@hexabot-ai/api 3.2.2-alpha.0 → 3.2.2-alpha.10

package/src/cms/services/content-type.service.ts

@@ -8,8 +8,8 @@ import { ContentType } from '@hexabot-ai/types';
 import { Injectable } from '@nestjs/common';
 import { JSONSchema7 } from 'json-schema';
 
-import { InferCreateDto } from '@/utils';
 import { BaseOrmService } from '@/utils/generics/base-orm.service';
+import type { InferCreateDto } from '@/utils/types/dto.types';
 
 import { ContentTypeOrmEntity } from '../entities/content-type.entity';
 import { ContentTypeRepository } from '../repositories/content-type.repository';

package/src/cms/services/rag.service.ts

@@ -9,7 +9,7 @@ import { OnEvent } from '@nestjs/event-emitter';
 
 import { LoggerService } from '@/logger/logger.service';
 import { SettingService } from '@/setting/services/setting.service';
-import { UserOrmEntity } from '@/user';
+import type { UserOrmEntity } from '@/user/entities/user.entity';
 import {
   DeleteEntityEvent,
   InsertEntityEvent,

package/src/config/index.ts

@@ -82,23 +82,37 @@ const sessionLimitSubquery =
     ? true
     : process.env.SESSION_LIMIT_SUBQUERY === 'true';
 const sessionTtlSeconds = parseOptionalInt(process.env.SESSION_TTL_SECONDS);
+const apiBaseUrl = process.env.API_ORIGIN || 'http://localhost:3000/api';
 
 export const config: Config = {
   i18n: {
     translationFilename: process.env.I18N_TRANSLATION_FILENAME || 'messages',
   },
   appPath: process.cwd(),
-  apiBaseUrl: process.env.API_ORIGIN || 'http://localhost:3000/api',
+  apiBaseUrl,
   uiBaseUrl: process.env.FRONTEND_BASE_URL
     ? process.env.FRONTEND_BASE_URL
     : 'http://localhost:3000', // default to local dev
   ssoEnabled: process.env.SSO_ENABLED === 'true',
+  mcp: {
+    enabled: process.env.MCP_ENABLED === 'true',
+    serverName: process.env.MCP_SERVER_NAME || 'hexabot-api',
+    serverTitle: process.env.MCP_SERVER_TITLE || 'Hexabot API MCP Server',
+    serverVersion: process.env.MCP_SERVER_VERSION || '1.0.0',
+    serverDescription:
+      process.env.MCP_SERVER_DESCRIPTION ||
+      'Manage Hexabot workflows, runs, memory, credentials, actions, and CMS content.',
+    serverInstructions:
+      process.env.MCP_SERVER_INSTRUCTIONS ||
+      'Use these tools to inspect and manage Hexabot API resources. Credential values are never exposed.',
+  },
   security: {
     httpsEnabled: process.env.HTTPS_ENABLED === 'true',
     trustProxy: process.env.HTTPS_ENABLED === 'true', // Nginx in use ?
     cors: {
       allRoutes: true,
-      headers: 'content-type,x-xsrf-token,x-csrf-token',
+      headers:
+        'content-type,x-xsrf-token,x-csrf-token,authorization,mcp-session-id,last-event-id',
       methods: ['GET', 'PATCH', 'POST', 'DELETE', 'OPTIONS', 'HEAD'],
       allowOrigins: process.env.FRONTEND_ORIGIN
         ? process.env.FRONTEND_ORIGIN.split(',').map((origin) => origin.trim())
@@ -109,6 +123,7 @@ export const config: Config = {
     csrfExclude: [
       /^\/auth\/local$/, // login
       /^\/auth\/logout$/, // logout
+      /^\/mcp$/, // MCP Streamable HTTP endpoint
       /^\/webhook\//, // Any webhook channel
       /^\/reset(\/[^\/]+)?$/, // Reset request / Change password
     ],

