@intentface/latch-channels 0.9.1

package/dist/telegram/verify.js

@@ -0,0 +1,14 @@
+import { timingSafeEqual } from "node:crypto";
+/**
+ * Verify Telegram's webhook secret: the `x-telegram-bot-api-secret-token`
+ * header must equal the `secret_token` we registered with `setWebhook`.
+ * Constant-time compare (length check first — `timingSafeEqual` requires it).
+ */
+export function verifyTelegramSecretToken(header, expected) {
+    if (!header || !expected)
+        return false;
+    const a = Buffer.from(header);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+//# sourceMappingURL=verify.js.map

package/dist/telegram/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/telegram/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,QAAgB;IAEhB,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,240 @@
+/**
+ * Platform-agnostic vocabulary for bringing a Latch run to a chat surface.
+ *
+ * A channel adapter (Slack, Teams, …) only ever sees `RenderEvent`s — the
+ * normalized, surface-independent shape of what an agent is doing — and maps
+ * them to its platform's primitives (a streamed message, a status line, an
+ * approval card). The mapping from a Latch run's raw UIMessage part-stream to
+ * these events lives once in `render.ts`, so a new platform is "translate
+ * RenderEvents", never "re-parse the AI stream".
+ */
+import type { AppMessage } from "@intentface/latch-core";
+/** A single thing worth showing on a chat surface as a run progresses. */
+export type RenderEvent = 
+/** Coarse run lifecycle, for typing/status indicators. */
+{
+    type: "status";
+    status: RunStatus;
+}
+/** A chunk of the assistant's visible answer. */
+ | {
+    type: "text-delta";
+    text: string;
+}
+/** A chunk of reasoning/thinking (render collapsed or throttled). */
+ | {
+    type: "reasoning-delta";
+    text: string;
+}
+/** A tool call started (we know its name + input). */
+ | {
+    type: "tool-start";
+    toolCallId: string;
+    toolName: string;
+    input?: unknown;
+}
+/** A tool call settled with a result or an error. */
+ | {
+    type: "tool-end";
+    toolCallId: string;
+    toolName: string;
+    output?: unknown;
+    error?: string;
+}
+/** The run failed; `message` is the error text to surface to the user. */
+ | {
+    type: "error";
+    message: string;
+}
+/** The streamed turn ended (may still be paused awaiting approval — see status). */
+ | {
+    type: "finish";
+};
+export type RunStatus = "thinking" | "working" | "awaiting_input" | "done" | "error";
+/**
+ * A pending human-in-the-loop decision surfaced after a turn pauses. Detected
+ * from persisted history (not the live chunk stream), because approvals are
+ * message state, not stream chunks.
+ */
+export interface PendingApproval {
+    /** The opaque approval id to pass back to `runtime.applyApproval`. */
+    approvalId: string;
+    /** The tool awaiting approval (bare name, e.g. `web_search`). */
+    toolName: string;
+    /** The tool input the model proposed, for display. */
+    input?: unknown;
+    /**
+     * OAuth "connect a connection" approvals (`connect_<name>`) are special: they
+     * resolve by sending the user through the platform's authorize URL, not by an
+     * approve/deny button. `connectionName` is the `<name>` part.
+     */
+    isConnect: boolean;
+    connectionName?: string;
+}
+/** One choice on an `askUser` question. `label` goes on the button. */
+export interface QuestionOption {
+    label: string;
+    description: string;
+}
+/** One question from an `askUser` call (mirrors `AskUserQuestion` in the platform UI). */
+export interface Question {
+    question: string;
+    header?: string;
+    options: QuestionOption[];
+    multiSelect?: boolean;
+}
+/**
+ * A questionnaire a paused turn is waiting on — an `askUser` tool call parked in
+ * `input-available`. Unlike an approval it resolves through
+ * `runtime.applyToolResult`, and ALL questions resolve in one call, so a channel
+ * must collect every answer before submitting.
+ */
+export interface PendingQuestion {
+    /** The tool call to resolve via `runtime.applyToolResult`. */
+    toolCallId: string;
+    questions: Question[];
+}
+/**
