@noodleseed/one 0.173.0 → 0.175.0

package/node_modules/@noodle-borg/service/dist/channels/360dialog.js

@@ -20,6 +20,17 @@ const valueSchema = z.object({
         timestamp,
         type: z.string().max(64),
         text: z.object({ body: z.string().max(1 << 20) }).optional(),
+        // A tapped reply button arrives as type "interactive" with interactive.type "button_reply"
+        // carrying the id and title we sent (360dialog webhook reference, "Received Answer to Reply
+        // Button", checked 2026-09-21). Other interactive kinds are not conversation input here.
+        interactive: z
+            .object({
+            type: z.string().max(64),
+            button_reply: z
+                .object({ id: z.string().min(1).max(256), title: z.string().max(64) })
+                .optional(),
+        })
+            .optional(),
     }))
         .max(100)
         .optional(),
@@ -74,11 +85,15 @@ export function parseWhatsAppWebhook(input, phoneNumberId) {
                     address = { kind: 'opaque', value: message.user_id };
                 else
                     throw new ChannelError('recipient_invalid');
+                const button = message.type === 'interactive' && message.interactive?.type === 'button_reply'
+                    ? message.interactive.button_reply
+                    : undefined;
                 messages.push({
                     providerId: message.id,
                     address,
                     eventAt: message.timestamp,
                     ...(message.type === 'text' && message.text ? { text: message.text.body } : {}),
+                    ...(button ? { button: { id: button.id, title: button.title } } : {}),
                 });
             }
             for (const status of value.statuses ?? [])
@@ -88,6 +103,10 @@ export function parseWhatsAppWebhook(input, phoneNumberId) {
         }
     return { messages, statuses };
 }
+/** A 4xx that judges the payload itself; auth, throttling and timeouts are no reason to resend differently. */
+function rejectedPayload(status) {
+    return status >= 400 && status < 500 && ![401, 403, 408, 429].includes(status);
+}
 async function boundedJson(response) {
     const reader = response.body?.getReader();
     if (!reader)
@@ -205,17 +224,56 @@ export class Dialog360 {
             return { state: 'unknown', code: 'provider_outcome_unknown' };
         }
     }
+    /**
+     * One reply. With buttons the review goes as an interactive reply-button message: at most three
+     * buttons, titles up to 20 characters, ids up to 256 and a body up to 1024 characters, per the
+     * Meta Cloud API reply-buttons reference that the 360dialog Cloud API host relays (360dialog's own
+     * interactive-messages page states only the three-button limit; its webhook reference gives the
+     * inbound shape); all checked 2026-09-21. A payload the provider rejects outright dispatched
+     * nothing, so the same text goes plain instead; an ambiguous outcome is never retried.
+     */
     async send(input) {
         if (!input.text || input.text.length > 4096)
             return { state: 'failed', code: 'reply_invalid' };
+        const buttons = input.buttons ?? [];
+        const interactive = buttons.length > 0 &&
+            buttons.length <= 3 &&
+            input.text.length <= 1024 &&
+            buttons.every((button) => button.id.length <= 256 && button.title.length <= 20);
+        const envelope = {
+            messaging_product: 'whatsapp',
+            recipient_type: 'individual',
+            ...(input.to.kind === 'phone' ? { to: input.to.value } : { recipient: input.to.value }),
+        };
         try {
-            const response = await this.request('/messages', 'POST', {
-                messaging_product: 'whatsapp',
-                recipient_type: 'individual',
-                type: 'text',
-                ...(input.to.kind === 'phone' ? { to: input.to.value } : { recipient: input.to.value }),
-                text: { body: input.text, preview_url: false },
-            });
+            let code;
+            let response = interactive
+                ? await this.request('/messages', 'POST', {
+                    ...envelope,
+                    type: 'interactive',
+                    interactive: {
+                        type: 'button',
+                        body: { text: input.text },
+                        action: {
+                            buttons: buttons.map((button) => ({
+                                type: 'reply',
+                                reply: { id: button.id, title: button.title },
+                            })),
+                        },
+                    },
+                })
+                : undefined;
+            if (response !== undefined && !response.ok && rejectedPayload(response.status)) {
+                await response.body?.cancel();
+                code = 'interactive_rejected';
+                response = undefined;
+            }
+            if (response === undefined)
+                response = await this.request('/messages', 'POST', {
+                    ...envelope,
+                    type: 'text',
+                    text: { body: input.text, preview_url: false },
+                });
             if (!response.ok) {
                 await response.body?.cancel();
                 return {
@@ -227,7 +285,11 @@ export class Dialog360 {
                 .object({ messages: z.array(z.object({ id: identifier })).length(1) })
                 .safeParse(await boundedJson(response));
             return parsed.success
-                ? { state: 'accepted', providerMessageId: parsed.data.messages[0].id }
+                ? {
+                    state: 'accepted',
+                    providerMessageId: parsed.data.messages[0].id,
+                    ...(code === undefined ? {} : { code }),
+                }
                 : { state: 'unknown', code: 'provider_receipt_invalid' };
         }
         catch {

