@copilotkit/channels-whatsapp 0.0.1

package/dist/webhook-server.d.ts

@@ -0,0 +1,23 @@
+import type { AddressInfo } from "node:net";
+import type { WebhookBody } from "./types.js";
+export interface WebhookServerArgs {
+    path: string;
+    verifyToken: string;
+    appSecret: string;
+    /** Called (async, after the 200 ack) with the parsed webhook body. */
+    onEvent: (body: WebhookBody) => Promise<void>;
+}
+/** Owns the inbound webhook HTTP server: GET verify + signed POST intake. */
+export declare class WebhookServer {
+    private readonly args;
+    private server;
+    constructor(args: WebhookServerArgs);
+    address(): AddressInfo | null;
+    start(port: number): Promise<void>;
+    stop(): Promise<void>;
+    private handle;
+    private handleVerify;
+    private handlePost;
+    private verifySignature;
+}
+//# sourceMappingURL=webhook-server.d.ts.map

package/dist/webhook-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-server.d.ts","sourceRoot":"","sources":["../src/webhook-server.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,OAAO,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AAED,6EAA6E;AAC7E,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAqB;gBAEvB,IAAI,EAAE,iBAAiB;IAInC,OAAO,IAAI,WAAW,GAAG,IAAI;IAKvB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3B,OAAO,CAAC,MAAM;IA2Bd,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,UAAU;IA6BlB,OAAO,CAAC,eAAe;CASxB"}

package/dist/webhook-server.js

@@ -0,0 +1,99 @@
+import { createServer } from "node:http";
+import { createHmac, timingSafeEqual } from "node:crypto";
+/** Owns the inbound webhook HTTP server: GET verify + signed POST intake. */
+export class WebhookServer {
+    args;
+    server;
+    constructor(args) {
+        this.args = args;
+    }
+    address() {
+        const a = this.server?.address();
+        return a && typeof a === "object" ? a : null;
+    }
+    async start(port) {
+        this.server = createServer((req, res) => this.handle(req, res));
+        await new Promise((resolve) => this.server.listen(port, resolve));
+    }
+    async stop() {
+        if (!this.server)
+            return;
+        await new Promise((resolve, reject) => this.server.close((err) => (err ? reject(err) : resolve())));
+        this.server = undefined;
+    }
+    handle(req, res) {
+        const url = new URL(req.url ?? "/", "http://localhost");
+        // Health check — gives the Railway public domain a 200 to hit. The webhook
+        // itself lives at `this.args.path`; everything else 404s as before. Guard
+        // with `path !== "/"` so that if an operator configures the webhook AT the
+        // root, the Meta verify handshake (GET /?hub...) is not shadowed by health.
+        if (req.method === "GET" &&
+            url.pathname === "/" &&
+            this.args.path !== "/") {
+            res.statusCode = 200;
+            res.setHeader("content-type", "text/plain");
+            res.end("ok");
+            return;
+        }
+        if (url.pathname !== this.args.path) {
+            res.statusCode = 404;
+            res.end();
+            return;
+        }
+        if (req.method === "GET")
+            return this.handleVerify(url, res);
+        if (req.method === "POST")
+            return this.handlePost(req, res);
+        res.statusCode = 405;
+        res.end();
+    }
+    handleVerify(url, res) {
+        const mode = url.searchParams.get("hub.mode");
+        const token = url.searchParams.get("hub.verify_token");
+        const challenge = url.searchParams.get("hub.challenge") ?? "";
+        if (mode === "subscribe" && token === this.args.verifyToken) {
+            res.statusCode = 200;
+            res.end(challenge);
+        }
+        else {
+            res.statusCode = 403;
+            res.end();
+        }
+    }
+    handlePost(req, res) {
+        const chunks = [];
+        req.on("data", (c) => chunks.push(c));
+        req.on("end", () => {
+            const rawBuf = Buffer.concat(chunks);
+            const raw = rawBuf.toString("utf8");
+            const sig = req.headers["x-hub-signature-256"];
+            if (!this.verifySignature(rawBuf, typeof sig === "string" ? sig : undefined)) {
+                res.statusCode = 401;
+                res.end();
+                return;
+            }
+            // Ack immediately; Meta retries non-200 and can disable a flapping webhook.
+            res.statusCode = 200;
+            res.end();
+            let body;
+            try {
+                body = JSON.parse(raw);
+            }
+            catch {
+                return;
+            }
+            void this.args.onEvent(body).catch((err) => {
+                console.error("[whatsapp] onEvent failed:", err);
+            });
+        });
+    }
+    verifySignature(raw, signature) {
+        if (!signature || !signature.startsWith("sha256="))
+            return false;
+        const expected = "sha256=" +
+            createHmac("sha256", this.args.appSecret).update(raw).digest("hex");
+        const a = Buffer.from(signature);
+        const b = Buffer.from(expected);
+        return a.length === b.length && timingSafeEqual(a, b);
+    }
+}

package/dist/webhook-server.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=webhook-server.test.d.ts.map

package/dist/webhook-server.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-server.test.d.ts","sourceRoot":"","sources":["../src/webhook-server.test.ts"],"names":[],"mappings":""}

