET in your environment\"\n : undefined,\n };\n },\n };\n}\n\n/*\n Parse a comma-separated env var into a Set of trimmed, non-empty values.\n * Returns null when the env var is unset or empty (so callers can\n * distinguish \"no allowlist configured\" from \"empty allowlist\").\n /\nfunction parseAllowlistEnv(name: string): Set<string> \| null {\n const raw = process.env[name];\n if (!raw) return null;\n const values = raw\n .split(\",\")\n .map((v) => v.trim())\n .filter((v) => v.length > 0);\n if (values.length === 0) return null;\n return new Set(values);\n}\n\nlet _missingAllowlistWarned = false;\n\n/\n Enforce that an incoming Slack event comes from an allowlisted workspace.\n \n H1 in the webhook audit: the framework uses a SINGLE global\n * SLACK_SIGNING_SECRET for every workspace the Slack app is installed to,\n * so a valid signature alone doesn't prove the request belongs to the\n * tenant the deployment intends to serve. This helper layers a per-tenant\n * allowlist on top of signature verification.\n \n Behavior:\n * - If `SLACK_ALLOWED_TEAM_IDS` is set: reject any payload whose\n * `team_id` isn't in the list.\n * - If `SLACK_ALLOWED_API_APP_IDS` is set: also reject payloads whose\n * `api_app_id` isn't in the list (bot apps can be installed under the\n * same Slack app id across multiple workspaces — pinning both keeps\n * the surface tight when team_id allows multiple workspaces).\n * - If `SLACK_ALLOWED_TEAM_IDS` is unset/empty in production: reject the\n * event. Production must fail closed so any workspace with the shared\n * signing secret cannot drive the agent.\n * - If `SLACK_ALLOWED_TEAM_IDS` is unset/empty in dev / single-tenant: log a\n * one-time warning and accept (current local setup behavior).\n \n Throws an h3 401 error when an allowlisted-but-mismatched payload is\n * received, which the integrations plugin surfaces to the caller as\n * \"Unrecognized Slack workspace\" without enqueuing the event.\n /\nfunction enforceWorkspaceAllowlist(payload: any): void {\n const teamId =\n typeof payload?.team_id === \"string\" ? payload.team_id : undefined;\n const apiAppId =\n typeof payload?.api_app_id === \"string\" ? payload.api_app_id : undefined;\n\n const allowedTeamIds = parseAllowlistEnv(\"SLACK_ALLOWED_TEAM_IDS\");\n const allowedAppIds = parseAllowlistEnv(\"SLACK_ALLOWED_API_APP_IDS\");\n\n if (!allowedTeamIds) {\n if (process.env.NODE_ENV === \"production\") {\n throw createError({\n statusCode: 401,\n statusMessage: \"Slack workspace allowlist is not configured\",\n });\n }\n if (!_missingAllowlistWarned) {\n _missingAllowlistWarned = true;\n console.warn(\n \"[slack] SLACK_ALLOWED_TEAM_IDS not set — accepting events from any workspace whose signature matches SLACK_SIGNING_SECRET. \" +\n \"Set SLACK_ALLOWED_TEAM_IDS to a comma-separated list of allowed team_id values before deploying to production.\",\n );\n }\n }\n\n if (allowedTeamIds) {\n if (!teamId \|\| !allowedTeamIds.has(teamId)) {\n throw createError({\n statusCode: 401,\n statusMessage: \"Unrecognized Slack workspace\",\n });\n }\n }\n\n if (allowedAppIds) {\n if (!apiAppId \|\| !allowedAppIds.has(apiAppId)) {\n throw createError({\n statusCode: 401,\n statusMessage: \"Unrecognized Slack workspace\",\n });\n }\n }\n}\n\n/\n Read the raw request body as a string and cache on the event context.\n \n This MUST read raw bytes from the request stream — never `JSON.stringify`\n * a parsed body, because Slack's HMAC is computed over the exact bytes Slack\n * sent. Re-stringifying a parsed object loses key ordering, whitespace, and\n * Unicode-escape choices, so the signature check would silently fail for\n * legitimate requests (M2 in the webhook security audit).\n \n h3 v2's body stream is consume-once, so we cache the raw string on the\n * event context after the first read. All call sites (handleVerification,\n * verifyWebhook, parseIncomingMessage) MUST go through this helper.\n /\nasync function readRawBodyCached(event: H3Event): Promise<string> {\n const cached = event.context.__rawBody;\n if (typeof cached === \"string\") return cached;\n // h3's readRawBody returns the bytes Slack actually sent, defaulting to\n // utf8-decoded. Returns undefined for empty bodies — we coerce to \"\" so\n // the HMAC check can proceed deterministically.\n const raw = (await readRawBody(event)) ?? \"\";\n event.context.__rawBody = raw;\n return raw;\n}\n\nfunction utf8ByteLength(text: string): number {\n return new TextEncoder().encode(text).length;\n}\n\nfunction prefixWithinUtf8ByteLimit(text: string, maxLength: number): string {\n let bytes = 0;\n let end = 0;\n for (const char of text) {\n const nextBytes = utf8ByteLength(char);\n if (bytes + nextBytes > maxLength) break;\n bytes += nextBytes;\n end += char.length;\n }\n return text.slice(0, end \|\| 1);\n}\n\n/* Split a message into chunks that fit within the platform's byte limit. /\nfunction splitMessage(text: string, maxLength: number): string[] {\n if (utf8ByteLength(text) <= maxLength) return [text];\n const chunks: string[] = [];\n let remaining = text;\n while (remaining.length > 0) {\n if (utf8ByteLength(remaining) <= maxLength) {\n chunks.push(remaining);\n break;\n }\n\n const prefix = prefixWithinUtf8ByteLimit(remaining, maxLength);\n\n // Try to split at a newline\n let splitIdx = prefix.lastIndexOf(\"\\n\");\n if (splitIdx <= 0) {\n // Try to split at a space\n splitIdx = prefix.lastIndexOf(\" \");\n }\n if (splitIdx <= 0) {\n splitIdx = prefix.length;\n }\n chunks.push(remaining.slice(0, splitIdx));\n remaining = remaining.slice(splitIdx).trimStart();\n }\n return chunks;\n}\n\n/* Split a message and drop chunks Slack would render as blank messages. /\nfunction splitNonEmptyMessage(text: string, maxLength: number): string[] {\n return splitMessage(text, maxLength).filter(\n (chunk) => chunk.trim().length > 0,\n );\n}\n\n/* Hard cap on input length we feed to the regex-based mrkdwn converter.\n * L2 in the webhook audit: `\\\\(.+?)\\\\` with the `s` flag on a long\n * string of asterisks can exhibit super-linear backtracking. Slack\n * itself caps message bodies at 4000 chars (SLACK_MAX_LENGTH); we cap\n * the input here at 10x that as a defensive bound for any caller that\n * passes a longer rendering source through this helper before chunking. /\nconst MRKDWN_MAX_LENGTH = 40_000;\n\n/\n Convert standard markdown to Slack's mrkdwn dialect.\n * - `[text](url)` → `<url\|text>`\n * - `bold` → `bold` (Slack uses single asterisks for bold)\n \n Inputs longer than MRKDWN_MAX_LENGTH are truncated before the regex\n * pass to bound worst-case backtracking on pathological input (L2 in the\n * webhook audit).\n /\nfunction markdownToSlackMrkdwn(text: string): string {\n const bounded =\n text.length > MRKDWN_MAX_LENGTH ? text.slice(0, MRKDWN_MAX_LENGTH) : text;\n return (\n bounded\n .replace(/\\[([^\\]]+)\\]\$([^)]+)\$/g, \"<$2\|$1>\")\n // Do not wrap bare URLs in Slack bold markers. Slack's autolinker can\n // treat the trailing `` as part of the URL, producing a broken link.\n .replace(/\\\\<?(https?:\\/\\/[^\\s>]+)>?\\\\/g, \"<$1>\")\n // Bounded character class instead of `.+?` with the `s` flag — caps\n // each bold span at 5000 chars so an attacker can't construct a\n // pathological \"\" sequence that exhibits super-linear backtracking.\n // Newlines are allowed because `[^]` excludes only the asterisk\n // itself, so multi-line bold spans still match.\n .replace(/\\\\([^]{1,5000})\\\\/g, \"$1\")\n );\n}\n\n/\n Optionally set Slack's native AI-assistant status indicator (the small\n * \"is thinking…\" line under the message composer) for an app configured\n * with the `assistant:write` scope. Pure best-effort — fails silently for\n * apps that aren't set up as AI assistants.\n /\nfunction setSlackAssistantStatus(\n token: string,\n channelId: string,\n threadTs: string,\n status: string,\n): void {\n slackApiFetch(\"https://slack.com/api/assistant.threads.setStatus\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n channel_id: channelId,\n thread_ts: threadTs,\n status,\n }),\n }).catch(() => {});\n}\n\n/\n Block Kit payload for the final answer. We avoid auto-unfurl previews by\n * separating the deep-link out into a button instead of inlining it as a\n * `<url\|text>` markdown link in the section body — that's what was producing\n * the giant \"Agent-Native Dispatch\" card in every thread reply.\n /\nfunction buildResponseBlocks(\n text: string,\n opts: { threadDeepLinkUrl?: string },\n): unknown[] {\n const sectionChunks = splitMessage(\n text \|\| \"_(no response)_\",\n SLACK_SECTION_TEXT_MAX_LENGTH,\n );\n const blocks: any[] = sectionChunks.map((chunk) => ({\n type: \"section\",\n text: { type: \"mrkdwn\", text: chunk },\n }));\n if (opts.threadDeepLinkUrl) {\n blocks.push({\n type: \"actions\",\n elements: [\n {\n type: \"button\",\n text: { type: \"plain_text\", text: \"Open thread\", emoji: true },\n url: opts.threadDeepLinkUrl,\n action_id: \"open_dispatch_thread\",\n },\n ],\n });\n }\n return blocks;\n}\n\n/\n Post a fresh message to a thread. Used as the placeholder-fallback path\n * (e.g. when chat.update fails) and for follow-up overflow chunks.\n */\nasync function postFresh(\n token: string,\n channelId: string,\n threadTs: string \| undefined,\n body: Record<string, unknown>,\n): Promise<void> {\n const hasBlocks =\n Array.isArray(body.blocks) && (body.blocks as unknown[]).length > 0;\n if (\n typeof body.text === \"string\" &&\n body.text.trim().length === 0 &&\n !hasBlocks\n ) {\n return;\n }\n\n const payload: Record<string, unknown> = {\n ...body,\n channel: channelId,\n };\n if (threadTs && !payload.thread_ts) payload.thread_ts = threadTs;\n const res = await slackApiFetch(\"https://slack.com/api/chat.postMessage\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(payload),\n });\n const data = (await res.json()) as { ok: boolean; error?: string };\n if (!data.ok) {\n console.error(\"[slack] chat.postMessage error:\", data.error);\n throw new Error(data.error \|\| \"chat.postMessage failed\");\n }\n}\n\nasync function slackApiFetch(\n url: string,\n init: RequestInit,\n): Promise<Response> {\n const controller =\n typeof AbortController !== \"undefined\" ? new AbortController() : undefined;\n const timer = controller\n ? setTimeout(() => controller.abort(), SLACK_API_TIMEOUT_MS)\n : undefined;\n try {\n return await fetch(url, {\n ...init,\n signal: controller?.signal ?? init.signal,\n });\n } finally {\n if (timer) clearTimeout(timer);\n }\n}\n"]}
1	+ {"version":3,"file":"slack.js","sourceRoot":"","sources":["../../../src/integrations/adapters/slack.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAGzD,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AASpE,iCAAiC;AACjC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,OAAO;QAEd,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,iBAAiB;oBACtB,KAAK,EAAE,iBAAiB;oBACxB,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,iGAAiG;iBACpG;gBACD;oBACE,GAAG,EAAE,sBAAsB;oBAC3B,KAAK,EAAE,sBAAsB;oBAC7B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,qFAAqF;iBACxF;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,kEAAkE;YAClE,uEAAuE;YACvE,oEAAoE;YACpE,2DAA2D;YAC3D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;oBACvC,8DAA8D;oBAC9D,mEAAmE;oBACnE,8DAA8D;oBAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,sBAAsB,CAAC,CAAC;YAClE,IAAI,CAAC,aAAa;gBAAE,OAAO,KAAK,CAAC;YAEjC,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;YAChE,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAE3C,2DAA2D;YAC3D,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC;YAEzD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;YAC7C,MAAM,iBAAiB,GACrB,KAAK;gBACL,MAAM;qBACH,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC;qBACnC,MAAM,CAAC,UAAU,CAAC;qBAClB,MAAM,CAAC,KAAK,CAAC,CAAC;YAEnB,yBAAyB;YACzB,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAC/B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,OAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YAED,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,iCAAiC;YACjC,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAEnC,4BAA4B;YAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACtC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;gBACxB,IAAI,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAEpB,sBAAsB;gBACtB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,aAAa;oBAAE,OAAO,IAAI,CAAC;gBACzD,mCAAmC;gBACnC,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB,IAAI,CAAC,CAAC,OAAO,KAAK,iBAAiB;oBACpE,OAAO,IAAI,CAAC;gBAEd,+CAA+C;gBAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI;oBAAE,OAAO,IAAI,CAAC;gBAEvB,+EAA+E;gBAC/E,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,SAAS;oBAAE,OAAO,IAAI,CAAC;gBAE5B,gEAAgE;gBAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrC,MAAM,gBAAgB,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAEpD,OAAO;oBACL,QAAQ,EAAE,OAAO;oBACjB,gBAAgB;oBAChB,IAAI,EAAE,SAAS;oBACf,UAAU,EAAE,CAAC,CAAC,IAAI;oBAClB,QAAQ,EAAE,CAAC,CAAC,IAAI;oBAChB,eAAe,EAAE;wBACf,SAAS,EAAE,CAAC,CAAC,OAAO;wBACpB,QAAQ,EAAE,QAAQ;wBAClB,SAAS,EAAE,CAAC,CAAC,EAAE;wBACf,MAAM,EAAE,OAAO,CAAC,OAAO;wBACvB,OAAO,EAAE,OAAO,CAAC,QAAQ;qBAC1B;oBACD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;iBAC/C,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,yBAAyB,CAC7B,QAAyB;YAEzB,gEAAgE;YAChE,sEAAsE;YACtE,kEAAkE;YAClE,oEAAoE;YACpE,sEAAsE;YACtE,sCAAsC;YACtC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,SAAS,GAAG,QAAQ,CAAC,eAAe,CAAC,SAAmB,CAAC;YAC/D,MAAM,QAAQ,GAAG,QAAQ,CAAC,eAAe,CAAC,QAAkB,CAAC;YAC7D,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAEzC,sEAAsE;YACtE,qEAAqE;YACrE,mCAAmC;YACnC,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB,EACxB,IAAkC;YAElC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,SAAmB,CAAC;YAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,QAAkB,CAAC;YAC5D,MAAM,MAAM,GAAI,OAAO,CAAC,eAAuB,EAAE,MAEpC,CAAC;YACd,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;YAE5C,wEAAwE;YACxE,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACpE,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,QAAQ,EAAE,CAAC;oBACb,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAEnC,MAAM,WAAW,GACf,MAAM;gBACN,mBAAmB,CAAC,UAAU,EAAE;oBAC9B,iBAAiB,EAAG,OAAO,CAAC,eAAuB;wBACjD,EAAE,iBAAiB;iBACtB,CAAC,CAAC;YAEL,MAAM,QAAQ,GAA4B;gBACxC,OAAO,EAAE,SAAS;gBAClB,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,WAAW;gBACnB,YAAY,EAAE,KAAK;gBACnB,YAAY,EAAE,KAAK;gBACnB,MAAM,EAAE,IAAI;aACb,CAAC;YAEF,IAAI,CAAC;gBACH,IAAI,cAAc,EAAE,CAAC;oBACnB,gDAAgD;oBAChD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,mCAAmC,EAAE;wBACnE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,KAAK,EAAE;4BAChC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,CAAC;qBAC1D,CAAC,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;wBACxD,2DAA2D;wBAC3D,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBACxD,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBACxD,CAAC;gBAED,8DAA8D;gBAC9D,sDAAsD;gBACtD,IAAI,QAAQ,EAAE,CAAC;oBACb,uBAAuB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC1D,CAAC;gBAED,uEAAuE;gBACvE,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC/B,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE;wBAC1C,OAAO,EAAE,SAAS;wBAClB,IAAI,EAAE,KAAK;wBACX,YAAY,EAAE,KAAK;wBACnB,YAAY,EAAE,KAAK;wBACnB,MAAM,EAAE,IAAI;qBACb,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;gBACtD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;gBACxD,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAA4B;oBACpC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,IAAI,EAAE,KAAK;iBACZ,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS;oBAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBAExD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,wCAAwC,EACxC;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,KAAK,EAAE;4BAChC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;oBACnE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;oBAC3D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;oBAChE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CACjB,IAAY,EACZ,IAAqC;YAErC,OAAO;gBACL,IAAI,EAAE,qBAAqB,CAAC,IAAI,CAAC;gBACjC,eAAe,EAAE,IAAI,EAAE,iBAAiB;oBACtC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE;oBAC/C,CAAC,CAAC,EAAE;aACP,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC5D,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC;YAClE,MAAM,UAAU,GAAG,QAAQ,IAAI,SAAS,CAAC;YAEzC,OAAO;gBACL,QAAQ,EAAE,OAAO;gBACjB,KAAK,EAAE,OAAO;gBACd,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU;gBACV,OAAO,EAAE;oBACP,QAAQ;oBACR,SAAS;iBACV;gBACD,KAAK,EAAE,CAAC,UAAU;oBAChB,CAAC,CAAC,2DAA2D;oBAC7D,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,IAAI,uBAAuB,GAAG,KAAK,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAS,yBAAyB,CAAC,OAAY;IAC7C,MAAM,MAAM,GACV,OAAO,OAAO,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,QAAQ,GACZ,OAAO,OAAO,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3E,MAAM,cAAc,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;IACnE,MAAM,aAAa,GAAG,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;IAErE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,6CAA6C;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,uBAAuB,GAAG,IAAI,CAAC;YAC/B,OAAO,CAAC,IAAI,CACV,6HAA6H;gBAC3H,gHAAgH,CACnH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,8BAA8B;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC,QAAQ,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,WAAW,CAAC;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,8BAA8B;aAC9C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,iBAAiB,CAAC,KAAc;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,wEAAwE;IACxE,wEAAwE;IACxE,gDAAgD;IAChD,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY,EAAE,SAAiB;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,GAAG,SAAS,GAAG,SAAS;YAAE,MAAM;QACzC,KAAK,IAAI,SAAS,CAAC;QACnB,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,cAAc,CAAC,SAAS,CAAC,IAAI,SAAS,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE/D,4BAA4B;QAC5B,IAAI,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,0BAA0B;YAC1B,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;QAC3B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,SAAS,oBAAoB,CAAC,IAAY,EAAE,SAAiB;IAC3D,OAAO,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,MAAM,CACzC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CACnC,CAAC;AACJ,CAAC;AAED;;;;;4EAK4E;AAC5E,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,IAAY;IACzC,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,OAAO,CACL,OAAO;SACJ,OAAO,CAAC,0BAA0B,EAAE,SAAS,CAAC;QAC/C,sEAAsE;QACtE,sEAAsE;SACrE,OAAO,CAAC,oCAAoC,EAAE,MAAM,CAAC;QACtD,oEAAoE;QACpE,gEAAgE;QAChE,sEAAsE;QACtE,iEAAiE;QACjE,gDAAgD;SAC/C,OAAO,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,uBAAuB,CAC9B,KAAa,EACb,SAAiB,EACjB,QAAgB,EAChB,MAAc;IAEd,aAAa,CAAC,mDAAmD,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,SAAS;YACrB,SAAS,EAAE,QAAQ;YACnB,MAAM;SACP,CAAC;KACH,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,IAAoC;IAEpC,MAAM,aAAa,GAAG,YAAY,CAChC,IAAI,IAAI,iBAAiB,EACzB,6BAA6B,CAC9B,CAAC;IACF,MAAM,MAAM,GAAU,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;KACtC,CAAC,CAAC,CAAC;IACJ,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE;oBAC9D,GAAG,EAAE,IAAI,CAAC,iBAAiB;oBAC3B,SAAS,EAAE,sBAAsB;iBAClC;aACF;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,SAAS,CACtB,KAAa,EACb,SAAiB,EACjB,QAA4B,EAC5B,IAA6B;IAE7B,MAAM,SAAS,GACb,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAK,IAAI,CAAC,MAAoB,CAAC,MAAM,GAAG,CAAC,CAAC;IACtE,IACE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,SAAS,EACV,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAA4B;QACvC,GAAG,IAAI;QACP,OAAO,EAAE,SAAS;KACnB,CAAC;IACF,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC;IACjE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,wCAAwC,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,yBAAyB,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,IAAiB;IAEjB,MAAM,UAAU,GACd,OAAO,eAAe,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7E,MAAM,KAAK,GAAG,UAAU;QACtB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC;QAC5D,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;YACtB,GAAG,IAAI;YACP,MAAM,EAAE,UAAU,EAAE,MAAM,IAAI,IAAI,CAAC,MAAM;SAC1C,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { createError, getHeader, readRawBody } from \"h3\";\n\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { resolveSecret } from \"../../server/credential-provider.js\";\nimport type {\n PlatformAdapter,\n IncomingMessage,\n OutgoingMessage,\n IntegrationStatus,\n OutboundTarget,\n} from \"../types.js\";\n\n/** Slack's max message length /\nconst SLACK_MAX_LENGTH = 4000;\nconst SLACK_SECTION_TEXT_MAX_LENGTH = 3000;\nconst SLACK_API_TIMEOUT_MS = 10_000;\n\n/\n Create a Slack platform adapter.\n \n Required env vars:\n * - SLACK_BOT_TOKEN — Bot user OAuth token (xoxb-...)\n * - SLACK_SIGNING_SECRET — Used to verify webhook signatures\n \n Optional env vars:\n * - SLACK_ALLOWED_TEAM_IDS — Comma-separated list of Slack workspace\n * `team_id` values (e.g. \"T012ABCDEF,T034GHIJKL\") that this deployment\n * accepts events from. Required in production and strongly recommended\n * to prevent cross-workspace event injection (H1 in the webhook audit):\n * the global `SLACK_SIGNING_SECRET` is the same key for every workspace\n * the app is installed to, so without an allowlist any installed\n * workspace can drive the agent. When unset the adapter accepts events\n * from any workspace in development, but rejects events in production.\n * - SLACK_ALLOWED_API_APP_IDS — Comma-separated list of Slack app IDs\n * (`api_app_id`) to additionally pin events to. Useful when the same\n * signing secret rotation surfaces multiple app installs.\n /\nexport function slackAdapter(): PlatformAdapter {\n return {\n platform: \"slack\",\n label: \"Slack\",\n\n getRequiredEnvKeys(): EnvKeyConfig[] {\n return [\n {\n key: \"SLACK_BOT_TOKEN\",\n label: \"Slack Bot Token\",\n required: true,\n helpText:\n \"In your Slack app's left nav: OAuth & Permissions → Bot User OAuth Token (starts with `xoxb-`).\",\n },\n {\n key: \"SLACK_SIGNING_SECRET\",\n label: \"Slack Signing Secret\",\n required: true,\n helpText:\n \"In your Slack app's left nav: Basic Information → App Credentials → Signing Secret.\",\n },\n ];\n },\n\n async handleVerification(\n event: H3Event,\n ): Promise<{ handled: boolean; response?: unknown }> {\n // Slack sends url_verification when first setting up the webhook.\n // readRawBodyCached caches the raw bytes on event.context.__rawBody so\n // subsequent verifyWebhook + parseIncomingMessage calls re-use them\n // without re-stringifying a parsed body (M2 in the audit).\n const body = await readRawBodyCached(event);\n try {\n const parsed = JSON.parse(body);\n if (parsed.type === \"url_verification\") {\n // Slack's URL verifier expects the raw challenge value in the\n // response body. Returning JSON works for some clients but the app\n // settings verifier rejects it as not matching the challenge.\n return { handled: true, response: parsed.challenge };\n }\n } catch {}\n return { handled: false };\n },\n\n async verifyWebhook(event: H3Event): Promise<boolean> {\n const signingSecret = await resolveSecret(\"SLACK_SIGNING_SECRET\");\n if (!signingSecret) return false;\n\n const signature = getHeader(event, \"x-slack-signature\");\n const timestamp = getHeader(event, \"x-slack-request-timestamp\");\n if (!signature \|\| !timestamp) return false;\n\n // Reject requests older than 5 minutes (replay protection)\n const ts = parseInt(timestamp, 10);\n if (Math.abs(Date.now() / 1000 - ts) > 300) return false;\n\n const body = await readRawBodyCached(event);\n const crypto = await import(\"node:crypto\");\n const basestring = `v0:${timestamp}:${body}`;\n const expectedSignature =\n \"v0=\" +\n crypto\n .createHmac(\"sha256\", signingSecret)\n .update(basestring)\n .digest(\"hex\");\n\n // Timing-safe comparison\n try {\n return crypto.timingSafeEqual(\n Buffer.from(signature),\n Buffer.from(expectedSignature),\n );\n } catch {\n return false;\n }\n },\n\n async parseIncomingMessage(\n event: H3Event,\n ): Promise<IncomingMessage \| null> {\n const raw = await readRawBodyCached(event);\n let payload: any;\n try {\n payload = JSON.parse(raw);\n } catch {\n return null;\n }\n\n // H1 (webhook audit): cross-workspace event injection. The global\n // SLACK_SIGNING_SECRET is the same key for every workspace this Slack\n // app is installed to — without a per-tenant allowlist any installed\n // workspace can drive the agent. We enforce SLACK_ALLOWED_TEAM_IDS\n // here AFTER the signature has already been verified by the webhook\n // handler, so this is purely a tenant-isolation gate (not a forgery\n // defense). When unset in production we surface a one-time warning\n // recommending it be configured.\n enforceWorkspaceAllowlist(payload);\n\n // Handle Events API wrapper\n if (payload.type === \"event_callback\") {\n const e = payload.event;\n if (!e) return null;\n\n // Ignore bot messages\n if (e.bot_id \|\| e.subtype === \"bot_message\") return null;\n // Ignore message edits and deletes\n if (e.subtype === \"message_changed\" \|\| e.subtype === \"message_deleted\")\n return null;\n\n // Handle both direct messages and app_mentions\n const text = e.text?.trim();\n if (!text) return null;\n\n // Remove bot mention from text (e.g., \"<@U123> do something\" → \"do something\")\n const cleanText = text.replace(/<@[A-Z0-9]+>/g, \"\").trim();\n if (!cleanText) return null;\n\n // Thread ID: use thread_ts if in a thread, otherwise message ts\n const threadTs = e.thread_ts \|\| e.ts;\n const externalThreadId = `${e.channel}:${threadTs}`;\n\n return {\n platform: \"slack\",\n externalThreadId,\n text: cleanText,\n senderName: e.user,\n senderId: e.user,\n platformContext: {\n channelId: e.channel,\n threadTs: threadTs,\n messageTs: e.ts,\n teamId: payload.team_id,\n eventId: payload.event_id,\n },\n timestamp: Math.floor(parseFloat(e.ts) 1000),\n };\n }\n\n return null;\n },\n\n async postProcessingPlaceholder(\n incoming: IncomingMessage,\n ): Promise<{ placeholderRef: string } \| null> {\n // No placeholder reply in the thread — Slack's native assistant\n // status bar (\"agent-native is thinking…\", below the composer) is the\n // loading affordance. A second visible \"Working on it…\" reply was\n // redundant and added an extra chunk that we then had to overwrite.\n // We just set the native status and return null so sendResponse posts\n // the final reply as a fresh message.