@funnelchat-hq/sandbox 0.1.1 → 0.2.0

package/dist/{chunk-KH6A3I2A.js → chunk-M5E6NAXM.js}

@@ -4,6 +4,7 @@ import { createHmac, randomUUID, randomBytes, createHash } from 'crypto';
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import addFormatsModule from 'ajv-formats';
 import { createServer } from 'http';
+import { deflateSync } from 'zlib';
 
 // src/config.ts
 function isoSeconds(date) {
@@ -81,6 +82,8 @@ function defaultConfig() {
     rules: { window: true, antiblock: true, rateLimit: true },
     templateApprovalSeconds: 5,
     subscriptions: [],
+    numbers: { limit: 5, included: true, trial: false, metaConnect: false, linksPerMinute: 10 },
+    publicUrl: null,
     historyLimit: 200,
     log: true
   };
@@ -157,6 +160,24 @@ function mergeConfig(base, input) {
       return structuredClone(s);
     });
   }
+  if (input.numbers !== void 0) {
+    const n = input.numbers;
+    if (!isRecord(n)) throw new ConfigError("numbers must be an object {limit, included, trial, metaConnect, linksPerMinute}.");
+    for (const key of ["limit", "linksPerMinute"]) {
+      if (n[key] === void 0) continue;
+      if (!Number.isInteger(n[key]) || n[key] < 0) throw new ConfigError(`numbers.${key} must be an integer, 0 or more.`);
+      out.numbers[key] = n[key];
+    }
+    for (const key of ["included", "trial", "metaConnect"]) {
+      if (n[key] !== void 0) out.numbers[key] = Boolean(n[key]);
+    }
+  }
+  if (input.publicUrl !== void 0) {
+    if (input.publicUrl !== null && (typeof input.publicUrl !== "string" || !/^https?:\/\/[^/]+/.test(input.publicUrl))) {
+      throw new ConfigError("publicUrl must be an http(s) URL, like https://sandbox.example.com, or null.");
+    }
+    out.publicUrl = input.publicUrl === null ? null : input.publicUrl.replace(/\/+$/, "");
+  }
   if (input.historyLimit !== void 0) {
     if (!Number.isInteger(input.historyLimit) || input.historyLimit < 1) {
       throw new ConfigError("historyLimit must be an integer greater than 0.");
@@ -229,6 +250,9 @@ function parseArgs(argv) {
       case "--host":
         o.host = value();
         break;
+      case "--public-url":
+        o.publicUrl = value();
+        break;
       case "--status-delays": {
         const [sent, delivered, read] = parseSecondsList(value(), "--status-delays", true);
         if (sent === null || sent === void 0) throw new ConfigError("--status-delays: the first one (sent) must be a number.");
@@ -260,6 +284,9 @@ function parseArgs(argv) {
         o.templateApprovalSeconds = n ?? null;
         break;
       }
+      case "--meta-connect":
+        o.numbers = { ...o.numbers, metaConnect: true };
+        break;
       case "-q":
       case "--quiet":
         o.log = false;
@@ -24748,7 +24775,164 @@ var openapi_default = {
         },
         summary: "Listar n\xFAmeros",
         "x-fc-proposito": "Sirve para listar tus n\xFAmeros de WhatsApp con su proveedor, si est\xE1n conectados y activos y su estado de salud, y obtener los IDs que usan las dem\xE1s operaciones.",
-        "x-fc-domain": "accounts"
+        "x-fc-domain": "accounts",
+        parameters: [
+          {
+            name: "external_reference",
+            in: "query",
+            required: false,
+            description: "Only the numbers with exactly this reference.",
+            schema: {
+              type: "string",
+              maxLength: 255
+            },
+            "x-fc-pending": "accounts-alta-de-numeros"
+          }
+        ]
+      },
+      post: {
+        operationId: "pendingSandboxDevices.store",
+        summary: "Create a number by QR",
+        description: "Creates a number of the account to connect by QR, with `connected: false`; ask for its code with `GET /devices/{device}/qr`. Same path and same rejections as the panel: the quota counts phones (QR and Meta of the same phone count once). `same_number_as` adds QR to an official number in coexistence without taking a place. An official number is created only with a sign-up link.\n\n**Pending of the spec**: from the contract of the sign-up by API (22-10, A1), while accounts writes it; its OpenAPI will be the final source.\n\nAmendment v0.1 (23-10): as accounts did it in `feat/alta-de-numeros-api` `52d49b319`. The pool keeps at most one unconnected QR number per account: another one answers `409 pending_number_exists` with its `device_id`. Without an active plan, `403` without `error`.\n\nOptional `country` (two letters, any case): the country of the phone that will scan the QR, where the WhatsApp session is opened from.",
+        tags: [
+          "Device"
+        ],
+        "x-fc-domain": "accounts",
+        "x-fc-permission": "accounts:operate",
+        "x-fc-pending": "accounts-alta-de-numeros",
+        parameters: [
+          {
+            name: "Idempotency-Key",
+            in: "header",
+            required: false,
+            description: "Up to 255 characters, kept 24 hours. The same key with the same body gives back the same answer without creating anything; with another body, `422 idempotency_key_mismatch`; while the first call runs, `409 operation_in_progress`.",
+            schema: {
+              type: "string",
+              maxLength: 255
+            }
+          }
+        ],
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: {
+                  connection: {
+                    type: "string",
+                    enum: [
+                      "qr"
+                    ],
+                    description: "For now the only value."
+                  },
+                  alias: {
+                    type: [
+                      "string",
+                      "null"
+                    ],
+                    maxLength: 255
+                  },
+                  external_reference: {
+                    type: [
+                      "string",
+                      "null"
+                    ],
+                    maxLength: 255,
+                    description: "Free text to find your customer: not unique. It comes back in the number, in `GET /devices?external_reference=` and in every `device.*` event."
+                  },
+                  same_number_as: {
+                    type: [
+                      "integer",
+                      "null"
+                    ],
+                    description: "An official number in coexistence that gets QR too."
+                  },
+                  country: {
+                    type: [
+                      "string",
+                      "null"
+                    ],
+                    pattern: "^[A-Za-z]{2}$",
+                    description: "The country of the phone that will scan the QR (ISO 3166-1 alpha-2, two letters, any case): the WhatsApp session is opened from there. Without it, the default."
+                  }
+                },
+                required: [
+                  "connection"
+                ]
+              }
+            }
+          }
+        },
+        responses: {
+          "201": {
+            description: "Created, not connected yet",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    data: {
+                      $ref: "#/components/schemas/DeviceResource"
+                    }
+                  },
+                  required: [
+                    "data"
+                  ]
+                }
+              }
+            },
+            headers: {
+              "Idempotent-Replayed": {
+                description: "`true` when the answer is a replay of the same `Idempotency-Key`.",
+                schema: {
+                  type: "string"
+                }
+              }
+            }
+          },
+          "403": {
+            description: "`numbers_not_included`, `number_limit_reached` (with `limit`, `used` and `pending_device_ids`) or `connect_not_allowed`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          },
+          "409": {
+            description: "`pending_number_exists` (with `device_id`) or `operation_in_progress`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          },
+          "422": {
+            description: "`invalid_request` (with `errors`), `invalid_reference_device`, `qr_requires_coexistence`, `method_already_present` (with `device_id`), `number_suspended_by_plan`, `idempotency_key_mismatch` or `invalid_idempotency_key`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          },
+          "500": {
+            description: "`provider_error`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          }
+        },
+        "x-fc-validation-error": "invalid_request"
       }
     },
     "/api/v1/devices/{device}/me": {
@@ -25079,6 +25263,14 @@ var openapi_default = {
                   capi_consent: {
                     type: "boolean",
                     description: "Meta Conversions API (CAPI) opt-in consent \u2014 capi-meta-connection Inc 3\n(design.md D3). Optional: only meaningful on the Meta branch, and even\nthere it is a no-op unless the `capi` feature flag is enabled for the\naccount (defense in depth, see updateMetaDevice below)."
+                  },
+                  external_reference: {
+                    type: [
+                      "string",
+                      "null"
+                    ],
+                    maxLength: 255,
+                    description: "Free text to find your customer; `null` clears it."
                   }
                 }
               }
@@ -25256,7 +25448,8 @@ var openapi_default = {
         "x-fc-destructive": false,
         summary: "Actualizar un n\xFAmero",
         "x-fc-proposito": "Sirve para actualizar los datos de un n\xFAmero (alias, color, imagen) o completar sus datos de WhatsApp Business, como WABA y phone number ID, y el consentimiento de Conversions API.",
-        "x-fc-domain": "accounts"
+        "x-fc-domain": "accounts",
+        "x-fc-pending": "accounts-alta-de-numeros"
       },
       delete: {
         operationId: "device.destroy",
@@ -25275,13 +25468,63 @@ var openapi_default = {
             }
           }
         ],
+        responses: {
+          "200": {
+            description: "Deleted: an empty body, as today. Emits `device.deleted`."
+          },
+          "401": {
+            $ref: "#/components/responses/AccountsAuthenticationException"
+          },
+          "403": {
+            $ref: "#/components/responses/AccountsAuthorizationException"
+          },
+          "404": {
+            $ref: "#/components/responses/AccountsModelNotFoundException"
+          }
+        },
+        "x-fc-access": "write",
+        "x-fc-permission": "accounts:operate",
+        "x-fc-destructive": true,
+        summary: "Eliminar un n\xFAmero",
+        "x-fc-proposito": "Usalo para dar de baja un n\xFAmero de la cuenta de forma definitiva. Es irreversible y requiere el permiso `accounts:operate`.",
+        "x-fc-domain": "accounts",
+        "x-fc-pending-response": "accounts-alta-de-numeros"
+      }
+    },
+    "/api/v1/devices/{device}/reset": {
+      put: {
+        operationId: "device.reset",
+        description: "**Escritura** \xB7 requiere el permiso `accounts:operate`.\n\n> \u26A0\uFE0F **Operaci\xF3n irreversible.** No hay papelera ni deshacer: resetear o limpiar un n\xFAmero mata su sesi\xF3n de WhatsApp (hay que volver a escanear el c\xF3digo), purgar la cola descarta los mensajes encolados sin dejar registro de lo descartado, y los borrados eliminan el recurso.",
+        tags: [
+          "Device"
+        ],
+        parameters: [
+          {
+            name: "device",
+            in: "path",
+            required: true,
+            description: "The device ID",
+            schema: {
+              type: "integer"
+            }
+          }
+        ],
         responses: {
           "200": {
             description: "",
             content: {
               "application/json": {
                 schema: {
-                  type: "object"
+                  type: "object",
+                  properties: {
+                    message: {
+                      type: "string",
+                      const: "Device reset processed successfully"
+                    }
+                  },
+                  required: [
+                    "message"
+                  ]
                 }
               }
             }
@@ -25294,188 +25537,132 @@ var openapi_default = {
           },
           "404": {
             $ref: "#/components/responses/AccountsModelNotFoundException"
+          },
+          "500": {
+            description: "",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    message: {
+                      type: "string",
+                      const: "An error occurred while resetting the device"
+                    }
+                  },
+                  required: [
+                    "message"
+                  ]
+                }
+              }
+            }
           }
         },
         "x-fc-access": "write",
         "x-fc-permission": "accounts:operate",
         "x-fc-destructive": true,
-        summary: "Eliminar un n\xFAmero",
-        "x-fc-proposito": "Usalo para dar de baja un n\xFAmero de la cuenta de forma definitiva. Es irreversible y requiere el permiso `accounts:operate`.",
+        summary: "Reiniciar la sesi\xF3n de un n\xFAmero",
+        "x-fc-proposito": "Sirve para reiniciar desde cero la sesi\xF3n de WhatsApp de un n\xFAmero; despu\xE9s hay que volver a escanear el c\xF3digo QR. Es irreversible y requiere `accounts:operate`.",
         "x-fc-domain": "accounts"
       }
     },
-    "/api/v1/devices/{device}/reset": {
+    "/api/v1/devices/{device}/update-webhook-received": {
       put: {
-        operationId: "device.reset",
-        description: "**Escritura** \xB7 requiere el permiso `accounts:operate`.\n\n> \u26A0\uFE0F **Operaci\xF3n irreversible.** No hay papelera ni deshacer: resetear o limpiar un n\xFAmero mata su sesi\xF3n de WhatsApp (hay que volver a escanear el c\xF3digo), purgar la cola descarta los mensajes encolados sin dejar registro de lo descartado, y los borrados eliminan el recurso.",
-        tags: [
-          "Device"
-        ],
-        parameters: [
-          {
-            name: "device",
-            in: "path",
-            required: true,
-            description: "The device ID",
-            schema: {
-              type: "integer"
-            }
-          }
-        ],
-        responses: {
-          "200": {
-            description: "",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    message: {
-                      type: "string",
-                      const: "Device reset processed successfully"
-                    }
-                  },
-                  required: [
-                    "message"
-                  ]
-                }
-              }
-            }
-          },
-          "401": {
-            $ref: "#/components/responses/AccountsAuthenticationException"
-          },
-          "403": {
-            $ref: "#/components/responses/AccountsAuthorizationException"
-          },
-          "404": {
-            $ref: "#/components/responses/AccountsModelNotFoundException"
-          },
-          "500": {
-            description: "",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object",
-                  properties: {
-                    message: {
-                      type: "string",
-                      const: "An error occurred while resetting the device"
-                    }
-                  },
-                  required: [
-                    "message"
-                  ]
-                }
-              }
-            }
-          }
-        },
-        "x-fc-access": "write",
-        "x-fc-permission": "accounts:operate",
-        "x-fc-destructive": true,
-        summary: "Reiniciar la sesi\xF3n de un n\xFAmero",
-        "x-fc-proposito": "Sirve para reiniciar desde cero la sesi\xF3n de WhatsApp de un n\xFAmero; despu\xE9s hay que volver a escanear el c\xF3digo QR. Es irreversible y requiere `accounts:operate`.",
-        "x-fc-domain": "accounts"
-      }
-    },
-    "/api/v1/devices/{device}/update-webhook-received": {
-      put: {
-        operationId: "device.updateWebhookReceived",
-        description: "**Escritura** \xB7 requiere el permiso `accounts:write`.",