package/src/config/types.ts

@@ -43,6 +43,14 @@ type TDatabaseConfig = {
   schema?: string;
   autoMigrate: boolean;
 };
+type TMcpConfig = {
+  enabled: boolean;
+  serverName: string;
+  serverTitle: string;
+  serverVersion: string;
+  serverDescription: string;
+  serverInstructions: string;
+};
 type SocketCookie =
   | {
       maxAge?: number | undefined;
@@ -59,6 +67,7 @@ export type Config = {
   apiBaseUrl: string;
   uiBaseUrl: string;
   ssoEnabled: boolean;
+  mcp: TMcpConfig;
   security: {
     httpsEnabled: boolean;
     trustProxy: boolean;

package/src/database/decorators/json-column.decorator.ts

@@ -12,6 +12,7 @@ type JsonColumnOptions = Omit<ColumnOptions, 'type'>;
 
 const dbTypeToJsonColumn: Record<string, ColumnType> = {
   sqlite: 'simple-json',
+  'better-sqlite3': 'simple-json',
   postgres: 'json',
   mysql: 'json',
   mariadb: 'json',

package/src/database/typeorm-config.service.ts

@@ -51,7 +51,7 @@ export class TypeormConfigService implements TypeOrmOptionsFactory {
         // @ts-expect-error type mismatch)
         return {
           ...base,
-          type: 'sqlite',
+          type: 'better-sqlite3',
           database: db.sqlitePath ?? 'hexabot.sqlite',
         };
     }

package/src/extensions/actions/ai/mcp.binding.ts

@@ -30,12 +30,13 @@ export const aiMcpToolBindingSchema = z.strictObject({
         'Optional allow-list of MCP tool names. Leave empty to expose all server tools.',
       'ui:widget': 'AutoCompleteWidget',
       'ui:options': {
-        entity: 'McpServerTool',
-        valueKey: 'name',
+        apiPath: '/mcpserver/:id/tools',
         labelKey: 'name',
+        idKey: 'name',
+        valueKey: 'name',
         idFormPath: 'server_id',
-        routeParamKey: 'id',
         disableSearch: true,
+        multiple: true,
       },
     }),
 });

package/src/extensions/actions/web/http-request.action.ts

@@ -110,6 +110,26 @@ function isJsonContentType(contentType?: string) {
   );
 }
 
+function normalizeHeaderValue(value: unknown): string | undefined {
+  if (value === undefined || value === null) {
+    return undefined;
+  }
+
+  if (Array.isArray(value)) {
+    return value.map(String).join(', ');
+  }
+
+  if (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    typeof value === 'boolean'
+  ) {
+    return String(value);
+  }
+
+  return undefined;
+}
+
 function resolveFinalUrl(response: {
   request?: { res?: { responseUrl?: string }; responseUrl?: string };
 }) {
@@ -175,10 +195,9 @@ export const HttpRequestAction = createAction<
         validateStatus: () => true,
         ...(requestData !== undefined ? { data: requestData } : {}),
       });
-      const contentTypeHeader = response.headers?.['content-type'];
-      const contentType = Array.isArray(contentTypeHeader)
-        ? contentTypeHeader.join(', ')
-        : contentTypeHeader;
+      const contentType = normalizeHeaderValue(
+        response.headers?.['content-type'],
+      );
       const responseData = response.data;
       let body: HttpRequestOutput['body'] = '';
 

package/src/extensions/actions/web/i18n/en.translations.json

@@ -25,5 +25,14 @@
     "URL": "URL",
     "Whether the HTTP response status indicates success.": "Whether the HTTP response status indicates success.",
     "Whether the response body was truncated.": "Whether the response body was truncated."
+  },
+  "send_mail": {
+    "Sends an email using HTML content.": "Sends an email using HTML content.",
+    "To": "To",
+    "Recipient email address.": "Recipient email address.",
+    "Title": "Title",
+    "Email subject.": "Email subject.",
+    "Content (HTML)": "Content (HTML)",
+    "HTML email content.": "HTML email content."
   }
 }