\n const token = await resolveSecret(\"SLACK_BOT_TOKEN\");\n if (!token) return null;\n\n const channelId = incoming.platformContext.channelId as string;\n const threadTs = incoming.platformContext.threadTs as string;\n if (!channelId \|\| !threadTs) return null;\n\n // Best-effort: flip the native AI-assistant \"is thinking…\" status bar\n // in the channel input area. Requires `assistant:write` scope on the\n // app — otherwise silently no-ops.\n setSlackAssistantStatus(token, channelId, threadTs, \"is thinking…\");\n return null;\n },\n\n async sendResponse(\n message: OutgoingMessage,\n context: IncomingMessage,\n opts?: { placeholderRef?: string },\n ): Promise<void> {\n const token = await resolveSecret(\"SLACK_BOT_TOKEN\");\n if (!token) {\n console.error(\"[slack] SLACK_BOT_TOKEN not configured\");\n return;\n }\n\n const channelId = context.platformContext.channelId as string;\n const threadTs = context.platformContext.threadTs as string;\n const blocks = (message.platformContext as any)?.blocks as\n \| unknown[]\n \| undefined;\n const placeholderRef = opts?.placeholderRef;\n\n // Block-rich path: split text into chunks but render the FIRST chunk as\n // blocks (so we keep the in-place edit + button) and any overflow as\n // plain follow-up posts. The vast majority of replies fit in one block.\n const chunks = splitNonEmptyMessage(message.text, SLACK_MAX_LENGTH);\n const hasProvidedBlocks = Array.isArray(blocks) && blocks.length > 0;\n const firstChunk = chunks[0] ?? (hasProvidedBlocks ? \"Response\" : \"\");\n if (!firstChunk) {\n if (threadTs) {\n setSlackAssistantStatus(token, channelId, threadTs, \"\");\n }\n return;\n }\n const restChunks = chunks.slice(1);\n\n const finalBlocks =\n blocks ??\n buildResponseBlocks(firstChunk, {\n threadDeepLinkUrl: (message.platformContext as any)\n ?.threadDeepLinkUrl,\n });\n\n const baseBody: Record<string, unknown> = {\n channel: channelId,\n text: firstChunk,\n blocks: finalBlocks,\n unfurl_links: false,\n unfurl_media: false,\n mrkdwn: true,\n };\n\n try {\n if (placeholderRef) {\n // Replace the \"thinking…\" placeholder in place.\n const res = await slackApiFetch(\"https://slack.com/api/chat.update\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ ...baseBody, ts: placeholderRef }),\n });\n const data = (await res.json()) as {\n ok: boolean;\n error?: string;\n };\n if (!data.ok) {\n console.error(\"[slack] chat.update error:\", data.error);\n // Fall back to a fresh post so the user still sees a reply\n await postFresh(token, channelId, threadTs, baseBody);\n }\n } else {\n await postFresh(token, channelId, threadTs, baseBody);\n }\n\n // Clear the AI-assistant \"is thinking…\" status now that we've\n // delivered the final answer. Empty status clears it.\n if (threadTs) {\n setSlackAssistantStatus(token, channelId, threadTs, \"\");\n }\n\n // Overflow chunks (rare) — post as plain follow-ups in the same thread\n for (const chunk of restChunks) {\n await postFresh(token, channelId, threadTs, {\n channel: channelId,\n text: chunk,\n unfurl_links: false,\n unfurl_media: false,\n mrkdwn: true,\n });\n }\n } catch (err) {\n console.error(\"[slack] Failed to send message:\", err);\n throw err;\n }\n },\n\n async sendMessageToTarget(\n message: OutgoingMessage,\n target: OutboundTarget,\n ): Promise<void> {\n const token = await resolveSecret(\"SLACK_BOT_TOKEN\");\n if (!token) {\n console.error(\"[slack] SLACK_BOT_TOKEN not configured\");\n return;\n }\n\n const chunks = splitNonEmptyMessage(message.text, SLACK_MAX_LENGTH);\n if (chunks.length === 0) return;\n for (const chunk of chunks) {\n const body: Record<string, unknown> = {\n channel: target.destination,\n text: chunk,\n };\n if (target.threadRef) body.thread_ts = target.threadRef;\n\n try {\n const res = await slackApiFetch(\n \"https://slack.com/api/chat.postMessage\",\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(body),\n },\n );\n const data = (await res.json()) as { ok: boolean; error?: string };\n if (!data.ok) {\n throw new Error(data.error \|\| \"chat.postMessage failed\");\n }\n } catch (err) {\n console.error(\"[slack] Failed to send proactive message:\", err);\n throw err;\n }\n }\n },\n\n formatAgentResponse(\n text: string,\n opts?: { threadDeepLinkUrl?: string },\n ): OutgoingMessage {\n return {\n text: markdownToSlackMrkdwn(text),\n platformContext: opts?.threadDeepLinkUrl\n ? { threadDeepLinkUrl: opts.threadDeepLinkUrl }\n : {},\n };\n },\n\n async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n const hasToken = !!(await resolveSecret(\"SLACK_BOT_TOKEN\"));\n const hasSecret = !!(await resolveSecret(\"SLACK_SIGNING_SECRET\"));\n const configured = hasToken && hasSecret;\n\n return {\n platform: \"slack\",\n label: \"Slack\",\n enabled: false, // overridden by plugin\n configured,\n details: {\n hasToken,\n hasSecret,\n },\n error: !configured\n ? \"Save SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET in settings\"\n : undefined,\n };\n },\n };\n}\n\n/*\n Parse a comma-separated env var into a Set of trimmed, non-empty values.\n * Returns null when the env var is unset or empty (so callers can\n * distinguish \"no allowlist configured\" from \"empty allowlist\").\n /\nfunction parseAllowlistEnv(name: string): Set<string> \| null {\n const raw = process.env[name];\n if (!raw) return null;\n const values = raw\n .split(\",\")\n .map((v) => v.trim())\n .filter((v) => v.length > 0);\n if (values.length === 0) return null;\n return new Set(values);\n}\n\nlet _missingAllowlistWarned = false;\n\n/\n Enforce that an incoming Slack event comes from an allowlisted workspace.\n \n H1 in the webhook audit: the framework uses a SINGLE global\n * SLACK_SIGNING_SECRET for every workspace the Slack app is installed to,\n * so a valid signature alone doesn't prove the request belongs to the\n * tenant the deployment intends to serve. This helper layers a per-tenant\n * allowlist on top of signature verification.\n \n Behavior:\n * - If `SLACK_ALLOWED_TEAM_IDS` is set: reject any payload whose\n * `team_id` isn't in the list.\n * - If `SLACK_ALLOWED_API_APP_IDS` is set: also reject payloads whose\n * `api_app_id` isn't in the list (bot apps can be installed under the\n * same Slack app id across multiple workspaces — pinning both keeps\n * the surface tight when team_id allows multiple workspaces).\n * - If `SLACK_ALLOWED_TEAM_IDS` is unset/empty in production: reject the\n * event. Production must fail closed so any workspace with the shared\n * signing secret cannot drive the agent.\n * - If `SLACK_ALLOWED_TEAM_IDS` is unset/empty in dev / single-tenant: log a\n * one-time warning and accept (current local setup behavior).\n \n Throws an h3 401 error when an allowlisted-but-mismatched payload is\n * received, which the integrations plugin surfaces to the caller as\n * \"Unrecognized Slack workspace\" without enqueuing the event.\n /\nfunction enforceWorkspaceAllowlist(payload: any): void {\n const teamId =\n typeof payload?.team_id === \"string\" ? payload.team_id : undefined;\n const apiAppId =\n typeof payload?.api_app_id === \"string\" ? payload.api_app_id : undefined;\n\n const allowedTeamIds = parseAllowlistEnv(\"SLACK_ALLOWED_TEAM_IDS\");\n const allowedAppIds = parseAllowlistEnv(\"SLACK_ALLOWED_API_APP_IDS\");\n\n if (!allowedTeamIds) {\n if (process.env.NODE_ENV === \"production\") {\n throw createError({\n statusCode: 401,\n statusMessage: \"Slack workspace allowlist is not configured\",\n });\n }\n if (!_missingAllowlistWarned) {\n _missingAllowlistWarned = true;\n console.warn(\n \"[slack] SLACK_ALLOWED_TEAM_IDS not set — accepting events from any workspace whose signature matches SLACK_SIGNING_SECRET. \" +\n \"Set SLACK_ALLOWED_TEAM_IDS to a comma-separated list of allowed team_id values before deploying to production.\",\n );\n }\n }\n\n if (allowedTeamIds) {\n if (!teamId \|\| !allowedTeamIds.has(teamId)) {\n throw createError({\n statusCode: 401,\n statusMessage: \"Unrecognized Slack workspace\",\n });\n }\n }\n\n if (allowedAppIds) {\n if (!apiAppId \|\| !allowedAppIds.has(apiAppId)) {\n throw createError({\n statusCode: 401,\n statusMessage: \"Unrecognized Slack workspace\",\n });\n }\n }\n}\n\n/\n Read the raw request body as a string and cache on the event context.\n \n This MUST read raw bytes from the request stream — never `JSON.stringify`\n * a parsed body, because Slack's HMAC is computed over the exact bytes Slack\n * sent. Re-stringifying a parsed object loses key ordering, whitespace, and\n * Unicode-escape choices, so the signature check would silently fail for\n * legitimate requests (M2 in the webhook security audit).\n \n h3 v2's body stream is consume-once, so we cache the raw string on the\n * event context after the first read. All call sites (handleVerification,\n * verifyWebhook, parseIncomingMessage) MUST go through this helper.\n /\nasync function readRawBodyCached(event: H3Event): Promise<string> {\n const cached = event.context.__rawBody;\n if (typeof cached === \"string\") return cached;\n // h3's readRawBody returns the bytes Slack actually sent, defaulting to\n // utf8-decoded. Returns undefined for empty bodies — we coerce to \"\" so\n // the HMAC check can proceed deterministically.\n const raw = (await readRawBody(event)) ?? \"\";\n event.context.__rawBody = raw;\n return raw;\n}\n\nfunction utf8ByteLength(text: string): number {\n return new TextEncoder().encode(text).length;\n}\n\nfunction prefixWithinUtf8ByteLimit(text: string, maxLength: number): string {\n let bytes = 0;\n let end = 0;\n for (const char of text) {\n const nextBytes = utf8ByteLength(char);\n if (bytes + nextBytes > maxLength) break;\n bytes += nextBytes;\n end += char.length;\n }\n return text.slice(0, end \|\| 1);\n}\n\n/* Split a message into chunks that fit within the platform's byte limit. /\nfunction splitMessage(text: string, maxLength: number): string[] {\n if (utf8ByteLength(text) <= maxLength) return [text];\n const chunks: string[] = [];\n let remaining = text;\n while (remaining.length > 0) {\n if (utf8ByteLength(remaining) <= maxLength) {\n chunks.push(remaining);\n break;\n }\n\n const prefix = prefixWithinUtf8ByteLimit(remaining, maxLength);\n\n // Try to split at a newline\n let splitIdx = prefix.lastIndexOf(\"\\n\");\n if (splitIdx <= 0) {\n // Try to split at a space\n splitIdx = prefix.lastIndexOf(\" \");\n }\n if (splitIdx <= 0) {\n splitIdx = prefix.length;\n }\n chunks.push(remaining.slice(0, splitIdx));\n remaining = remaining.slice(splitIdx).trimStart();\n }\n return chunks;\n}\n\n/* Split a message and drop chunks Slack would render as blank messages. /\nfunction splitNonEmptyMessage(text: string, maxLength: number): string[] {\n return splitMessage(text, maxLength).filter(\n (chunk) => chunk.trim().length > 0,\n );\n}\n\n/* Hard cap on input length we feed to the regex-based mrkdwn converter.\n * L2 in the webhook audit: `\\\\(.+?)\\\\` with the `s` flag on a long\n * string of asterisks can exhibit super-linear backtracking. Slack\n * itself caps message bodies at 4000 chars (SLACK_MAX_LENGTH); we cap\n * the input here at 10x that as a defensive bound for any caller that\n * passes a longer rendering source through this helper before chunking. /\nconst MRKDWN_MAX_LENGTH = 40_000;\n\n/\n Convert standard markdown to Slack's mrkdwn dialect.\n * - `[text](url)` → `<url\|text>`\n * - `bold` → `bold` (Slack uses single asterisks for bold)\n \n Inputs longer than MRKDWN_MAX_LENGTH are truncated before the regex\n * pass to bound worst-case backtracking on pathological input (L2 in the\n * webhook audit).\n /\nfunction markdownToSlackMrkdwn(text: string): string {\n const bounded =\n text.length > MRKDWN_MAX_LENGTH ? text.slice(0, MRKDWN_MAX_LENGTH) : text;\n return (\n bounded\n .replace(/\\[([^\\]]+)\\]\$([^)]+)\$/g, \"<$2\|$1>\")\n // Do not wrap bare URLs in Slack bold markers. Slack's autolinker can\n // treat the trailing `` as part of the URL, producing a broken link.\n .replace(/\\\\<?(https?:\\/\\/[^\\s>]+)>?\\\\/g, \"<$1>\")\n // Bounded character class instead of `.+?` with the `s` flag — caps\n // each bold span at 5000 chars so an attacker can't construct a\n // pathological \"\" sequence that exhibits super-linear backtracking.\n // Newlines are allowed because `[^]` excludes only the asterisk\n // itself, so multi-line bold spans still match.\n .replace(/\\\\([^]{1,5000})\\\\/g, \"$1\")\n );\n}\n\n/\n Optionally set Slack's native AI-assistant status indicator (the small\n * \"is thinking…\" line under the message composer) for an app configured\n * with the `assistant:write` scope. Pure best-effort — fails silently for\n * apps that aren't set up as AI assistants.\n /\nfunction setSlackAssistantStatus(\n token: string,\n channelId: string,\n threadTs: string,\n status: string,\n): void {\n slackApiFetch(\"https://slack.com/api/assistant.threads.setStatus\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n channel_id: channelId,\n thread_ts: threadTs,\n status,\n }),\n }).catch(() => {});\n}\n\n/\n Block Kit payload for the final answer. We avoid auto-unfurl previews by\n * separating the deep-link out into a button instead of inlining it as a\n * `<url\|text>` markdown link in the section body — that's what was producing\n * the giant \"Agent-Native Dispatch\" card in every thread reply.