-        tags: [
-          "Device"
-        ],
-        parameters: [
-          {
-            name: "device",
-            in: "path",
-            required: true,
-            description: "The device ID",
-            schema: {
-              type: "integer"
-            }
-          }
-        ],
-        responses: {
-          "200": {
-            description: "",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object"
-                }
-              }
-            }
-          },
-          "401": {
-            $ref: "#/components/responses/AccountsAuthenticationException"
-          },
-          "403": {
-            $ref: "#/components/responses/AccountsAuthorizationException"
-          },
-          "404": {
-            $ref: "#/components/responses/AccountsModelNotFoundException"
-          }
-        },
-        "x-fc-access": "write",
-        "x-fc-permission": "accounts:write",
-        "x-fc-destructive": false,
-        summary: "Configurar el webhook de mensajes recibidos",
-        "x-fc-proposito": "Sirve para configurar en un n\xFAmero el aviso de mensajes recibidos que usa Funnelchat para recibirlos.",
-        "x-fc-domain": "accounts"
-      }
-    },
-    "/api/v1/devices/{device}/update-webhook-received-and-delivery": {
-      put: {
-        operationId: "device.updateWebhookReceivedAndDelivery",
-        description: "**Escritura** \xB7 requiere el permiso `accounts:write`.",
-        tags: [
-          "Device"
-        ],
-        parameters: [
-          {
-            name: "device",
-            in: "path",
-            required: true,
-            description: "The device ID",
-            schema: {
-              type: "integer"
-            }
-          }
-        ],
-        responses: {
-          "200": {
-            description: "",
-            content: {
-              "application/json": {
-                schema: {
-                  type: "object"
-                }
-              }
-            }
-          },
-          "401": {
-            $ref: "#/components/responses/AccountsAuthenticationException"
-          },
-          "403": {
-            $ref: "#/components/responses/AccountsAuthorizationException"
-          },
-          "404": {
-            $ref: "#/components/responses/AccountsModelNotFoundException"
-          }
-        },
-        "x-fc-access": "write",
-        "x-fc-permission": "accounts:write",
-        "x-fc-destructive": false,
-        summary: "Configurar el webhook de recibidos y entregas",
-        "x-fc-proposito": "Sirve para configurar en un n\xFAmero los avisos de mensajes recibidos y de confirmaciones de entrega que usa Funnelchat.",
-        "x-fc-domain": "accounts"
-      }
-    },
-    "/api/v1/devices/{device}/clean": {
-      post: {
-        operationId: "device.clean",
+        operationId: "device.updateWebhookReceived",
+        description: "**Escritura** \xB7 requiere el permiso `accounts:write`.",
+        tags: [
+          "Device"
+        ],
+        parameters: [
+          {
+            name: "device",
+            in: "path",
+            required: true,
+            description: "The device ID",
+            schema: {
+              type: "integer"
+            }
+          }
+        ],
+        responses: {
+          "200": {
+            description: "",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object"
+                }
+              }
+            }
+          },
+          "401": {
+            $ref: "#/components/responses/AccountsAuthenticationException"
+          },
+          "403": {
+            $ref: "#/components/responses/AccountsAuthorizationException"
+          },
+          "404": {
+            $ref: "#/components/responses/AccountsModelNotFoundException"
+          }
+        },
+        "x-fc-access": "write",
+        "x-fc-permission": "accounts:write",
+        "x-fc-destructive": false,
+        summary: "Configurar el webhook de mensajes recibidos",
+        "x-fc-proposito": "Sirve para configurar en un n\xFAmero el aviso de mensajes recibidos que usa Funnelchat para recibirlos.",
+        "x-fc-domain": "accounts"
+      }
+    },
+    "/api/v1/devices/{device}/update-webhook-received-and-delivery": {
+      put: {
+        operationId: "device.updateWebhookReceivedAndDelivery",
+        description: "**Escritura** \xB7 requiere el permiso `accounts:write`.",
+        tags: [
+          "Device"
+        ],
+        parameters: [
+          {
+            name: "device",
+            in: "path",
+            required: true,
+            description: "The device ID",
+            schema: {
+              type: "integer"
+            }
+          }
+        ],
+        responses: {
+          "200": {
+            description: "",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object"
+                }
+              }
+            }
+          },
+          "401": {
+            $ref: "#/components/responses/AccountsAuthenticationException"
+          },
+          "403": {
+            $ref: "#/components/responses/AccountsAuthorizationException"
+          },
+          "404": {
+            $ref: "#/components/responses/AccountsModelNotFoundException"
+          }
+        },
+        "x-fc-access": "write",
+        "x-fc-permission": "accounts:write",
+        "x-fc-destructive": false,
+        summary: "Configurar el webhook de recibidos y entregas",
+        "x-fc-proposito": "Sirve para configurar en un n\xFAmero los avisos de mensajes recibidos y de confirmaciones de entrega que usa Funnelchat.",
+        "x-fc-domain": "accounts"
+      }
+    },
+    "/api/v1/devices/{device}/clean": {
+      post: {
+        operationId: "device.clean",
         description: "**Escritura** \xB7 requiere el permiso `accounts:operate`.\n\n> \u26A0\uFE0F **Operaci\xF3n irreversible.** No hay papelera ni deshacer: resetear o limpiar un n\xFAmero mata su sesi\xF3n de WhatsApp (hay que volver a escanear el c\xF3digo), purgar la cola descarta los mensajes encolados sin dejar registro de lo descartado, y los borrados eliminan el recurso.",
         tags: [
           "Device"
@@ -29520,6 +29707,477 @@ var openapi_default = {
           }
         }
       }
+    },
+    "/api/v1/devices/{device}/qr": {
+      get: {
+        operationId: "pendingSandboxDevices.qr",
+        summary: "The QR code of a number",
+        description: "Creates the instance if needed and gives its QR code. Only for QR numbers: an official one answers `422 provider_unsupported`. Scanning it gives control of a WhatsApp, so it asks for `accounts:operate`.\n\n**Pending of the spec**: from the contract of the sign-up by API (22-10, A1), while accounts writes it; its OpenAPI will be the final source.\n\nAmendment v0.1 (23-10): as accounts did it in `feat/alta-de-numeros-api` `52d49b319`. `connected` is a boolean here (`0`/`1` in the number).\n\naccounts #1335 (25-10, in production): `expires_in` is 5 with a code, the cadence of the panel. Ask for it again every 5 seconds and show the new one at once: WhatsApp changes the code every few seconds and an old one does not link. The answer carries `Cache-Control: no-store`.",
+        tags: [
+          "Device"
+        ],
+        "x-fc-domain": "accounts",
+        "x-fc-permission": "accounts:operate",
+        "x-fc-pending": "accounts-alta-de-numeros",
+        parameters: [
+          {
+            name: "device",
+            in: "path",
+            required: true,
+            schema: {
+              type: "integer"
+            }
+          }
+        ],
+        responses: {
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxDeviceQr"
+                }
+              }
+            }
+          },
+          "403": {
+            description: "`number_limit_reached`, `connect_not_allowed` or `payment_required`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          },
+          "404": {
+            description: "It does not exist in the account",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxModelNotFound"
+                }
+              }
+            }
+          },
+          "409": {
+            description: "`trial_number_blocked`, `qr_requires_coexistence`, `number_suspended_by_plan`, `device_inactive` or `provisioning_quota_exceeded`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          },
+          "422": {
+            description: "`provider_unsupported`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          },
+          "502": {
+            description: "`provider_error`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/api/v1/connect-links": {
+      get: {
+        operationId: "pendingSandboxConnectLinks.index",
+        summary: "List the sign-up links",
+        description: "Paginated like the other lists (`perPage`, 25 by default, up to 100), newest first (by id). Filters by `status` and `external_reference`.\n\nAmendment v0.1 (23-10): as accounts did it in `feat/alta-de-numeros-api` `52d49b319`.",
+        tags: [
+          "ConnectLink"
+        ],
+        "x-fc-domain": "accounts",
+        "x-fc-permission": "accounts:read",
+        "x-fc-pending": "accounts-alta-de-numeros",
+        parameters: [
+          {
+            name: "status",
+            in: "query",
+            required: false,
+            schema: {
+              type: "string",
+              enum: [
+                "pending",
+                "completed",
+                "failed",
+                "expired",
+                "revoked"
+              ]
+            }
+          },
+          {
+            name: "external_reference",
+            in: "query",
+            required: false,
+            schema: {
+              type: "string",
+              maxLength: 255
+            }
+          },
+          {
+            name: "page",
+            in: "query",
+            required: false,
+            schema: {
+              type: "integer",
+              minimum: 1
+            }
+          },
+          {
+            name: "perPage",
+            in: "query",
+            required: false,
+            schema: {
+              type: "integer",
+              minimum: 1,
+              maximum: 100
+            }
+          }
+        ],
+        responses: {
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    data: {
+                      type: "array",
+                      items: {
+                        $ref: "#/components/schemas/PendingSandboxConnectLink"
+                      }
+                    },
+                    links: {
+                      type: "object"
+                    },
+                    meta: {
+                      type: "object"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "x-fc-validation-error": "invalid_request"
+      },
+      post: {
+        operationId: "pendingSandboxConnectLinks.store",
+        summary: "Create a sign-up link",
+        description: 'A link of the account that creates the number when your customer completes the page (`url`), or reconnects the number of `device_id` without taking a new place. The quota is checked now (except for a reconnection) and again at the end. Up to 20 open links per account. With `type: meta` while the Meta sign-up is off, `503 meta_connect_disabled`.\n\n**Pending of the spec**: from the contract of the sign-up by API (22-10, A1), while accounts writes it; its OpenAPI will be the final source.\n\nAmendment v0.1 (23-10): as accounts did it in `feat/alta-de-numeros-api` `52d49b319`. Body rules: `allowed_connection_types` required with `meta` and prohibited with `qr` (one or two distinct values); `provision_us_number` prohibited with `qr`; `same_number_as` prohibited with `meta` and excluding `device_id`; `return_url` `https`, up to 2048. Up to 10 creations per minute: one more answers Laravel\'s `429 {"message": "Too Many Attempts."}`. The answer carries `Cache-Control: no-store`.\n\nAmendment v0.2 (23-10, accounts `8852b3fad`): `provision_us_number: true` needs `dedicated` among `allowed_connection_types` and does not go with `device_id` (a pool number is always dedicated and new); otherwise `422 invalid_request`. A Meta link survives failures of Facebook or Meta: it stays `pending` so your customer retries, and ends `failed` (`facebook_auth_failed` or `meta_error`) at the fifth; `quota_exceeded`, `trial_number_blocked` and `number_not_owned` end it at the first.\n\nIn production (25-10): the Meta sign-up stays off until the domain is registered with Meta, so `type: meta` answers `503 meta_connect_disabled`; the sandbox starts with it off too. Optional `country` (two letters, `qr` only and not with `device_id`): the country of the phone, which the link returns in lower case.',
+        tags: [
+          "ConnectLink"
+        ],
+        "x-fc-domain": "accounts",
+        "x-fc-permission": "accounts:operate",
+        "x-fc-pending": "accounts-alta-de-numeros",
+        parameters: [
+          {
+            name: "Idempotency-Key",
+            in: "header",
+            required: false,
+            description: "Up to 255 characters, kept 24 hours. The same key with the same body gives back the same answer without creating anything; with another body, `422 idempotency_key_mismatch`; while the first call runs, `409 operation_in_progress`.",
+            schema: {
+              type: "string",
+              maxLength: 255
+            }
+          }
+        ],
+        requestBody: {
+          required: true,
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: {
+                  type: {
+                    type: "string",
+                    enum: [
+                      "meta",
+                      "qr"
+                    ]
+                  },
+                  allowed_connection_types: {
+                    type: [
+                      "array",
+                      "null"
+                    ],
+                    items: {
+                      type: "string",
+                      enum: [
+                        "coexistence",
+                        "dedicated"
+                      ]
+                    },
+                    minItems: 1,
+                    maxItems: 2,
+                    uniqueItems: true,
+                    description: "Required with `type: meta`, forbidden with `qr`. With both, your customer chooses."
+                  },
+                  provision_us_number: {
+                    type: "boolean",
+                    description: "`meta` only (prohibited with `qr`): offer a US number of the pool (3 per account, 1 on trial accounts). Needs `dedicated` among `allowed_connection_types` and does not go with `device_id`."
+                  },
+                  device_id: {
+                    type: [
+                      "integer",
+                      "null"
+                    ],
+                    description: "Reconnect this number. `type` must match its method."
+                  },
+                  same_number_as: {
+                    type: [
+                      "integer",
+                      "null"
+                    ],
+                    description: "`qr` only (prohibited with `meta`), and not with `device_id`: add QR to a number in coexistence."
+                  },
+                  country: {
+                    type: [
+                      "string",
+                      "null"
+                    ],
+                    pattern: "^[A-Za-z]{2}$",
+                    description: "`qr` only (prohibited with `meta`), and not with `device_id`: the country of the phone (ISO 3166-1 alpha-2, two letters, any case), where the WhatsApp session is opened from. The link returns it in lower case."
+                  },
+                  external_reference: {
+                    type: [
+                      "string",
+                      "null"
+                    ],
+                    maxLength: 255
+                  },
+                  return_url: {
+                    type: [
+                      "string",
+                      "null"
+                    ],
+                    format: "uri",
+                    maxLength: 2048,
+                    description: "`https` only. Gets `connect_link_id`, `status`, `device_id` and `error_code`, nothing else."
