@automagik/omni 2.261006.2 → 2.261008.2

package/dist/index.js

@@ -137462,7 +137462,7 @@ import { fileURLToPath } from "url";
 // package.json
 var package_default = {
   name: "@automagik/omni",
-  version: "2.261006.2",
+  version: "2.261008.2",
   repository: {
     type: "git",
     url: "git+https://github.com/automagik-dev/omni.git",

package/dist/server/index.js

@@ -266444,7 +266444,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.261006.2",
+    version: "2.261008.2",
     private: true,
     type: "module",
     exports: {
@@ -266504,6 +266504,7 @@ var require_package7 = __commonJS((exports, module) => {
       "@asteasolutions/zod-to-openapi": "7.3.4",
       "@types/qrcode-terminal": "^0.12.2",
       "@types/bun": "1.3.14",
+      baileys: "file:../channel-whatsapp/vendor/baileys-v7.0.0-rc14.tgz",
       "openapi3-ts": "^4.5.0",
       "qrcode-terminal": "^0.12.0",
       typescript: "^5.7.3"
@@ -327263,7 +327264,7 @@ var init_worker_tenant_context = __esm(() => {
 });
 
 // ../api/src/middleware/config-audit.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 function resolveTarget(method, path2) {
   const rel = path2.replace(/^\/api\/v2/, "").replace(/\/$/, "");
   for (const resource of RESOURCES) {
@@ -327277,7 +327278,7 @@ function resolveTarget(method, path2) {
   return null;
 }
 function fingerprint(value) {
-  return `sha256:${createHash12("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 12)}`;
+  return `sha256:${createHash13("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 12)}`;
 }
 function redactSecrets2(value, keyName = "") {
   if (value === null || value === undefined)
@@ -327612,9 +327613,9 @@ var init_body_limit2 = __esm(() => {
 });
 
 // ../api/src/middleware/genie-signature.ts
-import { createHash as createHash13, createPublicKey, verify } from "crypto";
+import { createHash as createHash14, createPublicKey, verify } from "crypto";
 function canonicalSigningInput(timestamp3, method, path2, body) {
-  const bodyHash = createHash13("sha256").update(body, "utf-8").digest("hex");
+  const bodyHash = createHash14("sha256").update(body, "utf-8").digest("hex");
   return `${timestamp3}
 ${method.toUpperCase()}
 ${path2}
@@ -327882,12 +327883,12 @@ var init_profiles = __esm(() => {
 });
 
 // ../api/src/middleware/output-redactor.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 function escapeRegex(literal2) {
   return literal2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function hashPattern(source) {
-  return createHash14("sha256").update(source).digest("hex").slice(0, 12);
+  return createHash15("sha256").update(source).digest("hex").slice(0, 12);
 }
 function compilePatterns(literals) {
   const out = [];
@@ -328137,6 +328138,12 @@ var DEFAULT_TURN_SCOPES, SCOPE_MAP;
 var init_scopes = __esm(() => {
   DEFAULT_TURN_SCOPES = ["messages:send", "turns:close", "tts:synthesize", "context:read"];
   SCOPE_MAP = {
+    "GET /instances/:id/self": "instances:read",
+    "GET /instances/:id/self/chats": "messages:selected:read",
+    "POST /instances/:id/self/messages": "messages:self:read",
+    "POST /instances/:id/self/receipt": "messages:self:read",
+    "POST /instances/:id/self/history": "messages:selected:read",
+    "POST /messages/send-self": "messages:self:send",
     "GET /audit": "audit:read",
     "GET /audit/:id": "audit:read",
     "GET /a2a/agents": "agents:read",
@@ -329153,6 +329160,8 @@ var init_route_ownership = __esm(() => {
     "GET /api/v2/instances/:id/passkey",
     "GET /api/v2/instances/:id/privacy",
     "GET /api/v2/instances/:id/qr",
+    "GET /api/v2/instances/:id/self",
+    "GET /api/v2/instances/:id/self/chats",
     "GET /api/v2/instances/:id/status",
     "GET /api/v2/instances/:id/sync",
     "GET /api/v2/instances/:id/sync/:jobId",
@@ -329236,6 +329245,10 @@ var init_route_ownership = __esm(() => {
     "POST /api/v2/:id/test",
     "POST /api/v2/access/check",
     "POST /api/v2/access/rules",
+    "POST /api/v2/instances/:id/self/history",
+    "POST /api/v2/instances/:id/self/messages",
+    "POST /api/v2/instances/:id/self/receipt",
+    "POST /api/v2/messages/send-self",
     "POST /api/v2/agent-tasks",
     "POST /api/v2/agents",
     "POST /api/v2/agents/:id/identities/link",
@@ -329462,6 +329475,10 @@ var init_route_ownership = __esm(() => {
 