package/dist/webhook-server.test.js

@@ -0,0 +1,150 @@
+import { describe, it, expect, vi } from "vitest";
+import { createHmac } from "node:crypto";
+import { WebhookServer } from "./webhook-server.js";
+const sign = (secret, body) => "sha256=" + createHmac("sha256", secret).update(body).digest("hex");
+async function get(server, path) {
+    const port = server.address().port;
+    return fetch(`http://127.0.0.1:${port}${path}`);
+}
+async function post(server, path, body, sig) {
+    const port = server.address().port;
+    return fetch(`http://127.0.0.1:${port}${path}`, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            ...(sig ? { "X-Hub-Signature-256": sig } : {}),
+        },
+        body,
+    });
+}
+describe("WebhookServer", () => {
+    it("echoes hub.challenge when verify token matches", async () => {
+        const server = new WebhookServer({
+            path: "/webhook",
+            verifyToken: "VTOK",
+            appSecret: "SECRET",
+            onEvent: async () => { },
+        });
+        await server.start(0);
+        try {
+            const res = await get(server, "/webhook?hub.mode=subscribe&hub.verify_token=VTOK&hub.challenge=12345");
+            expect(res.status).toBe(200);
+            expect(await res.text()).toBe("12345");
+        }
+        finally {
+            await server.stop();
+        }
+    });
+    it("rejects a verify with a wrong token", async () => {
+        const server = new WebhookServer({
+            path: "/webhook",
+            verifyToken: "VTOK",
+            appSecret: "S",
+            onEvent: async () => { },
+        });
+        await server.start(0);
+        try {
+            const res = await get(server, "/webhook?hub.mode=subscribe&hub.verify_token=WRONG&hub.challenge=1");
+            expect(res.status).toBe(403);
+        }
+        finally {
+            await server.stop();
+        }
+    });
+    it("accepts a correctly-signed POST and invokes onEvent", async () => {
+        const onEvent = vi.fn(async () => { });
+        const server = new WebhookServer({
+            path: "/webhook",
+            verifyToken: "V",
+            appSecret: "SECRET",
+            onEvent,
+        });
+        await server.start(0);
+        try {
+            const body = JSON.stringify({
+                object: "whatsapp_business_account",
+                entry: [],
+            });
+            const res = await post(server, "/webhook", body, sign("SECRET", body));
+            expect(res.status).toBe(200);
+            await new Promise((r) => setTimeout(r, 10));
+            expect(onEvent).toHaveBeenCalledOnce();
+        }
+        finally {
+            await server.stop();
+        }
+    });
+    it("rejects a POST with a bad signature", async () => {
+        const onEvent = vi.fn(async () => { });
+        const server = new WebhookServer({
+            path: "/webhook",
+            verifyToken: "V",
+            appSecret: "SECRET",
+            onEvent,
+        });
+        await server.start(0);
+        try {
+            const res = await post(server, "/webhook", "{}", "sha256=deadbeef");
+            expect(res.status).toBe(401);
+            expect(onEvent).not.toHaveBeenCalled();
+        }
+        finally {
+            await server.stop();
+        }
+    });
+    it("rejects a POST with a correctly-formatted but wrong signature", async () => {
+        const onEvent = vi.fn(async () => { });
+        const server = new WebhookServer({
+            path: "/webhook",
+            verifyToken: "V",
+            appSecret: "SECRET",
+            onEvent,
+        });
+        await server.start(0);
+        try {
+            const body = "{}";
+            // valid length (64 hex) but computed with the WRONG secret
+            const wrong = "sha256=" +
+                createHmac("sha256", "NOT_THE_SECRET").update(body).digest("hex");
+            const res = await post(server, "/webhook", body, wrong);
+            expect(res.status).toBe(401);
+            expect(onEvent).not.toHaveBeenCalled();
+        }
+        finally {
+            await server.stop();
+        }
+    });
+    it("responds 200 ok to GET / for health checks", async () => {
+        const server = new WebhookServer({
+            path: "/webhook",
+            verifyToken: "V",
+            appSecret: "S",
+            onEvent: async () => { },
+        });
+        await server.start(0);
+        try {
+            const res = await get(server, "/");
+            expect(res.status).toBe(200);
+            expect(await res.text()).toBe("ok");
+        }
+        finally {
+            await server.stop();
+        }
+    });
+    it("still 404s an unknown path (health route doesn't broaden 200)", async () => {
+        const server = new WebhookServer({
+            path: "/webhook",
+            verifyToken: "V",
+            appSecret: "S",
+            onEvent: async () => { },
+        });
+        await server.start(0);
+        try {
+            const res = await get(server, "/nope");
+            expect(res.status).toBe(404);
+        }
+        finally {
+            await server.stop();
+        }
+    });
+});

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "@copilotkit/channels-whatsapp",
+  "version": "0.0.1",
+  "description": "WhatsApp Cloud API platform adapter for CopilotKit JSX channels (@copilotkit/channels).",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/CopilotKit/CopilotKit.git",
+    "directory": "packages/channels-whatsapp"
+  },
+  "homepage": "https://github.com/CopilotKit/CopilotKit",
+  "keywords": [
+    "ai",
+    "agent",
+    "bot",
+    "whatsapp",
+    "cloud-api",
+    "copilotkit",
+    "ag-ui"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@ag-ui/client": "0.0.57",
+    "@copilotkit/channels-ui": "~0.1.0",
+    "@copilotkit/channels": "~0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.6.3",
+    "vitest": "^4.1.3",
+    "@copilotkit/typescript-config": "^1.55.0-next.8"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check-types": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.check.json",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "publint": "publint .",
+    "attw": "attw --pack . --profile esm-only"
+  }
+}