@noodleseed/one 0.170.0 → 0.171.0

package/node_modules/@noodle-borg/service/dist/routes/whatsapp.js

@@ -0,0 +1,238 @@
+import { ChannelError, channelParticipantId, recordChannelDelivery, } from '@noodle-borg/assistant-gateway/portable';
+import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
+import * as wire from '@noodle-borg/wire-contracts';
+import { parseWhatsAppWebhook, verifyWhatsAppWebhookSecret, WHATSAPP_CALLBACK_HEADER, } from '../channels/360dialog.js';
+import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
+const participant = /^p_[a-f0-9]{64}$/;
+const eventId = /^e_[0-9_]+$/;
+function eventView(event) {
+    return {
+        id: event.id,
+        participantId: event.participantId,
+        state: event.state,
+        eventAt: event.eventAt,
+        receivedAt: event.receivedAt,
+        attempts: event.attempts,
+        deploymentId: event.deploymentId,
+        ...(event.code ? { code: event.code } : {}),
+    };
+}
+function respond(res, schema, data) {
+    sendJson(res, 200, schema.parse({ ok: true, data }));
+}
+async function body(req, schema) {
+    const input = await readJsonBody(req, 16_384);
+    if (!input.ok)
+        throw new ChannelError('request_invalid');
+    const parsed = schema.safeParse(input.value);
+    if (!parsed.success)
+        throw new ChannelError('request_invalid');
+    return parsed.data;
+}
+export function dispatchWhatsAppRoutes(req, res, url, runtime, grants) {
+    const callback = /^\/v1\/channels\/whatsapp\/webhooks\/([a-z0-9-]+)$/.exec(url.pathname);
+    const operator = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/channels\/whatsapp(?:\/(.*))?$/.exec(url.pathname);
+    if (!callback && !operator)
+        return false;
+    res.setHeader('Cache-Control', 'no-store');
+    if (!runtime) {
+        sendJson(res, 503, {
+            error: 'WhatsApp is unavailable on this service',
+            code: 'whatsapp_unavailable',
+        });
+        return true;
+    }
+    const run = Promise.resolve().then(() => callback
+        ? webhook(req, res, callback[1], runtime)
+        : operate(req, res, url, {
+            org: decodeURIComponent(operator[1]),
+            app: decodeURIComponent(operator[2]),
+            env: decodeURIComponent(operator[3]),
+        }, operator[4] ?? '', runtime, grants));
+    void run.catch((error) => {
+        const code = error instanceof ChannelError ? error.code : 'channel_unavailable';
+        const status = code === 'channel_not_found'
+            ? 404
+            : [
+                'revision_conflict',
+                'idempotency_conflict',
+                'asset_in_use',
+                'not_ready',
+                'deployment_changed',
+            ].includes(code)
+                ? 409
+                : code === 'channel_unavailable' || code === 'ingress_capacity'
+                    ? 503
+                    : 400;
+        if (!res.headersSent)
+            sendJson(res, status, { error: code, code });
+    });
+    return true;
+}
+async function webhook(req, res, id, runtime) {
+    if (req.method !== 'POST')
+        return sendJson(res, 405, { error: 'method_not_allowed' });
+    const binding = await runtime.channels.internal(id);
+    const { webhookSecret } = await runtime.provider(binding);
+    if (!verifyWhatsAppWebhookSecret(req.headers[WHATSAPP_CALLBACK_HEADER], webhookSecret))
+        return sendJson(res, 401, { error: 'unauthorized' });
+    const input = await readJsonBody(req, 1 << 20);
+    if (!input.ok)
+        return sendJson(res, input.status, { error: 'webhook_invalid' });
+    const batch = parseWhatsAppWebhook(input.value, binding.phoneNumberId);
+    await runtime.channels.receive(id, batch.messages, await runtime.retention(binding));
+    for (const status of batch.statuses)