+ * A questionnaire in progress on a chat surface — at most one per chat.
+ *
+ * Chat surfaces answer one question at a time, but `applyToolResult` closes the
+ * whole tool call in one shot, so the answers collected so far have to live
+ * somewhere between taps. Serverless channels have no memory between webhook
+ * deliveries, hence a host-backed store.
+ */
+export interface AskSession {
+    /** The parked `askUser` call these answers will resolve. */
+    toolCallId: string;
+    /** Freshness token carried in button payloads so stale buttons are rejected. */
+    nonce: string;
+    /** The questions as posted — avoids a history read on every tap. */
+    questions: Question[];
+    /** Index of the question currently on screen. */
+    cursor: number;
+    /** question text → committed answer, for questions already answered. */
+    answers: Record<string, string>;
+    /** Option indices ticked so far on the current `multiSelect` question. */
+    selected: number[];
+    /** Platform chat to post questions into (the Telegram/WhatsApp chat id). */
+    promptChatId: string;
+    /** Platform id of the visible prompt message (cosmetic — used to edit it). */
+    promptRef?: string;
+    /** Fence for optimistic concurrency; every successful write bumps it. */
+    rev: number;
+}
+/**
+ * Host-backed storage for in-flight questionnaires, injected like `seen` and
+ * `claimTurn`. Grouped into one object because these are a single transactional
+ * aggregate over one row — partial wiring is a bug, not a degradation, so a
+ * channel checks for the whole store or renders questions as plain text.
+ */
+export interface AskStateStore {
+    /** The live session for this chat, or null (expired rows count as absent). */
+    get(chatId: string): Promise<AskSession | null>;
+    /**
+     * Claim the right to prompt. Replaces a session for a DIFFERENT tool call,
+     * but leaves one for the SAME tool call untouched and answers `"already"` —
+     * so re-rendering a still-pending questionnaire never double-prompts.
+     */
+    begin(chatId: string, session: Omit<AskSession, "rev">): Promise<"started" | "already">;
+    /** Fenced patch. Returns the new rev, or null when `rev` was stale. */
+    update(chatId: string, toolCallId: string, rev: number, patch: Partial<Pick<AskSession, "cursor" | "answers" | "selected" | "promptRef">>): Promise<number | null>;
+    /** Fenced delete — true only if THIS caller removed it. Gates the submit. */
+    finish(chatId: string, toolCallId: string, rev: number): Promise<boolean>;
+    /** Unconditional drop, returning whatever was removed. */
+    clear(chatId: string): Promise<AskSession | null>;
+}
+/**
+ * Host-backed "which thread am I in" pointer for surfaces that have exactly one
+ * conversation per person (a Telegram DM, a WhatsApp thread) and therefore no
+ * native way to start a new one. `/new` bumps the epoch; the channel derives the
+ * chat id from it, so epoch 0 keeps the original id and existing conversations
+ * never move.
+ */
+export interface ChannelThreadStore {
+    /** Current epoch for a surface conversation; 0 when it has never rotated. */
+    current(baseChatId: string): Promise<number>;
+    /** Start a fresh thread; returns the new (higher) epoch. */
+    rotate(baseChatId: string): Promise<number>;
+}
+/**
+ * The identity gate's verdict for one inbound platform user. `principal` is the
+ * principal the turn runs as (required when `allowed`); `linkUrl` is the signed
+ * account-link URL to send on refusal; `silent` suppresses the refusal notice
+ * (a disabled binding shouldn't reply at all).
+ */
+export interface AuthResult<P> {
+    allowed: boolean;
+    principal?: P;
+    linkUrl?: string;
+    /** Override the refusal message. */
+    message?: string;
+    silent?: boolean;
+}
+/**
+ * The subset of the Latch runtime a channel drives. Structural so the package
+ * stays decoupled from the concrete app (and could even target a remote Latch).
+ */
+export interface ChannelRunOps<P> {
+    handleChat(input: {
+        agent: string;
+        chatId?: string;
+        principal: P;
+        message: AppMessage;
+    }): Promise<Response>;
+    applyApproval(input: {