package/node_modules/@noodle-borg/service/dist/channels/capability-report.js

@@ -0,0 +1,73 @@
+const ACCOUNT_SELF_SERVICE = {
+    capability: 'account_self_service',
+    status: 'unavailable',
+    code: 'IDENTITY_NOT_ESTABLISHABLE',
+    requirement: 'verified_customer',
+    next: 'Account questions are answered as limitations until WhatsApp identity linking ships.',
+};
+export async function capabilityReport(input) {
+    const { artifact } = input;
+    if (artifact === undefined)
+        return [ACCOUNT_SELF_SERVICE];
+    const reports = [];
+    const interactions = artifact.toolInteractions ?? {};
+    const present = new Set(artifact.tools.map((tool) => tool.name));
+    const openers = Object.entries(interactions).filter(([opener, interaction]) => present.has(opener) && present.has(interaction.action));
+    const actions = new Set(openers.map(([, interaction]) => interaction.action));
+    if ((artifact.server.knowledge?.length ?? 0) > 0)
+        reports.push({ capability: 'answer_questions', status: 'native' });
+    const reads = artifact.tools.filter((tool) => tool.annotations?.readOnlyHint === true &&
+        interactions[tool.name] === undefined &&
+        !actions.has(tool.name));
+    if (reads.length > 0)
+        reports.push({ capability: 'look_up_information', status: 'native' });
+    if (openers.length > 0) {
+        const setup = await captureSetup(input, artifact, openers);
+        reports.push({ capability: 'capture_request', ...(setup ?? { status: 'native' }) });
+    }
+    reports.push(ACCOUNT_SELF_SERVICE);
+    return reports;
+}
+/** The first missing prerequisite of any selected collect action, mirroring the record connector's own gates. */
+async function captureSetup(input, artifact, openers) {
+    const needs = (code, requirement, next) => ({
+        status: 'needs_setup',
+        code,
+        requirement,
+        next,
+    });
+    if (!input.durable)
+        return needs('durable_storage_required', 'durable_interaction_store', 'Run the service with PostgreSQL channel storage, then rerun doctor.');
+    if (input.installations === undefined)
+        return needs('business_information_unavailable', 'collection_installation', 'Enable managed business information on this service, then rerun doctor.');
+    const installations = (await input.installations.listInstallations(input.tenant.org)).filter((item) => item.scope.app === input.tenant.app && item.scope.env === input.tenant.env);
+    const installation = installations.length === 1 ? installations[0] : undefined;
+    if (installation === undefined)
+        return needs('collection_not_installed', 'collection_installation', "Install the application's collections for this environment, then rerun doctor.");
+    for (const [, interaction] of openers) {
+        const action = artifact.tools.find((tool) => tool.name === interaction.action);
+        const collection = action === undefined ? undefined : targetCollection(action.fulfilment);
+        if (collection !== undefined && !enabled(installation, collection))
+            return needs('collection_not_installed', 'collection_installation', `Enable the "${collection}" collection on the installation, then rerun doctor.`);
+    }
+    if (!installation.intakeActive)
+        return needs('intake_inactive', 'public_intake', 'Resume public intake for the installation, then rerun doctor.');
+    return undefined;
+}
+function enabled(installation, collection) {
+    return (installation.managedCollections.includes(collection) &&
+        installation.definition.collections.some((entry) => entry.key === collection));
+}
+/** The literal `collection` argument of the action's single native-record operation, when readable. */
+function targetCollection(fulfilment) {
+    const args = fulfilment.kind === 'operation'
+        ? [fulfilment.args]
+        : fulfilment.steps.flatMap((step) => (step.kind === 'operation' ? [step.args] : []));
+    for (const map of args) {
+        const node = map.collection;
+        if (node?.kind === 'literal' && typeof node.value === 'string')
+            return node.value;
+    }
+    return undefined;
+}
+//# sourceMappingURL=capability-report.js.map

