@kilnai/runtime 0.1.1

package/dist/gateway/tenant-admin-routes.js

@@ -0,0 +1,148 @@
+// Gateway: Tenant admin CRUD routes -- Hono sub-app for managing tenant configs
+// Handles tenant listing, creation, update, and deletion with optional auth
+import { Hono } from "hono";
+import { TenantNotFoundError, TenantValidationFailedError } from "../tenant/tenant-registry.js";
+/**
+ * Mutable fields allowed in tenant create/update requests.
+ * Immutable fields (tenantId, appName, createdAt, updatedAt) are set server-side.
+ * This prevents prototype pollution and field injection from untrusted request bodies.
+ */
+const MUTABLE_TENANT_FIELDS = [
+    "name",
+    "description",
+    "services",
+    "hours",
+    "faqEntries",
+    "escalationContact",
+    "tone",
+    "language",
+    "whatsappPhoneNumberId",
+    "whatsappAccessToken",
+    "whatsappVerifyToken",
+    "billing",
+    "idleTimeoutMs",
+    "enabled",
+];
+/** Pick only safe mutable fields from an untrusted body */
+function pickMutableFields(body) {
+    const result = {};
+    for (const field of MUTABLE_TENANT_FIELDS) {
+        if (field in body) {
+            result[field] = body[field];
+        }
+    }
+    return result;
+}
+/**
+ * Generate a tenant ID from a display name.
+ * Lowercases, removes diacritics (NFD + strip combining chars),
+ * replaces non-alphanumeric with hyphens, trims hyphens, max 64 chars.
+ */
+export function generateTenantId(name) {
+    return name
+        .normalize("NFD")
+        .replace(/[\u0300-\u036f]/g, "")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 64);
+}
+export function createTenantAdminRoutes(config) {
+    const app = new Hono();
+    // Auth middleware: if adminToken is configured, require Bearer token
+    if (config.adminToken) {
+        app.use("*", async (c, next) => {
+            const auth = c.req.header("Authorization");
+            if (!auth || auth !== `Bearer ${config.adminToken}`) {
+                return c.json({ error: "Unauthorized" }, 401);
+            }
+            await next();
+        });
+    }
+    // GET /tenants -- list tenants for this App
+    app.get("/tenants", (c) => {
+        const tenants = config.tenantRegistry.list(config.appName);
+        return c.json({ tenants });
+    });
+    // GET /tenants/:tenantId -- get single tenant
+    app.get("/tenants/:tenantId", (c) => {
+        const tenantId = c.req.param("tenantId");
+        const tenant = config.tenantRegistry.get(tenantId);
+        if (!tenant || tenant.appName !== config.appName) {
+            return c.json({ error: "Tenant not found" }, 404);
+        }
+        return c.json(tenant);
+    });
+    // POST /tenants -- create tenant
+    app.post("/tenants", async (c) => {
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        const now = new Date().toISOString();
+        const tenantId = body.tenantId || generateTenantId(body.name ?? "");
+        const safeFields = pickMutableFields(body);
+        const tenantConfig = {
+            ...safeFields,
+            tenantId,
+            appName: config.appName,
+            enabled: body.enabled !== undefined ? Boolean(body.enabled) : true,
+            createdAt: now,
+            updatedAt: now,
+        };
+        try {
+            const created = config.tenantRegistry.create(tenantConfig);
+            return c.json(created, 201);
+        }
+        catch (err) {
+            if (err instanceof TenantValidationFailedError) {
+                const isDuplicate = err.errors.some((e) => e.message.includes("duplicate"));
+                if (isDuplicate) {
+                    return c.json({ error: "Tenant already exists", details: err.errors }, 409);
+                }
+                return c.json({ error: "Validation failed", details: err.errors }, 422);
+            }
+            throw err;
+        }
+    });
+    // PATCH /tenants/:tenantId -- partial update
+    app.patch("/tenants/:tenantId", async (c) => {
+        const tenantId = c.req.param("tenantId");
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        try {
+            const safeUpdate = pickMutableFields(body);
+            const updated = config.tenantRegistry.update(tenantId, safeUpdate);
+            return c.json(updated);
+        }
+        catch (err) {
+            if (err instanceof TenantNotFoundError) {
+                return c.json({ error: "Tenant not found" }, 404);
+            }
+            if (err instanceof TenantValidationFailedError) {
+                return c.json({ error: "Validation failed", details: err.errors }, 422);
+            }
+            throw err;
+        }
+    });
+    // DELETE /tenants/:tenantId -- remove tenant
+    app.delete("/tenants/:tenantId", (c) => {
+        const tenantId = c.req.param("tenantId");
+        const tenant = config.tenantRegistry.get(tenantId);
+        if (!tenant || tenant.appName !== config.appName) {
+            return c.json({ error: "Tenant not found" }, 404);
+        }
+        config.tenantRegistry.remove(tenantId);
+        return c.json({ removed: true });
+    });
+    return app;
+}
+//# sourceMappingURL=tenant-admin-routes.js.map

