@diegoaltoworks/chatter 0.45.0 → 0.48.0

package/dist/channels/whatsapp/index.js

@@ -39,6 +39,7 @@ __export(index_exports, {
   createWhatsAppChannel: () => createWhatsAppChannel,
   createWhatsAppImageHandler: () => createWhatsAppImageHandler,
   createWhatsAppInboundHandler: () => createWhatsAppInboundHandler,
+  createWhatsAppMessageRouter: () => createWhatsAppMessageRouter,
   decrypt: () => decrypt,
   drawSubject: () => drawSubject,
   encrypt: () => encrypt,
@@ -50,6 +51,7 @@ __export(index_exports, {
   loadBaileys: () => loadBaileys,
   messageContext: () => messageContext,
   reconnectDelayMs: () => reconnectDelayMs,
+  resolveWaMessage: () => resolveWaMessage,
   senderNameFor: () => senderNameFor,
   senderPhoneFor: () => senderPhoneFor,
   shutdownWaSessions: () => shutdownWaSessions,
@@ -60,26 +62,59 @@ module.exports = __toCommonJS(index_exports);
 
 // src/channels/whatsapp/crypto.ts
 var import_node_crypto = require("node:crypto");
+var import_node_util = require("node:util");
+var scryptAsync = (0, import_node_util.promisify)(import_node_crypto.scrypt);
 var IV_LENGTH = 12;
 var TAG_LENGTH = 16;
-function deriveKey(secret) {
+var SALT_LENGTH = 16;
+var KEY_LENGTH = 32;
+var VERSION = 1;
+function deriveLegacyKey(secret) {
   return (0, import_node_crypto.createHash)("sha256").update(secret, "utf-8").digest();
 }
-function encrypt(plaintext, secret) {
+async function deriveKey(secret, salt) {
+  return await scryptAsync(secret, salt, KEY_LENGTH);
+}
+async function encrypt(plaintext, secret) {
+  const salt = (0, import_node_crypto.randomBytes)(SALT_LENGTH);
   const iv = (0, import_node_crypto.randomBytes)(IV_LENGTH);
-  const cipher = (0, import_node_crypto.createCipheriv)("aes-256-gcm", deriveKey(secret), iv);
+  const cipher = (0, import_node_crypto.createCipheriv)("aes-256-gcm", await deriveKey(secret, salt), iv);
   const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-  return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]).toString("base64");
+  return Buffer.concat([
+    Buffer.from([VERSION]),
+    salt,
+    iv,
+    cipher.getAuthTag(),
+    ciphertext
+  ]).toString("base64");
 }
-function decrypt(payload, secret) {
-  const raw = Buffer.from(payload, "base64");
+async function decryptVersioned(raw, secret) {
+  const salt = raw.subarray(1, 1 + SALT_LENGTH);
+  const iv = raw.subarray(1 + SALT_LENGTH, 1 + SALT_LENGTH + IV_LENGTH);
+  const tag = raw.subarray(1 + SALT_LENGTH + IV_LENGTH, 1 + SALT_LENGTH + IV_LENGTH + TAG_LENGTH);
+  const ciphertext = raw.subarray(1 + SALT_LENGTH + IV_LENGTH + TAG_LENGTH);
+  const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", await deriveKey(secret, salt), iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf-8");
+}
+function decryptLegacy(raw, secret) {
   const iv = raw.subarray(0, IV_LENGTH);
   const tag = raw.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
   const ciphertext = raw.subarray(IV_LENGTH + TAG_LENGTH);
-  const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", deriveKey(secret), iv);
+  const decipher = (0, import_node_crypto.createDecipheriv)("aes-256-gcm", deriveLegacyKey(secret), iv);
   decipher.setAuthTag(tag);
   return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf-8");
 }
+async function decrypt(payload, secret) {
+  const raw = Buffer.from(payload, "base64");
+  if (raw[0] === VERSION) {
+    try {
+      return await decryptVersioned(raw, secret);
+    } catch {
+    }
+  }
+  return decryptLegacy(raw, secret);
+}
 
 // src/channels/whatsapp/authState.ts
 var schemaReady = /* @__PURE__ */ new WeakMap();
@@ -104,10 +139,10 @@ async function useTursoAuthState(db, secret, sessionId, runtime) {
     });
     const row = result.rows[0];
     if (!row) return null;
-    return JSON.parse(decrypt(row.value, secret), runtime.bufferJSON.reviver);
+    return JSON.parse(await decrypt(row.value, secret), runtime.bufferJSON.reviver);
   }
   async function write(id, value) {
-    const payload = encrypt(JSON.stringify(value, runtime.bufferJSON.replacer), secret);
