@noodleseed/one 0.175.0 → 0.176.0

package/node_modules/@noodle-borg/service/dist/routes/whatsapp.js

@@ -2,7 +2,9 @@ import { ChannelError, channelParticipantId, recordChannelDelivery, } from '@noo
 import { readJsonBody, sendJson } from '@noodle-borg/transport-http';
 import * as wire from '@noodle-borg/wire-contracts';
 import { parseWhatsAppWebhook, verifyWhatsAppWebhookSecret, WHATSAPP_CALLBACK_HEADER, } from '../channels/360dialog.js';
+import { WHATSAPP_META_CALLBACK_PATH } from '../channels/meta-cloud.js';
 import { authorizeTenantControl, developerGrantRouteAccess } from './control-plane.js';
+import { metaWebhook } from './whatsapp-meta.js';
 const participant = /^p_[a-f0-9]{64}$/;
 const eventId = /^e_[0-9_]+$/;
 function eventView(event) {
@@ -32,7 +34,8 @@ async function body(req, schema) {
 export function dispatchWhatsAppRoutes(req, res, url, runtime, grants) {
     const callback = /^\/v1\/channels\/whatsapp\/webhooks\/([a-z0-9-]+)$/.exec(url.pathname);
     const operator = /^\/v1\/orgs\/([^/]+)\/apps\/([^/]+)\/envs\/([^/]+)\/channels\/whatsapp(?:\/(.*))?$/.exec(url.pathname);
-    if (!callback && !operator)
+    const meta = url.pathname === WHATSAPP_META_CALLBACK_PATH;
+    if (!callback && !operator && !meta)
         return false;
     res.setHeader('Cache-Control', 'no-store');
     if (!runtime) {
@@ -42,13 +45,15 @@ export function dispatchWhatsAppRoutes(req, res, url, runtime, grants) {
         });
         return true;
     }
-    const run = Promise.resolve().then(() => callback
-        ? webhook(req, res, callback[1], runtime)
-        : operate(req, res, url, {
-            org: decodeURIComponent(operator[1]),
-            app: decodeURIComponent(operator[2]),
-            env: decodeURIComponent(operator[3]),
-        }, operator[4] ?? '', runtime, grants));
+    const run = Promise.resolve().then(() => meta
+        ? metaWebhook(req, res, url, runtime)
+        : callback
+            ? webhook(req, res, callback[1], runtime)
+            : operate(req, res, url, {
+                org: decodeURIComponent(operator[1]),
+                app: decodeURIComponent(operator[2]),
+                env: decodeURIComponent(operator[3]),
+            }, operator[4] ?? '', runtime, grants));
     void run.catch((error) => {
         const code = error instanceof ChannelError ? error.code : 'channel_unavailable';
         const status = code === 'channel_not_found'
@@ -73,8 +78,12 @@ async function webhook(req, res, id, runtime) {
     if (req.method !== 'POST')
         return sendJson(res, 405, { error: 'method_not_allowed' });
     const binding = await runtime.channels.internal(id);
+    // Meta numbers share the signed app callback; only 360dialog has a per-binding address.
+    if (binding.provider !== '360dialog')
+        return sendJson(res, 404, { error: 'not_found' });
     const { webhookSecret } = await runtime.provider(binding);
-    if (!verifyWhatsAppWebhookSecret(req.headers[WHATSAPP_CALLBACK_HEADER], webhookSecret))
+    if (!webhookSecret ||
+        !verifyWhatsAppWebhookSecret(req.headers[WHATSAPP_CALLBACK_HEADER], webhookSecret))
         return sendJson(res, 401, { error: 'unauthorized' });
     const input = await readJsonBody(req, 1 << 20);
     if (!input.ok)

package/node_modules/@noodle-borg/transport-http/dist/index.d.ts

@@ -3,7 +3,7 @@ export { type AccessMode, type AdmissionCategory, type AdmissionContext, type Ad
 export { bearerToken } from './identity-authorization.js';
 export { createLogger, type LogFields, type Logger, type LoggerOptions, type LogLevel, type LogSink, noopLogger, stderrSink, stdoutSink, } from './logging.js';
 export { resolveTrustedPublicOrg, resolveTrustedTenantMcpResource, type TrustedPublicOrg, type TrustedPublicRef, type TrustedPublicRouting, type TrustedTenantMcpResource, trustedPublicMcpRef, trustedPublicOrgWellKnownRef, } from './public-routing.js';
-export { readBody, readDeployBody, readJsonBody } from './request-body.js';
+export { readBody, readBodyBuffer, readDeployBody, readJsonBody } from './request-body.js';
 export { sendJson } from './responses.js';
 export { type RunningServer, type ServeOptions, serveHttp } from './serve.js';
 export type { HostedToolAuthorizationObservation, HostedToolAuthorizationObserver, ServicePrincipalToolAuthorizationObservation, } from './service-principal-authorization.js';