package/dist/gateway/tenant-admin-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-admin-routes.js","sourceRoot":"","sources":["../../src/gateway/tenant-admin-routes.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,4EAA4E;AAE5E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAEhG;;;;GAIG;AACH,MAAM,qBAAqB,GAAG;IAC5B,MAAM;IACN,aAAa;IACb,UAAU;IACV,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,MAAM;IACN,UAAU;IACV,uBAAuB;IACvB,qBAAqB;IACrB,qBAAqB;IACrB,SAAS;IACT,eAAe;IACf,SAAS;CACyC,CAAC;AAErD,2DAA2D;AAC3D,SAAS,iBAAiB,CAAC,IAA6B;IACtD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,MAA+B,CAAC;AACzC,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI;SACR,SAAS,CAAC,KAAK,CAAC;SAChB,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAA+B;IACrE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,qEAAqE;IACrE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,UAAU,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC;gBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,IAAI,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,8CAA8C;IAC9C,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,iCAAiC;IACjC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAI,IAAI,CAAC,QAAmB,IAAI,gBAAgB,CAAE,IAAI,CAAC,IAAe,IAAI,EAAE,CAAC,CAAC;QAC5F,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAE3C,MAAM,YAAY,GAAiB;YACjC,GAAG,UAAU;YACb,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;YAClE,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACC,CAAC;QAElB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;gBAC/C,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;gBAC5E,IAAI,WAAW,EAAE,CAAC;oBAChB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC9E,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,GAAG,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzC,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;gBAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/gateway/tenant-routes.d.ts

@@ -0,0 +1,15 @@
+import { Hono } from "hono";
+import type { ModeBOrchestrator } from "../session/mode-b-orchestrator.js";
+import type { SessionRegistry } from "../session/session-registry.js";
+import type { TenantRegistry } from "../tenant/tenant-registry.js";
+import type { BillingConfig } from "./budget-middleware.js";
+/** Runtime configuration for a multi-tenant App */
+export interface TenantAppRuntime {
+    readonly appName: string;
+    readonly orchestrator: ModeBOrchestrator;
+    readonly sessionRegistry: SessionRegistry;
+    readonly tenantRegistry: TenantRegistry;
+    readonly billing?: BillingConfig;
+}
+export declare function createTenantRoutes(runtime: TenantAppRuntime): Hono;
+//# sourceMappingURL=tenant-routes.d.ts.map

package/dist/gateway/tenant-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-routes.d.ts","sourceRoot":"","sources":["../../src/gateway/tenant-routes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAGnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,mDAAmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;CAClC;AAWD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CA8GlE"}