package/node_modules/@noodle-borg/service/dist/channels/collection-turn.js

@@ -0,0 +1,232 @@
+import { randomUUID } from 'node:crypto';
+import { CONFIRMATION_AFFIRMATIVES, CORRECTION_CUES, capture, confirmationReply, consentReply, normaliseReply, } from '@noodle-borg/assistant-gateway/model-runtime';
+import { applyConfirmation, applyConsent, attachProposal, cancelCollection, channelDigest, completeCollection, deleteCollection, expireCollection, ledgerForModel, loadCollection, pendingProposal, redactSpans, rejectField, renderReview, saveCollection, scanTypedValues, withdrawProposal, } from '@noodle-borg/assistant-gateway/portable';
+const PARSED = new Set(['email', 'phone', 'url']);
+function isParsed(control) {
+    return PARSED.has(control);
+}
+const reply = (ledger, text) => ({
+    kind: 'reply',
+    ledger,
+    reply: text,
+});
+const IGNORED = {
+    kind: 'ignored',
+    code: 'button_unbound',
+};
+export async function runCollectionTurn(open, text, deps, 
+/** The opaque id of a tapped review button; the text is then not conversation input. */
+button) {
+    const { spec, now } = deps;
+    // Re-entry after a crash between the durable claim and the receipt: the write may already have
+    // committed, so no clock governs this phase; the same identity re-executes and the connector replays.
+    if (open.phase === 'executing')
+        return execute(open, deps);
+    const ledger = expireCollection(open, now);
+    if (ledger.phase === 'expired') {
+        await deps.remove();
+        return button === undefined ? { kind: 'none' } : IGNORED;
+    }
+    if (ledger !== open) {
+        // The pending proposal lapsed: nothing was sent, and the participant may start over.
+        const cancelled = cancelCollection(ledger, now);
+        await deps.persist(cancelled);
+        return reply(cancelled, 'That review expired before it was confirmed, so nothing was sent. Tell me if you would like to start again.');
+    }
+    switch (ledger.phase) {
+        case 'completed': {
+            // A repeated confirmation inside the window, typed or tapped on the executed review's own
+            // button, is the same confirmation: the receipt is echoed without a model call or a write.
+            const within = Date.parse(ledger.updatedAt) + spec.confirmationExpiryMs > now;
+            const echo = within &&
+                (button === undefined
+                    ? CONFIRMATION_AFFIRMATIVES.includes(normaliseReply(text))
+                    : ledger.executedProposalId !== undefined &&
+                        deps.buttons?.act(ledger.executedProposalId, button) === 'confirm');
+            if (echo)
+                return reply(ledger, spec.successMessage);
+            await deps.remove();
+            return button === undefined ? { kind: 'none' } : IGNORED;
+        }
+        case 'cancelled':
+            await deps.remove();
+            return button === undefined ? { kind: 'none' } : IGNORED;
+        case 'awaiting_confirmation': {
+            const proposal = pendingProposal(ledger, now);
+            // Nothing is pending because the participant withdrew the proposal to edit: capture first.
+            if (proposal === undefined)
+                return button === undefined ? collect(ledger, text, deps) : IGNORED;
+            const act = button === undefined
+                ? await confirmationReply(text, spec, deps.model)
+                : deps.buttons?.act(proposal.id, button);
+            if (act === undefined)
+                return IGNORED;
+            if (act === 'confirm')
+                return execute(applyConfirmation(ledger, 'confirm', now), deps);
+            if (act === 'cancel') {
+                const cancelled = cancelCollection(ledger, now);
+                await deps.persist(cancelled);
+                return reply(cancelled, 'Okay, I have cancelled that. Nothing was sent.');
+            }
+            if (act === 'unclear')
+                return reply(ledger, 'Shall I send it? Yes or no.');
+            if (button !== undefined) {
+                // Edit: this proposal and its buttons lapse now; the next message is captured as the change.