package/src/extensions/actions/web/i18n/fr.translations.json

@@ -25,5 +25,14 @@
     "URL": "URL",
     "Whether the HTTP response status indicates success.": "Indique si le statut de la réponse HTTP signale un succès.",
     "Whether the response body was truncated.": "Indique si le corps de la réponse a été tronqué."
+  },
+  "send_mail": {
+    "Sends an email using HTML content.": "Envoie un e-mail en utilisant du contenu HTML.",
+    "To": "À",
+    "Recipient email address.": "Adresse e-mail du destinataire.",
+    "Title": "Titre",
+    "Email subject.": "Objet de l'e-mail.",
+    "Content (HTML)": "Contenu (HTML)",
+    "HTML email content.": "Contenu de l'e-mail en HTML."
   }
 }

package/src/extensions/actions/web/send-mail.action.ts

@@ -0,0 +1,89 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2025 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+import { Injectable } from '@nestjs/common';
+import { z } from 'zod';
+
+import { BaseAction, ExecArgs } from '@/actions';
+import { ActionService } from '@/actions/actions.service';
+import { MailerService } from '@/mailer/mailer.service';
+import { WorkflowRuntimeContext } from '@/workflow/contexts/workflow-runtime.context';
+
+const sendMailInputSchema = z.object({
+  to: z.email().meta({
+    title: 'To',
+    description: 'Recipient email address.',
+  }),
+  title: z.string().min(1).meta({
+    title: 'Title',
+    description: 'Email subject.',
+  }),
+  content: z.string().min(1).meta({
+    title: 'Content (HTML)',
+    description: 'HTML email content.',
+  }),
+});
+const sendMailOutputSchema = z.union([
+  z.object({
+    success: z.literal(true),
+  }),
+  z.object({
+    success: z.literal(false),
+    error: z.string(),
+  }),
+]);
+type SendMailInput = z.infer<typeof sendMailInputSchema>;
+type SendMailOutput = z.infer<typeof sendMailOutputSchema>;
+
+@Injectable()
+export class SendMailAction extends BaseAction<
+  SendMailInput,
+  SendMailOutput,
+  WorkflowRuntimeContext
+> {
+  constructor(
+    actionService: ActionService,
+    private readonly mailerService: MailerService,
+  ) {
+    super(
+      {
+        name: 'send_mail',
+        description: 'Sends an email using HTML content.',
+        group: 'web',
+        icon: 'Mail',
+        color: '#68b1ff',
+        inputSchema: sendMailInputSchema,
+        outputSchema: sendMailOutputSchema,
+      },
+      actionService,
+    );
+  }
+
+  async execute({
+    input,
+    context,
+  }: ExecArgs<SendMailInput, WorkflowRuntimeContext>) {
+    try {
+      await this.mailerService.sendMail({
+        to: input.to,
+        subject: input.title,
+        html: input.content,
+      });
+
+      return { success: true } satisfies SendMailOutput;
+    } catch (error) {
+      const message =
+        error instanceof Error ? error.message : 'Could not send email';
+      context.services.logger.error('send_mail action failed', message, '', {
+        to: input.to,
+      });
+
+      return { success: false, error: message } satisfies SendMailOutput;
+    }
+  }
+}
+
+export default SendMailAction;

package/src/extensions/channels/web/base-web-channel.ts

@@ -4,6 +4,8 @@
  * Full terms: see LICENSE.md.
  */
 
+import { randomUUID } from 'crypto';
+
 import type {
   Attachment,
   Source,
@@ -25,7 +27,6 @@ import {
 import { OnEvent } from '@nestjs/event-emitter';
 import { Request, Response } from 'express';
 import { Socket } from 'socket.io';
-import { v4 as uuidv4 } from 'uuid';
 import type { z } from 'zod';
 