+        await recordChannelDelivery(runtime.channels.store, id, status.providerMessageId, status.state, runtime.channels.now());
+    sendJson(res, 200, { ok: true });
+    runtime.options.worker.wake();
+}
+async function operate(req, res, url, tenant, path, runtime, grants) {
+    const { deps, channels } = runtime;
+    const read = req.method === 'GET';
+    const identity = await authorizeTenantControl(req, res, deps.gate, deps.controlPlane, tenant.org, developerGrantRouteAccess(grants, read ? 'cloud:read' : 'config:write'));
+    if (identity === false)
+        return;
+    const member = await deps.controlPlane.getOrgMember({
+        org: tenant.org,
+        subject: identity.subject,
+    });
+    if (!read && !identity.superAdmin && member?.role !== 'owner' && member?.role !== 'developer')
+        return sendJson(res, 403, { error: 'operator_required' });
+    const key = req.headers['idempotency-key'];
+    if (!read && (typeof key !== 'string' || !key || key.length > 200))
+        throw new ChannelError('idempotency_key_invalid');
+    const idempotency = typeof key === 'string' ? key : '';
+    const visible = await channels.get(tenant);
+    const audit = async (action) => deps.audit.emit({
+        eventType: `assistant.channel.${action}`,
+        ...tenant,
+        actorSubject: identity.subject,
+        decision: 'allow',
+        status: 200,
+    });
+    if (!path && req.method === 'GET')
+        return respond(res, wire.WhatsAppBindingResponseSchema, visible ?? null);
+    if (!path && req.method === 'PUT') {
+        const parsed = await body(req, wire.WhatsAppConfigureRequestSchema);
+        const target = await deps.registry.getActiveByTenant(tenant);
+        if (!target?.deploymentId)
+            throw new ChannelError('deployment_missing');
+        const { expectedRevision, ...configuration } = parsed;
+        const configured = await channels.configure({ ...configuration, tenant, deploymentId: target.deploymentId }, identity.subject, idempotency, expectedRevision);
+        await audit('configured');
+        return respond(res, wire.WhatsAppBindingResponseSchema, configured);
+    }
+    if (!visible)
+        throw new ChannelError('channel_not_found');
+    const id = visible.id;
+    if (path === 'readiness' && req.method === 'POST') {
+        await body(req, wire.WhatsAppEmptyRequestSchema);
+        return respond(res, wire.WhatsAppReadinessResponseSchema, await runtime.doctor(id, req));
+    }
+    if ((path === 'state' && req.method === 'PATCH') || (!path && req.method === 'DELETE')) {
+        const parsed = path
+            ? await body(req, wire.WhatsAppStateRequestSchema)
+            : {
+                ...(await body(req, wire.WhatsAppRevisionRequestSchema)),
+                state: 'disconnected',
+            };
+        const updated = await channels.setState(id, parsed.state, identity.subject, idempotency, parsed.expectedRevision);
+        await audit(parsed.state);
+        return respond(res, wire.WhatsAppBindingResponseSchema, updated);
+    }
+    if (path === 'limits' && req.method === 'GET')
+        return respond(res, wire.WhatsAppBindingResponseSchema, visible);
+    if (path === 'limits' && req.method === 'PATCH') {
+        const parsed = await body(req, wire.WhatsAppLimitsRequestSchema);
+        const updated = await channels.updateLimits(id, parsed.limits, identity.subject, idempotency, parsed.expectedRevision);
+        await audit('limits_changed');
+        return respond(res, wire.WhatsAppBindingResponseSchema, updated);
+    }
+    if (path === 'usage' && read)
+        return respond(res, wire.WhatsAppUsageResponseSchema, await channels.usage(id));
+    if (path === 'webhook' && (read || req.method === 'POST')) {
+        if (!read) {
+            const parsed = await body(req, wire.WhatsAppRevisionRequestSchema);
+            if (parsed.expectedRevision !== visible.revision)