+    const payload = await encrypt(JSON.stringify(value, runtime.bufferJSON.replacer), secret);
     await db.execute({
       sql: "INSERT OR REPLACE INTO wa_auth (id, value) VALUES (?, ?)",
       args: [rowId(id), payload]
@@ -196,6 +231,35 @@ function silentLogger() {
   return logger;
 }
 
+// src/auth/secretStrength.ts
+var MIN_SECRET_LENGTH = 16;
+function assertStrongSecret(secret, label) {
+  if (!secret) {
+    throw new Error(`${label} is required and cannot be empty.`);
+  }
+  if (secret.length < MIN_SECRET_LENGTH) {
+    throw new Error(
+      `${label} is too weak: must be at least ${MIN_SECRET_LENGTH} characters (got ${secret.length}). Generate one with \`openssl rand -base64 32\`.`
+    );
+  }
+}
+
+// src/core/logger.ts
+var LEVEL_ORDER = { debug: 0, info: 1, warn: 2, error: 3 };
+function createConsoleLogger(level = "info") {
+  const threshold = LEVEL_ORDER[level];
+  const write = (at) => (...args) => {
+    if (LEVEL_ORDER[at] < threshold) return;
+    console.error(`[${at}]`, ...args);
+  };
+  return {
+    debug: write("debug"),
+    info: write("info"),
+    warn: write("warn"),
+    error: write("error")
+  };
+}
+
 // src/channels/whatsapp/lease.ts
 var LEASE_STALE_MS = 9e4;
 var LEASE_HEARTBEAT_MS = 3e4;
@@ -278,11 +342,12 @@ async function acquireSessionLease(sessionId, deps) {
   const heartbeatMs = deps.heartbeatMs ?? LEASE_HEARTBEAT_MS;
   const waitMs = deps.waitMs ?? LEASE_WAIT_MS;
   const schedule = deps.schedule ?? ((fn, ms) => void setTimeout(fn, ms));
+  const logger = deps.logger ?? createConsoleLogger();
   if (isStopped()) return;
   const retry = () => {
     schedule(
       () => void acquireSessionLease(sessionId, deps).catch(
-        (error) => console.error(`WhatsApp[${sessionId}]: lease re-check failed:`, error)
+        (error) => logger.error(`WhatsApp[${sessionId}]: lease re-check failed:`, error)
       ),
       waitMs
     );
@@ -291,21 +356,21 @@ async function acquireSessionLease(sessionId, deps) {
   try {
     acquired = await leaseStore.tryAcquire(sessionId, instanceId, now(), staleMs);
   } catch (error) {
-    console.warn(`WhatsApp[${sessionId}]: lease acquire failed, retrying:`, error);
+    logger.warn(`WhatsApp[${sessionId}]: lease acquire failed, retrying:`, error);
     retry();
     return;
   }
   if (!acquired) {
-    console.warn(`WhatsApp[${sessionId}]: lease held by another instance, re-checking later`);
+    logger.warn(`WhatsApp[${sessionId}]: lease held by another instance, re-checking later`);
     retry();
     return;
   }
   const heartbeat = setInterval(() => {
     void leaseStore.tryAcquire(sessionId, instanceId, now(), staleMs).then((stillHeld) => {
       if (stillHeld || isStopped()) return;
-      console.error(`WhatsApp[${sessionId}]: lost the lease to another instance \u2014 disconnecting`);
+      logger.error(`WhatsApp[${sessionId}]: lost the lease to another instance \u2014 disconnecting`);
       void loseSession(sessionId, sessions).then(retry);
-    }).catch((error) => console.warn(`WhatsApp[${sessionId}]: lease heartbeat failed:`, error));
+    }).catch((error) => logger.warn(`WhatsApp[${sessionId}]: lease heartbeat failed:`, error));
   }, heartbeatMs);
   if (typeof heartbeat === "object" && "unref" in heartbeat) heartbeat.unref();
   sessions.set(sessionId, {
@@ -316,7 +381,7 @@ async function acquireSessionLease(sessionId, deps) {
   try {
     await connect(sessionId);
   } catch (error) {
-    console.error(`WhatsApp[${sessionId}]: connect failed right after acquiring the lease:`, error);
+    logger.error(`WhatsApp[${sessionId}]: connect failed right after acquiring the lease:`, error);
     await loseSession(sessionId, sessions);
     retry();
   }
@@ -325,6 +390,7 @@ function senderNameFor(channelName, sessionId) {
   return sessionId === "default" ? channelName : `${channelName}:${sessionId}`;
 }
 function createWhatsAppChannel(config) {
+  assertStrongSecret(config.sessionSecret, "WhatsApp sessionSecret (e.g. WA_SESSION_SECRET)");