+                  },
+                  expires_in_minutes: {
+                    type: "integer",
+                    minimum: 30,
+                    maximum: 10080,
+                    description: "1440 by default."
+                  }
+                },
+                required: [
+                  "type"
+                ]
+              }
+            }
+          }
+        },
+        responses: {
+          "201": {
+            description: "Created",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    data: {
+                      $ref: "#/components/schemas/PendingSandboxConnectLinkCreated"
+                    }
+                  },
+                  required: [
+                    "data"
+                  ]
+                }
+              }
+            },
+            headers: {
+              "Cache-Control": {
+                schema: {
+                  type: "string",
+                  const: "no-store"
+                }
+              },
+              "Idempotent-Replayed": {
+                description: "`true` when the answer is a replay of the same `Idempotency-Key`.",
+                schema: {
+                  type: "string"
+                }
+              }
+            }
+          },
+          "403": {
+            description: "`numbers_not_included` or `number_limit_reached`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          },
+          "409": {
+            description: "`operation_in_progress`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          },
+          "422": {
+            description: "`invalid_request` (with `errors`), `invalid_reference_device`, `connection_type_mismatch`, `qr_requires_coexistence`, `method_already_present`, `idempotency_key_mismatch` or `invalid_idempotency_key`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          },
+          "429": {
+            description: '`too_many_open_links`, or the per-minute limit (`{"message": "Too Many Attempts."}`)',
+            content: {
+              "application/json": {
+                schema: {
+                  oneOf: [
+                    {
+                      $ref: "#/components/schemas/PendingSandboxAccountsError"
+                    },
+                    {
+                      $ref: "#/components/schemas/PendingSandboxTooManyAttempts"
+                    }
+                  ]
+                }
+              }
+            }
+          },
+          "503": {
+            description: "`meta_connect_disabled`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          }
+        },
+        "x-fc-validation-error": "invalid_request"
+      }
+    },
+    "/api/v1/connect-links/{link}": {
+      get: {
+        operationId: "pendingSandboxConnectLinks.show",
+        summary: "Show a sign-up link",
+        description: "The link without its token: its `status`, the `device_id` it created and its `error_code`.\n\n**Pending of the spec**: from the contract of the sign-up by API (22-10, A1), while accounts writes it; its OpenAPI will be the final source.",
+        tags: [
+          "ConnectLink"
+        ],
+        "x-fc-domain": "accounts",
+        "x-fc-permission": "accounts:read",
+        "x-fc-pending": "accounts-alta-de-numeros",
+        parameters: [
+          {
+            name: "link",
+            in: "path",
+            required: true,
+            schema: {
+              type: "integer"
+            }
+          }
+        ],
+        responses: {
+          "200": {
+            description: "OK",
+            content: {
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    data: {
+                      $ref: "#/components/schemas/PendingSandboxConnectLink"
+                    }
+                  },
+                  required: [
+                    "data"
+                  ]
+                }
+              }
+            }
+          },
+          "404": {
+            description: "`not_found`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          }
+        }
+      },
+      delete: {
+        operationId: "pendingSandboxConnectLinks.destroy",
+        summary: "Revoke a sign-up link",
+        description: "Revokes a `pending` link: `204` without a body. `409 link_not_pending` if it is not pending any more; `404` if it does not exist.\n\nAmendment v0.1 (23-10): as accounts did it in `feat/alta-de-numeros-api` `52d49b319`.",
+        tags: [
+          "ConnectLink"
+        ],
+        "x-fc-domain": "accounts",
+        "x-fc-permission": "accounts:operate",
+        "x-fc-pending": "accounts-alta-de-numeros",
+        parameters: [
+          {
+            name: "link",
+            in: "path",
+            required: true,
+            schema: {
+              type: "integer"
+            }
+          }
+        ],
+        responses: {
+          "204": {
+            description: "Revoked"
+          },
+          "404": {
+            description: "`not_found`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          },
+          "409": {
+            description: "`link_not_pending`",
+            content: {
+              "application/json": {
+                schema: {
+                  $ref: "#/components/schemas/PendingSandboxAccountsError"
+                }
+              }
+            }
+          }
+        }
+      }
     }
   },
   webhooks: {
@@ -31717,18 +32375,43 @@ var openapi_default = {
                               "string",
                               "null"
                             ],
-                            description: "Solo d\xEDgitos, sin `+`."
+                            description: "Digits only, without `+`."
+                          },
+                          connection: {
+                            type: "string",
+                            enum: [
+                              "qr",
+                              "coexistence",
+                              "dedicated"
+                            ]
+                          },
+                          external_reference: {
+                            type: [
+                              "string",
+                              "null"
+                            ]
                           }
                         },
                         required: [
                           "id",
                           "name",
-                          "number"
-                        ]
+                          "number",
+                          "connection",
+                          "external_reference"
+                        ],
+                        "x-fc-pending": "accounts-alta-de-numeros"
                       },
                       connected_at: {
                         type: "string",
                         format: "date-time"
+                      },
+                      connect_link_id: {
+                        type: [
+                          "integer",
+                          "null"
+                        ],
+                        description: "The sign-up link of this connection, or `null`. Optional until accounts deploys it.",
+                        "x-fc-pending": "accounts-alta-de-numeros"
                       }
                     },
                     required: [
@@ -31737,6 +32420,23 @@ var openapi_default = {
                     ]
                   }
                 }
+              },
+              example: {
+                id: "evt_0f8e4b526c1d4c7a9a3e2b5d",
+                type: "device.connected",
+                version: 1,
+                occurred_at: "2026-10-22T03:00:00Z",
+                data: {
+                  device: {
+                    id: 4521,
+                    name: "Ventas",
+                    number: "5491100000000",
+                    connection: "qr",
+                    external_reference: "cliente-8841"
+                  },
+                  connected_at: "2026-10-22T03:00:00+00:00",
+                  connect_link_id: 812
+                }
               }
             }
           }
@@ -31776,18 +32476,56 @@ var openapi_default = {
                               "string",
                               "null"
                             ],
-                            description: "Solo d\xEDgitos, sin `+`."
+                            description: "Digits only, without `+`."
+                          },
+                          connection: {
+                            type: "string",
+                            enum: [
+                              "qr",
+                              "coexistence",
+                              "dedicated"
+                            ]
+                          },
+                          external_reference: {
+                            type: [
+                              "string",
+                              "null"
+                            ]
                           }
                         },
                         required: [
                           "id",
                           "name",
-                          "number"
-                        ]
+                          "number",
+                          "connection",
+                          "external_reference"
+                        ],
+                        "x-fc-pending": "accounts-alta-de-numeros"
                       },
                       disconnected_at: {
                         type: "string",
                         format: "date-time"
+                      },
+                      reason: {
+                        type: "string",
+                        enum: [
+                          "qr_logged_out",
+                          "meta_account_not_registered",
+                          "shadow_ban_protection",
+                          "provider_error",
+                          "unknown",
+                          "disconnected_by_user"
+                        ],
+                        description: "`disconnected_by_user` [part 2]: \xABDesconectar\xBB or \xABBorrar datos\xBB of an official number in the panel.",
+                        "x-fc-pending": "accounts-alta-de-numeros"
+                      },
+                      connect_link_id: {
+                        type: [
+                          "integer",
+                          "null"
+                        ],
+                        description: "The sign-up link that connected this number last, or `null`. Optional until accounts deploys it.",
+                        "x-fc-pending": "accounts-alta-de-numeros"
                       }
                     },
                     required: [
@@ -31796,6 +32534,24 @@ var openapi_default = {
                     ]
                   }
                 }
+              },
+              example: {
+                id: "evt_0f8e4b526c1d4c7a9a3e2b5d",
+                type: "device.disconnected",
+                version: 1,
+                occurred_at: "2026-10-22T03:00:00Z",
+                data: {
+                  device: {
+                    id: 4521,
+                    name: "Ventas",
+                    number: "5491100000000",
+                    connection: "dedicated",
+                    external_reference: "cliente-8841"
+                  },
+                  disconnected_at: "2026-10-22T03:00:00+00:00",
+                  reason: "meta_account_not_registered",
+                  connect_link_id: null
+                }
               }
             }
           }
@@ -32264,6 +33020,226 @@ var openapi_default = {
           }
         }
       }
+    },
+    "device.deleted": {
+      post: {
+        summary: "device.deleted",
+        description: "A number of the account was deleted: its place of the quota is free again. Emitted once per number, before the row goes.\n\n**Pending of the spec**: from the contract of the sign-up by API (22-10, A3), while accounts writes it; its OpenAPI will be the final source.",
+        "x-fc-status": "live",
+        "x-fc-domain": "accounts",
+        "x-fc-pending": "accounts-alta-de-numeros",
+        requestBody: {
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: {
+                  data: {
+                    type: "object",
+                    properties: {
+                      device: {
+                        type: "object",
+                        properties: {
+                          id: {
+                            type: "integer"
+                          },
+                          name: {
+                            type: [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          number: {
+                            type: [
+                              "string",
+                              "null"
+                            ],
+                            description: "Digits only, without `+`."
+                          },
+                          connection: {
+                            type: "string",
+                            enum: [
+                              "qr",
+                              "coexistence",
+                              "dedicated"
+                            ]
+                          },
+                          external_reference: {
+                            type: [
+                              "string",
+                              "null"
+                            ]
+                          }
+                        },
+                        required: [
+                          "id",
+                          "name",
+                          "number",
+                          "connection",
+                          "external_reference"
+                        ]
+                      },
+                      deleted_at: {
+                        type: "string",
+                        format: "date-time"
+                      },
+                      connect_link_id: {
+                        type: [
+                          "integer",
+                          "null"
+                        ],
+                        description: "The sign-up link that connected this number last, or `null`. Optional until accounts deploys it."
+                      }
+                    },
+                    required: [
+                      "device",
+                      "deleted_at"
+                    ]
+                  }
+                }
+              },
+              example: {
+                id: "evt_0f8e4b526c1d4c7a9a3e2b5d",
+                type: "device.deleted",
+                version: 1,
+                occurred_at: "2026-10-22T03:00:00Z",
+                data: {
+                  device: {
+                    id: 4521,
+                    name: "Ventas",
+                    number: "5491100000000",
+                    connection: "qr",
+                    external_reference: "cliente-8841"
+                  },
+                  deleted_at: "2026-10-22T03:00:00+00:00",
+                  connect_link_id: 812
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "device.health_changed": {
+      post: {
+        summary: "device.health_changed",
+        description: "The aggregated health of an official number changed (not on every webhook of Meta).\n\n**Pending of the spec**: from the contract of the sign-up by API (22-10, A3), while accounts writes it; its OpenAPI will be the final source. Pending of the user: PR #1103 of accounts (open) defines `state: { previous, current }`; accounts implemented this contract. One of the two has to be chosen before merging.",
+        "x-fc-status": "live",
+        "x-fc-domain": "accounts",
+        "x-fc-pending": "accounts-alta-de-numeros",
+        requestBody: {
+          content: {
+            "application/json": {
+              schema: {
+                type: "object",
+                properties: {
+                  data: {
+                    type: "object",
+                    properties: {
+                      device: {
+                        type: "object",
+                        properties: {
+                          id: {
+                            type: "integer"
+                          },
+                          name: {
+                            type: [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          number: {
+                            type: [
+                              "string",
+                              "null"
+                            ],
+                            description: "Digits only, without `+`."
+                          },
+                          connection: {
+                            type: "string",
+                            enum: [
+                              "qr",
+                              "coexistence",
+                              "dedicated"
+                            ]
+                          },
+                          external_reference: {
+                            type: [
+                              "string",
+                              "null"
+                            ]
+                          }
+                        },
+                        required: [
+                          "id",
+                          "name",
+                          "number",
+                          "connection",
+                          "external_reference"
+                        ]
+                      },
+                      previous_state: {
+                        type: "string",
+                        enum: [
+                          "available",
+                          "limited",
+                          "blocked",
+                          "unknown"
+                        ]
+                      },
+                      state: {
+                        type: "string",
+                        enum: [
+                          "available",
+                          "limited",
+                          "blocked",
+                          "unknown"
+                        ]
+                      },
+                      changed_at: {
+                        type: "string",
+                        format: "date-time"
+                      },
+                      connect_link_id: {
+                        type: [
+                          "integer",
+                          "null"
+                        ],
+                        description: "The sign-up link that connected this number last, or `null`. Optional until accounts deploys it."
+                      }
+                    },
+                    required: [
+                      "device",
+                      "previous_state",
+                      "state",
+                      "changed_at"
+                    ]
+                  }
+                }
+              },
+              example: {
+                id: "evt_0f8e4b526c1d4c7a9a3e2b5d",
+                type: "device.health_changed",
+                version: 1,
+                occurred_at: "2026-10-22T03:00:00Z",
+                data: {
+                  device: {
+                    id: 4521,
+                    name: "Ventas",
+                    number: "5491100000000",
+                    connection: "dedicated",
+                    external_reference: "cliente-8841"
+                  },
+                  previous_state: "available",
+                  state: "limited",
+                  changed_at: "2026-10-22T03:00:00+00:00",
+                  connect_link_id: 812
+                }
+              }
+            }
+          }
+        }
+      }
     }
   },
   components: {
@@ -41349,6 +42325,345 @@ var openapi_default = {
         required: [
           "message"
         ]
+      },
+      PendingSandboxAccountsError: {
+        type: "object",
+        description: "An error of accounts: `error` (the code) and `message`; some codes add keys (`device_id`, `limit`).",
+        properties: {
+          error: {
+            type: "string"
+          },
+          message: {
+            type: "string"
+          }
+        },
+        required: [
+          "error",
+          "message"
+        ]
+      },
+      PendingSandboxModelNotFound: {
+        type: "object",
+        description: 'The 404 of a model in accounts: only `message`, "Object not found".',
+        properties: {
+          message: {
+            type: "string"
+          }
+        },
+        required: [
+          "message"
+        ]
+      },
+      PendingSandboxDeviceQr: {
+        type: "object",
+        properties: {
+          data: {
+            type: "object",
+            properties: {
+              connected: {
+                type: "boolean"
+              },
+              qr_code: {
+                type: [
+                  "string",
+                  "null"
+                ],
+                description: "A PNG image as a data URI; `null` when the number is already connected."
