@noodleseed/one 0.183.1 → 0.185.0

package/node_modules/@noodle-borg/service/dist/channels/instagram-meta.js

@@ -0,0 +1,196 @@
+import { createHash } from 'node:crypto';
+import { ChannelError } from '@noodle-borg/assistant-gateway/portable';
+import { guardedFetch } from '@noodle-borg/connector-http';
+import { z } from 'zod';
+import { boundedJson, } from './provider.js';
+/** The one callback every Instagram binding shares; bindings are found by Instagram account id. */
+export const INSTAGRAM_META_CALLBACK_PATH = '/v1/channels/instagram/meta';
+/** Instagram rejects text over 1000 UTF-8 bytes. */
+export const INSTAGRAM_TEXT_BYTES = 1000;
+const node = /^\d{1,32}$/;
+const PAGE_TOKEN_TTL_MS = 600_000;
+/** Derived Page tokens, in memory only and keyed by a digest: never logged, stored or returned. */
+const pageTokens = new Map();
+/** A 4xx that judges the payload itself; auth, throttling and timeouts are no reason to resend. */
+function rejectedPayload(status) {
+    return status >= 400 && status < 500 && ![401, 403, 408, 429].includes(status);
+}
+/**
+ * One Instagram professional account reached through its linked Facebook Page on the Messenger
+ * Platform (Facebook Login route). Sources, read 2026-09-26:
+ * - Instagram Messaging calls use the Page access token of the linked Page
+ *   (https://developers.facebook.com/docs/messenger-platform/instagram/get-started/); a system-user
+ *   token with Page access reads it from GET /{page-id}?fields=access_token.
+ * - send: POST /{page-id}/messages with `recipient.id` = the Instagram-scoped id and
+ *   `message.text`, answered `{recipient_id, message_id}`
+ *   (https://developers.facebook.com/docs/messenger-platform/instagram/features/send-message/);
+ *   text is at most 1000 bytes; quick replies are at most 13 with titles up to 20 characters.
+ * - webhooks: GET | POST /{page-id}/subscribed_apps, `subscribed_fields=messages`
+ *   (https://developers.facebook.com/docs/messenger-platform/webhooks/).
+ * - asset: GET /{page-id}?fields=instagram_business_account names the linked account.
+ */
+export class InstagramMeta {
+    token;
+    asset;
+    app;
+    fetcher;
+    cacheKey;
+    constructor(token, asset, app, fetcher = (url, init) => guardedFetch(new URL(url), init)) {
+        this.token = token;
+        this.asset = asset;
+        this.app = app;
+        this.fetcher = fetcher;
+        if (!/^v\d{1,3}\.\d{1,2}$/.test(app.graphVersion) ||
+            !node.test(app.appId) ||
+            !node.test(asset.pageId) ||
+            !node.test(asset.instagramAccountId))
+            throw new ChannelError('provider_configuration_invalid');
+        this.cacheKey = createHash('sha256')
+            .update(JSON.stringify([token, asset.pageId]))
+            .digest('hex');
+    }
+    request(path, token, method = 'GET', body) {
+        return this.fetcher(`https://graph.facebook.com/${this.app.graphVersion}/${this.asset.pageId}${path}`, {
+            method,
+            headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            redirect: 'manual',
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    async pageToken() {
+        const cached = pageTokens.get(this.cacheKey);
+        if (cached && cached.until > Date.now())
+            return cached.token;
+        const response = await this.request('?fields=access_token', this.token);
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new ChannelError(response.status >= 500 ? 'provider_unavailable' : 'provider_page_access_denied');
+        }
+        const parsed = z
+            .object({ access_token: z.string().min(1).max(2048) })
+            .safeParse(await boundedJson(response));
+        if (!parsed.success)
+            throw new ChannelError('provider_page_access_denied');
+        if (pageTokens.size >= 100)
+            pageTokens.clear();
+        pageTokens.set(this.cacheKey, {
+            token: parsed.data.access_token,
+            until: Date.now() + PAGE_TOKEN_TTL_MS,
+        });
+        return parsed.data.access_token;
+    }
+    async health() {
+        const response = await this.request('?fields=instagram_business_account', await this.pageToken());
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new ChannelError('provider_unavailable');
+        }
+        const parsed = z
+            .object({ instagram_business_account: z.object({ id: z.string().max(64) }).optional() })
+            .safeParse(await boundedJson(response));
+        if (!parsed.success)
+            throw new ChannelError('provider_response_invalid');
+        const linked = parsed.data.instagram_business_account?.id;