+        chatId: string;
+        principal: P;
+        decisions: {
+            approvalId: string;
+            approved: boolean;
+        }[];
+    }): Promise<Response>;
+    /**
+     * Resume a turn paused on a client-handled tool (`askUser`). `output` is the
+     * answer map — one call closes the whole tool call. Optional so existing hosts
+     * keep type-checking; a channel without it can't render questionnaires.
+     */
+    applyToolResult?(input: {
+        chatId: string;
+        principal: P;
+        toolCallId: string;
+        output: unknown;
+    }): Promise<Response>;
+    /**
+     * Summarize the conversation and continue from the summary (`/compact`). Null
+     * when there's too little to compact. Optional so existing hosts keep
+     * type-checking; without it the command reports that it isn't available.
+     */
+    compactChat?(input: {
+        chatId: string;
+        principal: P;
+        focus?: string;
+    }): Promise<{
+        summary: string;
+        compacted: number;
+    } | null>;
+    loadHistory(input: {
+        chatId: string;
+        principal: P;
+    }): Promise<AppMessage[]>;
+}
+/**
+ * Host-provided speech-to-text for inbound voice/audio messages. Channels call
+ * it with the downloaded audio and put the returned transcript in the user
+ * message as text (the audio itself is never sent to the model — chat models
+ * generally don't accept audio input). Throws on failure.
+ */
+export type TranscribeAudio = (audio: {
+    bytes: Uint8Array;
+    mediaType: string;
+    filename: string;
+}) => Promise<string>;
+/** A tool-name → approval policy view, for rendering an agent's capabilities. */
+export interface ToolCapability {
+    name: string;
+    description?: string;
+    /** Whether calling this tool pauses for user approval. */
+    requiresApproval: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,0EAA0E;AAC1E,MAAM,MAAM,WAAW;AACrB,0DAA0D;AACxD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE;AACvC,iDAAiD;GAC/C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AACtC,qEAAqE;GACnE;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAC3C,sDAAsD;GACpD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;AAC/E,qDAAqD;GACnD;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AACH,0EAA0E;GACxE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACpC,oFAAoF;GAClF;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,gBAAgB,GAAG,MAAM,GAAG,OAAO,CAAC;AAErF;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,0FAA0F;AAC1F,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,UAAU;IACzB,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,4EAA4E;IAC5E,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAChD;;;;OAIG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACxF,uEAAuE;IACvE,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,CAAC,CAAC,GAChF,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1B,6EAA6E;IAC7E,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,0DAA0D;IAC1D,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,4DAA4D;IAC5D,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,CAAC,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,UAAU,CAAC,KAAK,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,CAAC,CAAC;QACb,OAAO,EAAE,UAAU,CAAC;KACrB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB,aAAa,CAAC,KAAK,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,CAAC,CAAC;QACb,SAAS,EAAE;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,OAAO,CAAA;SAAE,EAAE,CAAC;KACxD,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB;;;;OAIG;IACH,eAAe,CAAC,CAAC,KAAK,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,CAAC,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,OAAO,CAAC;KACjB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB;;;;OAIG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,CAAC,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,WAAW,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CAC7E;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE;IACpC,KAAK,EAAE,UAAU,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAEtB,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,gBAAgB,EAAE,OAAO,CAAC;CAC3B"}