 // ../api/src/tenancy/scope-projection.ts
 function classifyLegacyScope(scope) {
+  if (scope === "messages:self:read" || scope === "messages:selected:read")
+    return "read";
+  if (scope === "messages:self:send")
+    return "write";
   const verb = scope.split(":")[1];
   if (verb === undefined)
     return null;
@@ -330701,7 +330718,7 @@ var require_gaxios = __commonJS((exports) => {
   var retry_js_1 = require_retry2();
   var stream_1 = __require("stream");
   var interceptor_js_1 = require_interceptor();
-  var randomUUID2 = async () => globalThis.crypto?.randomUUID() || (await import("crypto")).randomUUID();
+  var randomUUID3 = async () => globalThis.crypto?.randomUUID() || (await import("crypto")).randomUUID();
   var HTTP_STATUS_NO_CONTENT = 204;
 
   class Gaxios {
@@ -330912,7 +330929,7 @@ var require_gaxios = __commonJS((exports) => {
       }
       const shouldDirectlyPassData = typeof opts.data === "string" || opts.data instanceof ArrayBuffer || opts.data instanceof Blob || globalThis.File && opts.data instanceof File || opts.data instanceof FormData || opts.data instanceof stream_1.Readable || opts.data instanceof ReadableStream || opts.data instanceof String || opts.data instanceof URLSearchParams || ArrayBuffer.isView(opts.data) || ["Blob", "File", "FormData"].includes(opts.data?.constructor?.name || "");
       if (opts.multipart?.length) {
-        const boundary = await randomUUID2();
+        const boundary = await randomUUID3();
         preparedHeaders.set("content-type", `multipart/related; boundary=${boundary}`);
         opts.body = stream_1.Readable.from(this.getMultipartRequest(opts.multipart, boundary));
       } else if (shouldDirectlyPassData) {
@@ -378596,7 +378613,7 @@ var init_storage = __esm(() => {
 });
 
 // ../api/src/plugins/context.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 function createPluginDatabase(db2) {
   return {
     async execute(_sql, _params) {
@@ -378611,7 +378628,7 @@ function createPluginDatabase(db2) {
 function createIngressClaim(db2) {
   return {
     async claim({ idempotencyKey, instanceId, channelType, externalId, eventType = "message.received" }) {
-      const id = randomUUID2();
+      const id = randomUUID3();
       try {
         const claimed = await db2.insert(omniEvents).values({
           id,
@@ -379855,12 +379872,12 @@ var init_message_persistence = __esm(() => {
 });
 
 // ../api/src/plugins/agent-dispatcher.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { unlink, writeFile as writeFile4 } from "fs/promises";
 import { tmpdir as tmpdir11 } from "os";
 import { join as join22, resolve as resolve3 } from "path";
 function sha256Digest(value) {
-  return `sha256:${createHash15("sha256").update(value).digest("hex")}`;
+  return `sha256:${createHash16("sha256").update(value).digest("hex")}`;
 }
 function redactLifecycleText(value) {
   return value.replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, "[EMAIL]").replace(/\b\+?\d[\d\s().-]{5,}\d\b/g, "[PHONE]").replace(/\b\d{6,}\b/g, "[NUMBER]").replace(/\b[^\s@]+@(s\.whatsapp\.net|g\.us|lid|newsletter)\b/gi, "[JID]");
@@ -384102,7 +384119,7 @@ var init_batch_pricing = __esm(() => {
 });
 
 // ../api/src/services/media-storage.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync2 } from "fs";
 import { rm as rm3, writeFile as writeFile5 } from "fs/promises";
 import { tmpdir as tmpdir12 } from "os";
@@ -384336,7 +384353,7 @@ class MediaStorageService {
     }
     const buffer3 = await this.backend.read(reference);
     const ext = extname2(reference) || ".bin";
-    const tempPath = join23(tmpdir12(), `omni-media-${randomUUID3()}${ext}`);
+    const tempPath = join23(tmpdir12(), `omni-media-${randomUUID4()}${ext}`);
     try {
       await writeFile5(tempPath, buffer3);
     } catch (error3) {
@@ -386223,7 +386240,7 @@ var init_events2 = __esm(() => {
 });
 
 // ../api/src/services/event-consumers.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 function planSharedPull(state, now) {
   const expired = state.leases.find((lease) => lease.expiresAt <= now);
   return expired ? { reclaim: expired } : { after: state.claimed };
@@ -386408,7 +386425,7 @@ class EventConsumerService {
       const last = scanned[scanned.length - 1];
       if (!plan.reclaim && !last)
         return { consumer, lease: null, scanned };
-      const lease = plan.reclaim ? { ...plan.reclaim, id: randomUUID4(), expiresAt: now + leaseMs } : { id: randomUUID4(), from: plan.after, to: Number(last?.journalSeq), expiresAt: now + leaseMs };
+      const lease = plan.reclaim ? { ...plan.reclaim, id: randomUUID5(), expiresAt: now + leaseMs } : { id: randomUUID5(), from: plan.after, to: Number(last?.journalSeq), expiresAt: now + leaseMs };
       if (await this.casLeaseState(consumer, claimLease(state, lease, plan.reclaim?.id))) {
         return { consumer, lease, scanned };
       }
@@ -387728,7 +387745,7 @@ var init_instances = __esm(() => {
 });
 