   const channelName = "whatsapp";
   const sessionIds = config.sessionIds && config.sessionIds.length > 0 ? config.sessionIds : ["default"];
   const now = config.now ?? Date.now;
@@ -342,6 +408,7 @@ function createWhatsAppChannel(config) {
   return {
     name: channelName,
     async start(deps) {
+      const log = config.logger ?? deps.logger ?? createConsoleLogger();
       const db = deps.db;
       const leaseStore = createTursoWaLeaseStore(db);
       senders = deps.senders;
@@ -361,7 +428,7 @@ function createWhatsAppChannel(config) {
           runtime
         );
         if (!state.creds.registered) {
-          console.warn(
+          log.warn(
             `WhatsApp[${sessionId}]: no paired session found \u2014 pair it first (see docs/channels.md). Re-checking in 60s.`
           );
           schedule(() => void connect(sessionId).catch(() => void 0), 6e4);
@@ -386,14 +453,14 @@ function createWhatsAppChannel(config) {
         sock.ev.on(
           "creds.update",
           () => void saveCreds().catch(
-            (error) => console.warn(`WhatsApp[${sessionId}]: creds save failed:`, error)
+            (error) => log.warn(`WhatsApp[${sessionId}]: creds save failed:`, error)
           )
         );
         sock.ev.on("connection.update", (update) => {
           const { connection, lastDisconnect } = update;
           if (connection === "open") {
             failureCounts.set(sessionId, 0);
-            console.log(`WhatsApp[${sessionId}]: connected as ${sock.user?.id ?? "unknown"}`);
+            log.info(`WhatsApp[${sessionId}]: connected as ${sock.user?.id ?? "unknown"}`);
             const senderName = senderNameFor(channelName, sessionId);
             const sender = {
               sendText: async (chatId, text) => {
@@ -411,7 +478,7 @@ function createWhatsAppChannel(config) {
             }
             const statusCode = lastDisconnect?.error?.output?.statusCode;
             if (statusCode === baileys.DisconnectReason.loggedOut) {
-              console.error(
+              log.error(
                 `WhatsApp[${sessionId}]: session logged out \u2014 re-pair to reconnect (see docs/channels.md).`
               );
               void loseSession(sessionId, sessions);
@@ -420,12 +487,12 @@ function createWhatsAppChannel(config) {
             if (!stopped && sessions.has(sessionId)) {
               const delay = reconnectDelayMs(failureCounts.get(sessionId) ?? 0);
               failureCounts.set(sessionId, (failureCounts.get(sessionId) ?? 0) + 1);
-              console.warn(
+              log.warn(
                 `WhatsApp[${sessionId}]: connection closed (${statusCode ?? "?"}), reconnecting in ${Math.round(delay / 1e3)}s...`
               );
               schedule(
                 () => void connect(sessionId).catch(
-                  (error) => console.error(`WhatsApp[${sessionId}]: reconnect failed:`, error)
+                  (error) => log.error(`WhatsApp[${sessionId}]: reconnect failed:`, error)
                 ),
                 delay
               );
@@ -439,7 +506,7 @@ function createWhatsAppChannel(config) {
               try {
                 await config.onMessage?.({ sessionId, sock, message });
               } catch (error) {
-                console.warn(`WhatsApp[${sessionId}]: onMessage handler failed:`, error);
+                log.warn(`WhatsApp[${sessionId}]: onMessage handler failed:`, error);
               }
             }
           });
@@ -456,8 +523,9 @@ function createWhatsAppChannel(config) {
           staleMs,
           heartbeatMs,
           waitMs,
-          schedule
-        }).catch((error) => console.error(`WhatsApp[${sessionId}]: failed to start:`, error));
+          schedule,
+          logger: log
+        }).catch((error) => log.error(`WhatsApp[${sessionId}]: failed to start:`, error));
       }
     },
     async stop() {
@@ -536,6 +604,53 @@ function createWhatsAppImageHandler(deps) {
   };
 }
 
+// src/channels/gates.ts
