@noodleseed/one 0.187.0 → 0.189.0

package/node_modules/@noodle-borg/authoring/dist/assistant.js

@@ -9,7 +9,7 @@ export function publicMessaging(input) {
             throw new Error(`publicMessaging does not accept ${key}`);
         }
     }
-    if (input.channel !== 'whatsapp' && input.channel !== 'instagram')
+    if (input.channel !== 'whatsapp' && input.channel !== 'instagram' && input.channel !== 'sms')
         throw new Error('Unsupported public messaging channel');
     return {
         kind: 'messaging',

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-channels.js

@@ -86,6 +86,32 @@ export const CHANNELS_COMMAND = {
     arguments: [],
     flags: [],
     subcommands: [
+        group('sms', 'Configure a Twilio SMS number and control two-way text messaging.', operations(leaf('configure', 'Save a paused SMS binding using a managed Twilio Auth Token reference.', [
+            revision,
+            ...mutation,
+            flag('account-sid', 'Twilio Account SID (AC...).'),
+            flag('phone-number-sid', 'Twilio IncomingPhoneNumber SID (PN...).'),
+            flag('phone-number', 'Business sending number in E.164 format.'),
+            flag('api-key-secret', 'Managed secret name for the Twilio account Auth Token.'),
+            flag('capabilities', 'Comma-separated knowledge:name or tool:name selections.'),
+            flag('support-email', 'Contact shown when an answer cannot be completed.'),
+            ...limits,
+        ]), [
+            leaf('block', 'Block locally; Twilio opt-outs remain separately enforced.', [
+                participant,
+                blockScope,
+                flag('phone-stdin', 'Read a phone number securely from standard input.', 'boolean'),
+                flag('until', 'Expiry as an ISO timestamp.'),
+                flag('indefinite', 'Retain this block until removed.', 'boolean'),
+                ...mutation,
+            ]),
+            leaf('unblock', 'Remove a local block; does not override a recipient opt-out.', [
+                participant,
+                blockScope,
+                flag('phone-stdin', 'Supply the number if retained context expired.', 'boolean'),
+                ...mutation,
+            ]),
+        ])),
         group('whatsapp', 'Configure a 360dialog or Meta Cloud API number, test readiness, and control public messaging.', operations(leaf('configure', 'Save a paused binding using managed secret references.', [
             revision,
             ...mutation,

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-solution-conversations.js

@@ -31,7 +31,7 @@ const paging = (maximum) => [
         type: 'string',
         value: '<channel>',
         summary: 'Only conversations from this channel.',
-        constraints: { choices: ['website', 'whatsapp', 'instagram'] },
+        constraints: { choices: ['website', 'whatsapp', 'instagram', 'sms'] },
     },
     {
         ...OPTIONAL_FLAG,

package/node_modules/@noodle-borg/cli-catalog/dist/catalog-data-solution-history.js

@@ -59,6 +59,7 @@ export const SOLUTION_HISTORY = {
                         channel('signed-in-customers', 'Record signed-in customers.'),
                         channel('whatsapp', 'Record WhatsApp conversations.'),
                         channel('instagram', 'Record Instagram DM conversations.'),
+                        channel('sms', 'Record SMS conversations.'),
                         {
                             ...OPTIONAL_FLAG,
                             required: true,

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.d.ts

@@ -364,6 +364,7 @@ export declare const manifestV1Schema: z.ZodObject<{
                 channel: z.ZodEnum<{
                     whatsapp: "whatsapp";
                     instagram: "instagram";
+                    sms: "sms";
                 }>;
                 mode: z.ZodLiteral<"public">;
                 capabilities: z.ZodArray<z.ZodObject<{
@@ -874,6 +875,7 @@ export declare const manifestV2Schema: z.ZodObject<{
                 channel: z.ZodEnum<{
                     whatsapp: "whatsapp";
                     instagram: "instagram";
+                    sms: "sms";
                 }>;
                 mode: z.ZodLiteral<"public">;
                 capabilities: z.ZodArray<z.ZodObject<{
@@ -1679,6 +1681,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 channel: z.ZodEnum<{
                     whatsapp: "whatsapp";
                     instagram: "instagram";
+                    sms: "sms";
                 }>;
                 mode: z.ZodLiteral<"public">;
                 capabilities: z.ZodArray<z.ZodObject<{
@@ -2188,6 +2191,7 @@ export declare const manifestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 channel: z.ZodEnum<{
                     whatsapp: "whatsapp";
                     instagram: "instagram";
+                    sms: "sms";
                 }>;
                 mode: z.ZodLiteral<"public">;
                 capabilities: z.ZodArray<z.ZodObject<{