 // ../api/src/services/manifest-compiler.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 function stableStringify(value) {
   if (Array.isArray(value)) {
     return `[${value.map((item) => stableStringify(item)).join(",")}]`;
@@ -387748,7 +387765,7 @@ function filterToConditions(filter) {
   return fields.map((field) => ({ field, operator: "eq", value: filter[field] }));
 }
 function compiledAutomationName(agentId, entry) {
-  const digest = createHash16("sha256").update(stableStringify({ event: entry.event, filter: entry.filter ?? null })).digest("hex").slice(0, 12);
+  const digest = createHash17("sha256").update(stableStringify({ event: entry.event, filter: entry.filter ?? null })).digest("hex").slice(0, 12);
   const prefix = `manifest:${agentId}:`;
   const suffix = `#${digest}`;
   const room = MAX_AUTOMATION_NAME_LENGTH - prefix.length - suffix.length;
@@ -391419,9 +391436,9 @@ var init_turns = __esm(() => {
 });
 
 // ../api/src/lib/ingress-idempotency.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 function sha256Hex(input) {
-  return createHash17("sha256").update(input).digest("hex");
+  return createHash18("sha256").update(input).digest("hex");
 }
 function resolvePayloadPath(payload, path3) {
   let current = payload;
@@ -396935,6 +396952,30 @@ var init_health3 = __esm(() => {
 
 // ../api/src/schemas/openapi/instances.ts
 function registerInstanceSchemas(registry4) {
+  const pathId = exports_external.object({ id: exports_external.string().uuid() });
+  for (const [method, path3, schema3] of [
+    ["get", "/instances/{id}/self", SelfIdentitySchema],
+    ["post", "/instances/{id}/self/messages", SelfMessagesSchema],
+    ["post", "/instances/{id}/self/history", SelfHistorySchema],
+    ["post", "/instances/{id}/self/receipt", SelfReceiptSchema],
+    ["get", "/instances/{id}/self/chats", SelfChatsSchema],
+    ["post", "/messages/send-self", SendSelfSchema]
+  ])
+    registry4.registerPath({
+      method,
+      path: path3,
+      tags: ["WhatsApp self"],
+      request: {
+        ...path3.includes("{id}") ? { params: pathId } : {},
+        ...method === "get" && path3 === "/instances/{id}/self/chats" ? { query: SelfChatsSchema } : {},
+        ...method === "post" ? { body: { content: { "application/json": { schema: schema3 } } } } : {}
+      },
+      responses: {
+        200: { description: "Verified bounded self capability" },
+        201: { description: "Native self send accepted" },
+        409: { description: "Identity changed or unverified" }
+      }
+    });
   registry4.register("Instance", InstanceSchema2);
   registry4.register("CreateInstanceRequest", CreateInstanceSchema2);
   registry4.register("InstanceStatus", InstanceStatusSchema2);
@@ -397493,7 +397534,7 @@ function registerInstanceSchemas(registry4) {
     }
   });
 }
-var gupshupHandoffFieldValue, gupshupHandoffFieldKey, gupshupHandoffFields, GupshupHandoffOptionsSchema, closeContactOutcomeOverride, CloseContactConfigSchema, InstanceSchema2, CreateInstanceSchema2, InstanceStatusSchema2, QrCodeSchema, PairingCodeRequestSchema, PairingCodeSchema, ConnectInstanceSchema, ConnectResponseSchema, UserProfileSchema, ContactSchema, GroupSchema, SupportedChannelSchema;