 import { AttachmentOrmEntity } from '@/attachment/entities/attachment.entity';
@@ -37,16 +38,16 @@ import {
 import {
   ChannelCapabilities,
   DEFAULT_CHANNEL_CAPABILITIES,
-  ExtensionInject,
-  WebSocketChannelHandler,
-} from '@/channel';
+} from '@/channel/lib/channel-capabilities';
+import { ExtensionInject } from '@/channel/lib/extension-inject.decorator';
 import { MessageInboundEvent } from '@/channel/lib/inbound-events';
+import { WebSocketChannelHandler } from '@/channel/lib/transports/websocket-channel-handler';
 import { SourceService } from '@/channel/services/source.service';
 import { ChannelName } from '@/channel/types';
-import { SubscriberChannelData } from '@/chat';
 import { MessageCreateDto } from '@/chat/dto/message.dto';
 import { SubscriberCreateDto } from '@/chat/dto/subscriber.dto';
 import { MessageService } from '@/chat/services/message.service';
+import type { SubscriberChannelData } from '@/chat/types/channel';
 import { MenuService } from '@/cms/services/menu.service';
 import { config } from '@/config';
 import { SocketRequest } from '@/websocket/utils/socket-request';
@@ -73,6 +74,10 @@ import { WebSessionService } from './services/web-session.service';
 import { WEB_CHANNEL_NAME } from './settings.schema';
 import { Web } from './types';
 
+type WebSocketData = Socket['data'] & {
+  webMessageQueue?: Promise<void>;
+};
+
 /**
  * Base handler for the Socket.IO-backed "web" channel.
  *
@@ -125,7 +130,7 @@ export default abstract class BaseWebChannelHandler<N extends ChannelName>
   }
 
   generateId(): string {
-    return `${this.name}-${uuidv4()}`;
+    return `${this.name}-${randomUUID()}`;
   }
 
   getChannelAttributes(
@@ -160,6 +165,30 @@ export default abstract class BaseWebChannelHandler<N extends ChannelName>
     return normalizedSourceId.length > 0 ? normalizedSourceId : null;
   }
 
+  private enqueueMessageDispatch(
+    req: SocketRequest,
+    event: MessageInboundEvent,
+  ): void {
+    const socket = req.socket as Socket & { data?: WebSocketData };
+    const socketData = (socket.data ??= {});
+    // Keep chatbot processing ordered per socket without making the client ack
+    // wait for slow actions, LLM calls, or external integrations.
+    const previous = socketData.webMessageQueue ?? Promise.resolve();
+    const next = previous
+      .catch(() => undefined)
+      .then(() => this.channelEventBus.emitMessage(event))
+      .catch((err) => {
+        this.logger.error('Failed to process web socket message', err);
+      });
+
+    socketData.webMessageQueue = next;
+    void next.finally(() => {
+      if (socketData.webMessageQueue === next) {
+        delete socketData.webMessageQueue;
+      }
+    });
+  }
+
   @OnEvent('hook:websocket:connection', { async: true })
   async onWebSocketConnection(client: Socket) {
     try {
@@ -546,15 +575,24 @@ export default abstract class BaseWebChannelHandler<N extends ChannelName>
           messageEvent.setAuthorForeignId(profile.foreignId);
         }
         messageEvent.setCreatedAt(new Date());
+        // Resolve the thread before acknowledging the socket request so the
+        // client receives a stable thread_id, then dispatch chatbot work later.
+        const thread = await this.sessionService.resolveThreadForIncoming(
+          req,
+          profile.id,
+          {
+            explicitThreadId: messageEvent.getThreadId(),
+            inactivityHours: this.sessionService.resolveInactivityHours(
+              source.settings,
+            ),
+            sourceId: source.id,
+          },
+        );
+        messageEvent.setThreadId(thread.id);
+        messageEvent.setThreadIdOnRaw(thread.id);
 
         this.broadcast(profile, StdEventType.message, messageEvent.getRaw());
-        await this.channelEventBus.emitMessage(messageEvent);
-
-        const resolvedThreadId = messageEvent.getThreadId();
-        if (resolvedThreadId) {
-          messageEvent.setThreadIdOnRaw(resolvedThreadId);
-          if (req.session.web) req.session.web.threadId = resolvedThreadId;
-        }
+        this.enqueueMessageDispatch(req, messageEvent);
 