package/node_modules/@noodle-borg/transport-http/dist/index.js

@@ -3,7 +3,7 @@ export { createMcpHttpHandler, createMcpRouter, } from './handler.js';
 export { bearerToken } from './identity-authorization.js';
 export { createLogger, noopLogger, stderrSink, stdoutSink, } from './logging.js';
 export { resolveTrustedPublicOrg, resolveTrustedTenantMcpResource, trustedPublicMcpRef, trustedPublicOrgWellKnownRef, } from './public-routing.js';
-export { readBody, readDeployBody, readJsonBody } from './request-body.js';
+export { readBody, readBodyBuffer, readDeployBody, readJsonBody } from './request-body.js';
 export { sendJson } from './responses.js';
 export { serveHttp } from './serve.js';
 export { preflightServicePrincipalToolCall, sendServicePrincipalToolDenial, } from './service-principal-authorization.js';

package/node_modules/@noodle-borg/transport-http/dist/request-body.d.ts

@@ -7,6 +7,15 @@ export declare function readBody(req: IncomingMessage, max: number): Promise<{
     receivedBytes: number;
     maxBytes: number;
 }>;
+/** The exact request bytes, bounded; for callers that must verify a signature before parsing. */
+export declare function readBodyBuffer(req: IncomingMessage, max: number): Promise<{
+    ok: true;
+    buffer: Buffer;
+} | {
+    ok: false;
+    receivedBytes: number;
+    maxBytes: number;
+}>;
 export declare function readDeployBody(req: IncomingMessage, max: number): Promise<{
     ok: true;
     text: string;

package/node_modules/@noodle-borg/transport-http/dist/request-body.js

@@ -3,7 +3,8 @@ export async function readBody(req, max) {
     const body = await readBodyBuffer(req, max);
     return body.ok ? { ok: true, text: body.buffer.toString('utf8') } : body;
 }
-async function readBodyBuffer(req, max) {
+/** The exact request bytes, bounded; for callers that must verify a signature before parsing. */
+export async function readBodyBuffer(req, max) {
     const chunks = [];
     let size = 0;
     for await (const chunk of req) {

package/node_modules/@noodle-borg/wire-contracts/dist/whatsapp.d.ts

@@ -11,11 +11,21 @@ export declare const WhatsAppLimitsSchema: z.ZodObject<{
     textCharacters: z.ZodNumber;
     dailyMicroUsd: z.ZodNumber;
 }, z.core.$strict>;
+/** `360dialog` keeps a per-binding callback secret; `meta` names its WABA and uses the app signature. */
+export declare const WhatsAppProviderSchema: z.ZodEnum<{
+    "360dialog": "360dialog";
+    meta: "meta";
+}>;
 export declare const WhatsAppConfigureRequestSchema: z.ZodObject<{
     expectedRevision: z.ZodNumber;
+    provider: z.ZodDefault<z.ZodEnum<{
+        "360dialog": "360dialog";
+        meta: "meta";
+    }>>;
     phoneNumberId: z.ZodString;
+    wabaId: z.ZodOptional<z.ZodString>;
     apiKeySecret: z.ZodString;
-    webhookSecret: z.ZodString;
+    webhookSecret: z.ZodOptional<z.ZodString>;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             tool: "tool";
@@ -86,10 +96,14 @@ export declare const WhatsAppBindingSchema: z.ZodObject<{
         app: z.ZodString;
         env: z.ZodString;
     }, z.core.$strict>;
-    provider: z.ZodLiteral<"360dialog">;
+    provider: z.ZodEnum<{
+        "360dialog": "360dialog";
+        meta: "meta";
+    }>;
     phoneNumberId: z.ZodString;
+    wabaId: z.ZodOptional<z.ZodString>;
     apiKeySecret: z.ZodString;
-    webhookSecret: z.ZodString;
+    webhookSecret: z.ZodOptional<z.ZodString>;
     deploymentId: z.ZodString;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
@@ -133,10 +147,14 @@ export declare const WhatsAppBindingResponseSchema: z.ZodObject<{
             app: z.ZodString;
             env: z.ZodString;
         }, z.core.$strict>;
-        provider: z.ZodLiteral<"360dialog">;
+        provider: z.ZodEnum<{
+            "360dialog": "360dialog";
+            meta: "meta";
+        }>;
         phoneNumberId: z.ZodString;
+        wabaId: z.ZodOptional<z.ZodString>;
         apiKeySecret: z.ZodString;
-        webhookSecret: z.ZodString;
+        webhookSecret: z.ZodOptional<z.ZodString>;
         deploymentId: z.ZodString;
         capabilities: z.ZodArray<z.ZodObject<{
             kind: z.ZodEnum<{
@@ -176,10 +194,14 @@ export declare const WhatsAppBindingClientResponseSchema: z.ZodObject<{
     ok: z.ZodLiteral<true>;
     data: z.ZodNullable<z.ZodObject<{
         id: z.ZodString;
-        provider: z.ZodLiteral<"360dialog">;
+        provider: z.ZodEnum<{
+            "360dialog": "360dialog";
+            meta: "meta";
+        }>;
         phoneNumberId: z.ZodString;
+        wabaId: z.ZodOptional<z.ZodString>;
         apiKeySecret: z.ZodString;
-        webhookSecret: z.ZodString;
+        webhookSecret: z.ZodOptional<z.ZodString>;
         deploymentId: z.ZodString;
         supportEmail: z.ZodEmail;
         revision: z.ZodNumber;