package/dist/gateway/tenant-routes.js

@@ -0,0 +1,107 @@
+// Gateway: Tenant routes -- Hono sub-app for multi-tenant message processing
+// Handles tenant-scoped message processing, session listing, and session removal
+import { Hono } from "hono";
+import { textParts, extractText } from "@kilnai/core";
+import { buildTenantSystemPrompt } from "../tenant/system-prompt-builder.js";
+import { checkBudget, reportUsage } from "./budget-middleware.js";
+export function createTenantRoutes(runtime) {
+    const app = new Hono();
+    app.post("/message", async (c) => {
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: "Invalid JSON body" }, 400);
+        }
+        // Accept either { message: string } or { parts: ContentPart[] }
+        const userParts = body.parts && Array.isArray(body.parts)
+            ? body.parts
+            : (body.message && typeof body.message === "string" ? textParts(body.message) : []);
+        if (userParts.length === 0) {
+            return c.json({ error: "message or parts is required" }, 400);
+        }
+        if (!body.userId || typeof body.userId !== "string") {
+            return c.json({ error: "userId is required" }, 400);
+        }
+        if (!body.tenantId || typeof body.tenantId !== "string") {
+            return c.json({ error: "tenantId is required" }, 400);
+        }
+        // Resolve tenant
+        const tenant = runtime.tenantRegistry.get(body.tenantId);
+        if (!tenant || tenant.appName !== runtime.appName) {
+            return c.json({ error: "Tenant not found" }, 404);
+        }
+        if (!tenant.enabled) {
+            return c.json({ error: "Tenant is disabled" }, 403);
+        }
+        // Budget check (use tenantId:userId as billing key)
+        const billingConfig = tenant.billing?.budgetEndpoint
+            ? tenant.billing
+            : runtime.billing;
+        if (billingConfig) {
+            const billingUserId = `${body.tenantId}:${body.userId}`;
+            const budgetResult = await checkBudget(billingConfig, billingUserId);
+            if (!budgetResult.allowed) {
+                return c.json({
+                    content: billingConfig.overBudgetMessage ?? "Budget exhausted.",
+                    budgetExhausted: true,
+                });
+            }
+        }
+        // Build system prompt from tenant config
+        const systemPrompt = buildTenantSystemPrompt(tenant);
+        // Get or create session with tenantId
+        const session = runtime.sessionRegistry.getOrCreate({
+            appName: runtime.appName,
+            tenantId: body.tenantId,
+            userId: body.userId,
+            systemPrompt,
+            idleTimeoutMs: tenant.idleTimeoutMs,
+        });
+        // Process message
+        const result = await runtime.orchestrator.processMessage(session, userParts);
+        // Report token usage to billing (fire-and-forget)
+        if (billingConfig) {
+            const billingUserId = `${body.tenantId}:${body.userId}`;
+            reportUsage(billingConfig, billingUserId, {
+                tokens: result.inputTokens + result.outputTokens,
+                model: runtime.orchestrator.model ?? "unknown",
+                role: "assistant",
+            });
+        }
+        return c.json({
+            content: extractText(result.parts),
+            parts: result.parts,
+            inputTokens: result.inputTokens,
+            outputTokens: result.outputTokens,
+            sessionId: session.id,
+            tenantId: body.tenantId,
+        });
+    });
+    app.get("/sessions", (c) => {
+        const tenantIdFilter = c.req.query("tenantId");
+        let sessions = runtime.sessionRegistry.activeSessions();
+        if (tenantIdFilter) {
+            sessions = sessions.filter((s) => s.tenantId === tenantIdFilter);
+        }
+        return c.json({
+            sessions: sessions.map((s) => ({
+                id: s.id,
+                userId: s.userId,
+                tenantId: s.tenantId,
+                messageCount: s.messageCount,
+                createdAt: s.createdAt.toISOString(),
+                lastActivityAt: s.lastActivityAt.toISOString(),
+            })),
+        });
+    });
+    app.delete("/sessions/:tenantId/:userId", (c) => {
+        const tenantId = c.req.param("tenantId");
+        const userId = c.req.param("userId");
+        const removed = runtime.sessionRegistry.remove(runtime.appName, userId, tenantId);
+        return c.json({ removed });
+    });
+    return app;
+}
+//# sourceMappingURL=tenant-routes.js.map

