@noodleseed/one 0.169.0 → 0.171.0

package/node_modules/@noodle-borg/service/dist/channels/360dialog.js

@@ -0,0 +1,233 @@
+import { timingSafeEqual } from 'node:crypto';
+import { ChannelError, } from '@noodle-borg/assistant-gateway/portable';
+import { guardedFetch } from '@noodle-borg/connector-http';
+import { z } from 'zod';
+export const WHATSAPP_CALLBACK_HEADER = 'x-noodle-webhook-secret';
+const identifier = z.string().min(1).max(512);
+const timestamp = z
+    .string()
+    .regex(/^\d{1,13}$/)
+    .transform((value) => Number(value) * 1000)
+    .refine(Number.isSafeInteger);
+const valueSchema = z.object({
+    messaging_product: z.literal('whatsapp'),
+    metadata: z.object({ phone_number_id: identifier }),
+    messages: z
+        .array(z.object({
+        id: identifier,
+        from: z.string().max(128).optional(),
+        user_id: z.string().max(128).optional(),
+        timestamp,
+        type: z.string().max(64),
+        text: z.object({ body: z.string().max(1 << 20) }).optional(),
+    }))
+        .max(100)
+        .optional(),
+    statuses: z
+        .array(z.object({
+        id: identifier,
+        status: z.enum(['sent', 'delivered', 'read', 'failed']),
+        timestamp,
+    }))
+        .max(100)
+        .optional(),
+});
+const webhookSchema = z.object({
+    object: z.literal('whatsapp_business_account'),
+    entry: z
+        .array(z.object({
+        changes: z.array(z.object({ field: z.string().max(128), value: z.unknown() })).max(100),
+    }))
+        .max(100),
+});
+export function verifyWhatsAppWebhookSecret(input, secret) {
+    if (typeof input !== 'string' || secret.length < 32 || secret.length > 512)
+        return false;
+    const actual = Buffer.from(input), expected = Buffer.from(secret);
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+export function parseWhatsAppWebhook(input, phoneNumberId) {
+    const parsed = webhookSchema.safeParse(input);
+    if (!parsed.success)
+        throw new ChannelError('webhook_invalid');
+    const messages = [];
+    const statuses = [];
+    let count = 0;
+    for (const entry of parsed.data.entry)
+        for (const change of entry.changes) {
+            if (++count > 100)
+                throw new ChannelError('batch_too_large');
+            // System notifications do not participate in conversation processing.
+            if (change.field !== 'messages')
+                continue;
+            const validated = valueSchema.safeParse(change.value);
+            if (!validated.success)
+                throw new ChannelError('webhook_invalid');
+            const value = validated.data;
+            if (value.metadata.phone_number_id !== phoneNumberId)
+                throw new ChannelError('asset_mismatch');
+            for (const message of value.messages ?? []) {
+                let address;
+                if (message.from && /^[1-9]\d{5,14}$/.test(message.from))
+                    address = { kind: 'phone', value: message.from };
+                else if (message.user_id && /^[A-Z]{2}\.[A-Za-z0-9]{1,124}$/.test(message.user_id))
+                    address = { kind: 'opaque', value: message.user_id };
+                else
+                    throw new ChannelError('recipient_invalid');
+                messages.push({
+                    providerId: message.id,
+                    address,
+                    eventAt: message.timestamp,
+                    ...(message.type === 'text' && message.text ? { text: message.text.body } : {}),
+                });
+            }
+            for (const status of value.statuses ?? [])
+                statuses.push({ providerMessageId: status.id, state: status.status });
+            if (messages.length + statuses.length > 100)
+                throw new ChannelError('batch_too_large');
+        }
+    return { messages, statuses };
+}
+async function boundedJson(response) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new ChannelError('provider_response_invalid');
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const result = await reader.read();
+            if (result.done)
+                break;
+            size += result.value.byteLength;
+            if (size > 65_536)
+                throw new ChannelError('provider_response_invalid');
+            chunks.push(result.value);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+    }
+}
+export class Dialog360 {
+    apiKey;
+    fetcher;
+    constructor(apiKey, fetcher = (url, init) => guardedFetch(new URL(url), init)) {
+        this.apiKey = apiKey;
+        this.fetcher = fetcher;
+    }
+    async request(path, method = 'GET', body) {
+        return this.fetcher(`https://waba-v2.360dialog.io${path}`, {
+            method,