+function matches(re, text) {
+  return new RegExp(re.source, re.flags.replace(/[gy]/g, "")).test(text);
+}
+function isBlockedByAllowlist(msg, config) {
+  return !msg.fromBot && msg.text.trim().length > 0 && !msg.isDirectMessage && config.allowedChats.length > 0 && !config.allowedChats.includes(msg.chatId);
+}
+function decideChannelAction(msg, config) {
+  if (msg.fromBot || !msg.text.trim()) return "ignore";
+  if (!msg.isDirectMessage) {
+    if (isBlockedByAllowlist(msg, config)) return "ignore";
+    if (config.muteRegex && matches(config.muteRegex, msg.text)) return "mute";
+    if (config.unmuteRegex && matches(config.unmuteRegex, msg.text)) return "unmute";
+    if (config.mutedChats.has(msg.chatId)) return "ignore";
+    return msg.mentionsBot || msg.isReplyToBot ? "reply" : "ignore";
+  }
+  return "reply";
+}
+function createSlidingWindowRateLimiter(maxPerWindow, windowMs, now = Date.now) {
+  const log = /* @__PURE__ */ new Map();
+  return function allow(key) {
+    const cutoff = now() - windowMs;
+    const entries = (log.get(key) ?? []).filter((t) => t > cutoff);
+    if (entries.length >= maxPerWindow) {
+      if (entries.length > 0) log.set(key, entries);
+      else log.delete(key);
+      return false;
+    }
+    entries.push(now());
+    log.set(key, entries);
+    return true;
+  };
+}
+function underReplyRateLimit(msg, limiters) {
+  return msg.isDirectMessage ? limiters.dm(msg.chatId) : limiters.group(msg.chatId);
+}
+function isFromAnySession(id, registry) {
+  if (!id) return false;
+  for (const ids of registry.values()) {
+    if (ids.includes(id)) return true;
+  }
+  return false;
+}
+function isEffectivelyFromSelf(msg, registry) {
+  return msg.fromBot || isFromAnySession(msg.senderId, registry);
+}
+
 // src/core/guardrails.ts
 function detectLeakage(text) {
   const flags = [
@@ -580,8 +695,8 @@ async function completeOnce({
 
 // src/core/answer.ts
 var noUsage = () => ({ prompt_tokens: 0, completion_tokens: 0, total_tokens: 0 });
-async function runAnswerFn(answerFn, { system, messages, mode, sender }) {
-  const result = await answerFn({ system, messages, mode, sender });
+async function runAnswerFn(answerFn, { system, messages, mode, sender, conversationId }) {
+  const result = await answerFn({ system, messages, mode, sender, conversationId });
   const raw = typeof result === "string" ? result : result?.content;
   const usage = typeof result === "string" ? void 0 : result?.usage;
   return {
@@ -596,11 +711,12 @@ async function answerOnce({
   messages,
   mode,
   sender,
+  conversationId,
   temperature,
   model
 }) {
   if (answerFn) {
-    return runAnswerFn(answerFn, { system, messages, mode, sender });
+    return runAnswerFn(answerFn, { system, messages, mode, sender, conversationId });
   }
   return completeOnce({ client, system, messages, temperature, model });
 }
@@ -636,6 +752,11 @@ async function resolveBuckets({
   return cleaned.filter((bucket) => ceiling.has(bucket));
 }
 
+// src/core/messages.ts
+function lastUserMessage(messages) {
+  return [...messages].reverse().find((m) => m.role === "user");
+}
+
 // src/core/pipeline.ts
 var MODE_SETTINGS = {
   public: { topK: 6, label: "Context" },
@@ -650,7 +771,7 @@ async function prepareChat({
   channelHint,
   buckets
 }) {
-  const lastUserMsg = [...messages].reverse().find((m) => m.role === "user");
+  const lastUserMsg = lastUserMessage(messages);
   if (!lastUserMsg) {
     throw new Error("no user message found in conversation");
   }
@@ -665,54 +786,93 @@ async function prepareChat({
     `${label}:
 ${ctx.join("\n\n")}`
   ].join("\n\n");
-  return { system, messages };
+  return { system, messages, context: ctx };
 }
 
-// src/channels/gates.ts
-function matches(re, text) {
-  return new RegExp(re.source, re.flags.replace(/[gy]/g, "")).test(text);
-}
-function decideChannelAction(msg, config) {
-  if (msg.fromBot || !msg.text.trim()) return "ignore";
-  if (!msg.isDirectMessage) {
-    if (config.allowedChats.length > 0 && !config.allowedChats.includes(msg.chatId)) {