+                throw new ChannelError('revision_conflict');
+            await runtime.configureWebhook(id, req);
+            await audit('webhook_configured');
+        }
+        return respond(res, wire.WhatsAppWebhookResponseSchema, await runtime.webhook(id, req));
+    }
+    if (path === 'blocks' && read) {
+        const after = url.searchParams.get('after') ?? undefined;
+        if (after && !participant.test(after))
+            throw new ChannelError('request_invalid');
+        return sendJson(res, 200, wire.WhatsAppBlocksResponseSchema.parse({ ok: true, ...(await runtime.blocks(id, after)) }));
+    }
+    if (path === 'blocks' && req.method === 'POST') {
+        const parsed = await body(req, wire.WhatsAppBlockRequestSchema);
+        const participantId = parsed.participantId ??
+            channelParticipantId(await channels.internal(id), {
+                kind: 'phone',
+                value: parsed.phone.slice(1),
+            });
+        await channels.block(id, participantId, identity.subject, idempotency, parsed.until);
+        if (parsed.scope === 'provider')
+            await runtime.providerBlock(id, participantId, true, identity.subject, idempotency);
+        await audit('blocked');
+        return sendJson(res, 200, wire.WhatsAppMutationResponseSchema.parse({ ok: true }));
+    }
+    const [kind, value, action] = path.split('/');
+    if (kind === 'blocks' && value && participant.test(value) && req.method === 'DELETE') {
+        const parsed = await body(req, wire.WhatsAppUnblockRequestSchema);
+        if (parsed.scope === 'provider')
+            await runtime.providerBlock(id, value, false, identity.subject, idempotency, parsed.phone);
+        else
+            await channels.unblock(id, value, identity.subject, idempotency);
+        await audit('unblocked');
+        return sendJson(res, 200, { ok: true });
+    }
+    if (kind === 'cooldowns' &&
+        value &&
+        participant.test(value) &&
+        (read || req.method === 'DELETE')) {
+        if (!read) {
+            await body(req, wire.WhatsAppEmptyRequestSchema);
+            await channels.clearCooldown(id, value, identity.subject, idempotency);
+            await audit('cooldown_cleared');
+        }
+        return respond(res, wire.WhatsAppCooldownResponseSchema, await channels.cooldown(id, value));
+    }
+    if (kind === 'participants' &&
+        value &&
+        participant.test(value) &&
+        action === 'forget' &&
+        req.method === 'POST') {
+        await body(req, wire.WhatsAppEmptyRequestSchema);
+        await channels.forget(id, value, identity.subject, idempotency);
+        await audit('conversation_forgotten');
+        return sendJson(res, 200, { ok: true });
+    }
+    if (kind === 'events' &&
+        (!value || eventId.test(value)) &&
+        (read || (action === 'reconcile' && req.method === 'POST'))) {
+        if (!read) {
+            await body(req, wire.WhatsAppEmptyRequestSchema);
+            await audit('receipt_inspected');
+        }
+        if (value) {
+            const event = await channels.event(id, value);
+            if (!event)
+                throw new ChannelError('event_not_found');
+            return respond(res, wire.WhatsAppEventsResponseSchema, [eventView(event)]);
+        }
+        const after = url.searchParams.get('after') ?? undefined;
+        if (after && !eventId.test(after))
+            throw new ChannelError('cursor_invalid');
+        const events = await channels.events(id, after);
+        return sendJson(res, 200, wire.WhatsAppEventsResponseSchema.parse({
+            ok: true,
+            data: events.map(eventView),
+            ...(events.length === 100 ? { next: events.at(-1).id } : {}),
+        }));
+    }
+    sendJson(res, 404, { error: 'not_found' });
+}
+//# sourceMappingURL=whatsapp.js.map