package/node_modules/@noodle-borg/compiler/dist/manifest/schema.js

@@ -199,7 +199,7 @@ const embeddedAssistantSchema = z
         z
             .object({
             kind: z.literal('messaging'),
-            channel: z.enum(['whatsapp', 'instagram']),
+            channel: z.enum(['whatsapp', 'instagram', 'sms']),
             mode: z.literal('public'),
             capabilities: z.array(assistantCapabilitySchema),
             instructions: z.string().trim().min(1).max(MAX_SERVER_INSTRUCTIONS).optional(),

package/node_modules/@noodle-borg/compiler/dist/manifest/website-projection.d.ts

@@ -19,6 +19,7 @@ import type { CompileError } from '../errors.js';
  */
 interface AssistantSurfaceInput {
     readonly kind?: 'website' | 'messaging' | undefined;
+    readonly channel?: string | undefined;
     readonly mode: 'authenticated' | 'public' | 'mixed';
     readonly capabilities?: readonly {
         readonly kind: string;

package/node_modules/@noodle-borg/compiler/dist/manifest/website-projection.js

@@ -55,7 +55,7 @@ export function validateWebsiteProjection(assistant, surfaces) {
             const path = `tools.${tool.name}`;
             if (surface.kind === 'messaging') {
                 const selected = new Set(surface.capabilities?.flatMap((entry) => (entry.kind === 'tool' ? [entry.name] : [])));
-                const requirement = messagingRequirement(tool, selected, surfaces);
+                const requirement = messagingRequirement(tool, selected, surfaces, surface.channel);
                 if (requirement !== undefined)
                     errors.push({ ...requirement, path });
             }
@@ -87,9 +87,18 @@ export function validateWebsiteProjection(assistant, surfaces) {
  * opener may carry a browser widget (the website keeps its React view) because the profile renders
  * the same block as natural collection. Anything else names the requirement it lacks.
  */
-function messagingRequirement(tool, selected, surfaces) {
+function messagingRequirement(tool, selected, surfaces, channel) {
     const operations = operationRefs(tool.fulfilment);
     const interaction = surfaces.interactions?.[tool.name];
+    if (channel === 'sms' &&
+        (interaction !== undefined ||
+            operations.length > 0 ||
+            tool.annotations?.readOnlyHint !== true ||
+            tool._meta?.ui !== undefined))
+        return {
+            code: 'channel_requirement_unsupported',
+            message: `"${tool.name}" requires an interaction not supported by the SMS question-answering profile`,
+        };
     if (interaction !== undefined && !selected.has(interaction.action)) {
         return {
             code: 'channel_dependency_missing',

package/node_modules/@noodle-borg/runtime/dist/connector/types.d.ts

@@ -92,7 +92,7 @@ export interface PublicAdmissionContext {
     readonly messaging?: string;
     readonly provenance?: {
         readonly kind: 'messaging';
-        readonly channel: 'whatsapp' | 'instagram';
+        readonly channel: 'whatsapp' | 'instagram' | 'sms';
     };
 }
 /** A single connector-operation invocation, fully resolved and credentialed by the runtime. */