         continue;
       }

package/src/extensions/channels/web/outbound/web-outbound-message-encoder.ts

@@ -24,8 +24,8 @@ import { ChannelOutboundMessageEncoder } from '@/channel/lib/outbound';
 import { ChannelAttachmentService } from '@/channel/services/channel-attachment.service';
 import { VIEW_MORE_PAYLOAD } from '@/chat/helpers/constants';
 import { ContentOrmEntity } from '@/cms/entities/content.entity';
-import { I18nService } from '@/i18n';
-import { LoggerService } from '@/logger';
+import { I18nService } from '@/i18n/services/i18n.service';
+import { LoggerService } from '@/logger/logger.service';
 
 import { Web } from '../types';
 

package/src/extensions/channels/web/services/web-session.service.ts

@@ -215,6 +215,10 @@ export class WebSessionService {
     return this.threadService.resolveThread({ subscriberId, explicitThreadId });
   }
 
+  resolveInactivityHours(settings: unknown): number {
+    return this.threadService.resolveInactivityHours(settings);
+  }
+
   /**
    * Resolves a thread from the request query/body and writes the result back
    * to the session. Used by the subscribe/history flows.
@@ -232,4 +236,35 @@ export class WebSessionService {
 
     return thread;
   }
+
+  /**
+   * Resolves the writable thread for an incoming message and persists it on the
+   * socket session before chatbot processing continues asynchronously.
+   */
+  async resolveThreadForIncoming(
+    req: SocketRequest,
+    subscriberId: string,
+    {
+      explicitThreadId,
+      inactivityHours,
+      sourceId,
+    }: {
+      explicitThreadId?: string;
+      inactivityHours?: number;
+      sourceId?: string;
+    },
+  ): Promise<Thread> {
+    const thread = await this.threadService.resolveThreadForIncoming({
+      subscriberId,
+      explicitThreadId,
+      inactivityHours,
+      sourceId,
+    });
+
+    if (req.session.web) {
+      req.session.web.threadId = thread.id;
+    }
+
+    return thread;
+  }
 }

package/src/extensions/index.ts

@@ -41,3 +41,5 @@ export * from './actions/messaging/buttons.action';
 export * from './actions/messaging/attachment.action';
 
 export * from './actions/messaging/list.action';
+
+export * from './actions/web/send-mail.action';

package/src/global.d.ts

@@ -8,10 +8,4 @@ import '../types/event-emitter';
 import '../types/express-session';
 import './types/ai-sdk-mcp-stdio';
 
-declare global {
-  type HyphenToUnderscore<S extends string> = S extends `${infer P}-${infer Q}`
-    ? `${P}_${HyphenToUnderscore<Q>}`
-    : S;
-}
-
 export {};

package/src/license/services/lemon-squeezy.service.ts

@@ -4,10 +4,11 @@
  * Full terms: see LICENSE.md.
  */
 
+import { randomUUID } from 'crypto';
+
 import { HttpService } from '@nestjs/axios';
 import { Injectable } from '@nestjs/common';
 import { AxiosError } from 'axios';
-import { v4 as uuidv4 } from 'uuid';
 
 import {
   LemonSqueezyActivationResponse,
@@ -52,7 +53,7 @@ export class LemonSqueezyService {
         `${LEMON_SQUEEZY_API_BASE_URL}/v1/licenses/activate`,
         {
           license_key: licenseKey,
-          instance_name: uuidv4(),
+          instance_name: randomUUID(),
         },
         {
           headers: {

package/src/mailer/mailer.module.ts

@@ -4,66 +4,13 @@
  * Full terms: see LICENSE.md.
  */
 
-import path from 'path';
-
 import { Global, Module } from '@nestjs/common';
-import {
-  ISendMailOptions,
-  MAILER_OPTIONS,
-  MailerOptions,
-  MailerModule as NestjsMailerModule,
-} from '@nestjs-modules/mailer';
-import SMTPTransport from 'nodemailer/lib/smtp-transport';
-
-import { config } from '@/config';
 