package/node_modules/@noodle-borg/service/dist/service.js

@@ -11,9 +11,11 @@ import { createApplicationServingRuntime } from './application-runtime-target.js
 import { createArchivePreflight } from './archive-preflight.js';
 import { ArchiveSweeper, resolveArchiveRetentionDays } from './archive-sweeper.js';
 import { serveLocalAsset } from './assets.js';
+import { assistantRouteDependencies } from './assistant-composition.js';
 import { resolveBuildInfo, serviceInfoPayload } from './build-info.js';
 import { createBusinessInformationRuntime, resolvePrivateInstallationDefinition, } from './business-information-runtime.js';
 import { serviceCapabilityReport } from './capabilities.js';
+import { createWhatsAppRuntime } from './channels/composition.js';
 import { rejectIncompatibleCli } from './client-compatibility.js';
 import { createDataPlaneMembershipAuthorizer } from './data-plane-membership.js';
 import { DEVELOPER_MCP_PATH, handleDeveloperMcpRequest } from './developer-mcp/mount.js';
@@ -50,6 +52,7 @@ import { dispatchProtectedResourceMetadata } from './routes/protected-resource-m
 import { dispatchResourceReads } from './routes/resource-read-dispatch.js';
 import { handleRollback } from './routes/rollback.js';
 import { createServicePrincipalDispatcher } from './routes/service-principals-dispatch.js';
+import { dispatchWhatsAppRoutes } from './routes/whatsapp.js';
 import { servicePrincipalDataPlaneHooks } from './service-principal-data-plane.js';
 import { InMemoryAlertRuleStore } from './store/alert-rules.js';
 import { StdoutAuditSink } from './store/audit.js';
@@ -181,6 +184,23 @@ export function createServiceHandler(registry, options = {}) {
             ? {}
             : { developerGrants: options.developerGrantStore }),
     };
+    const assistantDeps = assistantRouteDependencies(options, {
+        registry,
+        resolveRuntimeTarget,
+        store: assistantStore,
+        appearance: assistantAppearance,
+        gate,
+        controlPlane,
+        audit: activeAudit,
+        maxBody,
+        serviceBase: (request) => options.publicBaseUrl ?? baseFromRequest(request, tls),
+        logger,
+    });
+    const whatsapp = createWhatsAppRuntime(options.whatsapp, assistantDeps, {
+        allowance: moduleHost.resolveActivityHistoryAllowance,
+        installations: businessInformationStore,
+        activity,
+    });
     return (req, res) => {
         const url = new URL(req.url ?? '/', 'http://localhost');
         // Liveness/readiness probes: un-gated and **not** HTTPS-enforced — Cloud Run's internal probe is plain
@@ -212,7 +232,7 @@ export function createServiceHandler(registry, options = {}) {
         // post-deploy smoke can confirm exactly which commit is live. Non-sensitive fields only.
         if (req.method === 'GET' && url.pathname === '/v1/service/info') {
             applySecurityHeaders(res, tls);
-            return sendJson(res, 200, serviceInfoPayload(buildInfo, options.developerMcp === true));
+            return sendJson(res, 200, serviceInfoPayload(buildInfo, options.developerMcp === true, whatsapp !== undefined));
         }
         if (url.pathname.startsWith('/v1/') && rejectIncompatibleCli(req, res, buildInfo, tls))
             return;
@@ -285,6 +305,7 @@ export function createServiceHandler(registry, options = {}) {
         if (businessInformationStore !== undefined &&
             options.businessInformationEnabled !== false &&
             dispatchBusinessInformationRoutes(req, res, url, {
+                ...(whatsapp ? { readWhatsApp: whatsapp.projection.bind(whatsapp) } : {}),
                 store: businessInformationStore,
                 ...(businessOnboarding ? { businessOnboarding } : {}),
                 activateInstallation,
@@ -330,38 +351,15 @@ export function createServiceHandler(registry, options = {}) {
             })) {
             return;
         }
+        if (url.pathname.includes('/channels/whatsapp')) {
+            applySecurityHeaders(res, tls);
+            if (enforceHttps(req, res, tls))
+                return;
+            if (dispatchWhatsAppRoutes(req, res, url, whatsapp, options.developerGrantStore))
+                return;
+        }
         if (dispatchAssistantRoutes(req, res, url, {
-            registry,
-            resolveRuntimeTarget,
-            store: assistantStore,
-            appearance: assistantAppearance,
-            ...(options.publicEmbeds !== undefined ? { publicEmbeds: options.publicEmbeds } : {}),
-            ...(options.elevations !== undefined ? { elevations: options.elevations } : {}),
-            ...(options.elevationCoordinator !== undefined
-                ? { elevationCoordinator: options.elevationCoordinator }
-                : {}),
-            ...(options.admissionCounters !== undefined
-                ? { admissionCounters: options.admissionCounters }
-                : {}),
-            ...(options.admissionEnvelope !== undefined
-                ? { admissionEnvelope: options.admissionEnvelope }
-                : {}),
-            gate,
-            controlPlane,
-            audit: activeAudit,
-            maxBody,
-            serviceBase: (request) => options.publicBaseUrl ?? baseFromRequest(request, tls),
-            ...(options.assistantModelFetch !== undefined
-                ? { modelFetch: options.assistantModelFetch }
-                : {}),
-            ...(options.managedAssistantModelResolver !== undefined
-                ? { managedModelResolver: options.managedAssistantModelResolver }
-                : {}),
-            ...(options.captureRequestEvent !== undefined
-                ? { captureRequestEvent: options.captureRequestEvent }
-                : {}),
-            ...(options.clock !== undefined ? { clock: options.clock } : {}),
-            logger,
+            ...assistantDeps,
             applySecurityHeaders,
             enforceHttps,
             sendJson,