package/dist/gateway/tenant-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-routes.js","sourceRoot":"","sources":["../../src/gateway/tenant-routes.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,iFAAiF;AAEjF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAqBlE,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAC1D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,IAAI,IAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAwB,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,gEAAgE;QAChE,MAAM,SAAS,GAA2B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAC/E,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;QACxD,CAAC;QAED,iBAAiB;QACjB,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,oDAAoD;QACpD,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,EAAE,cAAc;YAClD,CAAC,CAAE,MAAM,CAAC,OAAoC;YAC9C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACpB,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;YACrE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,aAAa,CAAC,iBAAiB,IAAI,mBAAmB;oBAC/D,eAAe,EAAE,IAAI;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,YAAY,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAErD,sCAAsC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,WAAW,CAAC;YAClD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY;YACZ,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC,CAAC;QAEH,kBAAkB;QAClB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAE7E,kDAAkD;QAClD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,aAAa,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACxD,WAAW,CAAC,aAAa,EAAE,aAAa,EAAE;gBACxC,MAAM,EAAE,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,YAAY;gBAChD,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,KAAK,IAAI,SAAS;gBAC9C,IAAI,EAAE,WAAW;aAClB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;YAClC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,cAAc,EAAE,CAAC;QACxD,IAAI,cAAc,EAAE,CAAC;YACnB,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,cAAc,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7B,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;gBACpC,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE;aAC/C,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,6BAA6B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC9C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/gateway/whatsapp-webhook-routes.d.ts

@@ -0,0 +1,15 @@
+import { Hono } from "hono";
+import type { ModeBOrchestrator } from "../session/mode-b-orchestrator.js";
+import type { SessionRegistry } from "../session/session-registry.js";
+import type { TenantRegistry } from "../tenant/tenant-registry.js";
+export interface WhatsAppWebhookConfig {
+    readonly appName: string;
+    readonly orchestrator: ModeBOrchestrator;
+    readonly sessionRegistry: SessionRegistry;
+    readonly tenantRegistry: TenantRegistry;
+    readonly verifyToken: string;
+    /** Base path for per-tenant data (e.g. ~/.kiln/gateway/bonitas). Memory DBs stored under <basePath>/memory/ */
+    readonly memoryBasePath?: string;
+}
+export declare function createWhatsAppWebhookRoutes(config: WhatsAppWebhookConfig): Hono;
+//# sourceMappingURL=whatsapp-webhook-routes.d.ts.map

package/dist/gateway/whatsapp-webhook-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whatsapp-webhook-routes.d.ts","sourceRoot":"","sources":["../../src/gateway/whatsapp-webhook-routes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAInE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,iBAAiB,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,+GAA+G;IAC/G,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AA2FD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAuF/E"}