package/dist/types.js

@@ -0,0 +1,12 @@
+/**
+ * Platform-agnostic vocabulary for bringing a Latch run to a chat surface.
+ *
+ * A channel adapter (Slack, Teams, …) only ever sees `RenderEvent`s — the
+ * normalized, surface-independent shape of what an agent is doing — and maps
+ * them to its platform's primitives (a streamed message, a status line, an
+ * approval card). The mapping from a Latch run's raw UIMessage part-stream to
+ * these events lives once in `render.ts`, so a new platform is "translate
+ * RenderEvents", never "re-parse the AI stream".
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/whatsapp/api.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Minimal WhatsApp Business Cloud API client (Meta Graph API) — just what a
+ * channel needs: send text / interactive-button messages and download inbound
+ * media. JSON POSTs to `graph.facebook.com/<version>/<phoneNumberId>/messages`
+ * with a bearer access token. No SDK.
+ */
+export type LazyString = string | (() => string | Promise<string>);
+export declare class WhatsappApiError extends Error {
+    readonly status: number;
+    constructor(op: string, status: number, detail?: string);
+}
+export interface WhatsappApiOptions {
+    baseUrl?: string;
+    apiVersion?: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+/** An interactive reply button (Meta caps: 3 buttons, 20-char titles). */
+export interface WhatsappReplyButton {
+    id: string;
+    title: string;
+}
+/** Meta's caps on interactive messages — they decide which affordance fits. */
+export declare const MAX_REPLY_BUTTONS = 3;
+export declare const MAX_LIST_ROWS = 10;
+export declare function whatsappApi(creds: {
+    accessToken: LazyString;
+    phoneNumberId: LazyString;
+}, opts?: WhatsappApiOptions): {
+    /** Send a plain text message (link previews off). */
+    sendText(to: string, body: string): Promise<void>;
+    /** Send a body with up to 3 quick-reply buttons (approval prompts). */
+    sendReplyButtons(to: string, body: string, buttons: WhatsappReplyButton[]): Promise<void>;
+    /**
+     * Send a body with a tappable list — up to 10 rows, so it covers questions
+     * that have more options than the 3-button limit allows. Row titles cap at
+     * 24 chars; the option's description rides along in `description`.
+     */
+    sendList(to: string, body: string, buttonLabel: string, rows: {
+        id: string;
+        title: string;
+        description?: string;
+    }[]): Promise<void>;
+    /** Resolve an inbound media id to its (short-lived) download URL + metadata. */
+    getMediaInfo(mediaId: string): Promise<{
+        url?: string;
+        mimeType?: string;
+        fileSize?: number;
+    }>;
+    /** Download media from the URL `getMediaInfo` returned (token-authenticated). */
+    downloadMedia(url: string): Promise<Uint8Array>;
+    /** Validate credentials: fetch the phone number object (admin "save" check). */
+    checkCredentials(): Promise<{
+        displayPhoneNumber?: string;
+        verifiedName?: string;
+    }>;
+};
+export type WhatsappClient = ReturnType<typeof whatsappApi>;
+//# sourceMappingURL=api.d.ts.map

package/dist/whatsapp/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/whatsapp/api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAMnE,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAKxD;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,0EAA0E;AAC1E,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,wBAAgB,WAAW,CACzB,KAAK,EAAE;IAAE,WAAW,EAAE,UAAU,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,EAC7D,IAAI,GAAE,kBAAuB;IAwC3B,qDAAqD;iBAClC,MAAM,QAAQ,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQvD,uEAAuE;yBAEjE,MAAM,QACJ,MAAM,WACH,mBAAmB,EAAE,GAC7B,OAAO,CAAC,IAAI,CAAC;IAiBhB;;;;OAIG;iBAEG,MAAM,QACJ,MAAM,eACC,MAAM,QACb;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,GAC1D,OAAO,CAAC,IAAI,CAAC;IAwBhB,gFAAgF;0BAErE,MAAM,GACd,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAUlE,iFAAiF;uBACxD,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAerD,gFAAgF;wBACtD,OAAO,CAAC;QAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;EAW5F;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/whatsapp/api.js