+var gupshupHandoffFieldValue, gupshupHandoffFieldKey, gupshupHandoffFields, GupshupHandoffOptionsSchema, closeContactOutcomeOverride, CloseContactConfigSchema, InstanceSchema2, CreateInstanceSchema2, InstanceStatusSchema2, QrCodeSchema, PairingCodeRequestSchema, PairingCodeSchema, ConnectInstanceSchema, ConnectResponseSchema, UserProfileSchema, ContactSchema, GroupSchema, SupportedChannelSchema, ownJid, SelfIdentitySchema, selfWindow, validWindow = (v2) => Date.parse(v2.before) >= Date.parse(v2.after) && Date.parse(v2.before) - Date.parse(v2.after) <= 7 * 86400000, SelfMessagesSchema, SelfHistorySchema, SelfChatsSchema, SelfReceiptSchema, SendSelfSchema;
 var init_instances2 = __esm(() => {
   init_src();
   init_zod_openapi();
@@ -397677,6 +397718,34 @@ var init_instances2 = __esm(() => {
     loaded: exports_external.boolean().openapi({ description: "Whether plugin is loaded" }),
     capabilities: exports_external.record(exports_external.string(), exports_external.unknown()).optional().openapi({ description: "Plugin capabilities" })
   });
+  ownJid = exports_external.string().regex(/^\d{5,20}@s\.whatsapp\.net$/);
+  SelfIdentitySchema = exports_external.object({
+    ownerIdentifier: ownJid,
+    generation: exports_external.string().uuid(),
+    selfJid: ownJid,
+    connectedAt: exports_external.string().datetime()
+  }).strict();
+  selfWindow = {
+    expectedOwner: ownJid,
+    expectedGeneration: exports_external.string().uuid(),
+    after: exports_external.string().datetime(),
+    before: exports_external.string().datetime()
+  };
+  SelfMessagesSchema = exports_external.object({
+    ...selfWindow,
+    connectionStartedAt: exports_external.string().datetime(),
+    excludeExternalIds: exports_external.array(exports_external.string().min(1).max(255)).max(1000).refine((v2) => new Set(v2).size === v2.length)
+  }).strict().refine(validWindow, "At most seven days").refine((v2) => Date.parse(v2.connectionStartedAt) <= Date.parse(v2.after) && Date.parse(v2.after) === Math.max(Date.parse(v2.connectionStartedAt), Date.parse(v2.before) - 7 * 86400000), "Anchored self inbox window");
+  SelfHistorySchema = exports_external.object({ ...selfWindow, chatId: exports_external.string().uuid() }).strict().refine(validWindow, "At most seven days");
+  SelfChatsSchema = exports_external.object({ cursor: exports_external.string().uuid().optional() }).strict();
+  SelfReceiptSchema = exports_external.object({ expectedOwner: ownJid, expectedGeneration: exports_external.string().uuid(), externalId: exports_external.string().min(1).max(255) }).strict();
+  SendSelfSchema = exports_external.object({
+    instanceId: exports_external.string().uuid(),
+    expectedOwner: ownJid,
+    expectedGeneration: exports_external.string().uuid(),
+    operationKey: exports_external.string().regex(/^[A-Za-z0-9_-]{1,100}$/),
+    text: exports_external.string().min(1).max(8000)
+  }).strict();
 });
 