+                const withdrawn = withdrawProposal(ledger, now);
+                await deps.persist(withdrawn);
+                return reply(withdrawn, 'Sure. What would you like to change?');
+            }
+            return collect(ledger, text, deps);
+        }
+        case 'awaiting_consent': {
+            if (button !== undefined)
+                return IGNORED;
+            const decision = await consentReply(text, spec, deps.model);
+            if (decision === 'unclear')
+                return reply(ledger, 'Just to be clear, is that a yes or a no?');
+            const next = applyConsent(spec, ledger, decision, consentVersion(spec), now);
+            if (decision === 'declined') {
+                await deps.persist(next);
+                return reply(next, 'Understood. I have not sent anything.');
+            }
+            return propose(next, deps);
+        }
+        default:
+            return button === undefined ? collect(ledger, text, deps) : IGNORED;
+    }
+}
+/** Load, persist and clear the participant's ledger inside the binding's own transaction scope. */
+export function collectionCustody(store, bindingId, participantId) {
+    return {
+        load: () => store.transaction([bindingId], (tx) => loadCollection(tx, bindingId, participantId)),
+        persist: (ledger) => store.transaction([bindingId], (tx) => ledger.phase === 'cancelled' || ledger.phase === 'expired'
+            ? deleteCollection(tx, bindingId, participantId)
+            : saveCollection(tx, ledger)),
+        remove: () => store.transaction([bindingId], (tx) => deleteCollection(tx, bindingId, participantId)),
+    };
+}
+/** The trusted messaging admission bucket: binding-scoped, derived after webhook authentication. */
+export function messagingAdmissionDigest(bindingId, participantId) {
+    return channelDigest(JSON.stringify(['messaging', bindingId, participantId]));
+}
+/**
+ * Remove marked-private values from text bound for the conversation model or the transcript: every
+ * candidate of a private typed control, plus literal occurrences of a captured private text value.
+ */
+export function redactPrivate(spec, ledger, text) {
+    const privates = spec.fields.filter((field) => field.private === true);
+    const controls = [...new Set(privates.map((field) => field.control).filter(isParsed))];
+    let out = redactSpans(text, scanTypedValues(text, controls), (span) => `[${privates.find((field) => field.control === span.control)?.title ?? span.control} withheld]`);
+    for (const field of privates) {
+        if (isParsed(field.control))
+            continue;
+        const value = ledger.values[field.key];
+        if (typeof value !== 'string' || value.trim().length < 2)
+            continue;
+        out = out.replace(new RegExp(value.trim().replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi'), `[${field.title} withheld]`);
+    }
+    return out;
+}
+async function collect(ledger, text, deps) {
+    const { spec, now } = deps;
+    const captured = await capture(spec, reopenCorrected(spec, ledger, text, now), text, deps.model, now);
+    if (captured.phase === 'awaiting_consent') {
+        await deps.persist(captured);
+        return reply(captured, spec.consentQuestion);
+    }
+    if (captured.phase === 'awaiting_confirmation')
+        return propose(captured, deps);
+    await deps.persist(captured);
+    return {
+        kind: 'model',
+        ledger: captured,
+        utterance: redactPrivate(spec, captured, text),
+        note: modelNote(spec, captured, now),
+    };
+}
+/**
+ * A captured field named beside a correction cue, or a fresh value of a typed control that has one
+ * field, is a correction: reopen it so capture can apply the change and the proposal is invalidated.
+ */
+function reopenCorrected(spec, ledger, text, now) {
+    const lower = text.toLowerCase();
+    const cue = CORRECTION_CUES.test(lower);
+    let next = ledger;
+    for (const field of spec.fields) {
+        if (field.control === 'consent' || next.fields[field.key]?.status !== 'captured')
+            continue;