+        if (!linked)
+            throw new ChannelError('provider_instagram_unlinked');
+        // Messaging permission shows only on a send; readiness proves the Page and account link.
+        return { assetId: linked, canSend: true, status: 'AVAILABLE' };
+    }
+    async setBlocked() {
+        return { state: 'error', code: 'provider_block_unsupported' };
+    }
+    async send(input) {
+        if (!input.text || Buffer.byteLength(input.text, 'utf8') > INSTAGRAM_TEXT_BYTES)
+            return { state: 'failed', code: 'reply_invalid' };
+        const buttons = input.buttons ?? [];
+        const quick = buttons.length > 0 &&
+            buttons.length <= 13 &&
+            buttons.every((button) => button.title.length <= 20 && button.id.length <= 1000);
+        const text = { recipient: { id: input.to.value }, message: { text: input.text } };
+        try {
+            const token = await this.pageToken();
+            let code;
+            let response = quick
+                ? await this.request('/messages', token, 'POST', {
+                    recipient: text.recipient,
+                    message: {
+                        text: input.text,
+                        quick_replies: buttons.map((button) => ({
+                            content_type: 'text',
+                            title: button.title,
+                            payload: button.id,
+                        })),
+                    },
+                })
+                : undefined;
+            if (response !== undefined && !response.ok && rejectedPayload(response.status)) {
+                await response.body?.cancel();
+                code = 'quick_replies_rejected';
+                response = undefined;
+            }
+            response ??= await this.request('/messages', token, 'POST', text);
+            if (!response.ok) {
+                await response.body?.cancel();
+                return {
+                    state: response.status >= 500 || response.status === 408 ? 'unknown' : 'failed',
+                    code: `provider_http_${response.status}`,
+                };
+            }
+            const parsed = z
+                .object({ message_id: z.string().min(1).max(512) })
+                .safeParse(await boundedJson(response));
+            return parsed.success
+                ? {
+                    state: 'accepted',
+                    providerMessageId: parsed.data.message_id,
+                    ...(code === undefined ? {} : { code }),
+                }
+                : { state: 'unknown', code: 'provider_receipt_invalid' };
+        }
+        catch (error) {
+            // The Page token was refused before anything was sent, so nothing reached the participant.
+            if (error instanceof ChannelError && error.code === 'provider_page_access_denied')
+                return { state: 'failed', code: error.code };
+            return { state: 'unknown', code: 'send_outcome_unknown' };
+        }
+    }
+    async subscribed(token) {
+        const response = await this.request('/subscribed_apps', token);
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new ChannelError('provider_unavailable');
+        }
+        const parsed = z
+            .object({
+            data: z
+                .array(z.object({
+                id: z.string().max(64),
+                subscribed_fields: z.array(z.string().max(128)).max(100).optional(),
+            }))
+                .max(100),
+        })
+            .safeParse(await boundedJson(response));
+        if (!parsed.success)
+            throw new ChannelError('provider_response_invalid');
+        return parsed.data.data.some((app) => app.id === this.app.appId && (app.subscribed_fields ?? []).includes('messages'));
+    }
+    /** The app-level callback URL is set once in the Meta App Dashboard and is not read here. */
+    async inspectWebhook(_url) {
+        return { matches: await this.subscribed(await this.pageToken()), authenticated: true };
+    }
+    async configureWebhook(_url) {
+        const token = await this.pageToken();
+        if (await this.subscribed(token))
+            return;
+        const response = await this.request('/subscribed_apps?subscribed_fields=messages', token, 'POST');
+        const parsed = response.ok
+            ? z.object({ success: z.literal(true) }).safeParse(await boundedJson(response))
+            : undefined;
+        if (!response.ok)
+            await response.body?.cancel();
+        if (!parsed?.success)
+            throw new ChannelError('webhook_configuration_failed');
+    }
+}
+//# sourceMappingURL=instagram-meta.js.map