 // ../api/src/schemas/openapi/journeys.ts
@@ -405062,6 +405131,143 @@ var init_agent_replay = __esm(() => {
   MAX_REPLAY_WINDOW_MS = 24 * 60 * 60 * 1000;
 });
 
+// ../api/src/services/whatsapp-self.ts
+function selfPlugin(plugin13) {
+  if (!plugin13 || plugin13.id !== "whatsapp-baileys" || !("getSelfIdentity" in plugin13) || typeof plugin13.getSelfIdentity !== "function" || !("sendSelf" in plugin13) || typeof plugin13.sendSelf !== "function")
+    throw new Error("Self capability unavailable");
+  return plugin13;
+}
+function verifySelf(plugin13, instanceId, expected) {
+  const value = SelfIdentitySchema.parse(plugin13.getSelfIdentity(instanceId));
+  if (value.selfJid !== value.ownerIdentifier || expected && (value.ownerIdentifier !== expected.expectedOwner || value.generation !== expected.expectedGeneration))
+    throw new Error("Self identity changed");
+  return value;
+}
+function freshInboxWindow(input) {
+  const now = Date.now();
+  const before = Date.parse(input.before);
+  const after = Date.parse(input.after);
+  const connectionStartedAt = Date.parse(input.connectionStartedAt);
+  if (before < now - 60000 || before > now + 60000 || connectionStartedAt > after || after > before || before - after > 7 * 86400000 || after !== Math.max(connectionStartedAt, before - 7 * 86400000))
+    throw new Error("Read window expired");
+}
+function platformTime(value) {
+  let seconds;
+  if (typeof value === "number")
+    seconds = value;
+  else {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      return null;
+    const long = value;
+    if (Object.keys(long).length !== 3 || Object.keys(long).some((key) => !["low", "high", "unsigned"].includes(key)) || typeof long.low !== "number" || !Number.isInteger(long.low) || long.low < -2147483648 || long.low > 2147483647 || typeof long.high !== "number" || !Number.isInteger(long.high) || long.high < -2147483648 || long.high > 2147483647 || typeof long.unsigned !== "boolean")
+      return null;
+    let integer3 = BigInt(long.high >>> 0) << 32n | BigInt(long.low >>> 0);
+    if (!long.unsigned && long.high < 0)
+      integer3 -= 1n << 64n;
+    if (integer3 <= 0n || integer3 > 8640000000000n)
+      return null;
+    seconds = Number(integer3);
+  }
+  if (!Number.isSafeInteger(seconds) || seconds <= 0 || seconds > 8640000000000)
+    return null;
+  return new Date(seconds * 1000).toISOString();
+}
+function projectSelfEvent(row, owner, source = null) {
+  const raw2 = row.rawPayload ?? {};
+  const key = raw2.key;
+  const message2 = raw2.message;
+  const extended = message2?.extendedTextMessage;
+  const context20 = extended?.contextInfo;
+  const nativeText = message2?.conversation ?? extended?.text;
+  const at = platformTime(raw2.messageTimestamp);
+  const authority = source === "realtime" && row.eventType === "message.received" && row.contentType === "text" && key?.fromMe === true && raw2.isFromMe === true && key.remoteJid === owner && row.metadata?.from === owner.split("@")[0] && typeof nativeText === "string" && nativeText === row.textContent && at !== null && !row.replyToExternalId && !raw2.quotedMessage && !context20?.quotedMessage && !context20?.isForwarded && !context20?.forwardingScore && !message2?.protocolMessage && raw2.isHistorySync !== true;
+  return {
+    id: row.id,
+    externalId: row.externalId,
+    chatId: row.chatId,
+    from: owner,
+    text: row.textContent ?? "",
+    at,
+    receivedAt: row.receivedAt.toISOString(),
+    isFromMe: raw2.isFromMe === true,
+    authority
+  };
+}
+async function readSelfMessages(db2, plugin13, instanceId, input) {
+  const identity = verifySelf(plugin13, instanceId, input);
+  freshInboxWindow(input);
+  const rows = await db2.select({ event: omniEvents, source: messages2.source }).from(omniEvents).innerJoin(chats, and2(eq(chats.instanceId, omniEvents.instanceId), eq(chats.externalId, omniEvents.chatId))).innerJoin(messages2, and2(eq(messages2.chatId, chats.id), eq(messages2.externalId, omniEvents.externalId))).where(and2(eq(omniEvents.instanceId, instanceId), eq(omniEvents.chatId, identity.selfJid), eq(omniEvents.eventType, "message.received"), eq(omniEvents.contentType, "text"), eq(messages2.source, "realtime"), eq(messages2.isFromMe, true), isNull2(chats.deletedAt), isNull2(messages2.deletedAt), isNotNull(omniEvents.externalId), gte(omniEvents.receivedAt, new Date(input.after)), lte(omniEvents.receivedAt, new Date(input.before)), input.excludeExternalIds.length ? notInArray(omniEvents.externalId, input.excludeExternalIds) : undefined)).orderBy(asc(omniEvents.receivedAt), asc(omniEvents.id)).limit(51);