-      return "ignore";
-    }
-    if (config.muteRegex && matches(config.muteRegex, msg.text)) return "mute";
-    if (config.unmuteRegex && matches(config.unmuteRegex, msg.text)) return "unmute";
-    if (config.mutedChats.has(msg.chatId)) return "ignore";
-    return msg.mentionsBot || msg.isReplyToBot ? "reply" : "ignore";
+// src/channels/pipeline.ts
+var DEFAULT_HISTORY_LIMIT = 20;
+var DEFAULT_GROUP_RATE_LIMIT = { max: 30, windowMs: 60 * 60 * 1e3 };
+var DEFAULT_DM_RATE_LIMIT = { max: 20, windowMs: 60 * 60 * 1e3 };
+async function resolvePersonaLayer(config, ctx) {
+  if (!config.personaResolver) return void 0;
+  try {
+    return await config.personaResolver(ctx);
+  } catch {
+    return void 0;
   }
-  return "reply";
 }
-function createSlidingWindowRateLimiter(maxPerWindow, windowMs, now = Date.now) {
-  const log = /* @__PURE__ */ new Map();
-  return function allow(key) {
-    const cutoff = now() - windowMs;
-    const entries = (log.get(key) ?? []).filter((t) => t > cutoff);
-    if (entries.length >= maxPerWindow) {
-      if (entries.length > 0) log.set(key, entries);
-      else log.delete(key);
-      return false;
+function createInboundPipeline(deps, config) {
+  const mutedChats = /* @__PURE__ */ new Set();
+  const now = config.now ?? Date.now;
+  const group = config.groupRateLimit ?? DEFAULT_GROUP_RATE_LIMIT;
+  const dm = config.dmRateLimit ?? DEFAULT_DM_RATE_LIMIT;
+  const underGroupRateLimit = createSlidingWindowRateLimiter(group.max, group.windowMs, now);
+  const underDmRateLimit = createSlidingWindowRateLimiter(dm.max, dm.windowMs, now);
+  const mode = "public";
+  return async function handleInboundMessage(msg, turn) {
+    const allowedChats = config.allowedChats ?? [];
+    const action = decideChannelAction(msg, {
+      allowedChats,
+      mutedChats,
+      muteRegex: config.muteRegex,
+      unmuteRegex: config.unmuteRegex
+    });
+    if (action === "mute") {
+      mutedChats.add(msg.chatId);
+      if (config.muteReply) await turn.reply.sendGateReply(msg.chatId, config.muteReply);
+      return { action: "mute" };
     }
-    entries.push(now());
-    log.set(key, entries);
-    return true;
+    if (action === "unmute") {
+      mutedChats.delete(msg.chatId);
+      if (config.unmuteReply) await turn.reply.sendGateReply(msg.chatId, config.unmuteReply);
+      return { action: "unmute" };
+    }
+    if (action === "ignore") {
+      return { action: "ignore" };
+    }
+    if (!underReplyRateLimit(msg, { dm: underDmRateLimit, group: underGroupRateLimit })) {
+      return { action: "rate-limited" };
+    }
+    const sender = typeof turn.sender === "function" ? await turn.sender() : turn.sender ?? msg.senderId;
+    const conversationId = turn.conversationId ?? msg.chatId;
+    if (turn.intercept && await turn.intercept(sender)) {
+      return { action: "intercepted" };
+    }
+    const personaLayer = await resolvePersonaLayer(config, { sender, text: msg.text });
+    const buckets = await resolveBuckets({ mode, sender, bucketsFor: config.bucketsFor });
+    const priorTurns = config.history ? await config.history.store.load(
+      conversationId,
+      config.history.limit ?? DEFAULT_HISTORY_LIMIT
+    ) : [];
+    const messages = [...priorTurns, { role: "user", content: msg.text }];
+    await config.history?.store.append(conversationId, { role: "user", content: msg.text });
+    const { system } = await prepareChat({
+      store: deps.store,
+      prompts: deps.prompts,
+      mode,
+      messages,
+      personaLayer,
+      channelHint: config.channelHint,
+      buckets
+    });
+    const { content } = await answerOnce({
+      answerFn: config.answerFn,
+      client: deps.client,
+      system,
+      messages,
+      mode,
+      sender,
+      conversationId,
+      model: config.model
+    });
+    if (!content) {
+      return { action: "ignore" };
+    }
+    await config.history?.store.append(conversationId, { role: "assistant", content });