\n /\nfunction buildResponseBlocks(\n text: string,\n opts: { threadDeepLinkUrl?: string },\n): unknown[] {\n const sectionChunks = splitMessage(\n text \|\| \"_(no response)_\",\n SLACK_SECTION_TEXT_MAX_LENGTH,\n );\n const blocks: any[] = sectionChunks.map((chunk) => ({\n type: \"section\",\n text: { type: \"mrkdwn\", text: chunk },\n }));\n if (opts.threadDeepLinkUrl) {\n blocks.push({\n type: \"actions\",\n elements: [\n {\n type: \"button\",\n text: { type: \"plain_text\", text: \"Open thread\", emoji: true },\n url: opts.threadDeepLinkUrl,\n action_id: \"open_dispatch_thread\",\n },\n ],\n });\n }\n return blocks;\n}\n\n/\n Post a fresh message to a thread. Used as the placeholder-fallback path\n * (e.g. when chat.update fails) and for follow-up overflow chunks.\n */\nasync function postFresh(\n token: string,\n channelId: string,\n threadTs: string \| undefined,\n body: Record<string, unknown>,\n): Promise<void> {\n const hasBlocks =\n Array.isArray(body.blocks) && (body.blocks as unknown[]).length > 0;\n if (\n typeof body.text === \"string\" &&\n body.text.trim().length === 0 &&\n !hasBlocks\n ) {\n return;\n }\n\n const payload: Record<string, unknown> = {\n ...body,\n channel: channelId,\n };\n if (threadTs && !payload.thread_ts) payload.thread_ts = threadTs;\n const res = await slackApiFetch(\"https://slack.com/api/chat.postMessage\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify(payload),\n });\n const data = (await res.json()) as { ok: boolean; error?: string };\n if (!data.ok) {\n console.error(\"[slack] chat.postMessage error:\", data.error);\n throw new Error(data.error \|\| \"chat.postMessage failed\");\n }\n}\n\nasync function slackApiFetch(\n url: string,\n init: RequestInit,\n): Promise<Response> {\n const controller =\n typeof AbortController !== \"undefined\" ? new AbortController() : undefined;\n const timer = controller\n ? setTimeout(() => controller.abort(), SLACK_API_TIMEOUT_MS)\n : undefined;\n try {\n return await fetch(url, {\n ...init,\n signal: controller?.signal ?? init.signal,\n });\n } finally {\n if (timer) clearTimeout(timer);\n }\n}\n"]}

package/dist/integrations/adapters/telegram.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"telegram.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"~~AAKA~~,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AAuBrB;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,eAAe,~~CAwQjD~~"}
1	+ {"version":3,"file":"telegram.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,eAAe,EAKhB,MAAM,aAAa,CAAC;AAuBrB;;;;;;;;GAQG;AACH,wBAAgB,eAAe,IAAI,eAAe,CAqQjD"}

package/dist/integrations/adapters/telegram.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import { getHeader } from "h3";
+import { resolveSecret } from "../../server/credential-provider.js";
 import { readBody } from "../../server/h3-helpers.js";
 /** Telegram's max message length */
 const TELEGRAM_MAX_LENGTH = 4096;
@@ -67,7 +68,7 @@ export function telegramAdapter() {
             return { handled: false };
         },
         async verifyWebhook(event) {
-            const secret = process.env.TELEGRAM_WEBHOOK_SECRET;
+            const secret = await resolveSecret("TELEGRAM_WEBHOOK_SECRET");
             if (!secret) {
                 if (shouldRefuseWhenSecretMissing()) {
                     if (!_telegramUnverifiedWarned) {
@@ -82,7 +83,7 @@ export function telegramAdapter() {
                     console.warn("[telegram] TELEGRAM_WEBHOOK_SECRET not set — accepting webhook without verification (dev mode)");
                 }
                 // Dev mode: still require the bot token to be configured at all.
-                return !!process.env.TELEGRAM_BOT_TOKEN;
+                return !!(await resolveSecret("TELEGRAM_BOT_TOKEN"));
             }
             const headerSecret = getHeader(event, "x-telegram-bot-api-secret-token");
             if (!headerSecret)
@@ -135,7 +136,7 @@ export function telegramAdapter() {
             };
         },
         async sendResponse(message, context) {
-            const token = process.env.TELEGRAM_BOT_TOKEN;
+            const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
             if (!token) {
                 console.error("[telegram] TELEGRAM_BOT_TOKEN not configured");
                 return;
@@ -177,7 +178,7 @@ export function telegramAdapter() {
             }
         },
         async sendMessageToTarget(message, target) {
-            const token = process.env.TELEGRAM_BOT_TOKEN;
+            const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
             if (!token) {
                 console.error("[telegram] TELEGRAM_BOT_TOKEN not configured");
                 return;
@@ -216,11 +217,12 @@ export function telegramAdapter() {
             return { text: normalized, platformContext: { parse_mode: "Markdown" } };
         },
         async getStatus(_baseUrl) {
-            const hasToken = !!process.env.TELEGRAM_BOT_TOKEN;
+            const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
+            const hasToken = !!token;
             let botName;
             if (hasToken) {
                 try {
-                    const res = await fetch(`https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/getMe`);
+                    const res = await fetch(`https://api.telegram.org/bot${token}/getMe`);
                     const data = (await res.json());
                     if (data.ok) {
                         botName = data.result?.username;
@@ -237,9 +239,7 @@ export function telegramAdapter() {
                     hasToken,
                     botUsername: botName,
                 },
-                error: !hasToken
-                    ? "Set TELEGRAM_BOT_TOKEN in your environment"
-                    : undefined,
+                error: !hasToken ? "Save TELEGRAM_BOT_TOKEN in settings" : undefined,
             };
         },
     };

package/dist/integrations/adapters/telegram.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"telegram.js","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAG/B,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAStD,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;;;GAMG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;QAEjB,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,oBAAoB;oBAC3B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,uGAAuG;iBAC1G;gBACD;oBACE,GAAG,EAAE,yBAAyB;oBAC9B,KAAK,EAAE,yBAAyB;oBAChC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,6HAA6H;iBAChI;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,qEAAqE;YACrE,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,uCAAuC;YACvC,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACnC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBACjC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;YACD,qDAAqD;YACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YACnD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,6BAA6B,EAAE,EAAE,CAAC;oBACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBAC/B,yBAAyB,GAAG,IAAI,CAAC;wBACjC,OAAO,CAAC,KAAK,CACX,+EAA+E;4BAC7E,sGAAsG,CACzG,CAAC;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAC/B,yBAAyB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,IAAI,CACV,gGAAgG,CACjG,CAAC;gBACJ,CAAC;gBACD,iEAAiE;gBACjE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC1C,CAAC;YAED,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YACzE,IAAI,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAEhC,yBAAyB;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC3C,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAC1B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,wEAAwE;YACxE,mEAAmE;YACnE,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,CAAC,SAAiB,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,0BAA0B;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,6BAA6B;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YAEnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAE1B,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,EAAE,SAAS;gBACf,UAAU,EACR,IAAI,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1B,eAAe,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,IAAI,EAAE,EAAE;oBAChB,YAAY,EAAE,IAAI,EAAE,QAAQ;iBAC7B;gBACD,SAAS,EAAE,OAAO,CAAC,IAAI,GAAG,IAAI;aAC/B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,MAAM;4BACf,IAAI,EAAE,KAAK;4BACX,UAAU,EAAE,UAAU;yBACvB,CAAC;qBACH,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,0CAA0C;wBAC1C,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACxC,MAAM,KAAK,CAAC,+BAA+B,KAAK,cAAc,EAAE;gCAC9D,MAAM,EAAE,MAAM;gCACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gCAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oCACnB,OAAO,EAAE,MAAM;oCACf,IAAI,EAAE,KAAK;iCACZ,CAAC;6BACH,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;wBACnE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAA4B;oBACpC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,IAAI,EAAE,KAAK;iBACZ,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,SAAS,CAAC;gBAC5C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;oBACnE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,yEAAyE;YACzE,+CAA+C;YAC/C,wEAAwE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;QAC3E,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAElD,IAAI,OAA2B,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,OAAO,CAAC,GAAG,CAAC,kBAAkB,QAAQ,CACtE,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;wBACZ,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAClC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE;oBACP,QAAQ;oBACR,WAAW,EAAE,OAAO;iBACrB;gBACD,KAAK,EAAE,CAAC,QAAQ;oBACd,CAAC,CAAC,4CAA4C;oBAC9C,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getHeader } from \"h3\";\n\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { readBody } from \"../../server/h3-helpers.js\";\nimport type {\n PlatformAdapter,\n IncomingMessage,\n OutgoingMessage,\n IntegrationStatus,\n OutboundTarget,\n} from \"../types.js\";\n\n/** Telegram's max message length /\nconst TELEGRAM_MAX_LENGTH = 4096;\n\n/\n One-shot warning flag — log once per process when accepting unverified\n * webhooks (M6 in the webhook security audit).\n /\nlet _telegramUnverifiedWarned = false;\n\n/\n Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose secret is\n * unset — otherwise an attacker can drive the agent loop with arbitrary\n * messages (C2 in the webhook security audit).\n /\nfunction shouldRefuseWhenSecretMissing(): boolean {\n if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n return process.env.NODE_ENV === \"production\";\n}\n\n/\n Create a Telegram platform adapter.\n \n Required env vars:\n * - TELEGRAM_BOT_TOKEN — Bot token from @BotFather\n \n Optional env vars:\n * - TELEGRAM_WEBHOOK_SECRET — Secret token for webhook verification\n /\nexport function telegramAdapter(): PlatformAdapter {\n return {\n platform: \"telegram\",\n label: \"Telegram\",\n\n getRequiredEnvKeys(): EnvKeyConfig[] {\n return [\n {\n key: \"TELEGRAM_BOT_TOKEN\",\n label: \"Telegram Bot Token\",\n required: true,\n helpText:\n \"From @BotFather after `/newbot` — the long token Telegram gives you (looks like `123456:ABC-DEF...`).\",\n },\n {\n key: \"TELEGRAM_WEBHOOK_SECRET\",\n label: \"Telegram Webhook Secret\",\n required: false,\n helpText:\n \"Optional. Any random string — Telegram will echo it on every webhook so dispatch can verify the request came from Telegram.\",\n },\n ];\n },\n\n async handleVerification(\n event: H3Event,\n ): Promise<{ handled: boolean; response?: unknown }> {\n // Pre-read the raw body once and cache on the event context. h3 v2's\n // request body stream can only be consumed once; without this, the\n // later `parseIncomingMessage` call throws \"Body has already been read\"\n // because something upstream (signature check, dedupe, etc.) drains it.\n // Mirrors the Slack adapter's pattern.\n try {\n if (!event.context.__rawBody) {\n const body = await readBody(event);\n event.context.__rawBody = body;\n }\n } catch {\n // If we can't pre-read, parseIncomingMessage will surface the error\n }\n // Telegram has no challenge; we never short-circuit.\n return { handled: false };\n },\n\n async verifyWebhook(event: H3Event): Promise<boolean> {\n const secret = process.env.TELEGRAM_WEBHOOK_SECRET;\n if (!secret) {\n if (shouldRefuseWhenSecretMissing()) {\n if (!_telegramUnverifiedWarned) {\n _telegramUnverifiedWarned = true;\n console.error(\n \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — refusing webhook in production. \" +\n \"Set TELEGRAM_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n );\n }\n return false;\n }\n if (!_telegramUnverifiedWarned) {\n _telegramUnverifiedWarned = true;\n console.warn(\n \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — accepting webhook without verification (dev mode)\",\n );\n }\n // Dev mode: still require the bot token to be configured at all.\n return !!process.env.TELEGRAM_BOT_TOKEN;\n }\n\n const headerSecret = getHeader(event, \"x-telegram-bot-api-secret-token\");\n if (!headerSecret) return false;\n\n // Timing-safe comparison\n try {\n const crypto = await import(\"node:crypto\");\n return crypto.timingSafeEqual(\n Buffer.from(secret),\n Buffer.from(headerSecret),\n );\n } catch {\n return false;\n }\n },\n\n async parseIncomingMessage(\n event: H3Event,\n ): Promise<IncomingMessage \| null> {\n // Use the pre-cached raw body if available (set by handleVerification).