package/node_modules/@noodle-borg/service/dist/channels/instagram-webhook.js

@@ -0,0 +1,78 @@
+import { z } from 'zod';
+/**
+ * One `entry[].messaging[]` item of an `object: "instagram"` webhook on the Messenger Platform
+ * (https://developers.facebook.com/docs/messenger-platform/instagram/features/webhook/, read
+ * 2026-09-26). Everything but a new text, a quick-reply tap or a bare attachment is dropped.
+ */
+const scoped = z.object({ id: z.string().max(64) });
+const item = z.object({
+    sender: scoped,
+    recipient: scoped,
+    timestamp: z.number().int().positive(),
+    message: z
+        .object({
+        mid: z.string().min(1).max(512),
+        text: z.string().max(4096).optional(),
+        is_echo: z.boolean().optional(),
+        is_deleted: z.boolean().optional(),
+        is_unsupported: z.boolean().optional(),
+        quick_reply: z.object({ payload: z.string().min(1).max(1000) }).optional(),
+        attachments: z
+            .array(z.object({ type: z.string().max(64) }))
+            .max(20)
+            .optional(),
+    })
+        .optional(),
+});
+/**
+ * The inbound messages addressed to `accountId`. Echoes of our own replies and of staff replies from
+ * the Instagram inbox arrive with `is_echo` (or our account as sender) and are dropped; so are edits,
+ * deletions, reactions, reads, story mentions and unsupported types. A story reply with text is text;
+ * a bare attachment arrives without text and gets the existing text-only reply.
+ */
+export function parseInstagramMessaging(items, accountId) {
+    const messages = [];
+    const skipped = [];
+    for (const raw of items) {
+        const parsed = item.safeParse(raw);
+        if (!parsed.success) {
+            skipped.push('webhook_invalid');
+            continue;
+        }
+        const { sender, recipient, timestamp, message } = parsed.data;
+        if (!message || message.is_deleted || message.is_unsupported) {
+            skipped.push('not_a_message');
+            continue;
+        }
+        if (message.is_echo || sender.id === accountId) {
+            skipped.push('echo');
+            continue;
+        }
+        if (recipient.id !== accountId) {
+            skipped.push('recipient_mismatch');
+            continue;
+        }
+        if (!/^\d{1,64}$/.test(sender.id)) {
+            skipped.push('sender_invalid');
+            continue;
+        }
+        const attachments = message.attachments ?? [];
+        if (!message.text && attachments.some((attachment) => attachment.type === 'story_mention')) {
+            skipped.push('not_a_message');
+            continue;
+        }
+        messages.push({
+            providerId: message.mid,
+            address: { kind: 'opaque', value: sender.id },
+            // Meta documents milliseconds; a seconds value is normalised rather than read as 1970.
+            eventAt: timestamp < 1e12 ? timestamp * 1000 : timestamp,
+            ...(message.quick_reply
+                ? { button: { id: message.quick_reply.payload, title: message.text ?? '' } }
+                : message.text
+                    ? { text: message.text }
+                    : {}),
+        });
+    }
+    return { messages, skipped };
+}
+//# sourceMappingURL=instagram-webhook.js.map

package/node_modules/@noodle-borg/service/dist/channels/provider.js

@@ -75,7 +75,7 @@ export async function cloudApiHealth(response) {
             return errors.length > 0 && errors.every((error) => PAYMENT_BLOCKS.has(error.error_code));
         });
     return {
-        phoneNumberId: parsed.data.id,
+        assetId: parsed.data.id,
         // LIMITED meets provider messaging requirements; provider limits still govern each send.
         canSend: aggregate !== 'BLOCKED',
         status: aggregate,