@@ -0,0 +1,154 @@
+/**
+ * Minimal WhatsApp Business Cloud API client (Meta Graph API) — just what a
+ * channel needs: send text / interactive-button messages and download inbound
+ * media. JSON POSTs to `graph.facebook.com/<version>/<phoneNumberId>/messages`
+ * with a bearer access token. No SDK.
+ */
+const DEFAULT_GRAPH_BASE_URL = "https://graph.facebook.com";
+const DEFAULT_API_VERSION = "v25.0";
+const DEFAULT_TIMEOUT_MS = 10_000;
+export class WhatsappApiError extends Error {
+    status;
+    constructor(op, status, detail) {
+        super(`whatsapp:${op} failed: ${detail ?? `HTTP ${status}`}`);
+        this.name = "WhatsappApiError";
+        this.status = status;
+    }
+}
+async function resolve(value) {
+    return typeof value === "function" ? value() : value;
+}
+/** Meta's caps on interactive messages — they decide which affordance fits. */
+export const MAX_REPLY_BUTTONS = 3;
+export const MAX_LIST_ROWS = 10;
+export function whatsappApi(creds, opts = {}) {
+    const base = opts.baseUrl ?? DEFAULT_GRAPH_BASE_URL;
+    const version = opts.apiVersion ?? DEFAULT_API_VERSION;
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    async function graphFetch(op, path, init) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+        try {
+            const res = await fetchImpl(`${base}/${version}/${path}`, {
+                ...init,
+                headers: {
+                    authorization: `Bearer ${await resolve(creds.accessToken)}`,
+                    ...(init.headers ?? {}),
+                },
+                signal: controller.signal,
+            });
+            if (!res.ok) {
+                const detail = await res
+                    .json()
+                    .then((j) => j?.error?.message)
+                    .catch(() => undefined);
+                throw new WhatsappApiError(op, res.status, detail);
+            }
+            return res;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    async function sendPayload(op, payload) {
+        await graphFetch(op, `${await resolve(creds.phoneNumberId)}/messages`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ messaging_product: "whatsapp", ...payload }),
+        });
+    }
+    return {
+        /** Send a plain text message (link previews off). */
+        async sendText(to, body) {
+            await sendPayload("sendText", {
+                to,
+                type: "text",
+                text: { body, preview_url: false },
+            });
+        },
+        /** Send a body with up to 3 quick-reply buttons (approval prompts). */
+        async sendReplyButtons(to, body, buttons) {
+            await sendPayload("sendReplyButtons", {
+                to,
+                type: "interactive",
+                interactive: {
+                    type: "button",
+                    body: { text: body.slice(0, 1024) },
+                    action: {
+                        buttons: buttons.slice(0, 3).map((b) => ({
+                            type: "reply",
+                            reply: { id: b.id, title: b.title.slice(0, 20) },
+                        })),
+                    },
+                },
+            });
+        },
+        /**
+         * Send a body with a tappable list — up to 10 rows, so it covers questions
+         * that have more options than the 3-button limit allows. Row titles cap at
+         * 24 chars; the option's description rides along in `description`.
+         */
+        async sendList(to, body, buttonLabel, rows) {
+            await sendPayload("sendList", {
+                to,
+                type: "interactive",
+                interactive: {
+                    type: "list",
+                    body: { text: body.slice(0, 1024) },
+                    action: {
+                        button: buttonLabel.slice(0, 20),
+                        sections: [
+                            {
+                                title: "Options",
+                                rows: rows.slice(0, MAX_LIST_ROWS).map((r) => ({
+                                    id: r.id,
+                                    title: r.title.slice(0, 24),
+                                    ...(r.description ? { description: r.description.slice(0, 72) } : {}),
+                                })),
+                            },
+                        ],
+                    },
+                },
+            });
+        },
+        /** Resolve an inbound media id to its (short-lived) download URL + metadata. */
+        async getMediaInfo(mediaId) {
+            const res = await graphFetch("getMediaInfo", mediaId, { method: "GET" });
+            const j = (await res.json());
+            return {
+                ...(j.url ? { url: j.url } : {}),
+                ...(j.mime_type ? { mimeType: j.mime_type } : {}),
+                ...(typeof j.file_size === "number" ? { fileSize: j.file_size } : {}),
+            };
+        },
+        /** Download media from the URL `getMediaInfo` returned (token-authenticated). */
+        async downloadMedia(url) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+            try {
+                const res = await fetchImpl(url, {
+                    headers: { authorization: `Bearer ${await resolve(creds.accessToken)}` },
+                    signal: controller.signal,
+                });
+                if (!res.ok)
+                    throw new WhatsappApiError("downloadMedia", res.status);
+                return new Uint8Array(await res.arrayBuffer());
+            }
+            finally {
+                clearTimeout(timer);
+            }
+        },
+        /** Validate credentials: fetch the phone number object (admin "save" check). */
+        async checkCredentials() {
+            const res = await graphFetch("checkCredentials", await resolve(creds.phoneNumberId), {
+                method: "GET",
+            });
+            const j = (await res.json());
+            return {
+                ...(j.display_phone_number ? { displayPhoneNumber: j.display_phone_number } : {}),
+                ...(j.verified_name ? { verifiedName: j.verified_name } : {}),
+            };
+        },
+    };
+}
+//# sourceMappingURL=api.js.map