\n // Falls back to readBody for paths that bypass handleVerification.\n const body = (event.context.__rawBody as any) ?? (await readBody(event));\n if (!body) return null;\n\n // Handle regular messages\n const message = body.message \|\| body.edited_message;\n if (!message) return null;\n\n // Only process text messages\n const text = message.text?.trim();\n if (!text) return null;\n\n // Ignore bot commands that we don't handle (e.g., /start is fine)\n // Remove /start command prefix if present\n const cleanText =\n text === \"/start\"\n ? \"Hello! I'm ready to chat.\"\n : text.replace(/^\\/\\w+\\s/, \"\").trim() \|\| text;\n\n const chat = message.chat;\n const from = message.from;\n\n return {\n platform: \"telegram\",\n externalThreadId: String(chat.id),\n text: cleanText,\n senderName:\n from?.first_name + (from?.last_name ? ` ${from.last_name}` : \"\"),\n senderId: String(from?.id),\n platformContext: {\n chatId: chat.id,\n chatType: chat.type,\n messageId: message.message_id,\n rawText: text,\n fromId: from?.id,\n fromUsername: from?.username,\n },\n timestamp: message.date * 1000,\n };\n },\n\n async sendResponse(\n message: OutgoingMessage,\n context: IncomingMessage,\n ): Promise<void> {\n const token = process.env.TELEGRAM_BOT_TOKEN;\n if (!token) {\n console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n return;\n }\n\n const chatId = context.platformContext.chatId;\n const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n\n for (const chunk of chunks) {\n try {\n const res = await fetch(\n `https://api.telegram.org/bot${token}/sendMessage`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n chat_id: chatId,\n text: chunk,\n parse_mode: \"Markdown\",\n }),\n },\n );\n const data = (await res.json()) as {\n ok: boolean;\n description?: string;\n };\n if (!data.ok) {\n // Retry without Markdown if parsing fails\n if (data.description?.includes(\"parse\")) {\n await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n chat_id: chatId,\n text: chunk,\n }),\n });\n } else {\n console.error(\"[telegram] sendMessage error:\", data.description);\n }\n }\n } catch (err) {\n console.error(\"[telegram] Failed to send message:\", err);\n }\n }\n },\n\n async sendMessageToTarget(\n message: OutgoingMessage,\n target: OutboundTarget,\n ): Promise<void> {\n const token = process.env.TELEGRAM_BOT_TOKEN;\n if (!token) {\n console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n return;\n }\n\n const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n for (const chunk of chunks) {\n const body: Record<string, unknown> = {\n chat_id: target.destination,\n text: chunk,\n };\n if (target.threadRef) {\n body.message_thread_id = target.threadRef;\n }\n\n try {\n const res = await fetch(\n `https://api.telegram.org/bot${token}/sendMessage`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(body),\n },\n );\n const data = (await res.json()) as {\n ok: boolean;\n description?: string;\n };\n if (!data.ok) {\n throw new Error(data.description \|\| \"sendMessage failed\");\n }\n } catch (err) {\n console.error(\"[telegram] Failed to send proactive message:\", err);\n throw err;\n }\n }\n },\n\n formatAgentResponse(text: string): OutgoingMessage {\n // Telegram's legacy Markdown uses single asterisks for bold, not double.\n // `[text](url)` is already supported natively.\n // 's' flag (dotAll) so `.` matches newlines — bold text can span lines.\n const normalized = text.replace(/\\\\(.+?)\\\\/gs, \"$1\");\n return { text: normalized, platformContext: { parse_mode: \"Markdown\" } };\n },\n\n async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n const hasToken = !!process.env.TELEGRAM_BOT_TOKEN;\n\n let botName: string \| undefined;\n if (hasToken) {\n try {\n const res = await fetch(\n `https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/getMe`,\n );\n const data = (await res.json()) as {\n ok: boolean;\n result?: { username?: string };\n };\n if (data.ok) {\n botName = data.result?.username;\n }\n } catch {}\n }\n\n return {\n platform: \"telegram\",\n label: \"Telegram\",\n enabled: false, // overridden by plugin\n configured: hasToken,\n details: {\n hasToken,\n botUsername: botName,\n },\n error: !hasToken\n ? \"Set TELEGRAM_BOT_TOKEN in your environment\"\n : undefined,\n };\n },\n };\n}\n\n/** Split a message into chunks that fit within the platform's limit */\nfunction splitMessage(text: string, maxLength: number): string[] {\n if (text.length <= maxLength) return [text];\n const chunks: string[] = [];\n let remaining = text;\n while (remaining.length > 0) {\n if (remaining.length <= maxLength) {\n chunks.push(remaining);\n break;\n }\n let splitIdx = remaining.lastIndexOf(\"\\n\", maxLength);\n if (splitIdx <= 0) splitIdx = remaining.lastIndexOf(\" \", maxLength);\n if (splitIdx <= 0) splitIdx = maxLength;\n chunks.push(remaining.slice(0, splitIdx));\n remaining = remaining.slice(splitIdx).trimStart();\n }\n return chunks;\n}\n"]}
1	+ {"version":3,"file":"telegram.js","sourceRoot":"","sources":["../../../src/integrations/adapters/telegram.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAG/B,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AAStD,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;;;GAMG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;QAEjB,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,oBAAoB;oBACzB,KAAK,EAAE,oBAAoB;oBAC3B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,uGAAuG;iBAC1G;gBACD;oBACE,GAAG,EAAE,yBAAyB;oBAC9B,KAAK,EAAE,yBAAyB;oBAChC,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,6HAA6H;iBAChI;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,qEAAqE;YACrE,mEAAmE;YACnE,wEAAwE;YACxE,wEAAwE;YACxE,uCAAuC;YACvC,IAAI,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;oBACnC,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;gBACjC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;YACD,qDAAqD;YACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,yBAAyB,CAAC,CAAC;YAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,6BAA6B,EAAE,EAAE,CAAC;oBACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBAC/B,yBAAyB,GAAG,IAAI,CAAC;wBACjC,OAAO,CAAC,KAAK,CACX,+EAA+E;4BAC7E,sGAAsG,CACzG,CAAC;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAC/B,yBAAyB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,IAAI,CACV,gGAAgG,CACjG,CAAC;gBACJ,CAAC;gBACD,iEAAiE;gBACjE,OAAO,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,oBAAoB,CAAC,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,EAAE,iCAAiC,CAAC,CAAC;YACzE,IAAI,CAAC,YAAY;gBAAE,OAAO,KAAK,CAAC;YAEhC,yBAAyB;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC3C,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAC1B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,wEAAwE;YACxE,mEAAmE;YACnE,MAAM,IAAI,GAAI,KAAK,CAAC,OAAO,CAAC,SAAiB,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACzE,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,0BAA0B;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,cAAc,CAAC;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,6BAA6B;YAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,kEAAkE;YAClE,0CAA0C;YAC1C,MAAM,SAAS,GACb,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YAEnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAE1B,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,EAAE,SAAS;gBACf,UAAU,EACR,IAAI,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC1B,eAAe,EAAE;oBACf,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,SAAS,EAAE,OAAO,CAAC,UAAU;oBAC7B,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,IAAI,EAAE,EAAE;oBAChB,YAAY,EAAE,IAAI,EAAE,QAAQ;iBAC7B;gBACD,SAAS,EAAE,OAAO,CAAC,IAAI,GAAG,IAAI;aAC/B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,CAAC;YACxD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;YAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,OAAO,EAAE,MAAM;4BACf,IAAI,EAAE,KAAK;4BACX,UAAU,EAAE,UAAU;yBACvB,CAAC;qBACH,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,0CAA0C;wBAC1C,IAAI,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;4BACxC,MAAM,KAAK,CAAC,+BAA+B,KAAK,cAAc,EAAE;gCAC9D,MAAM,EAAE,MAAM;gCACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gCAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oCACnB,OAAO,EAAE,MAAM;oCACf,IAAI,EAAE,KAAK;iCACZ,CAAC;6BACH,CAAC,CAAC;wBACL,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;wBACnE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,MAAsB;YAEtB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,CAAC;YACxD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAA4B;oBACpC,OAAO,EAAE,MAAM,CAAC,WAAW;oBAC3B,IAAI,EAAE,KAAK;iBACZ,CAAC;gBACF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,SAAS,CAAC;gBAC5C,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,+BAA+B,KAAK,cAAc,EAClD;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CACF,CAAC;oBACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;wBACb,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAC;oBACnE,MAAM,GAAG,CAAC;gBACZ,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,yEAAyE;YACzE,+CAA+C;YAC/C,wEAAwE;YACxE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC;QAC3E,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,oBAAoB,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC;YAEzB,IAAI,OAA2B,CAAC;YAChC,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,+BAA+B,KAAK,QAAQ,CAAC,CAAC;oBACtE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;oBACF,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;wBACZ,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC;oBAClC,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;YACZ,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE;oBACP,QAAQ;oBACR,WAAW,EAAE,OAAO;iBACrB;gBACD,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,SAAS;aACrE,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getHeader } from \"h3\";\n\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { resolveSecret } from \"../../server/credential-provider.js\";\nimport { readBody } from \"../../server/h3-helpers.js\";\nimport type {\n PlatformAdapter,\n IncomingMessage,\n OutgoingMessage,\n IntegrationStatus,\n OutboundTarget,\n} from \"../types.js\";\n\n/** Telegram's max message length /\nconst TELEGRAM_MAX_LENGTH = 4096;\n\n/\n One-shot warning flag — log once per process when accepting unverified\n * webhooks (M6 in the webhook security audit).\n /\nlet _telegramUnverifiedWarned = false;\n\n/\n Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose secret is\n * unset — otherwise an attacker can drive the agent loop with arbitrary\n * messages (C2 in the webhook security audit).\n /\nfunction shouldRefuseWhenSecretMissing(): boolean {\n if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n return process.env.NODE_ENV === \"production\";\n}\n\n/\n Create a Telegram platform adapter.\n \n Required env vars:\n * - TELEGRAM_BOT_TOKEN — Bot token from @BotFather\n \n Optional env vars:\n * - TELEGRAM_WEBHOOK_SECRET — Secret token for webhook verification\n /\nexport function telegramAdapter(): PlatformAdapter {\n return {\n platform: \"telegram\",\n label: \"Telegram\",\n\n getRequiredEnvKeys(): EnvKeyConfig[] {\n return [\n {\n key: \"TELEGRAM_BOT_TOKEN\",\n label: \"Telegram Bot Token\",\n required: true,\n helpText:\n \"From @BotFather after `/newbot` — the long token Telegram gives you (looks like `123456:ABC-DEF...`).\",\n },\n {\n key: \"TELEGRAM_WEBHOOK_SECRET\",\n label: \"Telegram Webhook Secret\",\n required: false,\n helpText:\n \"Optional. Any random string — Telegram will echo it on every webhook so dispatch can verify the request came from Telegram.\",\n },\n ];\n },\n\n async handleVerification(\n event: H3Event,\n ): Promise<{ handled: boolean; response?: unknown }> {\n // Pre-read the raw body once and cache on the event context. h3 v2's\n // request body stream can only be consumed once; without this, the\n // later `parseIncomingMessage` call throws \"Body has already been read\"\n // because something upstream (signature check, dedupe, etc.) drains it.\n // Mirrors the Slack adapter's pattern.\n try {\n if (!event.context.__rawBody) {\n const body = await readBody(event);\n event.context.__rawBody = body;\n }\n } catch {\n // If we can't pre-read, parseIncomingMessage will surface the error\n }\n // Telegram has no challenge; we never short-circuit.\n return { handled: false };\n },\n\n async verifyWebhook(event: H3Event): Promise<boolean> {\n const secret = await resolveSecret(\"TELEGRAM_WEBHOOK_SECRET\");\n if (!secret) {\n if (shouldRefuseWhenSecretMissing()) {\n if (!_telegramUnverifiedWarned) {\n _telegramUnverifiedWarned = true;\n console.error(\n \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — refusing webhook in production. \" +\n \"Set TELEGRAM_WEBHOOK_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n );\n }\n return false;\n }\n if (!_telegramUnverifiedWarned) {\n _telegramUnverifiedWarned = true;\n console.warn(\n \"[telegram] TELEGRAM_WEBHOOK_SECRET not set — accepting webhook without verification (dev mode)\",\n );\n }\n // Dev mode: still require the bot token to be configured at all.\n return !!(await resolveSecret(\"TELEGRAM_BOT_TOKEN\"));\n }\n\n const headerSecret = getHeader(event, \"x-telegram-bot-api-secret-token\");\n if (!headerSecret) return false;\n\n // Timing-safe comparison\n try {\n const crypto = await import(\"node:crypto\");\n return crypto.timingSafeEqual(\n Buffer.from(secret),\n Buffer.from(headerSecret),\n );\n } catch {\n return false;\n }\n },\n\n async parseIncomingMessage(\n event: H3Event,\n ): Promise<IncomingMessage \| null> {\n // Use the pre-cached raw body if available (set by handleVerification).