package/node_modules/@noodle-borg/service/dist/channels/reply-bound.js

@@ -0,0 +1,24 @@
+const EXPAND = '\n\nAsk me to expand on any part.';
+/** Instagram rejects text over 1000 UTF-8 bytes; WhatsApp bodies stay well under its 4096 limit. */
+const INSTAGRAM_BYTES = 1000;
+/** One reply within its channel's limit, cut on a character boundary and inviting a follow-up. */
+export function boundReply(channel, answer) {
+    if (channel === 'whatsapp')
+        return answer.length <= 3500
+            ? answer
+            : `${answer.slice(0, 3350).replace(/[\uD800-\uDBFF]$/u, '')}${EXPAND}`;
+    if (Buffer.byteLength(answer, 'utf8') <= INSTAGRAM_BYTES)
+        return answer;
+    const budget = INSTAGRAM_BYTES - Buffer.byteLength(EXPAND, 'utf8');
+    let kept = '';
+    let bytes = 0;
+    for (const character of answer) {
+        const size = Buffer.byteLength(character, 'utf8');
+        if (bytes + size > budget)
+            break;
+        kept += character;
+        bytes += size;
+    }
+    return `${kept}${EXPAND}`;
+}
+//# sourceMappingURL=reply-bound.js.map

package/node_modules/@noodle-borg/service/dist/channels/runtime.js

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto';
-import { beginChannelProviderBlock, CHANNEL_RETENTION_MS, ChannelCoordinator, ChannelError, channelDigest, channelProviderBlocks, collectionSpecFor, finishChannelProviderBlock, messagingSurfaceOf, projectArtifactForSurface, resolveInvocationContextSnapshot, WHATSAPP_CONFIRMATION_EXPIRY_MS, withAssistantTurnExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
+import { beginChannelProviderBlock, CHANNEL_KINDS, CHANNEL_RETENTION_MS, ChannelCoordinator, ChannelError, channelDigest, channelProviderBlocks, collectionSpecFor, finishChannelProviderBlock, messagingSurfaceOf, projectArtifactForSurface, resolveInvocationContextSnapshot, WHATSAPP_CONFIRMATION_EXPIRY_MS, withAssistantTurnExecutionAuthority, } from '@noodle-borg/assistant-gateway/portable';
 import { guardedFetch } from '@noodle-borg/connector-http';
 import { executePreparedTool, prepareToolForConfirmation } from '@noodle-borg/runtime';
 import { historyNoticeSentence, messagingSurfaceHistory } from '../conversation-history/capture.js';
@@ -12,8 +12,10 @@ import { Dialog360, dialog360Provider, verifyWhatsAppWebhookSecret } from './360
 import { capabilityReport } from './capability-report.js';
 import { collectionCustody, messagingAdmissionDigest, redactPrivate, runCollectionTurn, } from './collection-turn.js';
 import { verifiedInferenceBound, withChannelInferenceGuard } from './inference-guard.js';
+import { INSTAGRAM_META_CALLBACK_PATH, InstagramMeta } from './instagram-meta.js';
 import { messagingProjectionIneligibility } from './messaging-eligibility.js';
 import { MetaCloud, WHATSAPP_META_CALLBACK_PATH } from './meta-cloud.js';
+import { boundReply } from './reply-bound.js';
 import { reviewButtonBinding } from './reply-buttons.js';
 export class WhatsAppRuntime {
     options;
@@ -37,12 +39,14 @@ export class WhatsAppRuntime {
             const meta = this.options.meta;
             if (!meta)
                 throw new ChannelError('meta_platform_unconfigured');
-            if (!apiKey || !binding.wabaId)
+            if (!apiKey || (binding.channel === 'whatsapp' && !binding.wabaId))
                 throw new ChannelError('channel_credentials_missing');
             // Only the tenant's business token is binding state; the platform app secret is not.
             await this.channels.checkCredentials(binding.id, channelDigest(JSON.stringify([apiKey])));
             return {
-                adapter: new MetaCloud(apiKey, { phoneNumberId: binding.phoneNumberId, wabaId: binding.wabaId }, meta, this.options.providerFetch),
+                adapter: binding.channel === 'instagram'
+                    ? new InstagramMeta(apiKey, { pageId: binding.pageId, instagramAccountId: binding.instagramAccountId }, meta, this.options.providerFetch)
+                    : new MetaCloud(apiKey, { phoneNumberId: binding.phoneNumberId, wabaId: binding.wabaId }, meta, this.options.providerFetch),
             };
         }
         const webhookSecret = binding.webhookSecret ? values[binding.webhookSecret] : undefined;