package/dist/gateway/whatsapp-webhook-routes.js

@@ -0,0 +1,217 @@
+// Gateway: WhatsApp webhook routes -- Hono sub-app for Meta webhook verification and incoming messages
+// Resolves tenant by phone number, processes messages via Mode B orchestrator, replies via Cloud API
+import { Hono } from "hono";
+import { join } from "node:path";
+import { mkdirSync } from "node:fs";
+import { textParts, extractText, SqliteMemoryStore } from "@kilnai/core";
+import { buildTenantSystemPrompt } from "../tenant/system-prompt-builder.js";
+import { sendWhatsAppMessage, whatsappMediaUrl } from "../channels/whatsapp-api.js";
+/** Lazily-opened per-tenant memory stores. Keyed by tenantId. */
+const memoryStores = new Map();
+function getMemoryStore(memoryBasePath, tenantId) {
+    let store = memoryStores.get(tenantId);
+    if (store)
+        return store;
+    const dir = join(memoryBasePath, "memory");
+    mkdirSync(dir, { recursive: true });
+    store = new SqliteMemoryStore({
+        dbPath: join(dir, `${tenantId}.db`),
+        layer: "user",
+        tenantId,
+    });
+    memoryStores.set(tenantId, store);
+    return store;
+}
+/** Tool definition for notify_owner -- injected when tenant has escalationContact */
+const NOTIFY_OWNER_TOOL = {
+    name: "notify_owner",
+    description: "Send a WhatsApp notification to the business owner. Use this when a customer wants to schedule an appointment, needs escalation, or when the owner needs to be informed about something. Include a clear summary of what the customer needs.",
+    inputSchema: {
+        type: "object",
+        properties: {
+            message: {
+                type: "string",
+                description: "The message to send to the owner. Include customer name (if known), requested service, date/time, and phone number.",
+            },
+        },
+        required: ["message"],
+    },
+    tags: new Set(["builtin"]),
+};
+/** Parse a WhatsApp message into ContentPart[] */
+function parseWhatsAppMessageParts(msg) {
+    switch (msg.type) {
+        case "text":
+            return msg.text?.body ? textParts(msg.text.body) : null;
+        case "image": {
+            if (!msg.image)
+                return null;
+            const parts = [
+                { type: "image", mimeType: msg.image.mime_type, url: whatsappMediaUrl(msg.image.id) },
+            ];
+            if (msg.image.caption)
+                parts.push({ type: "text", text: msg.image.caption });
+            return parts;
+        }
+        case "audio":
+            if (!msg.audio)
+                return null;
+            return [{ type: "audio", mimeType: msg.audio.mime_type, url: whatsappMediaUrl(msg.audio.id) }];
+        case "document": {
+            if (!msg.document)
+                return null;
+            const parts = [
+                { type: "file", mimeType: msg.document.mime_type, url: whatsappMediaUrl(msg.document.id), filename: msg.document.filename },
+            ];
+            if (msg.document.caption)
+                parts.push({ type: "text", text: msg.document.caption });
+            return parts;
+        }
+        default:
+            return null;
+    }
+}
+export function createWhatsAppWebhookRoutes(config) {
+    const app = new Hono();
+    // GET /webhook -- Meta verification handshake
+    app.get("/webhook", (c) => {
+        const mode = c.req.query("hub.mode");
+        const token = c.req.query("hub.verify_token");
+        const challenge = c.req.query("hub.challenge");
+        if (mode === "subscribe" && token === config.verifyToken) {
+            return c.text(challenge ?? "", 200);
+        }
+        return c.text("Forbidden", 403);
+    });
+    // POST /webhook -- Incoming messages from Meta
+    app.post("/webhook", async (c) => {
+        let payload;
+        try {
+            payload = await c.req.json();
+        }
+        catch {
+            return c.text("OK", 200);
+        }
+        if (!payload.entry) {
+            return c.text("OK", 200);
+        }
+        // Process each entry in the background
+        const processPromises = [];
+        for (const entry of payload.entry) {
+            for (const change of entry.changes) {
+                const phoneNumberId = change.value.metadata?.phone_number_id;
+                if (!phoneNumberId)
+                    continue;
+                const messages = change.value.messages;
+                if (!messages)
+                    continue;
+                // Resolve tenant by phone number
+                const tenant = config.tenantRegistry.resolveByPhone(phoneNumberId, config.appName);
+                if (!tenant) {
+                    console.warn(`[whatsapp] No tenant found for phone_number_id=${phoneNumberId} app=${config.appName}`);
+                    continue;
+                }
+                const contacts = change.value.contacts ?? [];