+              },
+              expires_in: {
+                type: "integer",
+                description: "Seconds after which to ask for it again: 5 with a QR (ask for it again and show the new one at once: an old code does not link), 3 while the session starts, 0 once connected. Never `null`."
+              }
+            },
+            required: [
+              "connected",
+              "qr_code",
+              "expires_in"
+            ]
+          }
+        },
+        required: [
+          "data"
+        ]
+      },
+      PendingSandboxConnectLink: {
+        type: "object",
+        description: "A sign-up link, without its token.",
+        properties: {
+          id: {
+            type: "integer"
+          },
+          type: {
+            type: "string",
+            enum: [
+              "meta",
+              "qr"
+            ]
+          },
+          status: {
+            type: "string",
+            enum: [
+              "pending",
+              "completed",
+              "failed",
+              "expired",
+              "revoked"
+            ]
+          },
+          expires_at: {
+            type: "string",
+            format: "date-time"
+          },
+          allowed_connection_types: {
+            type: [
+              "array",
+              "null"
+            ],
+            items: {
+              type: "string",
+              enum: [
+                "coexistence",
+                "dedicated"
+              ]
+            }
+          },
+          provision_us_number: {
+            type: "boolean"
+          },
+          country: {
+            type: [
+              "string",
+              "null"
+            ],
+            description: "`qr` links that create a number only: the country of the phone, two letters in lower case. `null` otherwise."
+          },
+          device_id: {
+            type: [
+              "integer",
+              "null"
+            ],
+            description: "Only for a reconnection, or once the link is `completed`."
+          },
+          external_reference: {
+            type: [
+              "string",
+              "null"
+            ]
+          },
+          return_url: {
+            type: [
+              "string",
+              "null"
+            ]
+          },
+          error_code: {
+            type: [
+              "string",
+              "null"
+            ],
+            enum: [
+              "link_expired",
+              "already_used",
+              "revoked",
+              "quota_exceeded",
+              "trial_number_blocked",
+              "facebook_auth_failed",
+              "meta_error",
+              "number_not_owned",
+              "qr_timeout",
+              "provider_error",
+              null
+            ]
+          },
+          created_at: {
+            type: "string",
+            format: "date-time"
+          },
+          completed_at: {
+            type: [
+              "string",
+              "null"
+            ],
+            format: "date-time"
+          }
+        },
+        required: [
+          "id",
+          "type",
+          "status",
+          "expires_at",
+          "allowed_connection_types",
+          "provision_us_number",
+          "country",
+          "device_id",
+          "external_reference",
+          "return_url",
+          "error_code",
+          "created_at",
+          "completed_at"
+        ]
+      },
+      PendingSandboxConnectLinkCreated: {
+        type: "object",
+        description: "The link as created: the only answer that carries `url`, with the raw token.",
+        properties: {
+          id: {
+            type: "integer"
+          },
+          type: {
+            type: "string",
+            enum: [
+              "meta",
+              "qr"
+            ]
+          },
+          status: {
+            type: "string",
+            enum: [
+              "pending",
+              "completed",
+              "failed",
+              "expired",
+              "revoked"
+            ]
+          },
+          expires_at: {
+            type: "string",
+            format: "date-time"
+          },
+          allowed_connection_types: {
+            type: [
+              "array",
+              "null"
+            ],
+            items: {
+              type: "string",
+              enum: [
+                "coexistence",
+                "dedicated"
+              ]
+            }
+          },
+          provision_us_number: {
+            type: "boolean"
+          },
+          country: {
+            type: [
+              "string",
+              "null"
+            ],
+            description: "`qr` links that create a number only: the country of the phone, two letters in lower case. `null` otherwise."
+          },
+          device_id: {
+            type: [
+              "integer",
+              "null"
+            ],
+            description: "Only for a reconnection, or once the link is `completed`."
+          },
+          external_reference: {
+            type: [
+              "string",
+              "null"
+            ]
+          },
+          return_url: {
+            type: [
+              "string",
+              "null"
+            ]
+          },
+          error_code: {
+            type: [
+              "string",
+              "null"
+            ],
+            enum: [
+              "link_expired",
+              "already_used",
+              "revoked",
+              "quota_exceeded",
+              "trial_number_blocked",
+              "facebook_auth_failed",
+              "meta_error",
+              "number_not_owned",
+              "qr_timeout",
+              "provider_error",
+              null
+            ]
+          },
+          created_at: {
+            type: "string",
+            format: "date-time"
+          },
+          completed_at: {
+            type: [
+              "string",
+              "null"
+            ],
+            format: "date-time"
+          },
+          url: {
+            type: "string",
+            format: "uri",
+            description: "`https://api.funnelchat.com/connect/<token>`, a 43-character base64url token. Shown once."
+          }
+        },
+        required: [
+          "id",
+          "type",
+          "status",
+          "expires_at",
+          "allowed_connection_types",
+          "provision_us_number",
+          "country",
+          "device_id",
+          "external_reference",
+          "return_url",
+          "error_code",
+          "created_at",
+          "completed_at",
+          "url"
+        ]
+      },
+      PendingSandboxInvalidRequest: {
+        type: "object",
+        description: "The `422` of these routes: `invalid_request` with the errors per field.",
+        properties: {
+          error: {
+            type: "string",
+            const: "invalid_request"
+          },
+          message: {
+            type: "string"
+          },
+          errors: {
+            type: "object",
+            additionalProperties: {
+              type: "array",
+              items: {
+                type: "string"
+              }
+            }
+          }
+        },
+        required: [
+          "error",
+          "message",
+          "errors"
+        ]
+      },
+      PendingSandboxTooManyAttempts: {
+        type: "object",
+        description: 'Laravel\'s `429` of the per-minute limit: only `message`, "Too Many Attempts.", with `Retry-After`.',
+        properties: {
+          message: {
+            type: "string"
+          }
+        },
+        required: [
+          "message"
+        ]
       }
     },
     responses: {
@@ -41768,7 +43083,7 @@ var openapi_default = {
     inputs: {
       "spec/funnelchat.json": "8bbbae569b4cab520884db98f28204156c1bd6c629578bee609343c193e0dadb",
       "spec/pending.json": "a14bc4dbc3025d3e958ffda8afd1fa9fdab34af264418060825f3300799aceb0",
-      "spec/pending-sandbox.json": "1f4dbb082f57a1093bd3e36260108ee7a15d64683a75ec1a366091a3127c498f"
+      "spec/pending-sandbox.json": "b2f7c2ccbab7c90f7adf22f8c3cec6700ff647700571dc306c898af8127bb22d"
     },
     snapshot_commit: "0ef4abb008870ed8c7cae49a08900a81e5e57ed8",
     pending_commit: "88557ce7819c5a4061e84c58053a1b6c49f35ec2",
@@ -41827,15 +43142,28 @@ var openapi_default = {
       "GET /api/v1/forms/families/{familyId}/responses [pending-sandbox.json]",
       "GET /api/v1/forms/families/{familyId}/responses/{runId} [pending-sandbox.json]",
       "POST /api/v1/contacts/{contact}/message/form [pending-sandbox.json]",
+      "POST /api/v1/devices [pending-sandbox.json]",
+      "GET /api/v1/devices/{device}/qr [pending-sandbox.json]",
+      "GET /api/v1/connect-links [pending-sandbox.json]",
+      "POST /api/v1/connect-links [pending-sandbox.json]",
+      "GET /api/v1/connect-links/{link} [pending-sandbox.json]",
+      "DELETE /api/v1/connect-links/{link} [pending-sandbox.json]",
       "POST /api/v1/contacts/{contact}/message (cuerpo: file_type, file_name) [pending-sandbox.json]",
       "POST /api/v1/message/send-message (cuerpo: file_type, file_name) [pending-sandbox.json]",
+      "PUT /api/v1/devices/{device} (cuerpo: external_reference) [pending-sandbox.json]",
+      "GET /api/v1/devices (par\xE1metros: external_reference) [pending-sandbox.json]",
       "POST /api/v1/contacts/{contact}/message (respuestas: 200) [pending-sandbox.json]",
       "POST /api/v1/message/send-message (respuestas: 200) [pending-sandbox.json]",
       "POST /api/v1/devices/{device}/templates/{template}/send-template (respuestas: 200) [pending-sandbox.json]",
       "POST /api/v1/contacts/{contact}/message/contact-card (respuestas: 200) [pending-sandbox.json]",
       "POST /api/v1/contacts/{contact}/messages/{message}/forward (respuestas: 200) [pending-sandbox.json]",
+      "DELETE /api/v1/devices/{device} (respuestas: 200) [pending-sandbox.json]",
+      "webhook device.deleted [pending-sandbox.json]",
+      "webhook device.health_changed [pending-sandbox.json]",
       "webhook message.received (data: device_id) [pending-sandbox.json]",
-      "webhook message.status_changed (data: error) [pending-sandbox.json]"
+      "webhook message.status_changed (data: error) [pending-sandbox.json]",
+      "webhook device.connected (data: device, connect_link_id) [pending-sandbox.json]",
+      "webhook device.disconnected (data: device, reason, connect_link_id) [pending-sandbox.json]"
     ]
   }
 };
@@ -41914,8 +43242,8 @@ function successResponse(op) {
   const entries = Object.entries(op.responses ?? {}).filter(([status2]) => /^2\d\d$/.test(status2)).sort(([a], [b]) => Number(a) - Number(b));
   const [status, raw] = entries[0] ?? ["200", void 0];
   const response = deref(raw);
-  const json = response?.content?.["application/json"];
-  return { status: Number(status), schema: json?.schema, example: json?.example };
+  const json2 = response?.content?.["application/json"];
+  return { status: Number(status), schema: json2?.schema, example: json2?.example };
 }
 
 // src/openapi/example.ts
@@ -42017,7 +43345,49 @@ function specData(type) {
   }
   return {};
 }
-var catalog = catalog_default.entries;
+var PENDING_DEVICE_ENTRIES = [
+  {
+    type: "device.deleted",
+    area: "accounts",
+    status: "active",
+    is_critical: false,
+    label: "N\xFAmero eliminado",
+    description: "Uno de los n\xFAmeros de WhatsApp de la cuenta se elimin\xF3 y liber\xF3 su lugar del plan.",
+    subscribable: true
+  },
+  {
+    type: "device.health_changed",
+    area: "accounts",
+    status: "active",
+    is_critical: false,
+    label: "Cambi\xF3 la salud de un n\xFAmero",
+    description: "Cambi\xF3 el estado de salud de uno de los n\xFAmeros oficiales de la cuenta: disponible, limitado, bloqueado o desconocido.",
+    subscribable: true
+  }
+];
+function envelopeFromSpec(type) {
+  for (const [key, item] of Object.entries(spec.webhooks ?? {})) {
+    if (eventTypeOfKey(key) !== type) continue;
+    const example = item.post?.requestBody?.content?.["application/json"]?.example;
+    if (isRecord(example) && "data" in example) return structuredClone(example);
+  }
+  return null;
+}
+function withPendingDeviceEvents(entries) {
+  const out = entries.map((entry) => {
+    if (entry.type !== "device.connected" && entry.type !== "device.disconnected") return entry;
+    const data = entry.example?.data;
+    if (isRecord(data) && isRecord(data.device) && "connection" in data.device) return entry;
+    const example = envelopeFromSpec(entry.type);
+    return example ? { ...entry, example } : entry;
+  });
+  const missing = PENDING_DEVICE_ENTRIES.filter((pending) => !out.some((entry) => entry.type === pending.type));
+  if (missing.length === 0) return out;
+  const after = out.map((entry) => entry.type.startsWith("device.")).lastIndexOf(true) + 1;
+  out.splice(after, 0, ...missing.map((pending) => ({ ...pending, example: envelopeFromSpec(pending.type) })));
+  return out;
+}
+var catalog = withPendingDeviceEvents(catalog_default.entries);
 function catalogEntry(type) {