+        const named = lower.includes(field.title.toLowerCase()) || new RegExp(`\\b${field.key}\\b`, 'i').test(text);
+        const typed = isParsed(field.control) &&
+            spec.fields.filter((candidate) => candidate.control === field.control).length === 1 &&
+            scanTypedValues(text, [field.control]).length > 0;
+        if ((named && cue) || typed)
+            next = rejectField(spec, next, field.key, now);
+    }
+    return next;
+}
+async function propose(ledger, deps) {
+    const { spec, now } = deps;
+    const prepared = await deps.prepare(spec.action, actionInput(spec, deps.artifact, ledger));
+    if (prepared.status !== 'confirmation_required') {
+        const cancelled = cancelCollection(ledger, now);
+        await deps.persist(cancelled);
+        return reply(cancelled, `I could not prepare that for sending, so nothing was saved. For help, contact ${deps.supportEmail}.`);
+    }
+    const review = renderReview(spec, ledger.values, ledger.consent);
+    const id = randomUUID();
+    const proposed = attachProposal(spec, ledger, { id, review, continuation: prepared.continuation }, now);
+    await deps.persist(proposed);
+    const buttons = deps.buttons?.render(id);
+    return {
+        kind: 'reply',
+        ledger: proposed,
+        reply: `${review}\n\nShall I send it?`,
+        ...(buttons === undefined ? {} : { buttons }),
+    };
+}
+async function execute(ledger, deps) {
+    const { spec, now } = deps;
+    const proposal = ledger.proposal;
+    if (proposal === undefined) {
+        const cancelled = cancelCollection(ledger, now);
+        await deps.persist(cancelled);
+        return reply(cancelled, 'That review is no longer available, so nothing was sent.');
+    }
+    // The durable claim precedes the external effect; a retry re-enters here with the same identity.
+    await deps.persist(ledger);
+    const result = await deps.execute(proposal.id, proposal.continuation);
+    if (result.status === 'completed') {
+        const done = completeCollection(ledger, now);
+        await deps.persist(done);
+        return reply(done, spec.successMessage);
+    }
+    const cancelled = cancelCollection(ledger, now);
+    await deps.persist(cancelled);
+    const changed = result.status === 'failed' && result.error.code === 'configuration_changed';
+    return reply(cancelled, `${changed ? 'The application changed while you were reviewing, so ' : ''}I could not send that, and nothing was saved. Please try again later or contact ${deps.supportEmail}.`);
+}
+/** The prepared action's input: every ledger value, plus the empty value for an optional field the schema still requires. */
+function actionInput(spec, artifact, ledger) {
+    const action = artifact.tools.find((tool) => tool.name === spec.action);
+    const required = new Set(Array.isArray(action?.inputSchema.required)
+        ? action.inputSchema.required.filter((key) => typeof key === 'string')
+        : []);
+    const input = { ...ledger.values };
+    for (const field of spec.fields)
+        if (field.optional === true && !(field.key in input) && required.has(field.key))
+            input[field.key] = '';
+    return input;
+}
+function consentVersion(spec) {
+    return channelDigest(spec.consentQuestion).slice(0, 16);
+}
+function modelNote(spec, ledger, now) {
+    const optional = spec.fields.filter((field) => field.optional === true).map((field) => field.key);
+    return [
+        `Natural collection is open for "${spec.interactionId}": the platform validates values, asks the consent question, shows the review and confirms; you only converse.`,
+        `Ledger: ${JSON.stringify({ ...ledgerForModel(spec, ledger, now), optional })}`,
+        'Ask naturally, in any grouping and without counters, only for fields whose status is missing, invalid, ambiguous or rejected_by_user; optional fields may stay blank. Answer side questions normally.',
+        'Never ask for or repeat a private value, never mention a form, never claim anything was sent, and never ask a yes-or-no question while a proposal is pending.',
+    ].join('\n');
+}
+//# sourceMappingURL=collection-turn.js.map