+                for (const msg of messages) {
+                    const msgParts = parseWhatsAppMessageParts(msg);
+                    if (!msgParts) {
+                        console.warn(`[whatsapp] Unsupported message type=${msg.type} from=${msg.from}`);
+                        continue;
+                    }
+                    // Resolve canonical reply address from contacts; fall back to msg.from
+                    const contact = contacts.find((c) => c.wa_id === msg.from);
+                    const replyTo = contact?.wa_id ?? msg.from;
+                    console.log(`[whatsapp] Received message from=${replyTo} tenant=${tenant.tenantId} type=${msg.type}`);
+                    const promise = processWhatsAppMessage(config, tenant.tenantId, replyTo, msgParts, phoneNumberId, tenant.whatsappAccessToken);
+                    processPromises.push(promise);
+                }
+            }
+        }
+        // Fire and forget -- log any failures from settled promises
+        Promise.allSettled(processPromises).then((results) => {
+            for (const result of results) {
+                if (result.status === "rejected") {
+                    console.warn("[whatsapp] Message processing failed:", result.reason);
+                }
+            }
+        });
+        return c.text("OK", 200);
+    });
+    return app;
+}
+async function processWhatsAppMessage(config, tenantId, senderPhone, messageParts, phoneNumberId, accessTokenEnv) {
+    const tenant = config.tenantRegistry.get(tenantId);
+    if (!tenant)
+        return;
+    const systemPrompt = buildTenantSystemPrompt(tenant);
+    const accessToken = accessTokenEnv ? process.env[accessTokenEnv] ?? "" : "";
+    const messageText = extractText(messageParts);
+    const session = config.sessionRegistry.getOrCreate({
+        appName: config.appName,
+        tenantId,
+        userId: senderPhone,
+        systemPrompt,
+        idleTimeoutMs: tenant.idleTimeoutMs,
+    });
+    // --- Memory: recall past context about this user ---
+    let recalledMemory;
+    if (config.memoryBasePath) {
+        try {
+            const store = getMemoryStore(config.memoryBasePath, tenantId);
+            const query = `${senderPhone} ${messageText}`;
+            recalledMemory = await store.recall(query, 500) || undefined;
+        }
+        catch (err) {
+            console.warn(`[whatsapp] Memory recall failed for tenant=${tenantId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    // --- Tools: build per-call builtin tools ---
+    const callTools = new Map();
+    if (tenant.escalationContact?.phone) {
+        const ownerPhone = tenant.escalationContact.phone.replace(/\+/g, "");
+        callTools.set("notify_owner", async (input) => {
+            const msg = String(input.message ?? "");
+            const fullMessage = `[Ale - Notificación automática]\n\nCliente: ${senderPhone}\n${msg}`;
+            await sendWhatsAppMessage(phoneNumberId, accessToken, ownerPhone, {
+                type: "text",
+                text: { body: fullMessage },
+            });
+            console.log(`[whatsapp] Owner notified for tenant=${tenantId} owner=${ownerPhone}`);
+            return { success: true, message: "Owner has been notified." };
+        });
+    }
+    // Register notify_owner tool definition on the orchestrator if not already present
+    if (callTools.size > 0 && config.orchestrator.tools) {
+        const hasNotifyTool = config.orchestrator.tools.some((t) => t.name === "notify_owner");
+        if (!hasNotifyTool) {
+            config.orchestrator.registerTools([NOTIFY_OWNER_TOOL]);
+        }
+    }
+    const result = await config.orchestrator.processMessage(session, messageParts, recalledMemory, callTools.size > 0 ? callTools : undefined);
+    // Reply via WhatsApp Cloud API
+    const replyText = extractText(result.parts);
+    try {
+        await sendWhatsAppMessage(phoneNumberId, accessToken, senderPhone, {
+            type: "text",
+            text: { body: replyText },
+        });
+    }
+    catch (err) {
+        console.warn(`[whatsapp] Failed to send reply -- phoneNumberId=${phoneNumberId} recipient=${senderPhone} error=${err instanceof Error ? err.message : String(err)}`);
+    }
+    // --- Memory: save what was learned from this exchange ---
+    if (config.memoryBasePath && messageText.length > 5) {
+        try {
+            const store = getMemoryStore(config.memoryBasePath, tenantId);
+            await store.save({
+                layer: "user",
+                content: `[${senderPhone}] User: ${messageText}\nAssistant: ${replyText}`,
+                tags: [senderPhone],
+            });
+        }
+        catch (err) {
+            console.warn(`[whatsapp] Memory save failed for tenant=${tenantId}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}
+//# sourceMappingURL=whatsapp-webhook-routes.js.map