@@ -59,6 +63,8 @@ export class WhatsAppRuntime {
     }
     webhookUrl(req, binding) {
         const base = this.deps.serviceBase(req).replace(/\/$/, '');
+        if (binding.channel === 'instagram')
+            return `${base}${INSTAGRAM_META_CALLBACK_PATH}`;
         return binding.provider === 'meta'
             ? `${base}${WHATSAPP_META_CALLBACK_PATH}`
             : `${base}/v1/channels/whatsapp/webhooks/${binding.id}`;
@@ -67,7 +73,7 @@ export class WhatsAppRuntime {
         const target = await activeAssistantTarget(this.deps, binding.tenant);
         if (!target || target.deploymentId !== binding.deploymentId)
             throw new ChannelError('deployment_changed');
-        const surface = messagingSurfaceOf(target.served.artifact.server.assistant);
+        const surface = messagingSurfaceOf(target.served.artifact.server.assistant, binding.channel);
         if (!surface)
             throw new ChannelError('messaging_surface_missing');
         if (binding.capabilities.some((cap) => !surface.capabilities.some((authored) => authored.kind === cap.kind && authored.name === cap.name)))
@@ -107,7 +113,7 @@ export class WhatsAppRuntime {
             target = await this.target(binding);
         });
         await check('model_cost', async () => {
-            const model = await resolveAssistantModelBinding(await this.target(binding), binding.tenant, binding.deploymentId, this.deps, 'whatsapp');
+            const model = await resolveAssistantModelBinding(await this.target(binding), binding.tenant, binding.deploymentId, this.deps, binding.channel);
             if (!model)
                 throw new ChannelError('model_not_configured');
             verifiedInferenceBound(model, this.channels.now());
@@ -123,7 +129,8 @@ export class WhatsAppRuntime {
         });
         await check('provider_asset', async () => {
             const health = await (await this.provider(binding)).adapter.health();
-            if (health.phoneNumberId !== binding.phoneNumberId)
+            const asset = binding.channel === 'instagram' ? binding.instagramAccountId : binding.phoneNumberId;
+            if (health.assetId !== asset)
                 throw new ChannelError('asset_mismatch');
             if (!health.canSend)
                 throw new ChannelError(health.reason === 'payment_method_required'
@@ -166,7 +173,7 @@ export class WhatsAppRuntime {
         await (await this.provider(binding)).adapter.configureWebhook(this.webhookUrl(req, binding));
     }
     async projection(tenant) {
-        const binding = await this.channels.get(tenant);
+        const binding = await this.channels.get(tenant, 'whatsapp');
         if (!binding)
             return {
                 status: 'unavailable',
@@ -193,18 +200,23 @@ export class WhatsAppRuntime {
         }
     }
     /**
-     * Erases one participant's working memory on the tenant's binding (ADR 0241): their context and every
-     * message body and reply, keeping content-free controls. False when the tenant has no binding or the
-     * reference cannot name a participant, which never reaches the channel store.
+     * Erases one participant's working memory on the tenant's bindings (ADR 0241): their context and every
+     * message body and reply, keeping content-free controls. A participant id is scoped to one binding, so
+     * every channel's binding is searched. False when the tenant has no binding or the reference cannot
+     * name a participant, which never reaches the channel store.
      */
     async forgetParticipant(tenant, participantId, actor) {
         if (!/^p_[a-f0-9]{64}$/.test(participantId))
             return false;
-        const binding = await this.channels.get(tenant);
-        if (!binding)
-            return false;
-        await this.channels.forget(binding.id, participantId, actor, `history-forget:${randomUUID()}`);
-        return true;
+        let found = false;
+        for (const channel of CHANNEL_KINDS) {
+            const binding = await this.channels.get(tenant, channel);
+            if (!binding)
+                continue;
+            found = true;
+            await this.channels.forget(binding.id, participantId, actor, `history-forget:${randomUUID()}`);
+        }