+    await turn.reply.sendAnswer(msg.chatId, content);
+    return { action: "reply", content };
   };
 }
-function underReplyRateLimit(msg, limiters) {
-  return msg.isDirectMessage ? limiters.dm(msg.chatId) : limiters.group(msg.chatId);
-}
-function isFromAnySession(id, registry) {
-  if (!id) return false;
-  for (const ids of registry.values()) {
-    if (ids.includes(id)) return true;
-  }
-  return false;
-}
-function isEffectivelyFromSelf(msg, registry) {
-  return msg.fromBot || isFromAnySession(msg.senderId, registry);
-}
 
 // src/channels/whatsapp/inbound.ts
 function isGroupJid(jid) {
@@ -729,11 +889,6 @@ function jidToPhoneNumber(jid) {
   const bare = bareUser(jid);
   return bare.startsWith("+") ? bare : `+${bare}`;
 }
-function normalizeJid(jid) {
-  const [user = "", domain] = jid.split("@");
-  const withoutDevice = user.split(":")[0] ?? user;
-  return domain ? `${withoutDevice}@${domain}` : withoutDevice;
-}
 async function senderPhoneFor(sock, message, chatJid) {
   const key = message.key;
   let jid = [key.participantPn, key.senderPn, key.participant, key.remoteJidAlt, chatJid].find(
@@ -761,6 +916,11 @@ function extractText(message) {
   if (!content) return "";
   return content.conversation ?? content.extendedTextMessage?.text ?? content.imageMessage?.caption ?? content.videoMessage?.caption ?? content.documentMessage?.caption ?? "";
 }
+function normalizeJid(jid) {
+  const [user = "", domain] = jid.split("@");
+  const withoutDevice = user.split(":")[0] ?? user;
+  return domain ? `${withoutDevice}@${domain}` : withoutDevice;
+}
 function stripOwnMentions(text, ownIds) {
   const ownUsers = new Set(ownIds.map(bareUser).filter(Boolean));
   if (!text || ownUsers.size === 0) return text;
@@ -774,109 +934,183 @@ function stripOwnMentions(text, ownIds) {
   const cleaned = stripped.trim();
   return cleaned ? cleaned : text;
 }
-var DEFAULT_GROUP_RATE_LIMIT = { max: 30, windowMs: 60 * 60 * 1e3 };
-var DEFAULT_DM_RATE_LIMIT = { max: 20, windowMs: 60 * 60 * 1e3 };
-async function resolvePersonaLayer(config, ctx) {
-  if (!config.personaResolver) return void 0;
-  try {
-    return await config.personaResolver(ctx);
-  } catch {
-    return void 0;
-  }
+function resolveWaMessage(event, registry) {
+  const { sessionId, sock, message } = event;
+  const chatId = message.key.remoteJid ?? "";
+  const rawText = extractText(message);
+  const context = messageContext(message);
+  const senderId = message.key.participant ?? chatId;
+  const ownIds = [sock.user?.id, sock.user?.lid].filter((id) => Boolean(id)).map(normalizeJid);
+  registry.set(sessionId, ownIds);
+  const text = stripOwnMentions(rawText, ownIds);
+  const fromBot = isEffectivelyFromSelf(
+    { fromBot: message.key.fromMe ?? false, senderId: normalizeJid(senderId) },
+    registry
+  );
+  const msg = {
+    chatId,
+    senderId,
+    text,
+    isDirectMessage: !isGroupJid(chatId),
+    mentionsBot: context.mentionedJids.some((jid) => ownIds.some((own) => jidsMatch(jid, own))),
+    isReplyToBot: ownIds.some((own) => jidsMatch(context.quotedParticipantJid, own)),
+    fromBot
+  };
+  return { msg, ownIds };
 }
 function createWhatsAppInboundHandler(config) {
-  const mutedChats = /* @__PURE__ */ new Set();
-  const now = config.now ?? Date.now;
-  const group = config.groupRateLimit ?? DEFAULT_GROUP_RATE_LIMIT;
-  const dm = config.dmRateLimit ?? DEFAULT_DM_RATE_LIMIT;
-  const underGroupRateLimit = createSlidingWindowRateLimiter(group.max, group.windowMs, now);
-  const underDmRateLimit = createSlidingWindowRateLimiter(dm.max, dm.windowMs, now);
+  const loggedUnallowedChats = /* @__PURE__ */ new Set();
+  const allowedChats = config.allowedChats ?? [];
+  const personaResolver = config.personaResolver;
+  const images = config.images;
+  const logger = config.logger ?? createConsoleLogger();
+  const pipeline = createInboundPipeline(
+    { client: config.client, store: config.store, prompts: config.prompts },
+    {
+      answerFn: config.answerFn,
+      bucketsFor: config.bucketsFor,