package/node_modules/@noodle-borg/service/dist/application-history-settings.js

@@ -5,6 +5,7 @@ const WIRE_SOURCES = {
     signedInCustomers: 'signed_in_customers',
     whatsapp: 'whatsapp',
     instagram: 'instagram',
+    sms: 'sms',
 };
 /**
  * The surfaces the served application declared `history: false` on (ADR 0241 decision 11), so staff
@@ -58,6 +59,7 @@ export function historySettingsProjection(setting, allowance, revision, canEdit)
                 signedInCustomers: setting.sources.signed_in_customers,
                 whatsapp: setting.sources.whatsapp,
                 instagram: setting.sources.instagram,
+                sms: setting.sources.sms,
             },
         },
     };

package/node_modules/@noodle-borg/service/dist/build-info.js

@@ -7,6 +7,7 @@ export function serviceInfoPayload(buildInfo, developerMcp, channels = {}) {
         features: {
             mixedCustomerAuth: MIXED_CUSTOMER_AUTH_FEATURE_VERSION,
             ...(channels.whatsapp ? { whatsapp: 1 } : {}),
+            ...(channels.sms ? { sms: 1 } : {}),
             ...(channels.instagram ? { instagram: 1 } : {}),
         },
         ...(developerMcp

package/node_modules/@noodle-borg/service/dist/channels/composition.js

@@ -15,10 +15,11 @@ export async function createPostgresWhatsApp(pool, secretBox, options) {
     };
 }
 export function createWhatsAppRuntime(options, deps, history) {
-    if (!options)
+    if (!options.whatsapp)
         return undefined;
     return new WhatsAppRuntime({
-        ...options,
+        ...options.whatsapp,
+        publicBaseUrl: options.publicBaseUrl,
         ...(history.installations ? { installations: history.installations } : {}),
         ...(history.allowance
             ? {

package/node_modules/@noodle-borg/service/dist/channels/messaging-eligibility.js

@@ -6,7 +6,7 @@ import { isNativeRecordsOperation, } from '@noodle-borg/compiler';
  * its confirmed native-record action selected beside it; everything else names, as a channel error
  * code, the requirement the messaging profile lacks.
  */
-export function messagingProjectionIneligibility(artifact) {
+export function messagingProjectionIneligibility(artifact, channel = 'whatsapp') {
     const interactions = artifact.toolInteractions ?? {};
     const present = new Set(artifact.tools.map((tool) => tool.name));
     const actions = new Set(Object.entries(interactions)
@@ -14,6 +14,11 @@ export function messagingProjectionIneligibility(artifact) {
         .map(([, interaction]) => interaction.action));
     for (const tool of artifact.tools) {
         const interaction = interactions[tool.name];
+        if (channel === 'sms' &&
+            (interaction !== undefined ||
+                tool.annotations?.readOnlyHint !== true ||
+                tool._meta?.ui !== undefined))
+            return 'messaging_action_unsupported';
         if (interaction !== undefined && !present.has(interaction.action))
             return 'channel_dependency_missing';
         const operations = operationRefs(tool.fulfilment);

package/node_modules/@noodle-borg/service/dist/channels/reply-bound.js

@@ -3,6 +3,10 @@ const EXPAND = '\n\nAsk me to expand on any part.';
 const INSTAGRAM_BYTES = 1000;
 /** One reply within its channel's limit, cut on a character boundary and inviting a follow-up. */
 export function boundReply(channel, answer) {
+    if (channel === 'sms')
+        return answer.length <= 600
+            ? answer
+            : `${answer.slice(0, 530).replace(/[\uD800-\uDBFF]$/u, '')}${EXPAND}\nReply STOP to unsubscribe.`;
     if (channel === 'whatsapp')
         return answer.length <= 3500
             ? answer