 import { MailerService } from './mailer.service';
-import { MjmlAdapter } from './mjml-adapter.class';
-
-const mailerOptions: MailerOptions = {
-  transport: new SMTPTransport({
-    ...config.emails.smtp,
-    logger: true,
-    debug: false,
-  }),
-  template: {
-    adapter: new MjmlAdapter(),
-    dir: path.join(process.cwd(), 'dist', 'templates'),
-    options: {
-      context: {
-        appName: config.parameters.appName,
-        appUrl: config.uiBaseUrl,
-      },
-    },
-  },
-  defaults: { from: config.emails.from },
-};
 
 @Global()
 @Module({
-  imports: [
-    ...(config.emails.isEnabled
-      ? [NestjsMailerModule.forRoot(mailerOptions)]
-      : []),
-  ],
-  providers: [
-    {
-      provide: MAILER_OPTIONS,
-      useValue: mailerOptions,
-    },
-    ...(config.emails.isEnabled
-      ? [MailerService]
-      : [
-          {
-            provide: MailerService,
-            useValue: {
-              sendMail(_options: ISendMailOptions) {
-                throw new Error('Email Service is not enabled');
-              },
-            },
-          },
-        ]),
-  ],
+  providers: [MailerService],
   exports: [MailerService],
 })
 export class MailerModule {}

package/src/mailer/mailer.service.ts

@@ -4,6 +4,90 @@
  * Full terms: see LICENSE.md.
  */
 
-import { MailerService as NestjsMailerService } from '@nestjs-modules/mailer';
+import { readFile } from 'fs/promises';
+import path from 'path';
 
-export class MailerService extends NestjsMailerService {}
+import { Injectable } from '@nestjs/common';
+import Handlebars from 'handlebars';
+import mjml2html from 'mjml';
+import nodemailer, {
+  SendMailOptions as NodemailerSendMailOptions,
+  SentMessageInfo,
+  Transporter,
+} from 'nodemailer';
+import SMTPTransport from 'nodemailer/lib/smtp-transport';
+
+import { config } from '@/config';
+
+export type SendMailOptions = NodemailerSendMailOptions & {
+  template?: string;
+  context?: Record<string, unknown>;
+};
+
+@Injectable()
+export class MailerService {
+  private readonly transporter?: Transporter<SentMessageInfo>;
+
+  constructor() {
+    if (!config.emails.isEnabled) {
+      return;
+    }
+
+    this.transporter = nodemailer.createTransport(
+      new SMTPTransport({
+        ...config.emails.smtp,
+        logger: true,
+        debug: false,
+      }),
+    );
+  }
+
+  async sendMail({ template, context, ...options }: SendMailOptions) {
+    if (!this.transporter) {
+      throw new Error('Email Service is not enabled');
+    }
+
+    const html = template
+      ? await this.renderTemplate(template, context)
+      : options.html;
+
+    return await this.transporter.sendMail({
+      from: config.emails.from,
+      ...options,
+      html,
+    });
+  }
+
+  async verifyAllTransporters(): Promise<boolean> {
+    if (!this.transporter) {
+      return false;
+    }
+
+    return await this.transporter.verify();
+  }
+
+  private async renderTemplate(
+    template: string,
+    context: Record<string, unknown> = {},
+  ): Promise<string> {
+    const templatePath = path.join(
+      process.cwd(),
+      'dist',
+      'templates',
+      template,
+    );
+    const content = await readFile(templatePath, 'utf-8');
+    const compiledHandlebars = Handlebars.compile(content)({
+      appName: config.parameters.appName,
+      appUrl: config.uiBaseUrl,
+      ...context,
+    });
+    const { errors, html } = mjml2html(compiledHandlebars);
+
+    if (errors.length) {
+      throw new Error('Unable to compile mjml template');
+    }
+
+    return html;
+  }
+}