+  const older = await db2.select({ id: omniEvents.id }).from(omniEvents).innerJoin(chats, and2(eq(chats.instanceId, omniEvents.instanceId), eq(chats.externalId, omniEvents.chatId))).innerJoin(messages2, and2(eq(messages2.chatId, chats.id), eq(messages2.externalId, omniEvents.externalId))).where(and2(eq(omniEvents.instanceId, instanceId), eq(omniEvents.chatId, identity.selfJid), eq(omniEvents.eventType, "message.received"), eq(omniEvents.contentType, "text"), eq(messages2.source, "realtime"), eq(messages2.isFromMe, true), isNull2(chats.deletedAt), isNull2(messages2.deletedAt), isNotNull(omniEvents.externalId), gte(omniEvents.receivedAt, new Date(input.connectionStartedAt)), lt(omniEvents.receivedAt, new Date(input.after)), input.excludeExternalIds.length ? notInArray(omniEvents.externalId, input.excludeExternalIds) : undefined)).limit(1);
+  verifySelf(plugin13, instanceId, input);
+  return {
+    items: rows.slice(0, 50).map((row) => {
+      const projected = projectSelfEvent(row.event, identity.selfJid, row.source);
+      projected.authority = projected.authority && projected.at !== null && Date.parse(projected.at) >= Date.parse(input.connectionStartedAt) && Date.parse(projected.at) <= Date.parse(input.before);
+      return projected;
+    }),
+    hasMore: rows.length > 50,
+    hasOlder: older.length > 0
+  };
+}
+async function readOwnedChats(db2, plugin13, instanceId, cursor) {
+  const identity = verifySelf(plugin13, instanceId);
+  const rows = await db2.select({ id: chats.id, name: chats.name }).from(chats).where(and2(eq(chats.instanceId, instanceId), isNull2(chats.deletedAt), cursor ? gt(chats.id, cursor) : undefined)).orderBy(asc(chats.id)).limit(26);
+  verifySelf(plugin13, instanceId, { expectedOwner: identity.ownerIdentifier, expectedGeneration: identity.generation });
+  const items = rows.slice(0, 25);
+  return { items, meta: { hasMore: rows.length > 25, cursor: rows.length > 25 ? items.at(-1)?.id ?? null : null } };
+}
+function boundHistory(rows) {
+  let characters = 0;
+  let partial = rows.length > 50;
+  const items = [];
+  for (const row of rows.slice(0, 50)) {
+    const text3 = row.text ?? "";
+    if (characters + text3.length > 8000) {
+      partial = true;
+      break;
+    }
+    characters += text3.length;
+    items.push({
+      externalId: row.externalId,
+      text: text3,
+      at: row.at.toISOString(),
+      direction: row.isFromMe ? "outbound" : "inbound"
+    });
+  }
+  return { items, partial, limits: { days: 7, messages: 50, characters: 8000 } };
+}
+async function readOwnedHistory(db2, plugin13, instanceId, input) {
+  verifySelf(plugin13, instanceId, input);
+  const rows = await db2.select({
+    externalId: messages2.externalId,
+    text: messages2.textContent,
+    at: messages2.platformTimestamp,
+    isFromMe: messages2.isFromMe
+  }).from(messages2).innerJoin(chats, eq(chats.id, messages2.chatId)).where(and2(eq(chats.id, input.chatId), eq(chats.instanceId, instanceId), isNull2(chats.deletedAt), isNull2(messages2.deletedAt), gte(messages2.platformTimestamp, new Date(input.after)), lte(messages2.platformTimestamp, new Date(input.before)))).orderBy(desc(messages2.platformTimestamp), desc(messages2.id)).limit(51);
+  const [chat2] = await db2.select({ id: chats.id }).from(chats).where(and2(eq(chats.id, input.chatId), eq(chats.instanceId, instanceId), isNull2(chats.deletedAt))).limit(1);
+  if (!chat2)
+    throw new Error("Selected chat unavailable");
+  verifySelf(plugin13, instanceId, input);
+  return boundHistory(rows);
+}
+async function readSelfReceipt(db2, plugin13, instanceId, input) {
+  const identity = verifySelf(plugin13, instanceId, input);
+  const [row] = await db2.select({ externalId: messages2.externalId, text: messages2.textContent, at: messages2.platformTimestamp }).from(messages2).innerJoin(chats, eq(chats.id, messages2.chatId)).innerJoin(omniEvents, and2(eq(omniEvents.externalId, messages2.externalId), eq(omniEvents.instanceId, instanceId), eq(omniEvents.chatId, identity.selfJid))).where(and2(eq(chats.instanceId, instanceId), eq(chats.externalId, identity.selfJid), eq(messages2.externalId, input.externalId), eq(messages2.source, "realtime"), eq(omniEvents.eventType, "message.sent"), eq(omniEvents.direction, "outbound"), eq(omniEvents.status, "completed"), eq(omniEvents.contentType, "text"), eq(messages2.messageType, "text"), eq(messages2.textContent, omniEvents.textContent), eq(messages2.isFromMe, true), isNull2(messages2.deletedAt))).limit(1);
+  verifySelf(plugin13, instanceId, input);
+  return row ? {
+    externalId: row.externalId,
+    text: row.text ?? "",
+    at: row.at.toISOString(),
+    ownerIdentifier: identity.ownerIdentifier,
+    generation: identity.generation
+  } : null;
+}