   return catalog.find((entry) => entry.type === type);
 }
@@ -42337,6 +43707,7 @@ var edgeError = (code) => {
 var methodNotAllowed = (method, allowed) => new ApiError(405, "method_not_allowed", `El m\xE9todo ${method} no est\xE1 disponible para esta ruta. Usa ${allowed.join(", ")}.`, {}, { Allow: allowed.join(", ") });
 var validationFailed = (errors) => new ApiError(422, "validation_failed", summarize(errors), { errors });
 var fieldError = (field, message) => validationFailed({ [field]: [message] });
+var invalidRequest = (errors) => new ApiError(422, "invalid_request", summarize(errors), { errors });
 
 // src/forms/templates.ts
 var FORM_TEMPLATES = [
@@ -42608,8 +43979,8 @@ function parseForced(mode, value, field) {
 function takeForcedFailure(app, headers, contactId) {
   const reject = headers["x-sandbox-reject"];
   if (reject) return { mode: "reject", code: parseForced("reject", reject, "X-Sandbox-Reject") };
-  const fail = headers["x-sandbox-fail"];
-  if (fail) return { mode: "fail", code: parseForced("fail", fail, "X-Sandbox-Fail") };
+  const fail2 = headers["x-sandbox-fail"];
+  if (fail2) return { mode: "fail", code: parseForced("fail", fail2, "X-Sandbox-Fail") };
   const armed = app.store.failures.find((f) => f.mode !== "edge" && f.remaining > 0 && (f.contactId === null || f.contactId === contactId));
   if (!armed) return null;
   armed.remaining--;
@@ -42785,7 +44156,7 @@ function resolveFile(body2, style) {
 
 // package.json
 var package_default = {
-  version: "0.1.1"};
+  version: "0.2.0"};
 
 // src/version.ts
 var VERSION = package_default.version;
@@ -42821,6 +44192,13 @@ var Store = class {
   forms = /* @__PURE__ */ new Map();
   formFamilies = /* @__PURE__ */ new Map();
   formRuns = /* @__PURE__ */ new Map();
+  connectLinks = /* @__PURE__ */ new Map();
+  /** When each `POST /connect-links` arrived in the last minute: the per-minute limit. */
+  linkAttempts = [];
+  /** Answers by `Idempotency-Key`, per resource (`devices`, `connect-links`): one account. */
+  idempotency = /* @__PURE__ */ new Map();
+  /** The number quota of the account and the switch of the Meta sign-up (`POST /_sandbox/numbers`). */
+  numbers = { limit: 5, included: true, trial: false, metaConnect: false, linksPerMinute: 10 };
   /** Last inbound message per `contactId:deviceId`: the 24-hour window. */
   lastInbound = /* @__PURE__ */ new Map();
   /** API-key sends per contact since its last inbound message: the antiblock counters. */
@@ -42843,7 +44221,9 @@ var Store = class {
     note: new Sequence(1),
     formFamily: new Sequence(8001),
     formVersion: new Sequence(8101),
-    formRun: new Sequence(1)
+    formRun: new Sequence(1),
+    device: new Sequence(5),
+    connectLink: new Sequence(1)
   };
   logRequest(entry) {
     const full = { id: this.ids.request.next(), ...entry };
@@ -42877,8 +44257,14 @@ function seed(store, now = /* @__PURE__ */ new Date()) {
     provider: 2,
     kind: "cloud",
     connected: true,
+    coexistence: false,
+    fromPool: false,
+    externalReference: null,
+    health: "available",
+    lastConnectLinkId: null,
     wabaId: "100000000000001",
     phoneNumberId: "100000000000003",
+    firstConnectedAt: now,
     createdAt: now
   });
   store.devices.set(4, {
@@ -42888,8 +44274,14 @@ function seed(store, now = /* @__PURE__ */ new Date()) {
     provider: 1,
     kind: "qr",
     connected: true,
+    coexistence: false,
+    fromPool: false,
+    externalReference: null,
+    health: null,
+    lastConnectLinkId: null,
     wabaId: null,
     phoneNumberId: null,
+    firstConnectedAt: now,
     createdAt: now
   });
   const contactId = store.ids.contact.next();
@@ -43161,8 +44553,15 @@ var SandboxApp = class {
   webhooks;
   /** Grows on every reset, so work started before a reset does not touch the new state. */
   generation = 0;
+  /** The address the sandbox listens on, once it does: the host of the sign-up links when `publicUrl` is not set. */
+  listenUrl = null;
+  /** `http://host:port` of the sign-up page: `publicUrl`, or where the sandbox listens. */
+  get publicUrl() {
+    return this.config.publicUrl ?? this.listenUrl ?? `http://localhost:${this.config.port}`;
+  }
   populate() {
     seed(this.store);
+    this.store.numbers = { ...this.config.numbers };
     for (const preset of this.config.subscriptions) {
       const unknown = preset.events.filter((e) => !isSubscribable(e));
       if (unknown.length) this.logger.warn(`subscription from the configuration with types that are not in the catalog: ${unknown.join(", ")}`);
@@ -43209,6 +44608,49 @@ function listContext(ctx) {
 function body(ctx) {
   return typeof ctx.body === "object" && ctx.body !== null && !Array.isArray(ctx.body) ? ctx.body : {};
 }
+var IDEMPOTENCY_HEADER = "Idempotency-Key";
+var REPLAYED_HEADER = "Idempotent-Replayed";
+var TTL_MS = 24 * 60 * 60 * 1e3;
+var running = /* @__PURE__ */ new WeakMap();
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (typeof value !== "object" || value === null) return value;
+  return Object.fromEntries(
+    Object.keys(value).sort().map((key) => [key, canonical(value[key])])
+  );
+}
+async function idempotent(ctx, resource, run) {
+  const key = ctx.headers["idempotency-key"];
+  if (key === void 0) return run();
+  if (key.length < 1 || key.length > 255 || !/^[\x21-\x7e]+$/.test(key)) {
+    throw new ApiError(422, "invalid_idempotency_key", `El header ${IDEMPOTENCY_HEADER} debe tener entre 1 y 255 caracteres visibles, sin espacios.`);
+  }
+  const { store } = ctx.app;
+  const now = Date.now();
+  for (const [k, answer] of store.idempotency) if (now - answer.storedAt.getTime() >= TTL_MS) store.idempotency.delete(k);
+  const slot = `${resource}|${key}`;
+  const fingerprint = createHash("sha256").update(JSON.stringify([ctx.op.method, ctx.pathname, canonical(ctx.body ?? null)])).digest("hex");
+  const stored = store.idempotency.get(slot);
+  if (stored) {
+    if (stored.fingerprint !== fingerprint) {
+      throw new ApiError(422, "idempotency_key_mismatch", `Ya usaste este ${IDEMPOTENCY_HEADER} con otro cuerpo. Usa una clave nueva para otra operaci\xF3n.`);
+    }
+    return { status: stored.status, body: structuredClone(stored.body), headers: { ...stored.headers, [REPLAYED_HEADER]: "true" } };
+  }
+  const inFlight = running.get(ctx.app) ?? /* @__PURE__ */ new Set();
+  running.set(ctx.app, inFlight);
+  if (inFlight.has(slot)) throw new ApiError(409, "operation_in_progress", `Una operaci\xF3n con este ${IDEMPOTENCY_HEADER} todav\xEDa est\xE1 en curso.`);
+  inFlight.add(slot);
+  try {
+    const result = await run();
+    if (result.status >= 200 && result.status < 300) {
+      store.idempotency.set(slot, { fingerprint, status: result.status, body: structuredClone(result.body), headers: { ...result.headers }, storedAt: /* @__PURE__ */ new Date() });
+    }
+    return result;
+  } finally {
+    inFlight.delete(slot);
+  }
+}
 
 // src/http/paginate.ts
 function perPageOf(query, fallback, max = 100) {
@@ -43230,27 +44672,27 @@ function urlWith(path, query, extra) {
 function paginate(items, ctx, map, fallbackPerPage = 25) {
   const perPage = perPageOf(ctx.query, fallbackPerPage);
   const pageRaw = Number(ctx.query.page ?? 1);
-  const page = Number.isInteger(pageRaw) && pageRaw > 0 ? pageRaw : 1;
+  const page2 = Number.isInteger(pageRaw) && pageRaw > 0 ? pageRaw : 1;
   const total = items.length;
   const lastPage = Math.max(1, Math.ceil(total / perPage));
-  const slice = items.slice((page - 1) * perPage, page * perPage);
-  const from = slice.length ? (page - 1) * perPage + 1 : null;
+  const slice = items.slice((page2 - 1) * perPage, page2 * perPage);
+  const from = slice.length ? (page2 - 1) * perPage + 1 : null;
   const to = slice.length ? from + slice.length - 1 : null;
   const link = (n) => urlWith(ctx.path, ctx.query, { page: n });
   const pageLinks = [
-    { url: page > 1 ? link(page - 1) : null, label: "&laquo; Anterior", active: false },
-    ...Array.from({ length: lastPage }, (_, i) => ({ url: link(i + 1), label: String(i + 1), active: i + 1 === page })),
-    { url: page < lastPage ? link(page + 1) : null, label: "Siguiente &raquo;", active: false }
+    { url: page2 > 1 ? link(page2 - 1) : null, label: "&laquo; Anterior", active: false },
+    ...Array.from({ length: lastPage }, (_, i) => ({ url: link(i + 1), label: String(i + 1), active: i + 1 === page2 })),
+    { url: page2 < lastPage ? link(page2 + 1) : null, label: "Siguiente &raquo;", active: false }
   ];
   return {
     data: slice.map(map),
     links: {
       first: link(1),
       last: link(lastPage),
-      prev: page > 1 ? link(page - 1) : null,
-      next: page < lastPage ? link(page + 1) : null
+      prev: page2 > 1 ? link(page2 - 1) : null,
+      next: page2 < lastPage ? link(page2 + 1) : null
     },
-    meta: { current_page: page, from, last_page: lastPage, links: pageLinks, path: ctx.path, per_page: perPage, to, total }
+    meta: { current_page: page2, from, last_page: lastPage, links: pageLinks, path: ctx.path, per_page: perPage, to, total }
   };
 }
 function encodeCursor(position) {
@@ -43457,7 +44899,7 @@ function deviceCapabilities(device) {
 function deviceHealth(device) {
   if (device.kind !== "cloud") return null;
   return {
-    state: device.connected ? "available" : "unknown",
+    state: device.health ?? "unknown",
     reason: null,
     reason_truncated: false,
     reason_key: null,
@@ -43469,15 +44911,19 @@ function deviceHealth(device) {
     stale: false
   };
 }
+function deviceConnection(device) {
+  if (device.kind === "qr") return "qr";
+  return device.coexistence ? "coexistence" : "dedicated";
+}
 function deviceResource(device) {
   return {
     id: device.id,
     alias: device.alias,
     image: "",
     color: device.kind === "cloud" ? "#25D366" : "#128C7E",
-    number: device.number,
+    number: device.number ?? "",
     normalized_number: device.number,
-    first_conecction_at: laravelJson(device.createdAt),
+    first_conecction_at: device.firstConnectedAt ? laravelJson(device.firstConnectedAt) : null,
     user_id: ACCOUNT_USER_ID,
     provider: device.provider,
     waba_id: device.wabaId ?? "",
@@ -43487,15 +44933,43 @@ function deviceResource(device) {
     active: 1,
     health: deviceHealth(device),
     number_key: device.number,
-    number_key_confirmed: true,
-    is_coexistence: false,
+    number_key_confirmed: device.number !== null,
+    is_coexistence: device.coexistence,
     slot_state: "held",
     pool_suspended: false,
     pool_suspension_reason: null,
     pool_keep: false,
     qr_allowed: device.kind === "qr",
     can_change_to_meta: false,
-    capabilities: deviceCapabilities(device)
+    capabilities: deviceCapabilities(device),
+    external_reference: device.externalReference,
+    connection: deviceConnection(device)
+  };
+}
+function eventDevice(device) {
+  return {
+    id: device.id,
+    name: device.alias,
+    number: device.number,
+    connection: deviceConnection(device),
+    external_reference: device.externalReference
+  };
+}
+function connectLinkResource(link) {
+  return {
+    id: link.id,
+    type: link.type,
+    status: link.status,
+    expires_at: iso8601(link.expiresAt),
+    allowed_connection_types: link.allowedConnectionTypes,
+    provision_us_number: link.provisionUsNumber,
+    country: link.country,
+    device_id: link.deviceId,
+    external_reference: link.externalReference,
+    return_url: link.returnUrl,
+    error_code: link.errorCode,
+    created_at: iso8601(link.createdAt),
+    completed_at: link.completedAt ? iso8601(link.completedAt) : null
   };
 }
 function publicMessage(message) {
@@ -43585,6 +45059,354 @@ function deliveryResource(delivery) {
   };
 }
 
+// src/numbers/numbers.ts
+var DISCONNECT_REASONS = ["qr_logged_out", "meta_account_not_registered", "shadow_ban_protection", "provider_error", "unknown", "disconnected_by_user"];
+var HEALTH_STATES = ["available", "limited", "blocked", "unknown"];
+var LINK_ERROR_CODES = [
+  "link_expired",
+  "already_used",
+  "revoked",
+  "quota_exceeded",
+  "trial_number_blocked",
+  "facebook_auth_failed",
+  "meta_error",
+  "number_not_owned",
+  "qr_timeout",
+  "provider_error"
+];
+var OPEN_LINKS_LIMIT = 20;
+var poolLimit = (app) => app.store.numbers.trial ? 1 : 3;
+var placeOf = (device) => device.number ?? `device:${device.id}`;
+function placesInUse(app) {
+  return new Set([...app.store.devices.values()].map(placeOf)).size;
+}
+var isPendingQr = (device) => device.kind === "qr" && !device.connected && device.firstConnectedAt === null;
+function pendingQrIds(app) {
+  return [...app.store.devices.values()].filter(isPendingQr).map((d) => d.id);
+}
+function checkQuota(app) {
+  const { numbers: numbers2 } = app.store;
+  if (!numbers2.included) {
+    throw new ApiError(403, "numbers_not_included", "Tu plan no incluye n\xFAmeros de WhatsApp.");
+  }
+  const used = placesInUse(app);
+  if (used >= numbers2.limit) {
+    throw new ApiError(403, "number_limit_reached", `Alcanzaste el l\xEDmite de ${numbers2.limit} n\xFAmeros de tu plan.`, {