package/node_modules/@noodle-borg/service/dist/channels/runtime.js

@@ -17,6 +17,7 @@ import { messagingProjectionIneligibility } from './messaging-eligibility.js';
 import { MetaCloud, WHATSAPP_META_CALLBACK_PATH } from './meta-cloud.js';
 import { boundReply } from './reply-bound.js';
 import { reviewButtonBinding } from './reply-buttons.js';
+import { TwilioSms } from './twilio-sms.js';
 export class WhatsAppRuntime {
     options;
     deps;
@@ -35,6 +36,18 @@ export class WhatsAppRuntime {
     async provider(binding) {
         const values = await this.deps.registry.configStore.resolveConfigValues('secret', resolveConfigScope(binding.tenant));
         const apiKey = values[binding.apiKeySecret];
+        if (binding.channel === 'sms') {
+            if (!apiKey)
+                throw new ChannelError('channel_credentials_missing');
+            const base = this.options.publicBaseUrl;
+            if (!base || !base.startsWith('https://'))
+                throw new ChannelError('sms_public_url_required');
+            await this.channels.checkCredentials(binding.id, channelDigest(JSON.stringify([apiKey])));
+            return {
+                adapter: new TwilioSms(apiKey, binding, `${base.replace(/\/$/, '')}/v1/channels/sms/webhooks/${binding.id}`, this.options.providerFetch),
+                webhookSecret: apiKey,
+            };
+        }
         if (binding.provider === 'meta') {
             const meta = this.options.meta;
             if (!meta)
@@ -62,7 +75,9 @@ export class WhatsAppRuntime {
         };
     }
     webhookUrl(req, binding) {
-        const base = this.deps.serviceBase(req).replace(/\/$/, '');
+        const base = (binding.channel === 'sms' ? (this.options.publicBaseUrl ?? '') : this.deps.serviceBase(req)).replace(/\/$/, '');
+        if (binding.channel === 'sms')
+            return `${base}/v1/channels/sms/webhooks/${binding.id}`;
         if (binding.channel === 'instagram')
             return `${base}${INSTAGRAM_META_CALLBACK_PATH}`;
         return binding.provider === 'meta'
@@ -79,7 +94,7 @@ export class WhatsAppRuntime {
         if (binding.capabilities.some((cap) => !surface.capabilities.some((authored) => authored.kind === cap.kind && authored.name === cap.name)))
             throw new ChannelError('capability_not_authored');
         const artifact = projectArtifactForSurface(target.served.artifact, binding.capabilities);
-        const ineligible = messagingProjectionIneligibility(artifact);
+        const ineligible = messagingProjectionIneligibility(artifact, binding.channel);
         if (ineligible !== undefined)
             throw new ChannelError(ineligible);
         return { ...target, served: { ...target.served, artifact } };
@@ -129,7 +144,11 @@ export class WhatsAppRuntime {
         });
         await check('provider_asset', async () => {
             const health = await (await this.provider(binding)).adapter.health();
-            const asset = binding.channel === 'instagram' ? binding.instagramAccountId : binding.phoneNumberId;
+            const asset = binding.channel === 'sms'
+                ? binding.phoneNumberSid
+                : binding.channel === 'instagram'
+                    ? binding.instagramAccountId
+                    : binding.phoneNumberId;
             if (health.assetId !== asset)
                 throw new ChannelError('asset_mismatch');
             if (!health.canSend)
@@ -178,7 +197,7 @@ export class WhatsAppRuntime {
             return {
                 status: 'unavailable',
                 capabilities: [],
-                reason: `${channel === 'instagram' ? 'Instagram' : 'WhatsApp'} is not configured.`,
+                reason: `${channel === 'sms' ? 'SMS' : channel === 'instagram' ? 'Instagram' : 'WhatsApp'} is not configured.`,
             };
         const view = {
             bindingId: binding.id,
@@ -236,10 +255,12 @@ export class WhatsAppRuntime {
     }
     async blocks(id, after) {
         const local = await this.channels.blocks(id, after);
+        const optouts = await this.channels.optouts(id, after);
         const provider = await channelProviderBlocks(this.channels.store, id, this.channels.now(), after);
         const ids = [
             ...new Set([
                 ...local.map((item) => item.participantId),
+                ...optouts.map((item) => item.participantId),
                 ...provider.map((item) => item.participantId),
             ]),
         ];
@@ -248,14 +269,16 @@ export class WhatsAppRuntime {
             .slice(0, 100)
             .map((participantId) => {
             const block = local.find((item) => item.participantId === participantId);
+            const optout = optouts.find((item) => item.participantId === participantId);
             const match = provider.find((item) => item.participantId === participantId);
             return {
                 ...(block ?? {
                     participantId,
-                    actor: match.actor,
-                    reason: 'operator',
+                    actor: match?.actor ?? 'recipient',
+                    reason: match ? 'operator' : 'recipient_opt_out',
                     until: null,
                 }),
+                ...(optout ? { optedOut: optout.blocked } : {}),
                 local: !!block && (block.until === null || block.until > this.channels.now()),
                 ...(match
                     ? {
@@ -463,10 +486,15 @@ export class WhatsAppRuntime {
                     ? ((await this.deps.conversations?.retentionDays(binding.tenant, binding.channel, surface)) ?? 0)
                     : 0;
                 const kept = days > 0 ? ` ${historyNoticeSentence(days, surface.noticeTemplate)}` : '';
-                const disclosure = participant.history.length === 0
-                    ? `I’m ${artifact.server.branding?.name ?? artifact.server.title}’s AI assistant.${kept}\n\n`
-                    : '';
-                answer = disclosure + text.trim();
+                const brand = artifact.server.branding?.name ?? artifact.server.title;
+                const displayName = binding.channel === 'sms' ? [...brand].slice(0, 80).join('') : brand;
+                const disclosure = participant.history.length === 0 ? `I’m ${displayName}’s AI assistant.${kept}\n\n` : '';
+                answer =
+                    disclosure +
+                        text.trim() +
+                        (binding.channel === 'sms' && participant.history.length === 0
+                            ? '\nReply STOP to unsubscribe.'
+                            : '');
             }
             const bounded = boundReply(binding.channel, answer);
             // Marked-private values never persist: history and the event row keep redacted text, and the