package/node_modules/@noodle-borg/wire-contracts/dist/whatsapp.js

@@ -20,14 +20,36 @@ export const WhatsAppLimitsSchema = z.strictObject({
 });
 const capability = z.strictObject({ kind: z.enum(['tool', 'knowledge']), name: id });
 const secretRef = z.string().regex(/^[A-Z][A-Z0-9_]{0,127}$/);
-export const WhatsAppConfigureRequestSchema = z.strictObject({
+/** `360dialog` keeps a per-binding callback secret; `meta` names its WABA and uses the app signature. */
+export const WhatsAppProviderSchema = z.enum(['360dialog', 'meta']);
+export const WhatsAppConfigureRequestSchema = z
+    .strictObject({
     expectedRevision: revision,
+    provider: WhatsAppProviderSchema.default('360dialog'),
     phoneNumberId: id,
+    wabaId: id.optional(),
     apiKeySecret: secretRef,
-    webhookSecret: secretRef,
+    webhookSecret: secretRef.optional(),
     capabilities: z.array(capability).max(64),
     supportEmail: z.email().max(254),
     limits: WhatsAppLimitsSchema.partial().optional(),
+})
+    .superRefine((value, context) => {
+    const meta = value.provider === 'meta';
+    if (meta ? !value.wabaId : !value.webhookSecret)
+        context.addIssue({
+            code: 'custom',
+            path: [meta ? 'wabaId' : 'webhookSecret'],
+            message: meta ? 'Meta requires wabaId' : '360dialog requires webhookSecret',
+        });
+    if (meta ? value.webhookSecret !== undefined : value.wabaId !== undefined)
+        context.addIssue({
+            code: 'custom',
+            path: [meta ? 'webhookSecret' : 'wabaId'],
+            message: meta
+                ? 'Meta callbacks are authenticated by the app signature, not a webhook secret'
+                : 'wabaId applies only to the meta provider',
+        });
 });
 export const WhatsAppStateRequestSchema = z.strictObject({
     expectedRevision: revision,
@@ -64,10 +86,11 @@ const tenant = z.strictObject({ org: id, app: id, env: id });
 export const WhatsAppBindingSchema = z.strictObject({
     id,
     tenant,
-    provider: z.literal('360dialog'),
+    provider: WhatsAppProviderSchema,
     phoneNumberId: id,
+    wabaId: id.optional(),
     apiKeySecret: secretRef,
-    webhookSecret: secretRef,
+    webhookSecret: secretRef.optional(),
     deploymentId: id,
     capabilities: z.array(capability),
     supportEmail: z.email(),

package/node_modules/@noodleseed/assistant/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/assistant",
-  "version": "1.36.0",
+  "version": "1.36.1",
   "description": "Embed the Noodle Seed customer-branded assistant in your web app with managed or framework-owned UI, a framework-neutral MCP App host, a DOM-free client, and a backend session helper. Authoring and deploying the server is @noodleseed/one.",
   "license": "Apache-2.0",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.175.0",
+  "version": "0.176.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",