package/dist/gateway/whatsapp-webhook-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"whatsapp-webhook-routes.js","sourceRoot":"","sources":["../../src/gateway/whatsapp-webhook-routes.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,qGAAqG;AAErG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAIzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAoCpF,iEAAiE;AACjE,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;AAE1D,SAAS,cAAc,CAAC,cAAsB,EAAE,QAAgB;IAC9D,IAAI,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpC,KAAK,GAAG,IAAI,iBAAiB,CAAC;QAC5B,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,KAAK,CAAC;QACnC,KAAK,EAAE,MAAM;QACb,QAAQ;KACT,CAAC,CAAC;IACH,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,MAAM,iBAAiB,GAAmB;IACxC,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,8OAA8O;IAC3P,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,qHAAqH;aACnI;SACF;QACD,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;CAC3B,CAAC;AAEF,kDAAkD;AAClD,SAAS,yBAAyB,CAAC,GAAuB;IACxD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAC5B,MAAM,KAAK,GAAkB;gBAC3B,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;aACtF,CAAC;YACF,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,OAAO;YACV,IAAI,CAAC,GAAG,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACjG,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,KAAK,GAAkB;gBAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE;aAC5H,CAAC;YACF,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YACnF,OAAO,KAAK,CAAC;QACf,CAAC;QACD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAA6B;IACvE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,8CAA8C;IAC9C,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAE/C,IAAI,IAAI,KAAK,WAAW,IAAI,KAAK,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACzD,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAsB,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,uCAAuC;QACvC,MAAM,eAAe,GAAoB,EAAE,CAAC;QAE5C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC;gBAC7D,IAAI,CAAC,aAAa;oBAAE,SAAS;gBAE7B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;gBACvC,IAAI,CAAC,QAAQ;oBAAE,SAAS;gBAExB,iCAAiC;gBACjC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,IAAI,CAAC,kDAAkD,aAAa,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;oBACtG,SAAS;gBACX,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAE7C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;oBAC3B,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;oBAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,OAAO,CAAC,IAAI,CAAC,uCAAuC,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;wBACjF,SAAS;oBACX,CAAC;oBAED,uEAAuE;oBACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC3D,MAAM,OAAO,GAAG,OAAO,EAAE,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC;oBAE3C,OAAO,CAAC,GAAG,CAAC,oCAAoC,OAAO,WAAW,MAAM,CAAC,QAAQ,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;oBAEtG,MAAM,OAAO,GAAG,sBAAsB,CACpC,MAAM,EACN,MAAM,CAAC,QAAQ,EACf,OAAO,EACP,QAAQ,EACR,aAAa,EACb,MAAM,CAAC,mBAAmB,CAC3B,CAAC;oBACF,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBACjC,OAAO,CAAC,IAAI,CAAC,uCAAuC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBACvE,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAA6B,EAC7B,QAAgB,EAChB,WAAmB,EACnB,YAAoC,EACpC,aAAqB,EACrB,cAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,YAAY,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,WAAW,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC;QACjD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ;QACR,MAAM,EAAE,WAAW;QACnB,YAAY;QACZ,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC,CAAC;IAEH,sDAAsD;IACtD,IAAI,cAAkC,CAAC;IACvC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC;YAC9C,cAAc,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,8CAA8C,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9H,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAgE,CAAC;IAE1F,IAAI,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,KAA8B,EAAE,EAAE;YACrE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,+CAA+C,WAAW,KAAK,GAAG,EAAE,CAAC;YAEzF,MAAM,mBAAmB,CAAC,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE;gBAChE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAC5B,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,wCAAwC,QAAQ,UAAU,UAAU,EAAE,CAAC,CAAC;YACpF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;QAChE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACpD,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QACvF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,cAAc,CACrD,OAAO,EACP,YAAY,EACZ,cAAc,EACd,SAAS,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;IAEF,+BAA+B;IAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,mBAAmB,CAAC,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE;YACjE,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,oDAAoD,aAAa,cAAc,WAAW,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvJ,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,IAAI,MAAM,CAAC,cAAc,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC9D,MAAM,KAAK,CAAC,IAAI,CAAC;gBACf,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,IAAI,WAAW,WAAW,WAAW,gBAAgB,SAAS,EAAE;gBACzE,IAAI,EAAE,CAAC,WAAW,CAAC;aACpB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,4CAA4C,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/gateway/ws-routes.d.ts