+            headers: { 'D360-API-KEY': this.apiKey, 'content-type': 'application/json' },
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            redirect: 'manual',
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    async health() {
+        const response = await this.request('/health_status?fields=id');
+        if (!response.ok)
+            throw new ChannelError('provider_unavailable');
+        const parsed = z
+            .object({ id: identifier, health_status: z.object({ can_send_message: z.string() }) })
+            .safeParse(await boundedJson(response));
+        if (!parsed.success)
+            throw new ChannelError('provider_response_invalid');
+        return {
+            phoneNumberId: parsed.data.id,
+            canSend: parsed.data.health_status.can_send_message === 'AVAILABLE',
+        };
+    }
+    async webhook() {
+        const response = await this.request('/v1/configs/webhook');
+        if (!response.ok)
+            throw new ChannelError('provider_unavailable');
+        const parsed = z
+            .object({ url: z.string().max(2048), headers: z.record(z.string(), z.string()).optional() })
+            .safeParse(await boundedJson(response));
+        if (!parsed.success)
+            throw new ChannelError('provider_response_invalid');
+        return parsed.data;
+    }
+    async configureWebhook(url, secret) {
+        const target = new URL(url);
+        if (target.protocol !== 'https:' ||
+            target.username ||
+            target.password ||
+            target.port ||
+            target.hash ||
+            target.search)
+            throw new ChannelError('webhook_url_invalid');
+        if (!verifyWhatsAppWebhookSecret(secret, secret))
+            throw new ChannelError('webhook_secret_invalid');
+        const response = await this.request('/v1/configs/webhook', 'POST', {
+            url,
+            headers: { [WHATSAPP_CALLBACK_HEADER]: secret },
+        });
+        if (!response.ok)
+            throw new ChannelError('webhook_configuration_failed');
+        await response.body?.cancel();
+    }
+    async setBlocked(phone, blocked) {
+        try {
+            const response = await this.request('/block_users', blocked ? 'POST' : 'DELETE', {
+                messaging_product: 'whatsapp',
+                block_users: [{ user: phone }],
+            });
+            if (!response.ok) {
+                await response.body?.cancel();
+                return {
+                    state: response.status >= 500 ? 'unknown' : 'error',
+                    code: `provider_http_${response.status}`,
+                };
+            }
+            const field = blocked ? 'added_users' : 'removed_users';
+            const parsed = z
+                .object({
+                block_users: z.object({
+                    [field]: z.array(z.object({ input: z.string(), wa_id: z.string() })),
+                }),
+            })
+                .safeParse(await boundedJson(response));
+            return parsed.success &&
+                parsed.data.block_users[field]?.some((user) => user.input === phone || user.wa_id === phone)
+                ? { state: 'confirmed' }
+                : { state: 'unknown', code: 'provider_receipt_invalid' };
+        }
+        catch {
+            return { state: 'unknown', code: 'provider_outcome_unknown' };
+        }
+    }
+    async send(input) {
+        if (!input.text || input.text.length > 4096)
+            return { state: 'failed', code: 'reply_invalid' };
+        try {
+            const response = await this.request('/messages', 'POST', {
+                messaging_product: 'whatsapp',
+                recipient_type: 'individual',
+                type: 'text',
+                ...(input.to.kind === 'phone' ? { to: input.to.value } : { recipient: input.to.value }),
+                text: { body: input.text, preview_url: false },
+            });
+            if (!response.ok) {
+                await response.body?.cancel();
+                return {
+                    state: response.status >= 500 || response.status === 408 ? 'unknown' : 'failed',
+                    code: `provider_http_${response.status}`,
+                };
+            }
+            const parsed = z
+                .object({ messages: z.array(z.object({ id: identifier })).length(1) })
+                .safeParse(await boundedJson(response));
+            return parsed.success
+                ? { state: 'accepted', providerMessageId: parsed.data.messages[0].id }
+                : { state: 'unknown', code: 'provider_receipt_invalid' };
+        }
+        catch {
+            return { state: 'unknown', code: 'send_outcome_unknown' };
+        }
+    }
+}
+//# sourceMappingURL=360dialog.js.map