\n // Falls back to readBody for paths that bypass handleVerification.\n const body = (event.context.__rawBody as any) ?? (await readBody(event));\n if (!body) return null;\n\n // Handle regular messages\n const message = body.message \|\| body.edited_message;\n if (!message) return null;\n\n // Only process text messages\n const text = message.text?.trim();\n if (!text) return null;\n\n // Ignore bot commands that we don't handle (e.g., /start is fine)\n // Remove /start command prefix if present\n const cleanText =\n text === \"/start\"\n ? \"Hello! I'm ready to chat.\"\n : text.replace(/^\\/\\w+\\s/, \"\").trim() \|\| text;\n\n const chat = message.chat;\n const from = message.from;\n\n return {\n platform: \"telegram\",\n externalThreadId: String(chat.id),\n text: cleanText,\n senderName:\n from?.first_name + (from?.last_name ? ` ${from.last_name}` : \"\"),\n senderId: String(from?.id),\n platformContext: {\n chatId: chat.id,\n chatType: chat.type,\n messageId: message.message_id,\n rawText: text,\n fromId: from?.id,\n fromUsername: from?.username,\n },\n timestamp: message.date * 1000,\n };\n },\n\n async sendResponse(\n message: OutgoingMessage,\n context: IncomingMessage,\n ): Promise<void> {\n const token = await resolveSecret(\"TELEGRAM_BOT_TOKEN\");\n if (!token) {\n console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n return;\n }\n\n const chatId = context.platformContext.chatId;\n const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n\n for (const chunk of chunks) {\n try {\n const res = await fetch(\n `https://api.telegram.org/bot${token}/sendMessage`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n chat_id: chatId,\n text: chunk,\n parse_mode: \"Markdown\",\n }),\n },\n );\n const data = (await res.json()) as {\n ok: boolean;\n description?: string;\n };\n if (!data.ok) {\n // Retry without Markdown if parsing fails\n if (data.description?.includes(\"parse\")) {\n await fetch(`https://api.telegram.org/bot${token}/sendMessage`, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n chat_id: chatId,\n text: chunk,\n }),\n });\n } else {\n console.error(\"[telegram] sendMessage error:\", data.description);\n }\n }\n } catch (err) {\n console.error(\"[telegram] Failed to send message:\", err);\n }\n }\n },\n\n async sendMessageToTarget(\n message: OutgoingMessage,\n target: OutboundTarget,\n ): Promise<void> {\n const token = await resolveSecret(\"TELEGRAM_BOT_TOKEN\");\n if (!token) {\n console.error(\"[telegram] TELEGRAM_BOT_TOKEN not configured\");\n return;\n }\n\n const chunks = splitMessage(message.text, TELEGRAM_MAX_LENGTH);\n for (const chunk of chunks) {\n const body: Record<string, unknown> = {\n chat_id: target.destination,\n text: chunk,\n };\n if (target.threadRef) {\n body.message_thread_id = target.threadRef;\n }\n\n try {\n const res = await fetch(\n `https://api.telegram.org/bot${token}/sendMessage`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(body),\n },\n );\n const data = (await res.json()) as {\n ok: boolean;\n description?: string;\n };\n if (!data.ok) {\n throw new Error(data.description \|\| \"sendMessage failed\");\n }\n } catch (err) {\n console.error(\"[telegram] Failed to send proactive message:\", err);\n throw err;\n }\n }\n },\n\n formatAgentResponse(text: string): OutgoingMessage {\n // Telegram's legacy Markdown uses single asterisks for bold, not double.\n // `[text](url)` is already supported natively.\n // 's' flag (dotAll) so `.` matches newlines — bold text can span lines.\n const normalized = text.replace(/\\\\(.+?)\\\\/gs, \"$1\");\n return { text: normalized, platformContext: { parse_mode: \"Markdown\" } };\n },\n\n async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n const token = await resolveSecret(\"TELEGRAM_BOT_TOKEN\");\n const hasToken = !!token;\n\n let botName: string \| undefined;\n if (hasToken) {\n try {\n const res = await fetch(`https://api.telegram.org/bot${token}/getMe`);\n const data = (await res.json()) as {\n ok: boolean;\n result?: { username?: string };\n };\n if (data.ok) {\n botName = data.result?.username;\n }\n } catch {}\n }\n\n return {\n platform: \"telegram\",\n label: \"Telegram\",\n enabled: false, // overridden by plugin\n configured: hasToken,\n details: {\n hasToken,\n botUsername: botName,\n },\n error: !hasToken ? \"Save TELEGRAM_BOT_TOKEN in settings\" : undefined,\n };\n },\n };\n}\n\n/** Split a message into chunks that fit within the platform's limit */\nfunction splitMessage(text: string, maxLength: number): string[] {\n if (text.length <= maxLength) return [text];\n const chunks: string[] = [];\n let remaining = text;\n while (remaining.length > 0) {\n if (remaining.length <= maxLength) {\n chunks.push(remaining);\n break;\n }\n let splitIdx = remaining.lastIndexOf(\"\\n\", maxLength);\n if (splitIdx <= 0) splitIdx = remaining.lastIndexOf(\" \", maxLength);\n if (splitIdx <= 0) splitIdx = maxLength;\n chunks.push(remaining.slice(0, splitIdx));\n remaining = remaining.slice(splitIdx).trimStart();\n }\n return chunks;\n}\n"]}

package/dist/integrations/adapters/whatsapp.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"whatsapp.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/whatsapp.ts"],"names":[],"mappings":"~~AAIA~~,OAAO,KAAK,EACV,eAAe,EAIhB,MAAM,aAAa,CAAC;AAsBrB;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI,eAAe,~~CA0PjD~~"}
1	+ {"version":3,"file":"whatsapp.d.ts","sourceRoot":"","sources":["../../../src/integrations/adapters/whatsapp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EAIhB,MAAM,aAAa,CAAC;AAsBrB;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,IAAI,eAAe,CA4PjD"}

package/dist/integrations/adapters/whatsapp.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import { getQuery, getHeader, readRawBody as h3ReadRawBody } from "h3";
+import { resolveSecret } from "../../server/credential-provider.js";
 /** WhatsApp's max message length */
 const WHATSAPP_MAX_LENGTH = 4096;
 /**
@@ -82,7 +83,7 @@ export function whatsappAdapter() {
             const mode = query["hub.mode"];
             const token = query["hub.verify_token"];
             const challenge = query["hub.challenge"];
-            const expected = process.env.WHATSAPP_VERIFY_TOKEN;
+            const expected = await resolveSecret("WHATSAPP_VERIFY_TOKEN");
             if (mode === "subscribe" && expected && typeof token === "string") {
                 // Timing-safe compare so an attacker can't measure character-wise
                 // mismatch latency (H6 in the webhook security audit).
@@ -103,7 +104,7 @@ export function whatsappAdapter() {
             return { handled: false };
         },
         async verifyWebhook(event) {
-            const appSecret = process.env.WHATSAPP_APP_SECRET;
+            const appSecret = await resolveSecret("WHATSAPP_APP_SECRET");
             if (!appSecret) {
                 if (shouldRefuseWhenSecretMissing()) {
                     if (!_whatsappUnverifiedWarned) {
@@ -118,7 +119,7 @@ export function whatsappAdapter() {
                     console.warn("[whatsapp] WHATSAPP_APP_SECRET not set — accepting webhook without verification (dev mode)");
                 }
                 // Dev mode: still require the access token to be configured at all.
-                return !!process.env.WHATSAPP_ACCESS_TOKEN;
+                return !!(await resolveSecret("WHATSAPP_ACCESS_TOKEN"));
             }
             const signature = getHeader(event, "x-hub-signature-256");
             if (!signature)
@@ -186,8 +187,8 @@ export function whatsappAdapter() {
             };
         },
         async sendResponse(message, context) {
-            const accessToken = process.env.WHATSAPP_ACCESS_TOKEN;
-            const phoneNumberId = process.env.WHATSAPP_PHONE_NUMBER_ID;
+            const accessToken = await resolveSecret("WHATSAPP_ACCESS_TOKEN");
+            const phoneNumberId = await resolveSecret("WHATSAPP_PHONE_NUMBER_ID");
             if (!accessToken || !phoneNumberId) {
                 console.error("[whatsapp] WHATSAPP_ACCESS_TOKEN or WHATSAPP_PHONE_NUMBER_ID not configured");
                 return;
@@ -224,9 +225,9 @@ export function whatsappAdapter() {
             return { text, platformContext: {} };
         },
         async getStatus(_baseUrl) {
-            const hasAccessToken = !!process.env.WHATSAPP_ACCESS_TOKEN;
-            const hasVerifyToken = !!process.env.WHATSAPP_VERIFY_TOKEN;
-            const hasPhoneNumberId = !!process.env.WHATSAPP_PHONE_NUMBER_ID;
+            const hasAccessToken = !!(await resolveSecret("WHATSAPP_ACCESS_TOKEN"));
+            const hasVerifyToken = !!(await resolveSecret("WHATSAPP_VERIFY_TOKEN"));
+            const hasPhoneNumberId = !!(await resolveSecret("WHATSAPP_PHONE_NUMBER_ID"));
             const configured = hasAccessToken && hasVerifyToken && hasPhoneNumberId;
             return {
                 platform: "whatsapp",
@@ -239,7 +240,7 @@ export function whatsappAdapter() {
                     hasPhoneNumberId,
                 },
                 error: !configured
-                    ? "Set WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID"
+                    ? "Save WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID in settings"
                     : undefined,
             };
         },

package/dist/integrations/adapters/whatsapp.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"whatsapp.js","sourceRoot":"","sources":["../../../src/integrations/adapters/whatsapp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,IAAI,aAAa,EAAE,MAAM,IAAI,CAAC;AAUvE,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;;GAKG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;QAEjB,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,uBAAuB;oBAC9B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,yHAAyH;iBAC5H;gBACD;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,uBAAuB;oBAC9B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,wIAAwI;iBAC3I;gBACD;oBACE,GAAG,EAAE,0BAA0B;oBAC/B,KAAK,EAAE,0BAA0B;oBACjC,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,uGAAuG;iBAC1G;gBACD;oBACE,GAAG,EAAE,qBAAqB;oBAC1B,KAAK,EAAE,qBAAqB;oBAC5B,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,2HAA2H;iBAC9H;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,MAAM,CAAC;YAEjD,qEAAqE;YACrE,kEAAkE;YAClE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,yCAAyC;YACzC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,2EAA2E;gBAC7E,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YAED,uCAAuC;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAEnD,IAAI,IAAI,KAAK,WAAW,IAAI,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAClE,kEAAkE;gBAClE,uDAAuD;gBACvD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;wBAC3C,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;4BACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;wBAChD,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,eAAe;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAClD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,6BAA6B,EAAE,EAAE,CAAC;oBACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBAC/B,yBAAyB,GAAG,IAAI,CAAC;wBACjC,OAAO,CAAC,KAAK,CACX,2EAA2E;4BACzE,kGAAkG,CACrG,CAAC;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAC/B,yBAAyB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,IAAI,CACV,4FAA4F,CAC7F,CAAC;gBACJ,CAAC;gBACD,oEAAoE;gBACpE,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAC7C,CAAC;YAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;YAC1D,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAE7B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,iBAAiB,GACrB,SAAS;gBACT,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEpE,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAC/B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,sEAAsE;YACtE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,+CAA+C;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YAE1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,4BAA4B;YAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe;YAE1C,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,gBAAgB,EAAE,IAAI;gBACtB,IAAI;gBACJ,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;gBAClC,QAAQ,EAAE,IAAI;gBACd,eAAe,EAAE;oBACf,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe;oBAC9C,kBAAkB,EAAE,KAAK,CAAC,QAAQ,EAAE,oBAAoB;oBACxD,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,IAAI;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B;gBACD,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI;aAClD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACtD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAC3D,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CACX,6EAA6E,CAC9E,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,oCAAoC,aAAa,WAAW,EAC5D;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,WAAW,EAAE;4BACtC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,iBAAiB,EAAE,UAAU;4BAC7B,cAAc,EAAE,YAAY;4BAC5B,EAAE;4BACF,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;yBACtB,CAAC;qBACH,CACF,CAAC;oBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;wBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;wBAChD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAC3D,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YAC3D,MAAM,gBAAgB,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAChE,MAAM,UAAU,GAAG,cAAc,IAAI,cAAc,IAAI,gBAAgB,CAAC;YAExE,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU;gBACV,OAAO,EAAE;oBACP,cAAc;oBACd,cAAc;oBACd,gBAAgB;iBACjB;gBACD,KAAK,EAAE,CAAC,UAAU;oBAChB,CAAC,CAAC,gFAAgF;oBAClF,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getQuery, getHeader, readRawBody as h3ReadRawBody } from \"h3\";\n\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport type {\n PlatformAdapter,\n IncomingMessage,\n OutgoingMessage,\n IntegrationStatus,\n} from \"../types.js\";\n\n/** WhatsApp's max message length /\nconst WHATSAPP_MAX_LENGTH = 4096;\n\n/\n One-shot warning flag — log once per process when accepting unverified\n * webhooks (M6 in the webhook security audit).