+      model: config.model,
+      channelHint: config.channelHint,
+      personaResolver: personaResolver ? ({ sender, text }) => personaResolver({ senderPhone: sender, text }) : void 0,
+      history: config.history,
+      allowedChats,
+      muteRegex: config.muteRegex,
+      unmuteRegex: config.unmuteRegex,
+      muteReply: config.muteReply,
+      unmuteReply: config.unmuteReply,
+      dmRateLimit: config.dmRateLimit,
+      groupRateLimit: config.groupRateLimit,
+      now: config.now
+    }
+  );
   return async function handleWhatsAppMessage(event) {
     const { sessionId, sock, message } = event;
     try {
       const chatId = message.key.remoteJid ?? "";
       if (!chatId || chatId === "status@broadcast") return;
-      const rawText = extractText(message);
-      const context = messageContext(message);
-      const senderId = message.key.participant ?? chatId;
-      const ownIds = [sock.user?.id, sock.user?.lid].filter((id) => Boolean(id)).map(normalizeJid);
-      config.registry.set(sessionId, ownIds);
-      const text = stripOwnMentions(rawText, ownIds);
-      const fromBot = isEffectivelyFromSelf(
-        { fromBot: message.key.fromMe ?? false, senderId: normalizeJid(senderId) },
-        config.registry
-      );
-      const msg = {
-        chatId,
-        senderId,
-        text,
-        isDirectMessage: !isGroupJid(chatId),
-        mentionsBot: context.mentionedJids.some((jid) => ownIds.some((own) => jidsMatch(jid, own))),
-        isReplyToBot: ownIds.some((own) => jidsMatch(context.quotedParticipantJid, own)),
-        fromBot
-      };
-      const action = decideChannelAction(msg, {
-        allowedChats: config.allowedChats ?? [],
-        mutedChats,
-        muteRegex: config.muteRegex,
-        unmuteRegex: config.unmuteRegex
-      });
-      if (action === "mute") {
-        mutedChats.add(chatId);
-        if (config.muteReply) await sock.sendMessage(chatId, { text: config.muteReply });
-        return;
-      }
-      if (action === "unmute") {
-        mutedChats.delete(chatId);
-        if (config.unmuteReply) await sock.sendMessage(chatId, { text: config.unmuteReply });
-        return;
-      }
-      if (action !== "reply") return;
-      if (!underReplyRateLimit(msg, { dm: underDmRateLimit, group: underGroupRateLimit })) {
-        return;
+      const { msg } = resolveWaMessage(event, config.registry);
+      const text = msg.text;
+      if (isBlockedByAllowlist(msg, { allowedChats })) {
+        const dedupKey = `${sessionId}:${chatId}`;
+        if (!loggedUnallowedChats.has(dedupKey)) {
+          loggedUnallowedChats.add(dedupKey);
+          logger.warn(`WhatsApp[${sessionId}]: skipped group ${chatId} - not in allowedChats`);
+        }
       }
-      const senderPhone = await senderPhoneFor(sock, message, chatId);
-      if (config.images) {
-        const handled = await config.images({
+      const reply = {
+        sendAnswer: async (targetChatId, replyText2) => {
+          await sock.sendMessage(targetChatId, { text: replyText2 }, { quoted: message });
+        },
+        sendGateReply: async (targetChatId, replyText2) => {
+          await sock.sendMessage(targetChatId, { text: replyText2 });
+        }
+      };
+      await pipeline(msg, {
+        reply,
+        conversationId: chatId,
+        sender: () => senderPhoneFor(sock, message, chatId),
+        intercept: images ? (senderPhone) => images({
           sock,
           message,
           chatId,
           senderId: senderPhone,
           text,
           hasPhoto: Boolean(message.message?.imageMessage)
-        });
-        if (handled) return;
-      }
-      const personaLayer = await resolvePersonaLayer(config, { senderPhone, text });
-      const buckets = await resolveBuckets({
-        mode: "public",
-        sender: senderPhone,
-        bucketsFor: config.bucketsFor
-      });
-      const messages = [{ role: "user", content: text }];
-      const { system } = await prepareChat({
-        store: config.store,