package/node_modules/@noodle-borg/service/package.json

@@ -40,7 +40,7 @@
     "@noodle-borg/managed-capabilities": "0.0.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@noodle-borg/admission-limits": "0.0.0",
-    "@noodle-borg/agent-kit": "0.105.0",
+    "@noodle-borg/agent-kit": "0.106.0",
     "@noodle-borg/app-package": "0.0.0",
     "@noodle-borg/assistant-gateway": "0.0.0",
     "@noodle-borg/auth": "0.0.0",

package/node_modules/@noodle-borg/wire-contracts/dist/application-channels.d.ts

@@ -37,6 +37,17 @@ export declare const ApplicationChannelsProjectionSchema: z.ZodObject<{
             }, z.core.$strict>>;
         }, z.core.$strict>>;
     }, z.core.$strict>;
+    whatsapp: z.ZodOptional<z.ZodObject<{
+        status: z.ZodEnum<{
+            unavailable: "unavailable";
+            ready: "ready";
+            paused: "paused";
+        }>;
+        bindingId: z.ZodOptional<z.ZodString>;
+        revision: z.ZodOptional<z.ZodNumber>;
+        capabilities: z.ZodArray<z.ZodString>;
+        reason: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type ApplicationChannelsProjection = z.infer<typeof ApplicationChannelsProjectionSchema>;
 export declare const ApplicationChannelsResponseSchema: z.ZodObject<{
@@ -79,6 +90,17 @@ export declare const ApplicationChannelsResponseSchema: z.ZodObject<{
                 }, z.core.$strict>>;
             }, z.core.$strict>>;
         }, z.core.$strict>;
+        whatsapp: z.ZodOptional<z.ZodObject<{
+            status: z.ZodEnum<{
+                unavailable: "unavailable";
+                ready: "ready";
+                paused: "paused";
+            }>;
+            bindingId: z.ZodOptional<z.ZodString>;
+            revision: z.ZodOptional<z.ZodNumber>;
+            capabilities: z.ZodArray<z.ZodString>;
+            reason: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 export declare const ApplicationChannelsClientResponseSchema: z.ZodObject<{
@@ -97,6 +119,17 @@ export declare const ApplicationChannelsClientResponseSchema: z.ZodObject<{
             url: z.ZodOptional<z.ZodURL>;
             accessMode: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>;
+        whatsapp: z.ZodOptional<z.ZodObject<{
+            status: z.ZodEnum<{
+                unavailable: "unavailable";
+                ready: "ready";
+                paused: "paused";
+            }>;
+            bindingId: z.ZodOptional<z.ZodString>;
+            revision: z.ZodOptional<z.ZodNumber>;
+            capabilities: z.ZodArray<z.ZodString>;
+            reason: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
         assistant: z.ZodObject<{
             status: z.ZodEnum<{
                 unavailable: "unavailable";