\n /\nlet _whatsappUnverifiedWarned = false;\n\n/\n Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose signature can't\n * be verified (C2 in the webhook security audit).\n /\nfunction shouldRefuseWhenSecretMissing(): boolean {\n if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n return process.env.NODE_ENV === \"production\";\n}\n\n/\n Create a WhatsApp Cloud API platform adapter.\n \n Required env vars:\n * - WHATSAPP_ACCESS_TOKEN — Permanent access token from Meta\n * - WHATSAPP_VERIFY_TOKEN — Custom token for webhook verification\n * - WHATSAPP_PHONE_NUMBER_ID — Phone number ID from Meta dashboard\n \n Optional env vars:\n * - WHATSAPP_APP_SECRET — App secret for signature verification\n /\nexport function whatsappAdapter(): PlatformAdapter {\n return {\n platform: \"whatsapp\",\n label: \"WhatsApp\",\n\n getRequiredEnvKeys(): EnvKeyConfig[] {\n return [\n {\n key: \"WHATSAPP_ACCESS_TOKEN\",\n label: \"WhatsApp Access Token\",\n required: true,\n helpText:\n \"From your Meta app → WhatsApp → API Setup → Permanent access token. Generate one under System Users for production use.\",\n },\n {\n key: \"WHATSAPP_VERIFY_TOKEN\",\n label: \"WhatsApp Verify Token\",\n required: true,\n helpText:\n \"Any random string you choose. You'll paste the same value into Meta's webhook configuration so Meta can confirm dispatch owns the URL.\",\n },\n {\n key: \"WHATSAPP_PHONE_NUMBER_ID\",\n label: \"WhatsApp Phone Number ID\",\n required: true,\n helpText:\n \"From your Meta app → WhatsApp → API Setup. The numeric Phone number ID (not the actual phone number).\",\n },\n {\n key: \"WHATSAPP_APP_SECRET\",\n label: \"WhatsApp App Secret\",\n required: false,\n helpText:\n \"Optional. From Meta App Dashboard → Basic Settings → App Secret. Enables HMAC signature verification on inbound webhooks.\",\n },\n ];\n },\n\n async handleVerification(\n event: H3Event,\n ): Promise<{ handled: boolean; response?: unknown }> {\n const method = event.node?.req?.method \|\| \"POST\";\n\n // For POST flows, pre-cache the raw body so verifyWebhook (HMAC) and\n // parseIncomingMessage don't both try to consume the request body\n // stream — h3 v2's body stream is consume-once, so a second read\n // hangs (M3 in the webhook security audit). Reads raw bytes; never\n // re-stringifies a parsed body, since Meta computes HMAC over the\n // exact bytes it sent (M2 in the audit).\n if (method === \"POST\") {\n try {\n await readRawBody(event);\n } catch {\n // Surfaces in verifyWebhook / parseIncomingMessage if it actually matters.\n }\n return { handled: false };\n }\n\n // GET: WhatsApp's challenge handshake.\n const query = getQuery(event);\n const mode = query[\"hub.mode\"];\n const token = query[\"hub.verify_token\"];\n const challenge = query[\"hub.challenge\"];\n const expected = process.env.WHATSAPP_VERIFY_TOKEN;\n\n if (mode === \"subscribe\" && expected && typeof token === \"string\") {\n // Timing-safe compare so an attacker can't measure character-wise\n // mismatch latency (H6 in the webhook security audit).\n const a = Buffer.from(String(token));\n const b = Buffer.from(String(expected));\n if (a.length === b.length) {\n try {\n const crypto = await import(\"node:crypto\");\n if (crypto.timingSafeEqual(a, b)) {\n return { handled: true, response: challenge };\n }\n } catch {\n // fall through\n }\n }\n }\n\n return { handled: false };\n },\n\n async verifyWebhook(event: H3Event): Promise<boolean> {\n const appSecret = process.env.WHATSAPP_APP_SECRET;\n if (!appSecret) {\n if (shouldRefuseWhenSecretMissing()) {\n if (!_whatsappUnverifiedWarned) {\n _whatsappUnverifiedWarned = true;\n console.error(\n \"[whatsapp] WHATSAPP_APP_SECRET not set — refusing webhook in production. \" +\n \"Set WHATSAPP_APP_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n );\n }\n return false;\n }\n if (!_whatsappUnverifiedWarned) {\n _whatsappUnverifiedWarned = true;\n console.warn(\n \"[whatsapp] WHATSAPP_APP_SECRET not set — accepting webhook without verification (dev mode)\",\n );\n }\n // Dev mode: still require the access token to be configured at all.\n return !!process.env.WHATSAPP_ACCESS_TOKEN;\n }\n\n const signature = getHeader(event, \"x-hub-signature-256\");\n if (!signature) return false;\n\n const body = await readRawBody(event);\n const crypto = await import(\"node:crypto\");\n const expectedSignature =\n \"sha256=\" +\n crypto.createHmac(\"sha256\", appSecret).update(body).digest(\"hex\");\n\n try {\n return crypto.timingSafeEqual(\n Buffer.from(signature),\n Buffer.from(expectedSignature),\n );\n } catch {\n return false;\n }\n },\n\n async parseIncomingMessage(\n event: H3Event,\n ): Promise<IncomingMessage \| null> {\n // Always read via the cached raw body so HMAC and parse see identical\n // bytes — h3 v2's body stream is consume-once, and re-stringifying a\n // parsed body breaks Meta's signature check (M2/M3 in the audit).\n const raw = await readRawBody(event);\n if (!raw) return null;\n let body: any;\n try {\n body = JSON.parse(raw);\n } catch {\n return null;\n }\n if (!body) return null;\n\n // WhatsApp Cloud API webhook payload structure\n const entry = body.entry?.[0];\n if (!entry) return null;\n\n const changes = entry.changes?.[0];\n if (!changes \|\| changes.field !== \"messages\") return null;\n\n const value = changes.value;\n const message = value?.messages?.[0];\n if (!message) return null;\n\n // Only handle text messages\n if (message.type !== \"text\") return null;\n const text = message.text?.body?.trim();\n if (!text) return null;\n\n const contact = value.contacts?.[0];\n const from = message.from; // Phone number\n\n return {\n platform: \"whatsapp\",\n externalThreadId: from,\n text,\n senderName: contact?.profile?.name,\n senderId: from,\n platformContext: {\n phoneNumberId: value.metadata?.phone_number_id,\n displayPhoneNumber: value.metadata?.display_phone_number,\n messageId: message.id,\n from,\n timestamp: message.timestamp,\n },\n timestamp: parseInt(message.timestamp, 10) 1000,\n };\n },\n\n async sendResponse(\n message: OutgoingMessage,\n context: IncomingMessage,\n ): Promise<void> {\n const accessToken = process.env.WHATSAPP_ACCESS_TOKEN;\n const phoneNumberId = process.env.WHATSAPP_PHONE_NUMBER_ID;\n if (!accessToken \|\| !phoneNumberId) {\n console.error(\n \"[whatsapp] WHATSAPP_ACCESS_TOKEN or WHATSAPP_PHONE_NUMBER_ID not configured\",\n );\n return;\n }\n\n const to = context.senderId;\n const chunks = splitMessage(message.text, WHATSAPP_MAX_LENGTH);\n\n for (const chunk of chunks) {\n try {\n const res = await fetch(\n `https://graph.facebook.com/v21.0/${phoneNumberId}/messages`,\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${accessToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n messaging_product: \"whatsapp\",\n recipient_type: \"individual\",\n to,\n type: \"text\",\n text: { body: chunk },\n }),\n },\n );\n if (!res.ok) {\n const data = await res.json().catch(() => ({}));\n console.error(\"[whatsapp] sendMessage error:\", data);\n }\n } catch (err) {\n console.error(\"[whatsapp] Failed to send message:\", err);\n }\n }\n },\n\n formatAgentResponse(text: string): OutgoingMessage {\n return { text, platformContext: {} };\n },\n\n async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n const hasAccessToken = !!process.env.WHATSAPP_ACCESS_TOKEN;\n const hasVerifyToken = !!process.env.WHATSAPP_VERIFY_TOKEN;\n const hasPhoneNumberId = !!process.env.WHATSAPP_PHONE_NUMBER_ID;\n const configured = hasAccessToken && hasVerifyToken && hasPhoneNumberId;\n\n return {\n platform: \"whatsapp\",\n label: \"WhatsApp\",\n enabled: false, // overridden by plugin\n configured,\n details: {\n hasAccessToken,\n hasVerifyToken,\n hasPhoneNumberId,\n },\n error: !configured\n ? \"Set WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID\"\n : undefined,\n };\n },\n };\n}\n\n/*\n Read the raw request body as a string and cache it on the event context.\n \n Reads raw bytes from the request stream, NEVER `JSON.stringify`s a parsed\n * body — Meta's signature is computed over the exact bytes Meta sent\n * (M2/M3 in the webhook security audit). h3 v2's body stream is consume-once\n * so we cache the raw string after the first read.\n */\nasync function readRawBody(event: H3Event): Promise<string> {\n const cached = event.context.__rawBody;\n if (typeof cached === \"string\") return cached;\n const raw = (await h3ReadRawBody(event)) ?? \"\";\n event.context.__rawBody = raw;\n return raw;\n}\n\nfunction splitMessage(text: string, maxLength: number): string[] {\n if (text.length <= maxLength) return [text];\n const chunks: string[] = [];\n let remaining = text;\n while (remaining.length > 0) {\n if (remaining.length <= maxLength) {\n chunks.push(remaining);\n break;\n }\n let splitIdx = remaining.lastIndexOf(\"\\n\", maxLength);\n if (splitIdx <= 0) splitIdx = remaining.lastIndexOf(\" \", maxLength);\n if (splitIdx <= 0) splitIdx = maxLength;\n chunks.push(remaining.slice(0, splitIdx));\n remaining = remaining.slice(splitIdx).trimStart();\n }\n return chunks;\n}\n"]}
1	+ {"version":3,"file":"whatsapp.js","sourceRoot":"","sources":["../../../src/integrations/adapters/whatsapp.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,IAAI,aAAa,EAAE,MAAM,IAAI,CAAC;AAGvE,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAQpE,oCAAoC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC;;;GAGG;AACH,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC;;;;;GAKG;AACH,SAAS,6BAA6B;IACpC,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,QAAQ,EAAE,UAAU;QACpB,KAAK,EAAE,UAAU;QAEjB,kBAAkB;YAChB,OAAO;gBACL;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,uBAAuB;oBAC9B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,yHAAyH;iBAC5H;gBACD;oBACE,GAAG,EAAE,uBAAuB;oBAC5B,KAAK,EAAE,uBAAuB;oBAC9B,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,wIAAwI;iBAC3I;gBACD;oBACE,GAAG,EAAE,0BAA0B;oBAC/B,KAAK,EAAE,0BAA0B;oBACjC,QAAQ,EAAE,IAAI;oBACd,QAAQ,EACN,uGAAuG;iBAC1G;gBACD;oBACE,GAAG,EAAE,qBAAqB;oBAC1B,KAAK,EAAE,qBAAqB;oBAC5B,QAAQ,EAAE,KAAK;oBACf,QAAQ,EACN,2HAA2H;iBAC9H;aACF,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,kBAAkB,CACtB,KAAc;YAEd,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,IAAI,MAAM,CAAC;YAEjD,qEAAqE;YACrE,kEAAkE;YAClE,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,yCAAyC;YACzC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,2EAA2E;gBAC7E,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC5B,CAAC;YAED,uCAAuC;YACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,KAAK,CAAC,eAAe,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,CAAC;YAE9D,IAAI,IAAI,KAAK,WAAW,IAAI,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAClE,kEAAkE;gBAClE,uDAAuD;gBACvD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;wBAC3C,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;4BACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;wBAChD,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,eAAe;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,KAAc;YAChC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,qBAAqB,CAAC,CAAC;YAC7D,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,6BAA6B,EAAE,EAAE,CAAC;oBACpC,IAAI,CAAC,yBAAyB,EAAE,CAAC;wBAC/B,yBAAyB,GAAG,IAAI,CAAC;wBACjC,OAAO,CAAC,KAAK,CACX,2EAA2E;4BACzE,kGAAkG,CACrG,CAAC;oBACJ,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,IAAI,CAAC,yBAAyB,EAAE,CAAC;oBAC/B,yBAAyB,GAAG,IAAI,CAAC;oBACjC,OAAO,CAAC,IAAI,CACV,4FAA4F,CAC7F,CAAC;gBACJ,CAAC;gBACD,oEAAoE;gBACpE,OAAO,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;YAC1D,IAAI,CAAC,SAAS;gBAAE,OAAO,KAAK,CAAC;YAE7B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,iBAAiB,GACrB,SAAS;gBACT,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAEpE,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,eAAe,CAC3B,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAC/B,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,oBAAoB,CACxB,KAAc;YAEd,sEAAsE;YACtE,qEAAqE;YACrE,kEAAkE;YAClE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,IAAS,CAAC;YACd,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,+CAA+C;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAExB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YAE1D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAE1B,4BAA4B;YAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YAEvB,