+var init_whatsapp_self = __esm(() => {
+  init_src6();
+  init_drizzle_orm();
+  init_instances2();
+});
+
 // ../api/src/routes/v2/instances.ts
 function shouldApplyDefaultReplyFilter(args) {
   if (!args.agentIdTouched)
@@ -405657,6 +405863,7 @@ var init_instances3 = __esm(() => {
   init_instances2();
   init_access();
   init_agent_replay();
+  init_whatsapp_self();
   log123 = createLogger("api:instances");
   instancesRoutes = new Hono2;
   instanceAccess3 = requireInstanceAccess((c) => c.req.param("id") ?? "");
@@ -406018,6 +406225,51 @@ var init_instances3 = __esm(() => {
     }
     return c.json({ success: true });
   });
+  instancesRoutes.get("/:id/self", instanceAccess3, async (c) => {
+    try {
+      const instance4 = await c.get("services").instances.getById(c.req.param("id"));
+      const plugin13 = selfPlugin(c.get("channelRegistry")?.get(instance4.channel));
+      return c.json({ data: verifySelf(plugin13, instance4.id) });
+    } catch {
+      return c.json({ error: { code: "SELF_UNAVAILABLE" } }, 409);
+    }
+  });
+  instancesRoutes.get("/:id/self/chats", instanceAccess3, zValidator("query", SelfChatsSchema), async (c) => {
+    try {
+      const instance4 = await c.get("services").instances.getById(c.req.param("id"));
+      const plugin13 = selfPlugin(c.get("channelRegistry")?.get(instance4.channel));
+      return c.json(await readOwnedChats(c.get("db"), plugin13, instance4.id, c.req.valid("query").cursor));
+    } catch {
+      return c.json({ error: { code: "SELF_READ_UNAVAILABLE" } }, 409);
+    }
+  });
+  instancesRoutes.post("/:id/self/messages", instanceAccess3, zValidator("json", SelfMessagesSchema), async (c) => {
+    try {
+      const instance4 = await c.get("services").instances.getById(c.req.param("id"));
+      const plugin13 = selfPlugin(c.get("channelRegistry")?.get(instance4.channel));
+      return c.json(await readSelfMessages(c.get("db"), plugin13, instance4.id, c.req.valid("json")));
+    } catch {
+      return c.json({ error: { code: "SELF_READ_UNAVAILABLE" } }, 409);
+    }
+  });
+  instancesRoutes.post("/:id/self/receipt", instanceAccess3, zValidator("json", SelfReceiptSchema), async (c) => {
+    try {
+      const instance4 = await c.get("services").instances.getById(c.req.param("id"));
+      const plugin13 = selfPlugin(c.get("channelRegistry")?.get(instance4.channel));
+      return c.json({ data: await readSelfReceipt(c.get("db"), plugin13, instance4.id, c.req.valid("json")) });
+    } catch {
+      return c.json({ error: { code: "SELF_READ_UNAVAILABLE" } }, 409);
+    }
+  });
+  instancesRoutes.post("/:id/self/history", instanceAccess3, zValidator("json", SelfHistorySchema), async (c) => {
+    try {
+      const instance4 = await c.get("services").instances.getById(c.req.param("id"));
+      const plugin13 = selfPlugin(c.get("channelRegistry")?.get(instance4.channel));
+      return c.json(await readOwnedHistory(c.get("db"), plugin13, instance4.id, c.req.valid("json")));
+    } catch {
+      return c.json({ error: { code: "SELF_READ_UNAVAILABLE" } }, 409);
+    }
+  });
   instancesRoutes.get("/:id/status", instanceAccess3, async (c) => {
     const id = c.req.param("id");
     const services = c.get("services");
@@ -409916,9 +410168,11 @@ var init_messages6 = __esm(() => {
   init_sentry_scrub();
   init_media_processor();
   init_date_query();
+  init_instances2();
   init_messages5();
   init_api_keys();
   init_media_storage();
+  init_whatsapp_self();
   init_tenant_scope();
   init__close_contact_config();
   log126 = createLogger("routes:messages");
@@ -410348,6 +410602,21 @@ var init_messages6 = __esm(() => {
     const message2 = await services.messages.updateDocumentExtraction(id, extraction);
     return c.json({ data: message2 });
   });
+  messagesRoutes.post("/send-self", zValidator("json", SendSelfSchema), async (c) => {
+    const { instanceId, ...input } = c.req.valid("json");
+    checkInstanceAccess2(c.get("apiKey"), instanceId);
+    try {
+      const instance4 = await c.get("services").instances.getById(instanceId);
+      const plugin13 = selfPlugin(c.get("channelRegistry")?.get(instance4.channel));
+      verifySelf(plugin13, instanceId, input);
+      const text3 = sanitizeOutboundText(input.text);
+      if (!text3.trim())
+        return c.json({ error: { code: "SELF_TEXT_REQUIRED" } }, 400);
+      return c.json({ data: await plugin13.sendSelf(instanceId, { ...input, text: text3 }) }, 201);
+    } catch {
+      return c.json({ error: { code: "SELF_SEND_UNCONFIRMED" } }, 409);
+    }
+  });
   messagesRoutes.post("/send", async (c) => {
     let rawBody;
     try {
@@ -412562,7 +412831,7 @@ var init_settings3 = __esm(() => {
 });
 