+        return found;
     }
     async providerBlock(id, participantId, blocked, actor, key, protectedPhone) {
         const operation = await beginChannelProviderBlock(this.channels.store, id, participantId, blocked ? 'blocked' : 'unblocked', actor, key, this.channels.now(), protectedPhone);
@@ -339,13 +351,13 @@ export class WhatsAppRuntime {
         try {
             const target = await this.target(binding);
             const artifact = target.served.artifact;
-            const model = await resolveAssistantModelBinding(target, binding.tenant, binding.deploymentId, this.deps, 'whatsapp');
+            const model = await resolveAssistantModelBinding(target, binding.tenant, binding.deploymentId, this.deps, binding.channel);
             if (!model)
                 throw new ChannelError('model_not_configured');
             const guarded = withChannelInferenceGuard(model, this.channels, binding.id, event.id, beforeStep);
             const session = {
                 kind: 'messaging',
-                channel: 'whatsapp',
+                channel: binding.channel,
                 id: event.id,
                 bindingId: binding.id,
                 participantId: participant.id,
@@ -400,7 +412,7 @@ export class WhatsAppRuntime {
                             invocationId: proposalId,
                             publicAdmission: {
                                 messaging: messagingAdmissionDigest(binding.id, participant.id),
-                                provenance: { kind: 'messaging', channel: 'whatsapp' },
+                                provenance: { kind: 'messaging', channel: binding.channel },
                             },
                         });
                     },
@@ -446,9 +458,9 @@ export class WhatsAppRuntime {
                     throw new ChannelError(failure ?? 'answer_unavailable');
                 // WhatsApp has no footer, so a recorded channel states its window here (ADR 0241 decision 17),
                 // in the author's `historyNotice` language when one is declared.
-                const surface = messagingSurfaceHistory(artifact.server.assistant);
+                const surface = messagingSurfaceHistory(artifact.server.assistant, binding.channel);
                 const days = participant.history.length === 0
-                    ? ((await this.deps.conversations?.retentionDays(binding.tenant, 'whatsapp', surface)) ?? 0)
+                    ? ((await this.deps.conversations?.retentionDays(binding.tenant, binding.channel, surface)) ?? 0)
                     : 0;
                 const kept = days > 0 ? ` ${historyNoticeSentence(days, surface.noticeTemplate)}` : '';
                 const disclosure = participant.history.length === 0
@@ -456,20 +468,19 @@ export class WhatsAppRuntime {
                     : '';
                 answer = disclosure + text.trim();
             }
-            const bounded = answer.length <= 3500
-                ? answer
-                : `${answer.slice(0, 3350).replace(/[\uD800-\uDBFF]$/u, '')}\n\nAsk me to expand on any part.`;
+            const bounded = boundReply(binding.channel, answer);
             // Marked-private values never persist: history and the event row keep redacted text, and the
             // full review outlives only its own delivery.
             const scrub = (text) => ledger !== undefined && spec !== undefined ? redactPrivate(spec, ledger, text) : text;
             await this.channels.complete(binding.id, event.id, event.lease, bounded, historyRetention, undefined, { user: scrub(heard), assistant: scrub(bounded) }, outcome.kind === 'reply' ? outcome.buttons : undefined);
             await this.deps.conversations?.recordChannelTurn({
                 tenant: binding.tenant,
+                channel: binding.channel,
                 participantId: participant.id,
                 user: scrub(heard),
                 assistant: scrub(bounded),
                 receivedAt: event.receivedAt,
-            }, messagingSurfaceHistory(artifact.server.assistant));
+            }, messagingSurfaceHistory(artifact.server.assistant, binding.channel));
         }
         catch (error) {
             const code = error instanceof ChannelError ? error.code : 'answer_failed';