+      limit: numbers2.limit,
+      used,
+      pending_device_ids: pendingQrIds(app)
+    });
+  }
+}
+function checkPendingNumber(app) {
+  const [pending] = pendingQrIds(app);
+  if (pending !== void 0) {
+    throw new ApiError(409, "pending_number_exists", "Ya tienes un n\xFAmero por QR sin conectar: con\xE9ctalo o b\xF3rralo antes de crear otro.", { device_id: pending });
+  }
+}
+var invalidReferenceDevice = () => new ApiError(422, "invalid_reference_device", "El n\xFAmero indicado no existe en la cuenta.");
+function checkSameNumber(app, id) {
+  const target = app.store.devices.get(Number(id));
+  if (!target) throw invalidReferenceDevice();
+  if (target.kind === "qr") {
+    throw new ApiError(422, "method_already_present", "Ese n\xFAmero ya tiene QR.", { device_id: target.id });
+  }
+  const sibling = [...app.store.devices.values()].find((d) => d.kind === "qr" && d.number !== null && d.number === target.number);
+  if (sibling) throw new ApiError(422, "method_already_present", "Ese n\xFAmero ya tiene QR.", { device_id: sibling.id });
+  if (!target.coexistence) {
+    throw new ApiError(422, "qr_requires_coexistence", "Solo puedes sumar QR a un n\xFAmero oficial que est\xE9 en coexistencia con la app de WhatsApp Business.");
+  }
+  return target;
+}
+function createDevice(app, input) {
+  const id = app.store.ids.device.next();
+  const now = /* @__PURE__ */ new Date();
+  const cloud = input.connection !== "qr";
+  const connected = input.connected ?? false;
+  const device = {
+    id,
+    alias: input.alias ?? `N\xFAmero ${id}`,
+    number: input.number ?? null,
+    provider: cloud ? 2 : 1,
+    kind: cloud ? "cloud" : "qr",
+    connected,
+    coexistence: input.connection === "coexistence",
+    fromPool: input.fromPool ?? false,
+    externalReference: input.externalReference ?? null,
+    health: cloud ? connected ? "available" : "unknown" : null,
+    lastConnectLinkId: null,
+    wabaId: cloud ? `1000000000${String(id).padStart(5, "0")}` : null,
+    phoneNumberId: cloud ? `2000000000${String(id).padStart(5, "0")}` : null,
+    firstConnectedAt: connected ? now : null,
+    createdAt: now
+  };
+  app.store.devices.set(id, device);
+  return device;
+}
+function fakeNumber(device) {
+  const tail = String(device.id).padStart(4, "0").slice(-4);
+  return device.fromPool ? `1555010${tail}` : `54911555${tail}`;
+}
+var eventData = (device, rest, connectLinkId = device.lastConnectLinkId) => ({
+  device: eventDevice(device),
+  ...rest,
+  connect_link_id: connectLinkId
+});
+function connectDevice(app, device, options = {}) {
+  if (device.connected) return null;
+  const at = /* @__PURE__ */ new Date();
+  const connectLinkId = options.connectLinkId ?? null;
+  if (connectLinkId !== null) device.lastConnectLinkId = connectLinkId;
+  if (options.number) device.number = options.number;
+  device.number ??= fakeNumber(device);
+  device.connected = true;
+  device.firstConnectedAt ??= at;
+  if (device.kind === "cloud" && (device.health === null || device.health === "unknown")) device.health = "available";
+  return app.webhooks.emit("device.connected", eventData(device, { connected_at: isoSeconds(at) }, connectLinkId), { occurredAt: at });
+}
+function disconnectDevice(app, device, reason) {
+  if (!device.connected) return null;
+  const at = /* @__PURE__ */ new Date();
+  device.connected = false;
+  return app.webhooks.emit("device.disconnected", eventData(device, { disconnected_at: isoSeconds(at), reason }), { occurredAt: at });
+}
+function setHealth(app, device, state2) {
+  const previous = device.health ?? "unknown";
+  if (previous === state2) return null;
+  device.health = state2;
+  const at = /* @__PURE__ */ new Date();
+  return app.webhooks.emit("device.health_changed", eventData(device, { previous_state: previous, state: state2, changed_at: isoSeconds(at) }), { occurredAt: at });
+}
+function deleteDevice(app, device) {
+  const at = /* @__PURE__ */ new Date();
+  const event = app.webhooks.emit("device.deleted", eventData(device, { deleted_at: isoSeconds(at) }), { occurredAt: at });
+  app.store.devices.delete(device.id);
+  for (const link of app.store.connectLinks.values()) {
+    if (link.reconnect && link.deviceId === device.id && link.status === "pending") {
+      link.status = "revoked";
+      link.errorCode = "revoked";
+    }
+  }
+  return event;
+}
+var sha256 = (text2) => createHash("sha256").update(text2).digest("hex");
+var newToken = () => randomBytes(32).toString("base64url");
+function refreshLink(link, now = /* @__PURE__ */ new Date()) {
+  if (link.status === "pending" && link.expiresAt.getTime() <= now.getTime()) {
+    link.status = "expired";
+    link.errorCode = "link_expired";
+  }
+  return link;
+}
+function findLinkByToken(app, token) {
+  const hash = sha256(token);
+  for (const link of app.store.connectLinks.values()) if (link.tokenHash === hash) return refreshLink(link);
+  return void 0;
+}
+function openLinks(app) {
+  let n = 0;
+  for (const link of app.store.connectLinks.values()) if (refreshLink(link).status === "pending") n++;
+  return n;
+}
+var META_ATTEMPTS = 5;
+var RETRYABLE = ["facebook_auth_failed", "meta_error"];
+function fail(link, code) {
+  link.status = "failed";
+  link.errorCode = code;
+  link.completedAt = /* @__PURE__ */ new Date();
+  return "failed";
+}
+function connectionAllowed(link, connection) {
+  return link.type !== "meta" || !connection || (link.allowedConnectionTypes ?? []).includes(connection);
+}
+function completeLink(app, link, input) {
+  if (input.outcome === "failed") {
+    const code = input.errorCode ?? (link.type === "qr" ? "qr_timeout" : "meta_error");
+    if (link.type === "meta" && RETRYABLE.includes(code)) {
+      link.failedAttempts++;
+      if (link.failedAttempts < META_ATTEMPTS) {
+        link.errorCode = null;
+        return "retry";
+      }
+    }
+    return fail(link, code);
+  }
+  link.status = "completed";
+  if (link.reconnect) {
+    const device2 = link.deviceId === null ? void 0 : app.store.devices.get(link.deviceId);
+    if (!device2) return fail(link, "provider_error");
+    link.completedAt = /* @__PURE__ */ new Date();
+    connectDevice(app, device2, { number: input.number, connectLinkId: link.id });
+    return "completed";
+  }
+  let connection = "qr";
+  let number = input.number ?? null;
+  let fromPool = false;
+  if (link.sameNumberAs !== null) {
+    const target = app.store.devices.get(link.sameNumberAs);
+    if (!target || !target.coexistence) return fail(link, "provider_error");
+    number = target.number;
+  } else {
+    try {
+      checkQuota(app);
+    } catch {
+      return fail(link, "quota_exceeded");
+    }
+  }
+  if (link.type === "meta") {
+    const allowed = link.allowedConnectionTypes ?? ["dedicated"];
+    connection = input.connection && allowed.includes(input.connection) ? input.connection : allowed[0];
+    if (connection === "dedicated" && link.provisionUsNumber && !number) {
+      const inPool = [...app.store.devices.values()].filter((d) => d.fromPool).length;
+      if (inPool >= poolLimit(app)) return fail(link, app.store.numbers.trial ? "trial_number_blocked" : "quota_exceeded");
+      fromPool = true;
+    }
+  }
+  const device = createDevice(app, { connection, externalReference: link.externalReference, fromPool, number });
+  link.deviceId = device.id;
+  link.completedAt = /* @__PURE__ */ new Date();
+  connectDevice(app, device, { connectLinkId: link.id });
+  return "completed";
+}
+function returnUrlFor(link) {
+  if (!link.returnUrl) return null;
+  const url = new URL(link.returnUrl);
+  url.searchParams.set("connect_link_id", String(link.id));
+  url.searchParams.set("status", link.status === "completed" ? "completed" : "failed");
+  if (link.deviceId !== null && link.status === "completed") url.searchParams.set("device_id", String(link.deviceId));
+  if (link.errorCode && link.status !== "completed") url.searchParams.set("error_code", link.errorCode);
+  return url.toString();
+}
+
+// src/handlers/connect-links.ts
+var DEFAULT_EXPIRES_IN_MINUTES = 1440;
+function linkOf(app, id) {
+  const link = app.store.connectLinks.get(Number(id));
+  if (!link) throw notFound("No encontramos ese link de alta en la cuenta.");
+  return refreshLink(link);
+}
+var present = (value) => value !== void 0 && value !== null && value !== "" && !(Array.isArray(value) && value.length === 0);
+function checkLinkBody(b) {
+  const errors = {};
+  const meta = b.type === "meta";
+  if (meta && !present(b.allowed_connection_types)) {
+    errors.allowed_connection_types = ["El campo allowed_connection_types es obligatorio cuando type es meta."];
+  }
+  if (!meta && present(b.allowed_connection_types)) {
+    errors.allowed_connection_types = ["El campo allowed_connection_types est\xE1 prohibido cuando type es qr."];
+  }
+  if (!meta && present(b.provision_us_number)) errors.provision_us_number = ["El campo provision_us_number est\xE1 prohibido cuando type es qr."];
+  else if (meta && b.provision_us_number === true) {
+    const allowed = Array.isArray(b.allowed_connection_types) ? b.allowed_connection_types : [];
+    if (present(b.device_id)) errors.provision_us_number = ["El campo provision_us_number no se acepta junto con device_id."];
+    else if (present(b.allowed_connection_types) && !allowed.includes("dedicated")) {
+      errors.provision_us_number = ["El campo provision_us_number exige dedicated en allowed_connection_types."];
+    }
+  }
+  if (meta && present(b.country)) errors.country = ["El campo country est\xE1 prohibido cuando type es meta."];
+  else if (present(b.country) && present(b.device_id)) errors.country = ["El campo country proh\xEDbe que device_id est\xE9 presente."];
+  if (meta && present(b.same_number_as)) errors.same_number_as = ["El campo same_number_as est\xE1 prohibido cuando type es meta."];
+  else if (present(b.same_number_as) && present(b.device_id)) errors.same_number_as = ["El campo same_number_as proh\xEDbe que device_id est\xE9 presente."];
+  if (present(b.return_url)) {
+    let url = null;
+    try {
+      url = new URL(String(b.return_url));
+    } catch {
+      url = null;
+    }
+    if (!url || url.protocol !== "https:") errors.return_url = ["El campo return_url debe ser una URL https."];
+  }
+  if (Object.keys(errors).length) throw invalidRequest(errors);
+}
+function throttle(app) {
+  const now = Date.now();
+  const { store } = app;
+  store.linkAttempts = store.linkAttempts.filter((at) => now - at < 6e4);
+  if (store.linkAttempts.length >= store.numbers.linksPerMinute) {
+    const retryAfter = Math.max(1, Math.ceil((6e4 - (now - store.linkAttempts[0])) / 1e3));
+    throw new RawApiError(429, { message: "Too Many Attempts." }, { "Retry-After": String(retryAfter) });
+  }
+  store.linkAttempts.push(now);
+}
+var connectLinkHandlers = {
+  "POST /api/v1/connect-links": (ctx) => {
+    throttle(ctx.app);
+    return idempotent(ctx, "connect-links", () => {
+      const { app } = ctx;
+      const b = body(ctx);
+      checkLinkBody(b);
+      if (b.type === "meta" && !app.store.numbers.metaConnect) {
+        throw new ApiError(503, "meta_connect_disabled", "El alta de n\xFAmeros oficiales por link no est\xE1 disponible todav\xEDa.");
+      }
+      const reconnect = present(b.device_id);
+      if (reconnect) {
+        const device = app.store.devices.get(Number(b.device_id));
+        if (!device) throw invalidReferenceDevice();
+        if (device.kind === "qr" !== (b.type === "qr")) {
+          throw new ApiError(422, "connection_type_mismatch", "El type del link tiene que coincidir con el m\xE9todo del n\xFAmero a reconectar.");
+        }
+      }
+      const sameNumberAs = present(b.same_number_as) ? checkSameNumber(app, b.same_number_as).id : null;
+      if (!reconnect && sameNumberAs === null) checkQuota(app);
+      if (openLinks(app) >= OPEN_LINKS_LIMIT) {
+        throw new ApiError(429, "too_many_open_links", `Tienes ${OPEN_LINKS_LIMIT} links de alta abiertos. Revoca alguno o espera a que venzan.`, { limit: OPEN_LINKS_LIMIT });
+      }
+      const now = /* @__PURE__ */ new Date();
+      const deviceId = reconnect ? Number(b.device_id) : null;
+      if (reconnect) {
+        for (const other of app.store.connectLinks.values()) {
+          if (other.reconnect && other.deviceId === deviceId && refreshLink(other).status === "pending") {
+            other.status = "revoked";
+            other.errorCode = "revoked";
+          }
+        }
+      }
+      const token = newToken();
+      const minutes = present(b.expires_in_minutes) ? Number(b.expires_in_minutes) : DEFAULT_EXPIRES_IN_MINUTES;
+      const link = {
+        id: app.store.ids.connectLink.next(),
+        type: b.type === "meta" ? "meta" : "qr",
+        status: "pending",
+        tokenHash: sha256(token),
+        allowedConnectionTypes: b.type === "meta" ? [...new Set(b.allowed_connection_types)] : null,
+        provisionUsNumber: b.type === "meta" && b.provision_us_number === true,
+        // accounts keeps it in lower case, and only on a QR link that creates a number.