 // ../api/src/lib/single-use-store.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 function createSingleUseStore(opts) {
   const { ttlMs, maxEntries, prefix } = opts;
   if (!(ttlMs > 0))
@@ -412601,7 +412870,7 @@ function createSingleUseStore(opts) {
   }
   return {
     put(value, entryTtlMs = ttlMs) {
-      const handle = `${prefix}${randomUUID5()}`;
+      const handle = `${prefix}${randomUUID6()}`;
       const expiresAt = Date.now() + entryTtlMs;
       remember(handle, expiresAt);
       store(handle, value, expiresAt);
@@ -430754,6 +431023,7 @@ var src_default8 = plugin9;
 // ../channel-whatsapp/src/plugin.ts
 init_src2();
 init_src();
+import { createHash as createHash12, randomUUID as randomUUID2 } from "crypto";
 
 // ../channel-whatsapp/src/auth.ts
 init_src();
@@ -545092,6 +545362,15 @@ function createRateLimitManager(instanceId, logger5, config2) {
 }
 
 // ../channel-whatsapp/src/plugin.ts
+function selfPlatformMessageId(instanceId, owner, operationKey) {
+  return `3EB0${createHash12("sha256").update(JSON.stringify([instanceId, owner, operationKey])).digest("hex").slice(0, 32).toUpperCase()}`;
+}
+function ownPhoneJid(value) {
+  if (typeof value !== "string" || !/^\d{5,20}(?::\d+)?@s\.whatsapp\.net$/.test(value)) {
+    throw new WhatsAppError(ErrorCode2.NOT_CONNECTED, "Verified own phone identity required");
+  }
+  return value.replace(/:\d+@/, "@");
+}
 function isTransientConnectionClosedError(error) {
   if (!error)
     return false;
@@ -545124,6 +545403,8 @@ class WhatsAppPlugin extends BaseChannelPlugin {
   version = "1.0.0";
   capabilities = WHATSAPP_CAPABILITIES;
   sockets = new Map;
+  selfGenerations = new WeakMap;
+  selfConnectedAt = new WeakMap;
   passkeyStates = new Map;
   pluginConfig = {};
   historySyncCallbacks = new Map;
@@ -545916,6 +546197,45 @@ class WhatsAppPlugin extends BaseChannelPlugin {
       systemNotice: originalMessage.metadata?.systemNotice
     };
   }
+  getSelfIdentity(instanceId) {
+    const sock = this.getSocket(instanceId);
+    if (this.instances.getStatus(instanceId)?.state !== "connected") {
+      throw new WhatsAppError(ErrorCode2.NOT_CONNECTED, "WhatsApp is disconnected");
+    }
+    const ownerIdentifier = ownPhoneJid(sock.user?.id);
+    const generation = this.selfGenerations.get(sock);
+    const connectedAt = this.selfConnectedAt.get(sock);
+    if (!generation || !connectedAt)
+      throw new Error("Authenticated connection epoch unavailable");
+    return { ownerIdentifier, generation, selfJid: ownerIdentifier, connectedAt };
+  }
+  async sendSelf(instanceId, input) {
+    if (Object.keys(input).some((key) => !["expectedOwner", "expectedGeneration", "operationKey", "text"].includes(key)) || !/^[A-Za-z0-9_-]{1,100}$/.test(input.operationKey) || typeof input.text !== "string" || !input.text.trim() || input.text.length > 8000)
+      throw new Error("Invalid self message");
+    const sock = this.getSocket(instanceId);
+    const admitted = this.getSelfIdentity(instanceId);
+    if (admitted.ownerIdentifier !== input.expectedOwner || admitted.generation !== input.expectedGeneration)
+      throw new Error("Self identity changed");
+    const externalId = selfPlatformMessageId(instanceId, admitted.ownerIdentifier, input.operationKey);
+    const limiter = await this.waitForRateLimitBackoff(instanceId);
+    const message2 = {
+      to: admitted.selfJid,
+      content: { type: "text", text: input.text },
+      metadata: { correlationId: input.operationKey }
+    };
+    this.trackSentMessageId(instanceId, externalId);
+    const current = this.getSelfIdentity(instanceId);
+    if (this.sockets.get(instanceId) !== sock || current.ownerIdentifier !== admitted.ownerIdentifier || current.generation !== admitted.generation)
+      throw new Error("Self identity changed");
+    const result = await sock.sendMessage(admitted.selfJid, { text: input.text }, { messageId: externalId });
+    if (result?.key?.id !== externalId)
+      throw new Error("Self send outcome is uncertain");
+    if (result.message)
+      this.trackRecentSentMessage(instanceId, externalId, result.message);
+    await this.emitMessageSent(this.buildSentEventPayload(instanceId, externalId, admitted.selfJid, message2, message2));
+    limiter.reset();
+    return { externalId, ownerIdentifier: admitted.ownerIdentifier, generation: admitted.generation };
+  }
   async sendMessage(instanceId, message2) {
     const sock = this.getSocket(instanceId);
     const jid = await this.resolveSendTarget(sock, instanceId, message2.to);
@@ -546657,6 +546977,13 @@ class WhatsAppPlugin extends BaseChannelPlugin {
     }
   }
   async handleConnected(instanceId, sock, isNewLogin = false) {
+    try {
+      ownPhoneJid(sock.user?.id);
+      if (!this.selfConnectedAt.has(sock))
+        this.selfConnectedAt.set(sock, new Date().toISOString());
+      if (!this.selfGenerations.has(sock))
+        this.selfGenerations.set(sock, randomUUID2());
+    } catch {}
     this.passkeyStates.delete(instanceId);
     let profileName;
     let profilePicUrl;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automagik/omni",
-  "version": "2.261006.2",
+  "version": "2.261008.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/automagik-dev/omni.git",