package/node_modules/@noodle-borg/service/dist/conversation-history/capture.js

@@ -27,9 +27,9 @@ export function websiteSurfaceHistory(assistant, binding) {
             : undefined;
     return { historyDisabled: surface?.history === false, ...noticeTemplateOf(assistant) };
 }
-export function messagingSurfaceHistory(assistant) {
+export function messagingSurfaceHistory(assistant, channel) {
     return {
-        historyDisabled: messagingSurfaceOf(assistant)?.history === false,
+        historyDisabled: messagingSurfaceOf(assistant, channel)?.history === false,
         ...noticeTemplateOf(assistant),
     };
 }
@@ -115,13 +115,13 @@ export class ConversationCapture {
         if (surface.historyDisabled)
             return Promise.resolve();
         return this.#guard(turn.tenant, async () => {
-            const days = effectiveConversationDays(await this.policy(turn.tenant), 'whatsapp');
+            const days = effectiveConversationDays(await this.policy(turn.tenant), turn.channel);
             if (days === 0)
                 return;
             const now = this.#now();
             const subject = { kind: 'participant', ref: turn.participantId };
-            const id = (await this.store.findRecent(turn.tenant, 'whatsapp', subject, turn.receivedAt - CHANNEL_CONVERSATION_GAP_MS)) ?? `cv_${randomUUID()}`;
-            await this.store.append({ id, tenant: turn.tenant, channel: 'whatsapp', subject }, [
+            const id = (await this.store.findRecent(turn.tenant, turn.channel, subject, turn.receivedAt - CHANNEL_CONVERSATION_GAP_MS)) ?? `cv_${randomUUID()}`;
+            await this.store.append({ id, tenant: turn.tenant, channel: turn.channel, subject }, [
                 { kind: 'message', role: 'user', text: maskPaymentCards(turn.user), at: turn.receivedAt },
                 { kind: 'message', role: 'assistant', text: maskPaymentCards(turn.assistant), at: now },
             ].filter((item) => item.text.trim()), days);

package/node_modules/@noodle-borg/service/dist/conversation-history/contracts.js

@@ -3,12 +3,13 @@
  * from the model's short working memory. It is never read back into a prompt, log, audit or analytics.
  */
 export const CONVERSATION_DAY_MS = 86_400_000;
-/** A WhatsApp conversation ends after this much silence, matching the provider's service window. */
+/** A messaging conversation ends after this much silence, matching the providers' reply window. */
 export const CHANNEL_CONVERSATION_GAP_MS = CONVERSATION_DAY_MS;
 export const ALL_CONVERSATION_SOURCES = {
     website_visitors: true,
     signed_in_customers: true,
     whatsapp: true,
+    instagram: true,
 };
 /**
  * The latest expiry a shorter window allows an item from `at`; Off (0 days) ends every item now. The

package/node_modules/@noodle-borg/service/dist/conversation-history/operator.js

@@ -1,6 +1,6 @@
 import { createHmac } from 'node:crypto';
 import { canonicalJson } from '@noodle-borg/compiler';
-import { ConversationExportResponseSchema, ConversationForgetRequestSchema, ConversationForgetResponseSchema, ConversationIdSchema, ConversationListResponseSchema, ConversationReviewRequestSchema, ConversationReviewStatusSchema, ConversationShowResponseSchema, } from '@noodle-borg/wire-contracts';
+import { ConversationChannelSchema, ConversationExportResponseSchema, ConversationForgetRequestSchema, ConversationForgetResponseSchema, ConversationIdSchema, ConversationListResponseSchema, ConversationReviewRequestSchema, ConversationReviewStatusSchema, ConversationShowResponseSchema, } from '@noodle-borg/wire-contracts';
 import { maskPaymentCards } from '../payment-card.js';
 import { CONVERSATION_DAY_MS, CONVERSATION_NOTE_LIMIT, } from './contracts.js';
 const runLocal = (operation) => operation();
@@ -174,7 +174,7 @@ export class ApplicationConversations {
         if (!Number.isInteger(limit) ||
             limit < 1 ||
             limit > bounds.maximum ||
-            (channel !== undefined && channel !== 'website' && channel !== 'whatsapp') ||
+            (channel !== undefined && !ConversationChannelSchema.safeParse(channel).success) ||
             (status !== undefined && !ConversationReviewStatusSchema.safeParse(status).success) ||
             (cursor !== undefined && (!cursor || cursor.length > 2048)))
             throw invalid();