package/node_modules/@noodle-borg/wire-contracts/dist/application-channels.js

@@ -39,6 +39,13 @@ const assistant = z
     usage: usage.optional(),
 })
     .strict();
+const whatsapp = z.strictObject({
+    status,
+    bindingId: z.string().max(256).optional(),
+    revision: z.number().int().positive().optional(),
+    capabilities: z.array(z.string().max(256)).max(64),
+    reason: z.string().max(200).optional(),
+});
 export const ApplicationChannelsProjectionSchema = z
     .object({
     revision: z.number().int().positive(),
@@ -47,6 +54,7 @@ export const ApplicationChannelsProjectionSchema = z
     deploymentId: z.string().min(1).max(256).optional(),
     mcp,
     assistant,
+    whatsapp: whatsapp.optional(),
 })
     .strict();
 export const ApplicationChannelsResponseSchema = z
@@ -57,6 +65,7 @@ export const ApplicationChannelsClientResponseSchema = z
     ok: z.literal(true),
     data: ApplicationChannelsProjectionSchema.extend({
         mcp: mcp.strip(),
+        whatsapp: whatsapp.strip().optional(),
         assistant: assistant
             .extend({
             usage: usage

package/node_modules/@noodle-borg/wire-contracts/dist/index.d.ts

@@ -393,4 +393,5 @@ export * from './billing-catalog.js';
 export * from './deployment-deletion.js';
 export * from './operation-coordination.js';
 export { MIXED_CUSTOMER_AUTH_FEATURE_VERSION, type ServiceInfoClientResponse, type ServiceInfoResponse, serviceInfoClientResponseSchema, serviceInfoResponseSchema, } from './service-info.js';
+export * from './whatsapp.js';
 //# sourceMappingURL=index.d.ts.map

package/node_modules/@noodle-borg/wire-contracts/dist/index.js

@@ -232,4 +232,5 @@ export * from './billing-catalog.js';
 export * from './deployment-deletion.js';
 export * from './operation-coordination.js';
 export { MIXED_CUSTOMER_AUTH_FEATURE_VERSION, serviceInfoClientResponseSchema, serviceInfoResponseSchema, } from './service-info.js';
+export * from './whatsapp.js';
 //# sourceMappingURL=index.js.map

package/node_modules/@noodle-borg/wire-contracts/dist/service-info.d.ts

@@ -7,6 +7,7 @@ export declare const serviceInfoResponseSchema: z.ZodObject<{
     }, z.core.$strict>>;
     features: z.ZodObject<{
         mixedCustomerAuth: z.ZodLiteral<1>;
+        whatsapp: z.ZodOptional<z.ZodLiteral<1>>;
     }, z.core.$strict>;
     ok: z.ZodLiteral<true>;
     status: z.ZodLiteral<"ok">;
@@ -25,6 +26,7 @@ export declare const serviceInfoClientResponseSchema: z.ZodObject<{
     }, z.core.$strip>>;
     features: z.ZodOptional<z.ZodObject<{
         mixedCustomerAuth: z.ZodOptional<z.ZodNumber>;
+        whatsapp: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
     ok: z.ZodLiteral<true>;
     status: z.ZodLiteral<"ok">;

package/node_modules/@noodle-borg/wire-contracts/dist/service-info.js

@@ -15,12 +15,20 @@ const buildInfoShape = {
 export const serviceInfoResponseSchema = z.strictObject({
     ...buildInfoShape,
     developerPlugin: z.strictObject({ mcpCapabilityVersion: z.string().min(1) }).optional(),
-    features: z.strictObject({ mixedCustomerAuth: z.literal(MIXED_CUSTOMER_AUTH_FEATURE_VERSION) }),
+    features: z.strictObject({
+        mixedCustomerAuth: z.literal(MIXED_CUSTOMER_AUTH_FEATURE_VERSION),
+        whatsapp: z.literal(1).optional(),
+    }),
 });
 /** Older services may omit features; future fields are stripped at each structured metadata layer. */
 export const serviceInfoClientResponseSchema = z.object({
     ...buildInfoShape,
     developerPlugin: z.object({ mcpCapabilityVersion: z.string().min(1) }).optional(),
-    features: z.object({ mixedCustomerAuth: z.number().int().positive().optional() }).optional(),
+    features: z
+        .object({
+        mixedCustomerAuth: z.number().int().positive().optional(),
+        whatsapp: z.number().int().positive().optional(),
+    })
+        .optional(),
 });
 //# sourceMappingURL=service-info.js.map