@@ -0,0 +1,19 @@
+import { Hono } from "hono";
+import type { UpgradeWebSocket } from "hono/ws";
+import type { WebChannel } from "../channels/web-channel.js";
+import type { ContentPart } from "@kilnai/core";
+export interface WsRoutesConfig {
+    readonly webChannel: WebChannel;
+    readonly upgradeWebSocket: UpgradeWebSocket;
+    readonly validateToken?: (token: string) => {
+        valid: boolean;
+        userId?: string;
+    };
+    readonly processMessage?: (userId: string, parts: readonly ContentPart[]) => Promise<{
+        parts: readonly ContentPart[];
+        inputTokens: number;
+        outputTokens: number;
+    }>;
+}
+export declare function createWsRoutes(config: WsRoutesConfig): Hono;
+//# sourceMappingURL=ws-routes.d.ts.map

package/dist/gateway/ws-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-routes.d.ts","sourceRoot":"","sources":["../../src/gateway/ws-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAa,MAAM,SAAS,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAmB,MAAM,cAAc,CAAC;AAGjE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAChF,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,WAAW,EAAE,KAAK,OAAO,CAAC;QACnF,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC,CAAC;CACJ;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAmF3D"}

package/dist/gateway/ws-routes.js

@@ -0,0 +1,79 @@
+import { Hono } from "hono";
+import { textParts, extractText } from "@kilnai/core";
+export function createWsRoutes(config) {
+    const app = new Hono();
+    /**
+     * Per-request validated userId, scoped by token to avoid module-level mutable state.
+     * Entries are consumed (deleted) immediately in the upgrade handler, so concurrent
+     * requests with different tokens never collide.
+     */
+    const validatedUserIds = new Map();
+    app.get("/ws", async (c, next) => {
+        if (config.validateToken) {
+            const token = c.req.query("token");
+            if (!token)
+                return c.text("Unauthorized", 401);
+            const result = config.validateToken(token);
+            if (!result.valid)
+                return c.text("Unauthorized", 401);
+            if (result.userId) {
+                validatedUserIds.set(token, result.userId);
+            }
+        }
+        await next();
+    }, config.upgradeWebSocket((c) => {
+        const token = c.req.query("token");
+        const validatedUserId = token ? validatedUserIds.get(token) : undefined;
+        if (token)
+            validatedUserIds.delete(token);
+        const userId = validatedUserId ??
+            c.req.query("sessionId") ??
+            c.req.query("userId") ??
+            crypto.randomUUID();
+        return {
+            onOpen(_event, ws) {
+                config.webChannel.addClient(ws, userId);
+            },
+            onClose(_event, ws) {
+                config.webChannel.removeClient(ws);
+            },
+            async onMessage(event, ws) {
+                try {
+                    const raw = event.data;
+                    const text = typeof raw === "string" ? raw : new TextDecoder().decode(raw);
+                    const parsed = JSON.parse(text);
+                    // Handle chat message frames via orchestrator
+                    if (parsed.type === "message" && config.processMessage) {
+                        const userParts = Array.isArray(parsed.parts)
+                            ? parsed.parts
+                            : textParts(String(parsed.content ?? ""));
+                        try {
+                            const result = await config.processMessage(userId, userParts);
+                            ws.send(JSON.stringify({
+                                type: "done",
+                                content: extractText(result.parts),
+                                parts: result.parts,
+                                inputTokens: result.inputTokens,
+                                outputTokens: result.outputTokens,
+                            }));
+                        }
+                        catch (err) {
+                            ws.send(JSON.stringify({
+                                type: "error",
+                                message: err instanceof Error ? err.message : String(err),
+                            }));
+                        }
+                        return;
+                    }
+                    // Fall back to webChannel.receive for non-message frames
+                    await config.webChannel.receive(parsed);
+                }
+                catch {
+                    // Discard malformed messages
+                }
+            },
+        };
+    }));
+    return app;
+}
+//# sourceMappingURL=ws-routes.js.map