package/node_modules/@noodle-borg/service/dist/routes/instagram-meta.js

@@ -0,0 +1,79 @@
+import { ChannelError } from '@noodle-borg/assistant-gateway/portable';
+import { readBodyBuffer, sendJson } from '@noodle-borg/transport-http';
+import { z } from 'zod';
+import { parseInstagramMessaging } from '../channels/instagram-webhook.js';
+import { handshake, META_RETRYABLE, META_SIGNATURE_HEADER, verifyMetaSignature, } from './meta-webhook.js';
+const envelope = z.object({
+    object: z.literal('instagram'),
+    entry: z
+        .array(z.object({
+        id: z.string().regex(/^\d{1,32}$/),
+        messaging: z.array(z.unknown()).max(100).optional(),
+    }))
+        .max(100),
+});
+/**
+ * The shared Instagram callback of Noodle Seed's Meta app, signed like WhatsApp's with the app secret.
+ * Each entry names the Instagram account it is for; only the one Instagram binding that owns that
+ * account receives it, and every message must also be addressed to it.
+ */
+export async function instagramWebhook(req, res, url, runtime) {
+    const meta = runtime.options.meta;
+    if (!meta)
+        return sendJson(res, 404, { error: 'not_found' });
+    if (req.method === 'GET')
+        return handshake(res, url, meta.verifyToken);
+    if (req.method !== 'POST')
+        return sendJson(res, 405, { error: 'method_not_allowed' });
+    const body = await readBodyBuffer(req, 1 << 20);
+    if (!body.ok)
+        return sendJson(res, 413, { error: 'webhook_invalid' });
+    // The signature covers the exact bytes Meta sent; nothing is parsed before it verifies.
+    if (!verifyMetaSignature(body.buffer, req.headers[META_SIGNATURE_HEADER], meta.appSecret))
+        return sendJson(res, 401, { error: 'unauthorized' });
+    // Content-free: a code and never a header, body, sender, message or account id.
+    const skip = (code) => runtime.deps.logger?.warn('assistant.channel.webhook', { channel: 'instagram', code });
+    let parsed;
+    try {
+        const result = envelope.safeParse(JSON.parse(body.buffer.toString('utf8')));
+        if (result.success)
+            parsed = result.data;
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (!parsed) {
+        skip('webhook_invalid');
+        return sendJson(res, 200, { ok: true });
+    }
+    const items = parsed.entry.reduce((total, entry) => total + (entry.messaging?.length ?? 0), 0);
+    if (items > 100) {
+        skip('batch_too_large');
+        return sendJson(res, 200, { ok: true });
+    }
+    for (const entry of parsed.entry) {
+        try {
+            const id = await runtime.channels.bindingForAsset('instagram', entry.id);
+            if (!id)
+                throw new ChannelError('binding_unknown');
+            const binding = await runtime.channels.internal(id);
+            if (binding.channel !== 'instagram' || binding.instagramAccountId !== entry.id)
+                throw new ChannelError('asset_mismatch');
+            const { messages, skipped } = parseInstagramMessaging(entry.messaging ?? [], binding.instagramAccountId);
+            // Echoes of our own and staff replies are expected traffic, not a finding.
+            for (const code of new Set(skipped))
+                if (code !== 'echo')
+                    skip(code);
+            if (messages.length > 0)
+                await runtime.channels.receive(id, messages, await runtime.retention(binding));
+        }
+        catch (error) {
+            if (!(error instanceof ChannelError) || META_RETRYABLE.has(error.code))
+                throw error;
+            skip(error.code);
+        }
+    }
+    sendJson(res, 200, { ok: true });
+    runtime.options.worker.wake();
+}
+//# sourceMappingURL=instagram-meta.js.map