-        prompts: config.prompts,
-        mode: "public",
-        messages,
-        personaLayer,
-        channelHint: config.channelHint,
-        buckets
+        }) : void 0
       });
-      const { content } = await answerOnce({
-        answerFn: config.answerFn,
-        client: config.client,
-        system,
-        messages,
-        mode: "public",
-        sender: senderPhone,
-        model: config.model
+    } catch (error) {
+      logger.warn(`WhatsApp[${sessionId}]: inbound message handling failed:`, error);
+    }
+  };
+}
+
+// src/channels/whatsapp/router.ts
+async function logDetectorError(config, logger, name, error) {
+  if (!config.onDetectorError) {
+    logger.warn(`WhatsApp router: detector "${name}" failed:`, error);
+    return;
+  }
+  try {
+    await config.onDetectorError(name, error);
+  } catch (callbackError) {
+    logger.warn(`WhatsApp router: onDetectorError itself failed:`, callbackError);
+  }
+}
+function isChatIneligible(msg, allowedChats) {
+  return !msg.isDirectMessage && allowedChats.length > 0 && !allowedChats.includes(msg.chatId);
+}
+function fireParallelDetector(config, logger, detector, ctx) {
+  void (async () => {
+    try {
+      if (await detector.test(ctx)) {
+        await detector.handle(ctx);
+      }
+    } catch (error) {
+      await logDetectorError(config, logger, detector.name, error);
+    }
+  })();
+}
+function createWhatsAppMessageRouter(config) {
+  const allowedChats = config.allowedChats ?? [];
+  const mutedChats = config.mutedChats ?? /* @__PURE__ */ new Set();
+  const logger = config.logger ?? createConsoleLogger();
+  const replaceDetectors = config.detectors.filter(
+    (d) => d.mode === "replace"
+  );
+  const parallelDetectors = config.detectors.filter(
+    (d) => d.mode === "parallel"
+  );
+  return async function routeWhatsAppMessage(event) {
+    const { sock, message } = event;
+    let ctx;
+    try {
+      const chatId = message.key.remoteJid ?? "";
+      if (!chatId || chatId === "status@broadcast") return;
+      const { msg, ownIds } = resolveWaMessage(event, config.registry);
+      if (msg.fromBot || isChatIneligible(msg, allowedChats)) return;
+      const action = decideChannelAction(msg, {
+        allowedChats,
+        mutedChats,
+        muteRegex: config.muteRegex,
+        unmuteRegex: config.unmuteRegex
       });
-      if (content) {
-        await sock.sendMessage(chatId, { text: content }, { quoted: message });
+      ctx = {
+        event,
+        sock,
+        message,
+        msg,
+        ownIds,
+        senderId: msg.senderId,
+        text: msg.text,
+        action
+      };
+    } catch (error) {
+      await logDetectorError(config, logger, "resolve", error);
+      return;
+    }
+    for (const detector of parallelDetectors) {
+      fireParallelDetector(config, logger, detector, ctx);
+    }
+    for (const detector of replaceDetectors) {
+      let matched;
+      try {
+        matched = await detector.test(ctx);
+      } catch (error) {
+        await logDetectorError(config, logger, detector.name, error);
+        continue;
       }
+      if (!matched) continue;
+      try {
+        await detector.handle(ctx);
+      } catch (error) {
+        await logDetectorError(config, logger, detector.name, error);
+      }
+      return;
+    }
+    try {
+      await config.fallback(event);
     } catch (error) {
-      console.warn(`WhatsApp[${sessionId}]: inbound message handling failed:`, error);
+      await logDetectorError(config, logger, "fallback", error);
     }
   };
 }
@@ -891,6 +1125,7 @@ function createWhatsAppInboundHandler(config) {
   createWhatsAppChannel,
   createWhatsAppImageHandler,
   createWhatsAppInboundHandler,
+  createWhatsAppMessageRouter,
   decrypt,
   drawSubject,
   encrypt,
@@ -902,6 +1137,7 @@ function createWhatsAppInboundHandler(config) {
   loadBaileys,
   messageContext,
   reconnectDelayMs,
+  resolveWaMessage,
   senderNameFor,
   senderPhoneFor,
   shutdownWaSessions,