+        country: b.type === "qr" && !reconnect && present(b.country) ? String(b.country).toLowerCase() : null,
+        deviceId,
+        reconnect,
+        sameNumberAs,
+        externalReference: present(b.external_reference) ? String(b.external_reference) : null,
+        returnUrl: present(b.return_url) ? String(b.return_url) : null,
+        errorCode: null,
+        failedAttempts: 0,
+        expiresAt: new Date(now.getTime() + minutes * 6e4),
+        createdAt: now,
+        completedAt: null
+      };
+      app.store.connectLinks.set(link.id, link);
+      app.logger.info(`sign-up link ${link.id} (${link.type}) \u2192 ${app.publicUrl}/connect/\u2026`);
+      const { id, type, status, ...rest } = connectLinkResource(link);
+      return { status: 201, body: { data: { id, type, status, url: `${app.publicUrl}/connect/${token}`, ...rest } }, headers: { "Cache-Control": "no-store" } };
+    });
+  },
+  // Paginated like the other lists, newest first (by id); filters by `status` and `external_reference`.
+  "GET /api/v1/connect-links": (ctx) => {
+    const { status, external_reference: reference } = ctx.query;
+    const list = [...ctx.app.store.connectLinks.values()].map((link) => refreshLink(link)).filter((link) => !status || link.status === status).filter((link) => reference === void 0 || reference === "" || link.externalReference === String(reference)).sort((a, b) => b.id - a.id);
+    return ok(paginate(list, listContext(ctx), connectLinkResource));
+  },
+  "GET /api/v1/connect-links/{link}": (ctx) => ok({ data: connectLinkResource(linkOf(ctx.app, ctx.path.link)) }),
+  "DELETE /api/v1/connect-links/{link}": (ctx) => {
+    const link = linkOf(ctx.app, ctx.path.link);
+    if (link.status !== "pending") {
+      throw new ApiError(409, "link_not_pending", `El link ya no est\xE1 pendiente: est\xE1 ${link.status}.`, { status: link.status });
+    }
+    link.status = "revoked";
+    link.errorCode = "revoked";
+    return noContent();
+  }
+};
+
 // src/handlers/contacts.ts
 function getContact(app, id) {
   const contact = app.store.contacts.get(Number(id));
@@ -43941,6 +45763,149 @@ function getCustomField(ctx) {
   if (!field) throw objectNotFound();
   return field;
 }
+var MODULES = 25;
+var SCALE = 6;
+var QUIET = 4;
+var crcTable2 = null;
+function crc32(bytes) {
+  if (!crcTable2) {
+    crcTable2 = new Int32Array(256);
+    for (let n = 0; n < 256; n++) {
+      let c = n;
+      for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+      crcTable2[n] = c;
+    }
+  }
+  let crc = -1;
+  for (const byte of bytes) crc = crcTable2[(crc ^ byte) & 255] ^ crc >>> 8;
+  return (crc ^ -1) >>> 0;
+}
+function chunk(type, data) {
+  const length = Buffer.alloc(4);
+  length.writeUInt32BE(data.length);
+  const body2 = Buffer.concat([Buffer.from(type, "ascii"), data]);
+  const crc = Buffer.alloc(4);
+  crc.writeUInt32BE(crc32(body2));
+  return Buffer.concat([length, body2, crc]);
+}
+function modules(seed2) {
+  const bits = createHash("sha512").update(seed2).digest();
+  const grid = Array.from(
+    { length: MODULES },
+    (_, y) => Array.from({ length: MODULES }, (_2, x) => {
+      const i = y * MODULES + x;
+      return (bits[i % bits.length] >> i % 8 & 1) === 1;
+    })
+  );
+  const finder = (ox, oy) => {
+    for (let y = -1; y <= 7; y++) {
+      for (let x = -1; x <= 7; x++) {
+        const gx = ox + x;
+        const gy = oy + y;
+        if (gx < 0 || gy < 0 || gx >= MODULES || gy >= MODULES) continue;
+        const ring = Math.max(Math.abs(x - 3), Math.abs(y - 3));
+        grid[gy][gx] = ring !== 2 && ring <= 3;
+      }
+    }
+  };
+  finder(0, 0);
+  finder(MODULES - 7, 0);
+  finder(0, MODULES - 7);
+  for (let i = 8; i < MODULES - 8; i++) {
+    grid[6][i] = i % 2 === 0;
+    grid[i][6] = i % 2 === 0;
+  }
+  return grid;
+}
+function fakeQrDataUri(seed2) {
+  const grid = modules(seed2);
+  const size = (MODULES + QUIET * 2) * SCALE;
+  const raw = Buffer.alloc((size + 1) * size, 255);
+  for (let y = 0; y < size; y++) {
+    raw[y * (size + 1)] = 0;
+    const my = Math.floor(y / SCALE) - QUIET;
+    for (let x = 0; x < size; x++) {
+      const mx = Math.floor(x / SCALE) - QUIET;
+      const dark = my >= 0 && mx >= 0 && my < MODULES && mx < MODULES && grid[my][mx];
+      if (dark) raw[y * (size + 1) + 1 + x] = 0;
+    }
+  }
+  const header = Buffer.alloc(13);
+  header.writeUInt32BE(size, 0);
+  header.writeUInt32BE(size, 4);
+  header[8] = 8;
+  header[9] = 0;
+  const png = Buffer.concat([
+    Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
+    chunk("IHDR", header),
+    chunk("IDAT", deflateSync(raw)),
+    chunk("IEND", Buffer.alloc(0))
+  ]);
+  return `data:image/png;base64,${png.toString("base64")}`;
+}
+
+// src/handlers/devices.ts
+var QR_EXPIRES_IN = 5;
+function deviceOf(app, id) {
+  const device = app.store.devices.get(Number(id));
+  if (!device) throw new RawApiError(404, { message: "Object not found" });
+  return device;
+}
+var optionalText = (value) => value === void 0 || value === null ? null : String(value);
+var deviceHandlers = {
+  // With an API key the list always paginates (accounts `PublicApiListings`: `perPage`, 25 by default, up to 100, by
+  // id). `external_reference` filters by exact equality.
+  "GET /api/v1/devices": (ctx) => {
+    const reference = ctx.query.external_reference;
+    const list = [...ctx.app.store.devices.values()].filter((d) => reference === void 0 || reference === "" || d.externalReference === String(reference)).sort((a, b) => a.id - b.id);
+    return ok(paginate(list, listContext(ctx), deviceResource));
+  },
+  "GET /api/v1/devices/{device}": (ctx) => ok(deviceResource(deviceOf(ctx.app, ctx.path.device))),
+  // What the sandbox keeps: the alias and the external reference. The rest of the body is accepted and ignored.
+  "PUT /api/v1/devices/{device}": (ctx) => {
+    const device = deviceOf(ctx.app, ctx.path.device);
+    const b = body(ctx);
+    if (typeof b.alias === "string" && b.alias.trim() !== "") device.alias = b.alias;
+    if ("external_reference" in b) device.externalReference = optionalText(b.external_reference);
+    return ok(deviceResource(device));
+  },
+  // `200` with an empty body, as today.
+  "DELETE /api/v1/devices/{device}": (ctx) => {
+    deleteDevice(ctx.app, deviceOf(ctx.app, ctx.path.device));
+    return { status: 200 };
+  },
+  "POST /api/v1/devices": (ctx) => idempotent(ctx, "devices", () => {
+    const b = body(ctx);
+    const target = b.same_number_as === void 0 || b.same_number_as === null ? null : checkSameNumber(ctx.app, b.same_number_as);
+    if (!target) {
+      checkQuota(ctx.app);
+      checkPendingNumber(ctx.app);
+    }
+    const device = createDevice(ctx.app, {
+      connection: "qr",
+      alias: optionalText(b.alias) ?? target?.alias ?? null,
+      number: target?.number ?? null,
+      externalReference: optionalText(b.external_reference) ?? target?.externalReference ?? null
+    });
+    return ok({ data: deviceResource(device) }, 201);
+  }),
+  // `Cache-Control: no-store`, as accounts: a QR read a few seconds ago may no longer link, so nothing may keep it.
+  "GET /api/v1/devices/{device}/qr": (ctx) => {
+    const device = deviceOf(ctx.app, ctx.path.device);
+    if (device.kind !== "qr") throw new ApiError(422, "provider_unsupported", "El c\xF3digo QR solo existe para n\xFAmeros por QR.");
+    return {
+      status: 200,
+      body: {
+        data: {
+          connected: device.connected,
+          qr_code: device.connected ? null : fakeQrDataUri(`${device.id}:${Math.floor(Date.now() / (QR_EXPIRES_IN * 1e3))}`),
+          expires_in: device.connected ? 0 : QR_EXPIRES_IN
+        }
+      },
+      headers: { "Cache-Control": "no-store" }
+    };
+  }
+};
 
 // src/messaging/lifecycle.ts
 var ORDER = { sent: 1, delivered: 2, read: 3 };
@@ -44320,14 +46285,6 @@ var messageHandlers = {
     if (template.deviceId !== Number(ctx.path.device)) throw notFound("La plantilla no es de este n\xFAmero.");
     ctx.app.store.templates.delete(template.id);
     return noContent();
-  },
-  // --- numbers (accounts) -----------------------------------------------------------------------------------
-  // With an API key the list always paginates (accounts `PublicApiListings`: `perPage`, 25 by default, up to 100, by id).
-  "GET /api/v1/devices": (ctx) => ok(paginate([...ctx.app.store.devices.values()].sort((a, b) => a.id - b.id), listContext(ctx), deviceResource)),
-  "GET /api/v1/devices/{device}": (ctx) => {
-    const device = ctx.app.store.devices.get(Number(ctx.path.device));
-    if (!device) throw new RawApiError(404, { message: "Object not found" });
-    return ok(deviceResource(device));
   }
 };
 function setTemplateStatus(app, template, status, reason) {
@@ -45028,6 +46985,132 @@ function parseQuery(search) {
   }
   return out;
 }
+function securityHeaders(nonce) {
+  return {
+    "Cache-Control": "no-store, private",
+    "Referrer-Policy": "no-referrer",
+    "X-Frame-Options": "DENY",
+    "X-Robots-Tag": "noindex",
+    "Strict-Transport-Security": "max-age=31536000",
+    "Cross-Origin-Opener-Policy": "same-origin-allow-popups",
+    "X-Content-Type-Options": "nosniff",
+    "Content-Security-Policy": `default-src 'none'; style-src 'nonce-${nonce}'; script-src 'nonce-${nonce}'; form-action 'self' https:; frame-ancestors 'none'; base-uri 'none'`
+  };
+}
+var PATH = /^\/connect\/([A-Za-z0-9_-]{1,200})(?:\/(start|complete|qr))?\/?$/;
+var isConnectPath = (pathname) => pathname === "/connect" || pathname.startsWith("/connect/");
+var escape = (text2) => text2.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+function page(status, title, text2, extra = "") {
+  const nonce = randomBytes(16).toString("base64");
+  const html = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${escape(title)} \xB7 Funnelchat</title>
+<style nonce="${nonce}">
+  :root { --bg: #f6f7f9; --card: #fff; --text: #1d2433; --muted: #5b6475; --line: #dfe3ea; --accent: #0b6e4f; }
+  @media (prefers-color-scheme: dark) { :root { --bg: #11151c; --card: #1a202a; --text: #e6e9ef; --muted: #9aa4b5; --line: #2b3340; --accent: #3fb68b; } }
+  body { margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 16px; box-sizing: border-box; font: 15px/1.5 system-ui, -apple-system, Segoe UI, sans-serif; background: var(--bg); color: var(--text); }
+  main { max-width: 420px; background: var(--card); border: 1px solid var(--line); border-radius: 10px; padding: 24px; }
+  h1 { font-size: 20px; margin: 0 0 8px; }
+  p { margin: 0 0 8px; }
+  label { display: block; margin: 6px 0; }
+  button { margin: 8px 0; padding: 10px 16px; border: 0; border-radius: 6px; background: var(--accent); color: #fff; font: inherit; cursor: pointer; }
+  small { color: var(--muted); }
+</style>
+</head>
+<body>
+<main>
+<h1>${escape(title)}</h1>
+<p>${escape(text2)}</p>
+${extra}<small>Funnelchat sandbox: a test page. Nothing is connected to WhatsApp.</small>
+</main>
+</body>
+</html>
+`;
+  return { status, html, headers: securityHeaders(nonce) };
+}
+function json(status, body2) {
+  return { status, body: body2, headers: securityHeaders(randomBytes(16).toString("base64")) };
+}
+function linkPage(token, link, again) {
+  const choice = link.type === "meta" && (link.allowedConnectionTypes?.length ?? 0) > 1 ? (link.allowedConnectionTypes ?? []).map(
+    (c, i) => `<label><input type="radio" name="connection" value="${c}"${i === 0 ? " checked" : ""}> ${c === "coexistence" ? "Keep using the WhatsApp Business app (coexistence)" : "A number only for the API"}</label>`
+  ).join("\n") : "";
+  const answer = page(
+    200,
+    again?.title ?? (link.type === "qr" ? "Connect your WhatsApp by QR" : "Connect your WhatsApp Business number"),
+    again?.text ?? "In the sandbox the button connects at once: there is no QR to scan and no Meta sign-up.",
+    `<form method="post" action="/connect/${token}/start">
+${choice}
+<button type="submit">Connect</button>
+</form>
+`
+  );
+  const nonce = /'nonce-([^']+)'/.exec(answer.headers["Content-Security-Policy"])?.[1] ?? "";
+  answer.html = answer.html.replace("</body>", `<script nonce="${nonce}">history.replaceState(null, '', '/connect/reopen');</script>
+</body>`);
+  return answer;
+}
+function outcomeOf(input) {
+  const code = typeof input.error_code === "string" && LINK_ERROR_CODES.includes(input.error_code) ? input.error_code : null;
+  const connection = input.connection === "coexistence" || input.connection === "dedicated" ? input.connection : null;
+  const number = input.number === void 0 ? null : digits(input.number) || null;
+  return { outcome: input.outcome === "failed" ? "failed" : "completed", errorCode: code, connection, number };
+}
+function closed(link) {
+  if (link.status === "expired") return page(410, "This link expired", "Ask whoever sent it for a new one.");