package/dist/whatsapp/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../src/whatsapp/api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAC5D,MAAM,mBAAmB,GAAG,OAAO,CAAC;AACpC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,MAAM,CAAS;IAExB,YAAY,EAAU,EAAE,MAAc,EAAE,MAAe;QACrD,KAAK,CAAC,YAAY,EAAE,YAAY,MAAM,IAAI,QAAQ,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AASD,KAAK,UAAU,OAAO,CAAC,KAAiB;IACtC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACvD,CAAC;AAQD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC;AAEhC,MAAM,UAAU,WAAW,CACzB,KAA6D,EAC7D,OAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,IAAiB;QACnE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,EAAE;gBACxD,GAAG,IAAI;gBACP,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;oBAC3D,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;iBACxB;gBACD,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,GAAG;qBACrB,IAAI,EAAE;qBACN,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAsC,EAAE,KAAK,EAAE,OAAO,CAAC;qBACpE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,EAAU,EAAE,OAAgC;QACrE,MAAM,UAAU,CAAC,EAAE,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,qDAAqD;QACrD,KAAK,CAAC,QAAQ,CAAC,EAAU,EAAE,IAAY;YACrC,MAAM,WAAW,CAAC,UAAU,EAAE;gBAC5B,EAAE;gBACF,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,KAAK,CAAC,gBAAgB,CACpB,EAAU,EACV,IAAY,EACZ,OAA8B;YAE9B,MAAM,WAAW,CAAC,kBAAkB,EAAE;gBACpC,EAAE;gBACF,IAAI,EAAE,aAAa;gBACnB,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE;oBACnC,MAAM,EAAE;wBACN,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BACvC,IAAI,EAAE,OAAO;4BACb,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;yBACjD,CAAC,CAAC;qBACJ;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,QAAQ,CACZ,EAAU,EACV,IAAY,EACZ,WAAmB,EACnB,IAA2D;YAE3D,MAAM,WAAW,CAAC,UAAU,EAAE;gBAC5B,EAAE;gBACF,IAAI,EAAE,aAAa;gBACnB,WAAW,EAAE;oBACX,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE;oBACnC,MAAM,EAAE;wBACN,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;wBAChC,QAAQ,EAAE;4BACR;gCACE,KAAK,EAAE,SAAS;gCAChB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oCAC7C,EAAE,EAAE,CAAC,CAAC,EAAE;oCACR,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oCAC3B,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iCACtE,CAAC,CAAC;6BACJ;yBACF;qBACF;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,KAAK,CAAC,YAAY,CAChB,OAAe;YAEf,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA6D,CAAC;YACzF,OAAO;gBACL,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtE,CAAC;QACJ,CAAC;QAED,iFAAiF;QACjF,KAAK,CAAC,aAAa,CAAC,GAAW;YAC7B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;YACzF,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;oBAC/B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE;oBACxE,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;gBACrE,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,KAAK,CAAC,gBAAgB;YACpB,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,kBAAkB,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE;gBACnF,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA8D,CAAC;YAC1F,OAAO;gBACL,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/whatsapp/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @intentface/latch-channels/whatsapp
+ *
+ * Bring a Latch agent to WhatsApp via the Meta Business Cloud API: per-bot
+ * webhook handling (hub.challenge handshake + X-Hub-Signature-256), one reply
+ * per turn (split past 4096 chars — WhatsApp cannot edit messages), reply-
+ * button approvals, and media → multimodal file parts. A Surface over the
+ * turn kernel — identity, credentials and dedupe are injected by the host.
+ */
+export { whatsappApi, WhatsappApiError, type LazyString, type WhatsappApiOptions, type WhatsappClient, type WhatsappReplyButton, } from "./api.js";
+export { verifyWhatsappSignature, whatsappVerifyChallenge } from "./verify.js";
+export { whatsappChannel, whatsappSurface, whatsappChatId, parseWhatsappChatId, encodeWhatsappApprovalId, decodeWhatsappApprovalId, splitWhatsappText, type WhatsappChannelConfig, type WhatsappUser, type WaMediaRef, } from "./whatsappChannel.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/whatsapp/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/whatsapp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,GACzB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,sBAAsB,CAAC"}