package/node_modules/@noodle-borg/service/dist/channels/composition.js

@@ -18,6 +18,7 @@ export function createWhatsAppRuntime(options, deps, history) {
         return undefined;
     return new WhatsAppRuntime({
         ...options,
+        ...(history.installations ? { installations: history.installations } : {}),
         ...(history.allowance
             ? {
                 historyDays: async (tenant) => {

package/node_modules/@noodle-borg/service/dist/channels/messaging-eligibility.js

@@ -0,0 +1,45 @@
+import { isNativeRecordsOperation, } from '@noodle-borg/compiler';
+/**
+ * Runtime twin of the compiler's messaging requirement check (ADR 0240). A binding selects a subset
+ * of the authored surface, so the projected artifact is re-checked with the compiler's own
+ * native-records predicate: pure reads and knowledge pass as before; a `collect` opener passes with
+ * its confirmed native-record action selected beside it; everything else names, as a channel error
+ * code, the requirement the messaging profile lacks.
+ */
+export function messagingProjectionIneligibility(artifact) {
+    const interactions = artifact.toolInteractions ?? {};
+    const present = new Set(artifact.tools.map((tool) => tool.name));
+    const actions = new Set(Object.entries(interactions)
+        .filter(([opener]) => present.has(opener))
+        .map(([, interaction]) => interaction.action));
+    for (const tool of artifact.tools) {
+        const interaction = interactions[tool.name];
+        if (interaction !== undefined && !present.has(interaction.action))
+            return 'channel_dependency_missing';
+        const operations = operationRefs(tool.fulfilment);
+        if (actions.has(tool.name)) {
+            const [operation] = operations;
+            if (operations.length !== 1 || operation === undefined)
+                return 'messaging_action_unsupported';
+            if (!isNativeRecordsOperation(operation, undefined))
+                return 'external_lookup_not_enabled';
+            continue;
+        }
+        if (tool.annotations?.readOnlyHint !== true ||
+            (tool._meta?.ui !== undefined && interaction === undefined))
+            return 'messaging_action_unsupported';
+        // No separately budgeted connector-backed inference yet: external lookups need their own slice.
+        if (operations.length > 0)
+            return 'external_lookup_not_enabled';
+    }
+    const ambient = artifact.server.context?.ambient;
+    if (ambient !== undefined && operationRefs(ambient.fulfilment).length > 0)
+        return 'external_lookup_not_enabled';
+    return undefined;
+}
+function operationRefs(fulfilment) {
+    return fulfilment.kind === 'operation'
+        ? [fulfilment.operationRef]
+        : fulfilment.steps.flatMap((step) => (step.kind === 'operation' ? [step.operationRef] : []));
+}
+//# sourceMappingURL=messaging-eligibility.js.map

package/node_modules/@noodle-borg/service/dist/channels/reply-buttons.js

@@ -0,0 +1,23 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+const ACTS = ['confirm', 'edit', 'cancel'];
+export const REVIEW_BUTTON_TITLES = {
+    confirm: 'Confirm',
+    edit: 'Edit',
+    cancel: 'Cancel',
+};
+export function reviewButtonBinding(indexKey, bindingId, participantId) {
+    const id = (proposalId, act) => `b_${createHmac('sha256', Buffer.from(indexKey, 'base64'))
+        .update(JSON.stringify(['review-button', bindingId, participantId, proposalId, act]))
+        .digest('base64url')}`;
+    return {
+        render: (proposalId) => ACTS.map((act) => ({ id: id(proposalId, act), title: REVIEW_BUTTON_TITLES[act] })),
+        act: (proposalId, buttonId) => {
+            const tapped = Buffer.from(buttonId);
+            return ACTS.find((act) => {
+                const expected = Buffer.from(id(proposalId, act));
+                return expected.length === tapped.length && timingSafeEqual(expected, tapped);
+            });
+        },
+    };
+}
+//# sourceMappingURL=reply-buttons.js.map