+  if (link.status === "revoked") return page(410, "This link is no longer valid", "Ask whoever sent it for a new one.");
+  return page(410, "This link was already used", "A sign-up link works only once. Ask whoever sent it for a new one.");
+}
+function handleConnectPage(app, method, pathname, headers, search, body2) {
+  if (headers.authorization !== void 0 || headers["x-api-key"] !== void 0) {
+    return json(403, { error: "credentials_not_allowed", message: "Esta p\xE1gina no acepta credenciales. Abre el link en un navegador, sin API key." });
+  }
+  if (pathname.replace(/\/+$/, "") === "/connect/reopen" && method === "GET") {
+    return page(200, "Open the link again", "For your security the link left the address bar. Open it again from the message you received.");
+  }
+  const match = PATH.exec(pathname);
+  if (!match || match[2] === "qr") return page(404, "This link does not exist", "Check that you copied the whole link.");
+  const token = match[1];
+  const action = match[2];
+  const expected = action ? "POST" : "GET";
+  if (method !== expected) {
+    const answer = page(405, "Not allowed", "Open the link in a browser.");
+    return { ...answer, headers: { ...answer.headers, Allow: expected } };
+  }
+  const link = findLinkByToken(app, token);
+  if (!link) return page(404, "This link does not exist", "Check that you copied the whole link.");
+  if (link.status !== "pending") return closed(link);
+  if (link.type === "meta" && !app.store.numbers.metaConnect) {
+    return page(503, "Not available yet", "Connecting official numbers by link is not available yet.");
+  }
+  if (!action) return linkPage(token, link);
+  const input = { ...parseQuery(search), ...isRecord(body2) ? body2 : {} };
+  const outcome = outcomeOf(input);
+  if (!connectionAllowed(link, outcome.connection)) {
+    return json(422, { error: "connection_type_not_allowed", message: "Este link no permite ese tipo de conexi\xF3n.", allowed_connection_types: link.allowedConnectionTypes });
+  }
+  if (completeLink(app, link, outcome) === "retry") {
+    const left = META_ATTEMPTS - link.failedAttempts;
+    const code = outcome.errorCode ?? "meta_error";
+    app.logger.info(`sign-up link ${link.id}: ${code}, still pending (${left} attempts left)`);
+    if ((headers["content-type"] ?? "").includes("json") || (headers.accept ?? "").includes("application/json")) {
+      return json(200, { state: "retry", error_code: code, attempts_left: left });
+    }
+    return linkPage(token, link, { title: "That did not work", text: `Facebook or Meta answered ${code}. Try again: ${left} attempts left.` });
+  }
+  app.logger.info(`sign-up link ${link.id}: ${link.status}${link.errorCode ? ` (${link.errorCode})` : ""}${link.deviceId ? ` \u2192 number ${link.deviceId}` : ""}`);
+  const back = returnUrlFor(link);
+  if (back) {
+    const { headers: pageHeaders } = page(303, "Done", "Going back.");
+    return { status: 303, headers: { ...pageHeaders, Location: back } };
+  }
+  const status = link.status;
+  return status === "completed" ? page(200, "Done: your number is connected", "You can close this page.") : page(200, "The number could not be connected", `Reason: ${link.errorCode ?? "unknown"}. Ask whoever sent the link for a new one.`);
+}
 
 // src/sandbox/panel.ts
 function panelHtml() {
@@ -45133,18 +47216,34 @@ function contactOf(app, id) {
   if (!contact) throw notFound("The contact does not exist in the sandbox.");
   return contact;
 }
-function deviceOf(app, id) {
+function deviceOf2(app, id) {
   const device = app.store.devices.get(Number(id ?? 3));
   if (!device) throw fieldError("device_id", `There is no number ${id} in the sandbox: the example ones are 3 (official) and 4 (QR).`);
   return device;
 }
 function emitted(result) {
-  return { id: result.envelope.id, type: result.envelope.type, subscriptions: result.subscriptions };
+  return result ? { id: result.envelope.id, type: result.envelope.type, subscriptions: result.subscriptions } : null;
+}
+function numbersState(app) {
+  const { numbers: numbers2 } = app.store;
+  return {
+    limit: numbers2.limit,
+    in_use: placesInUse(app),
+    pending_device_ids: pendingQrIds(app),
+    included: numbers2.included,
+    trial: numbers2.trial,
+    pool_limit: poolLimit(app),
+    meta_connect: numbers2.metaConnect,
+    links_per_minute: numbers2.linksPerMinute
+  };
 }
 function state(app) {
   const { store, config } = app;
   return {
     devices: [...store.devices.values()].map(deviceResource),
+    numbers: numbersState(app),
+    // Never the tokens: they are only in the `url` of the create answer.
+    connect_links: [...store.connectLinks.values()].map((link) => connectLinkResource(refreshLink(link))),
     counts: {
       contacts: store.contacts.size,
       messages: store.messages.size,
@@ -45192,7 +47291,7 @@ function limitOf2(query) {
 }
 function inboundMessage(app, req) {
   const b = obj(req.body);
-  const device = deviceOf(app, b.device_id);
+  const device = deviceOf2(app, b.device_id);
   let contact;
   if (b.contact_id !== void 0) contact = contactOf(app, b.contact_id);
   else {
@@ -45410,7 +47509,7 @@ var ROUTES = [
     handle: (app, req) => {
       const b = obj(req.body);
       const contact = contactOf(app, b.contact_id);
-      const device = deviceOf(app, b.device_id);
+      const device = deviceOf2(app, b.device_id);
       if (typeof b.open !== "boolean") throw fieldError("open", "open must be true or false.");
       const key = `${contact.id}:${device.id}`;
       if (b.open) app.store.lastInbound.set(key, /* @__PURE__ */ new Date());
@@ -45419,17 +47518,52 @@ var ROUTES = [
     }
   },
   {
+    // `connect` is the scan of the QR (or the end of the Meta sign-up): it takes `number`, a fake one otherwise.
+    // `disconnect` takes `reason` (qr_logged_out for QR and unknown for official numbers by default).
     method: "POST",
     pattern: /^\/_sandbox\/devices\/(\d+)\/(connect|disconnect)$/,
-    handle: (app, _req, [id, action]) => {
-      const device = deviceOf(app, id);
-      const connected = action === "connect";
-      if (device.connected === connected) return { status: 200, body: { device: deviceResource(device), event: null } };
-      device.connected = connected;
-      const at = /* @__PURE__ */ new Date();
-      const data = connected ? { device: { id: device.id, name: device.alias, number: device.number }, connected_at: isoSeconds(at) } : { device: { id: device.id, name: device.alias, number: device.number }, disconnected_at: isoSeconds(at) };
-      const event = app.webhooks.emit(connected ? "device.connected" : "device.disconnected", data, { occurredAt: at });
-      return { status: 200, body: { device: deviceResource(device), event: emitted(event) } };
+    handle: (app, req, [id, action]) => {
+      const device = deviceOf2(app, id);
+      const b = obj(req.body);
+      if (action === "connect") {
+        const number = b.number === void 0 || b.number === null ? null : digits(b.number);
+        if (number !== null && number.length < 8) throw fieldError("number", "number must be a phone, digits only.");
+        return { status: 200, body: { device: deviceResource(device), event: emitted(connectDevice(app, device, { number })) } };
+      }
+      const reason = b.reason ?? (device.kind === "qr" ? "qr_logged_out" : "unknown");
+      if (!DISCONNECT_REASONS.includes(reason)) throw fieldError("reason", `reason must be one of: ${DISCONNECT_REASONS.join(", ")}.`);
+      return { status: 200, body: { device: deviceResource(device), event: emitted(disconnectDevice(app, device, reason)) } };
+    }
+  },
+  {
+    method: "POST",
+    pattern: /^\/_sandbox\/devices\/(\d+)\/health$/,
+    handle: (app, req, [id]) => {
+      const device = deviceOf2(app, id);
+      if (device.kind !== "cloud") throw fieldError("device_id", "Only official numbers have a health state.");
+      const state2 = obj(req.body).state;
+      if (!HEALTH_STATES.includes(state2)) throw fieldError("state", `state must be one of: ${HEALTH_STATES.join(", ")}.`);
+      return { status: 200, body: { device: deviceResource(device), event: emitted(setHealth(app, device, state2)) } };
+    }
+  },
+  { method: "GET", pattern: /^\/_sandbox\/numbers$/, handle: (app) => ({ status: 200, body: numbersState(app) }) },
+  {
+    method: "POST",
+    pattern: /^\/_sandbox\/numbers$/,
+    handle: (app, req) => {
+      const b = obj(req.body);
+      const { numbers: numbers2 } = app.store;
+      for (const [field, key] of [["limit", "limit"], ["links_per_minute", "linksPerMinute"]]) {
+        if (b[field] === void 0) continue;
+        if (!Number.isInteger(b[field]) || b[field] < 0) throw fieldError(field, `${field} must be an integer, 0 or more.`);
+        numbers2[key] = b[field];
+      }
+      for (const [field, key] of [["included", "included"], ["trial", "trial"], ["meta_connect", "metaConnect"]]) {
+        if (b[field] === void 0) continue;
+        if (typeof b[field] !== "boolean") throw fieldError(field, `${field} must be true or false.`);
+        numbers2[key] = b[field];
+      }
+      return { status: 200, body: numbersState(app) };
     }
   },
   {
@@ -45460,16 +47594,24 @@ async function handleSandbox(app, req) {
 // src/server.ts
 var MAX_BODY_BYTES = 1024 * 1024;
 var API_KEY = /^Bearer\s+(\d+)\|fc_live_[A-Za-z0-9]+$/;
-var handlers = { ...contactHandlers, ...messageHandlers, ...formHandlers, ...gateHandlers, ...webhookHandlers };
+var handlers = {
+  ...contactHandlers,
+  ...messageHandlers,
+  ...deviceHandlers,
+  ...connectLinkHandlers,
+  ...formHandlers,
+  ...gateHandlers,
+  ...webhookHandlers
+};
 var BodyError = class extends ApiError {
 };
 async function readBody(req) {
   const chunks = [];
   let size = 0;
-  for await (const chunk of req) {
-    size += chunk.length;
+  for await (const chunk2 of req) {
+    size += chunk2.length;
     if (size > MAX_BODY_BYTES) throw new BodyError(413, "payload_too_large", "El cuerpo supera 1 MB.");
-    chunks.push(chunk);
+    chunks.push(chunk2);
   }
   return Buffer.concat(chunks);
 }
@@ -45547,7 +47689,7 @@ function createSandbox(options = {}) {
       const validation = validateRequest(op.operation, match.params, parseQuery(url.searchParams), requestBody, requestBodySchema(op.operation));
       if (!validation.ok) {
         if (validation.kind === "not_found") throw notFound();
-        throw validationFailed(validation.errors);
+        throw op.operation["x-fc-validation-error"] === "invalid_request" ? invalidRequest(validation.errors) : validationFailed(validation.errors);
       }
       const handler = handlers[`${op.method.toUpperCase()} ${op.path}`];
       const ctx = {
@@ -45595,6 +47737,25 @@ function createSandbox(options = {}) {
       }
       return;
     }
+    if (isConnectPath(url.pathname)) {
+      try {
+        const body2 = method === "POST" ? parseBody(await readBody(req), headers["content-type"]) : void 0;
+        const answer = handleConnectPage(app, method, url.pathname, headers, url.searchParams, body2);
+        if (answer.body !== void 0) {
+          send2(res, requestId, answer);
+        } else {
+          const pageHeaders = { "X-Funnelchat-Sandbox": VERSION, ...answer.headers, [REQUEST_ID_HEADER]: requestId };
+          if (answer.html !== void 0) pageHeaders["Content-Type"] = "text/html; charset=utf-8";
+          res.writeHead(answer.status, pageHeaders);
+          res.end(answer.html);
+        }
+      } catch (error) {
+        const result2 = errorResult(error);
+        send2(res, requestId, { ...result2, headers: { ...result2.headers, "Referrer-Policy": "no-referrer" } });
+      }
+      app.logger.info(`${method} /connect/*** \u2192 ${res.statusCode} (${Date.now() - started} ms)`);
+      return;
+    }
     if (url.pathname === "/" && method === "GET") {
       send2(res, requestId, {
         status: 200,
@@ -45633,7 +47794,8 @@ function createSandbox(options = {}) {
         server.off("error", reject);
         const { port } = server.address();
         const host = config.host === "0.0.0.0" || config.host === "::" ? "localhost" : config.host;
-        resolve2({ url: `http://${host}:${port}`, port });
+        app.listenUrl = `http://${host}:${port}`;
+        resolve2({ url: app.listenUrl, port });
       });
     }),
     close: () => new Promise((resolve2) => {
@@ -45645,5 +47807,5 @@ function createSandbox(options = {}) {
 }
 
 export { ConfigError, DEFAULT_CONFIG_FILE, DEFAULT_PORT, DELIVERY_HEADER, EDGE_ERRORS, EVENT_HEADER, FAILURE_REASONS, FORM_TEMPLATES, META_ERRORS, REJECTIONS, REQUEST_ID_HEADER, SEND_FILE_TYPES, SIGNATURE_HEADER, SUPPORTED_EXTENSIONS, VERSION, catalog, createSandbox, defaultConfig, mergeConfig, parseArgs, resolveConfig, signature };
-//# sourceMappingURL=chunk-KH6A3I2A.js.map
-//# sourceMappingURL=chunk-KH6A3I2A.js.map
+//# sourceMappingURL=chunk-M5E6NAXM.js.map
+//# sourceMappingURL=chunk-M5E6NAXM.js.map