package/dist/whatsapp/index.js

@@ -0,0 +1,13 @@
+/**
+ * @intentface/latch-channels/whatsapp
+ *
+ * Bring a Latch agent to WhatsApp via the Meta Business Cloud API: per-bot
+ * webhook handling (hub.challenge handshake + X-Hub-Signature-256), one reply
+ * per turn (split past 4096 chars — WhatsApp cannot edit messages), reply-
+ * button approvals, and media → multimodal file parts. A Surface over the
+ * turn kernel — identity, credentials and dedupe are injected by the host.
+ */
+export { whatsappApi, WhatsappApiError, } from "./api.js";
+export { verifyWhatsappSignature, whatsappVerifyChallenge } from "./verify.js";
+export { whatsappChannel, whatsappSurface, whatsappChatId, parseWhatsappChatId, encodeWhatsappApprovalId, decodeWhatsappApprovalId, splitWhatsappText, } from "./whatsappChannel.js";
+//# sourceMappingURL=index.js.map

package/dist/whatsapp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/whatsapp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,WAAW,EACX,gBAAgB,GAKjB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,iBAAiB,GAIlB,MAAM,sBAAsB,CAAC"}

package/dist/whatsapp/verify.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Meta webhook verification, both halves:
+ *  - GET handshake: Meta calls with `hub.mode=subscribe&hub.verify_token=…&
+ *    hub.challenge=…` when the callback URL is saved; echo the challenge iff
+ *    the verify token matches.
+ *  - POST signature: `X-Hub-Signature-256: sha256=<hex HMAC of the raw body
+ *    keyed on the app secret>`, constant-time compared.
+ */
+/** Returns the challenge to echo (HTTP 200 text/plain), or null → 403. */
+export declare function whatsappVerifyChallenge(url: URL, verifyToken: string): string | null;
+/** Verify a webhook POST's `X-Hub-Signature-256` header over the raw body. */
+export declare function verifyWhatsappSignature(opts: {
+    appSecret: string;
+    rawBody: string;
+    signature: string | null;
+}): boolean;
+//# sourceMappingURL=verify.d.ts.map

package/dist/whatsapp/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/whatsapp/verify.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAEH,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASpF;AAED,8EAA8E;AAC9E,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,GAAG,OAAO,CAMV"}

package/dist/whatsapp/verify.js

@@ -0,0 +1,32 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * Meta webhook verification, both halves:
+ *  - GET handshake: Meta calls with `hub.mode=subscribe&hub.verify_token=…&
+ *    hub.challenge=…` when the callback URL is saved; echo the challenge iff
+ *    the verify token matches.
+ *  - POST signature: `X-Hub-Signature-256: sha256=<hex HMAC of the raw body
+ *    keyed on the app secret>`, constant-time compared.
+ */
+/** Returns the challenge to echo (HTTP 200 text/plain), or null → 403. */
+export function whatsappVerifyChallenge(url, verifyToken) {
+    const mode = url.searchParams.get("hub.mode");
+    const token = url.searchParams.get("hub.verify_token");
+    const challenge = url.searchParams.get("hub.challenge");
+    if (mode !== "subscribe" || !token || !challenge || !verifyToken)
+        return null;
+    const a = Buffer.from(token);
+    const b = Buffer.from(verifyToken);
+    if (a.length !== b.length || !timingSafeEqual(a, b))
+        return null;
+    return challenge;
+}
+/** Verify a webhook POST's `X-Hub-Signature-256` header over the raw body. */
+export function verifyWhatsappSignature(opts) {
+    if (!opts.signature || !opts.appSecret)
+        return false;
+    const expected = `sha256=${createHmac("sha256", opts.appSecret).update(opts.rawBody).digest("hex")}`;
+    const a = Buffer.from(expected);
+    const b = Buffer.from(opts.signature);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+//# sourceMappingURL=verify.js.map

package/dist/whatsapp/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/whatsapp/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;;;;GAOG;AAEH,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,GAAQ,EAAE,WAAmB;IACnE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACxD,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,IAIvC;IACC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,QAAQ,GAAG,UAAU,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACrG,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}