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe;YAE1C,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,gBAAgB,EAAE,IAAI;gBACtB,IAAI;gBACJ,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI;gBAClC,QAAQ,EAAE,IAAI;gBACd,eAAe,EAAE;oBACf,aAAa,EAAE,KAAK,CAAC,QAAQ,EAAE,eAAe;oBAC9C,kBAAkB,EAAE,KAAK,CAAC,QAAQ,EAAE,oBAAoB;oBACxD,SAAS,EAAE,OAAO,CAAC,EAAE;oBACrB,IAAI;oBACJ,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B;gBACD,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI;aAClD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,YAAY,CAChB,OAAwB,EACxB,OAAwB;YAExB,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,CAAC;YACjE,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,0BAA0B,CAAC,CAAC;YACtE,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CACX,6EAA6E,CAC9E,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAE/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,oCAAoC,aAAa,WAAW,EAC5D;wBACE,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE;4BACP,aAAa,EAAE,UAAU,WAAW,EAAE;4BACtC,cAAc,EAAE,kBAAkB;yBACnC;wBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,iBAAiB,EAAE,UAAU;4BAC7B,cAAc,EAAE,YAAY;4BAC5B,EAAE;4BACF,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;yBACtB,CAAC;qBACH,CACF,CAAC;oBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;wBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;wBAChD,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,mBAAmB,CAAC,IAAY;YAC9B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAiB;YAC/B,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC;YACxE,MAAM,cAAc,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,uBAAuB,CAAC,CAAC,CAAC;YACxE,MAAM,gBAAgB,GAAG,CAAC,CAAC,CAAC,MAAM,aAAa,CAC7C,0BAA0B,CAC3B,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,cAAc,IAAI,cAAc,IAAI,gBAAgB,CAAC;YAExE,OAAO;gBACL,QAAQ,EAAE,UAAU;gBACpB,KAAK,EAAE,UAAU;gBACjB,OAAO,EAAE,KAAK,EAAE,uBAAuB;gBACvC,UAAU;gBACV,OAAO,EAAE;oBACP,cAAc;oBACd,cAAc;oBACd,gBAAgB;iBACjB;gBACD,KAAK,EAAE,CAAC,UAAU;oBAChB,CAAC,CAAC,6FAA6F;oBAC/F,CAAC,CAAC,SAAS;aACd,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,GAAG,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,GAAG,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QACD,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\nimport { getQuery, getHeader, readRawBody as h3ReadRawBody } from \"h3\";\n\nimport type { EnvKeyConfig } from \"../../server/create-server.js\";\nimport { resolveSecret } from \"../../server/credential-provider.js\";\nimport type {\n PlatformAdapter,\n IncomingMessage,\n OutgoingMessage,\n IntegrationStatus,\n} from \"../types.js\";\n\n/** WhatsApp's max message length /\nconst WHATSAPP_MAX_LENGTH = 4096;\n\n/\n One-shot warning flag — log once per process when accepting unverified\n * webhooks (M6 in the webhook security audit).\n /\nlet _whatsappUnverifiedWarned = false;\n\n/\n Returns true when the deployment is running in production mode and the\n * operator has NOT explicitly opted into accepting unverified webhooks for\n * local testing. In production we MUST refuse webhooks whose signature can't\n * be verified (C2 in the webhook security audit).\n /\nfunction shouldRefuseWhenSecretMissing(): boolean {\n if (process.env.AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS === \"1\") return false;\n return process.env.NODE_ENV === \"production\";\n}\n\n/\n Create a WhatsApp Cloud API platform adapter.\n \n Required env vars:\n * - WHATSAPP_ACCESS_TOKEN — Permanent access token from Meta\n * - WHATSAPP_VERIFY_TOKEN — Custom token for webhook verification\n * - WHATSAPP_PHONE_NUMBER_ID — Phone number ID from Meta dashboard\n \n Optional env vars:\n * - WHATSAPP_APP_SECRET — App secret for signature verification\n /\nexport function whatsappAdapter(): PlatformAdapter {\n return {\n platform: \"whatsapp\",\n label: \"WhatsApp\",\n\n getRequiredEnvKeys(): EnvKeyConfig[] {\n return [\n {\n key: \"WHATSAPP_ACCESS_TOKEN\",\n label: \"WhatsApp Access Token\",\n required: true,\n helpText:\n \"From your Meta app → WhatsApp → API Setup → Permanent access token. Generate one under System Users for production use.\",\n },\n {\n key: \"WHATSAPP_VERIFY_TOKEN\",\n label: \"WhatsApp Verify Token\",\n required: true,\n helpText:\n \"Any random string you choose. You'll paste the same value into Meta's webhook configuration so Meta can confirm dispatch owns the URL.\",\n },\n {\n key: \"WHATSAPP_PHONE_NUMBER_ID\",\n label: \"WhatsApp Phone Number ID\",\n required: true,\n helpText:\n \"From your Meta app → WhatsApp → API Setup. The numeric Phone number ID (not the actual phone number).\",\n },\n {\n key: \"WHATSAPP_APP_SECRET\",\n label: \"WhatsApp App Secret\",\n required: false,\n helpText:\n \"Optional. From Meta App Dashboard → Basic Settings → App Secret. Enables HMAC signature verification on inbound webhooks.\",\n },\n ];\n },\n\n async handleVerification(\n event: H3Event,\n ): Promise<{ handled: boolean; response?: unknown }> {\n const method = event.node?.req?.method \|\| \"POST\";\n\n // For POST flows, pre-cache the raw body so verifyWebhook (HMAC) and\n // parseIncomingMessage don't both try to consume the request body\n // stream — h3 v2's body stream is consume-once, so a second read\n // hangs (M3 in the webhook security audit). Reads raw bytes; never\n // re-stringifies a parsed body, since Meta computes HMAC over the\n // exact bytes it sent (M2 in the audit).\n if (method === \"POST\") {\n try {\n await readRawBody(event);\n } catch {\n // Surfaces in verifyWebhook / parseIncomingMessage if it actually matters.\n }\n return { handled: false };\n }\n\n // GET: WhatsApp's challenge handshake.\n const query = getQuery(event);\n const mode = query[\"hub.mode\"];\n const token = query[\"hub.verify_token\"];\n const challenge = query[\"hub.challenge\"];\n const expected = await resolveSecret(\"WHATSAPP_VERIFY_TOKEN\");\n\n if (mode === \"subscribe\" && expected && typeof token === \"string\") {\n // Timing-safe compare so an attacker can't measure character-wise\n // mismatch latency (H6 in the webhook security audit).\n const a = Buffer.from(String(token));\n const b = Buffer.from(String(expected));\n if (a.length === b.length) {\n try {\n const crypto = await import(\"node:crypto\");\n if (crypto.timingSafeEqual(a, b)) {\n return { handled: true, response: challenge };\n }\n } catch {\n // fall through\n }\n }\n }\n\n return { handled: false };\n },\n\n async verifyWebhook(event: H3Event): Promise<boolean> {\n const appSecret = await resolveSecret(\"WHATSAPP_APP_SECRET\");\n if (!appSecret) {\n if (shouldRefuseWhenSecretMissing()) {\n if (!_whatsappUnverifiedWarned) {\n _whatsappUnverifiedWarned = true;\n console.error(\n \"[whatsapp] WHATSAPP_APP_SECRET not set — refusing webhook in production. \" +\n \"Set WHATSAPP_APP_SECRET, or set AGENT_NATIVE_ALLOW_UNVERIFIED_WEBHOOKS=1 for local testing only.\",\n );\n }\n return false;\n }\n if (!_whatsappUnverifiedWarned) {\n _whatsappUnverifiedWarned = true;\n console.warn(\n \"[whatsapp] WHATSAPP_APP_SECRET not set — accepting webhook without verification (dev mode)\",\n );\n }\n // Dev mode: still require the access token to be configured at all.\n return !!(await resolveSecret(\"WHATSAPP_ACCESS_TOKEN\"));\n }\n\n const signature = getHeader(event, \"x-hub-signature-256\");\n if (!signature) return false;\n\n const body = await readRawBody(event);\n const crypto = await import(\"node:crypto\");\n const expectedSignature =\n \"sha256=\" +\n crypto.createHmac(\"sha256\", appSecret).update(body).digest(\"hex\");\n\n try {\n return crypto.timingSafeEqual(\n Buffer.from(signature),\n Buffer.from(expectedSignature),\n );\n } catch {\n return false;\n }\n },\n\n async parseIncomingMessage(\n event: H3Event,\n ): Promise<IncomingMessage \| null> {\n // Always read via the cached raw body so HMAC and parse see identical\n // bytes — h3 v2's body stream is consume-once, and re-stringifying a\n // parsed body breaks Meta's signature check (M2/M3 in the audit).\n const raw = await readRawBody(event);\n if (!raw) return null;\n let body: any;\n try {\n body = JSON.parse(raw);\n } catch {\n return null;\n }\n if (!body) return null;\n\n // WhatsApp Cloud API webhook payload structure\n const entry = body.entry?.[0];\n if (!entry) return null;\n\n const changes = entry.changes?.[0];\n if (!changes \|\| changes.field !== \"messages\") return null;\n\n const value = changes.value;\n const message = value?.messages?.[0];\n if (!message) return null;\n\n // Only handle text messages\n if (message.type !== \"text\") return null;\n const text = message.text?.body?.trim();\n if (!text) return null;\n\n const contact = value.contacts?.[0];\n const from = message.from; // Phone number\n\n return {\n platform: \"whatsapp\",\n externalThreadId: from,\n text,\n senderName: contact?.profile?.name,\n senderId: from,\n platformContext: {\n phoneNumberId: value.metadata?.phone_number_id,\n displayPhoneNumber: value.metadata?.display_phone_number,\n messageId: message.id,\n from,\n timestamp: message.timestamp,\n },\n timestamp: parseInt(message.timestamp, 10) 1000,\n };\n },\n\n async sendResponse(\n message: OutgoingMessage,\n context: IncomingMessage,\n ): Promise<void> {\n const accessToken = await resolveSecret(\"WHATSAPP_ACCESS_TOKEN\");\n const phoneNumberId = await resolveSecret(\"WHATSAPP_PHONE_NUMBER_ID\");\n if (!accessToken \|\| !phoneNumberId) {\n console.error(\n \"[whatsapp] WHATSAPP_ACCESS_TOKEN or WHATSAPP_PHONE_NUMBER_ID not configured\",\n );\n return;\n }\n\n const to = context.senderId;\n const chunks = splitMessage(message.text, WHATSAPP_MAX_LENGTH);\n\n for (const chunk of chunks) {\n try {\n const res = await fetch(\n `https://graph.facebook.com/v21.0/${phoneNumberId}/messages`,\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${accessToken}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n messaging_product: \"whatsapp\",\n recipient_type: \"individual\",\n to,\n type: \"text\",\n text: { body: chunk },\n }),\n },\n );\n if (!res.ok) {\n const data = await res.json().catch(() => ({}));\n console.error(\"[whatsapp] sendMessage error:\", data);\n }\n } catch (err) {\n console.error(\"[whatsapp] Failed to send message:\", err);\n }\n }\n },\n\n formatAgentResponse(text: string): OutgoingMessage {\n return { text, platformContext: {} };\n },\n\n async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {\n const hasAccessToken = !!(await resolveSecret(\"WHATSAPP_ACCESS_TOKEN\"));\n const hasVerifyToken = !!(await resolveSecret(\"WHATSAPP_VERIFY_TOKEN\"));\n const hasPhoneNumberId = !!(await resolveSecret(\n \"WHATSAPP_PHONE_NUMBER_ID\",\n ));\n const configured = hasAccessToken && hasVerifyToken && hasPhoneNumberId;\n\n return {\n platform: \"whatsapp\",\n label: \"WhatsApp\",\n enabled: false, // overridden by plugin\n configured,\n details: {\n hasAccessToken,\n hasVerifyToken,\n hasPhoneNumberId,\n },\n error: !configured\n ? \"Save WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID in settings\"\n : undefined,\n };\n },\n };\n}\n\n/*\n Read the raw request body as a string and cache it on the event context.\n \n Reads raw bytes from the request stream, NEVER `JSON.stringify`s a parsed\n * body — Meta's signature is computed over the exact bytes Meta sent\n * (M2/M3 in the webhook security audit). h3 v2's body stream is consume-once\n * so we cache the raw string after the first read.\n */\nasync function readRawBody(event: H3Event): Promise<string> {\n const cached = event.context.__rawBody;\n if (typeof cached === \"string\") return cached;\n const raw = (await h3ReadRawBody(event)) ?? \"\";\n event.context.__rawBody = raw;\n return raw;\n}\n\nfunction splitMessage(text: string, maxLength: number): string[] {\n if (text.length <= maxLength) return [text];\n const chunks: string[] = [];\n let remaining = text;\n while (remaining.length > 0) {\n if (remaining.length <= maxLength) {\n chunks.push(remaining);\n break;\n }\n let splitIdx = remaining.lastIndexOf(\"\\n\", maxLength);\n if (splitIdx <= 0) splitIdx = remaining.lastIndexOf(\" \", maxLength);\n if (splitIdx <= 0) splitIdx = maxLength;\n chunks.push(remaining.slice(0, splitIdx));\n remaining = remaining.slice(splitIdx).trimStart();\n }\n return chunks;\n}\n"]}

package/dist/integrations/plugin.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/integrations/plugin.ts"],"names":[],"mappings":"~~AAwEA~~,OAAO,KAAK,EAEV,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AAGpB,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AA0F9D,KAAK,yBAAyB,GAAG;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;~~AAIF~~,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsFlC;AA+ND;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,yBAAyB,GAClC,cAAc,~~CA+nChB~~;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,gBAA6B,CAAC"}
1	+ {"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/integrations/plugin.ts"],"names":[],"mappings":"AA0EA,OAAO,KAAK,EAEV,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AAGpB,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AA0F9D,KAAK,yBAAyB,GAAG;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAUF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsFlC;AA+ND;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,yBAAyB,GAClC,cAAc,CAyrChB;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,gBAA6B,CAAC"}