package/node_modules/@noodle-borg/service/dist/channels/cipher.js

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+const envelope = z
+    .object({
+    v: z.number(),
+    algo: z.string(),
+    keyId: z.string(),
+    iv: z.string(),
+    tag: z.string(),
+    ct: z.string(),
+})
+    .passthrough();
+export class ChannelSecretBoxCipher {
+    box;
+    constructor(box) {
+        this.box = box;
+    }
+    seal(scope, id, value) {
+        return this.box.seal(JSON.stringify({ purpose: 'assistant-channel-v1', scope, id, value }));
+    }
+    async open(scope, id, sealed) {
+        const parsed = envelope.parse(sealed);
+        const value = JSON.parse(await this.box.open(parsed));
+        const opened = z
+            .object({
+            purpose: z.literal('assistant-channel-v1'),
+            scope: z.string(),
+            id: z.string(),
+            value: z.unknown(),
+        })
+            .strict()
+            .parse(value);
+        if (opened.scope !== scope || opened.id !== id)
+            throw new Error('channel payload context mismatch');
+        return opened.value;
+    }
+}
+//# sourceMappingURL=cipher.js.map

package/node_modules/@noodle-borg/service/dist/channels/composition.js

@@ -0,0 +1,37 @@
+import { PostgresChannelStore } from '@noodle-borg/assistant-gateway/postgres';
+import { noopLogger } from '@noodle-borg/transport-http';
+import { ChannelSecretBoxCipher } from './cipher.js';
+import { WhatsAppRuntime } from './runtime.js';
+import { ChannelWorkerLoop } from './worker-loop.js';
+export async function createPostgresWhatsApp(pool, secretBox, options) {
+    if (!secretBox)
+        throw new Error('WhatsApp storage requires the service key custodian');
+    const store = new PostgresChannelStore(pool, new ChannelSecretBoxCipher(secretBox));
+    await store.ensureSchema();
+    return {
+        store,
+        worker: new ChannelWorkerLoop((code) => (options.logger ?? noopLogger).warn('assistant.channel.worker', { code })),
+    };
+}
+export function createWhatsAppRuntime(options, deps, history) {
+    if (!options)
+        return undefined;
+    return new WhatsAppRuntime({
+        ...options,
+        ...(history.allowance
+            ? {
+                historyDays: async (tenant) => {
+                    const allowance = await history.allowance?.(tenant.org);
+                    if (!allowance)
+                        throw new Error('history policy unavailable');
+                    const installation = (await history.installations?.listInstallations(tenant.org))?.find((item) => item.scope.app === tenant.app && item.scope.env === tenant.env);
+                    return installation && history.activity
+                        ? Math.min(allowance.maximumDays, (await history.activity.settings(installation.scope, false)).projection
+                            .retentionDays)
+                        : allowance.maximumDays;
+                },
+            }
+            : {}),
+    }, deps);
+}
+//# sourceMappingURL=composition.js.map

package/node_modules/@noodle-borg/service/dist/channels/inference-guard.js

@@ -0,0 +1,53 @@
+import { randomUUID } from 'node:crypto';
+import { billedOutputTokens, ChannelError, } from '@noodle-borg/assistant-gateway/portable';
+export function verifiedInferenceBound(binding, now = Date.now()) {
+    const bound = binding.inferenceCost;
+    if (!bound ||
+        !bound.version ||
+        !Number.isFinite(Date.parse(bound.validUntil)) ||
+        Date.parse(bound.validUntil) <= now)
+        throw new ChannelError('spend_bound_unverified');
+    for (const number of [
+        bound.maxInputTokens,
+        bound.maxBilledOutputTokens,
+        bound.inputMicroUsdPerMillionTokens,
+        bound.outputMicroUsdPerMillionTokens,
+    ])
+        if (!Number.isSafeInteger(number) || number <= 0)
+            throw new ChannelError('spend_bound_unverified');
+    if (!Number.isSafeInteger(quote(bound, bound.maxInputTokens, bound.maxBilledOutputTokens)))
+        throw new ChannelError('spend_bound_unverified');
+    return bound;
+}
+function quote(bound, input, output) {
+    // Integer arithmetic retains fractional micro-dollar prices without floating-point under-reservation.
+    return Number((BigInt(input) * BigInt(bound.inputMicroUsdPerMillionTokens) +
+        BigInt(output) * BigInt(bound.outputMicroUsdPerMillionTokens) +
+        999999n) /
+        1000000n);
+}
+export function withChannelInferenceGuard(binding, channels, id, turn, beforeRequest) {
+    verifiedInferenceBound(binding, channels.now());
+    return {
+        ...binding,
+        inferenceGuard: {
+            async reserve() {
+                await beforeRequest();
+                const bound = verifiedInferenceBound(binding, channels.now());
+                const attempt = `${turn}:${randomUUID()}`;
+                await channels.reserveSpend(id, attempt, quote(bound, bound.maxInputTokens, bound.maxBilledOutputTokens));
+                return {
+                    async cancelBeforeDispatch() {
+                        await channels.settleSpend(id, attempt, 0);
+                    },
+                    async settle(usage) {
+                        const output = billedOutputTokens(usage);
+                        const actual = quote(bound, usage.promptTokens, output);
+                        await channels.settleSpend(id, attempt, actual);
+                    },
+                };
+            },
+        },
+    };
+}
+//# sourceMappingURL=inference-guard.js.map