package/node_modules/@noodle-borg/service/dist/channels/twilio-sms.js

@@ -0,0 +1,188 @@
+import { ChannelError } from '@noodle-borg/assistant-gateway/portable';
+import { z } from 'zod';
+import { boundedJson, } from './provider.js';
+const phone = z.string().regex(/^\+[1-9]\d{1,14}$/);
+const messageId = z.string().regex(/^(SM|MM)[a-fA-F0-9]{32}$/);
+const numberSchema = z.object({
+    sid: z.string(),
+    account_sid: z.string(),
+    phone_number: phone,
+    capabilities: z.object({ sms: z.boolean() }),
+    sms_url: z.string().nullable(),
+    sms_method: z.string(),
+    sms_application_sid: z.string().nullable(),
+});
+/** Twilio REST transport, contained behind the existing messaging provider port. */
+export class TwilioSms {
+    token;
+    asset;
+    callback;
+    fetcher;
+    constructor(token, asset, callback, fetcher = fetch) {
+        this.token = token;
+        this.asset = asset;
+        this.callback = callback;
+        this.fetcher = fetcher;
+    }
+    request(path, fields) {
+        return this.fetcher(`https://api.twilio.com/2010-04-01/Accounts/${this.asset.accountSid}${path}`, {
+            method: fields ? 'POST' : 'GET',
+            headers: {
+                authorization: `Basic ${Buffer.from(`${this.asset.accountSid}:${this.token}`).toString('base64')}`,
+                ...(fields ? { 'content-type': 'application/x-www-form-urlencoded' } : {}),
+            },
+            ...(fields ? { body: new URLSearchParams(fields).toString() } : {}),
+            redirect: 'error',
+            signal: AbortSignal.timeout(8_000),
+        });
+    }
+    async number() {
+        const response = await this.request(`/IncomingPhoneNumbers/${this.asset.phoneNumberSid}.json`);
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new ChannelError('provider_unavailable');
+        }
+        const parsed = numberSchema.safeParse(await boundedJson(response));
+        if (!parsed.success)
+            throw new ChannelError('provider_response_invalid');
+        const number = parsed.data;
+        if (number.sid !== this.asset.phoneNumberSid ||
+            number.account_sid !== this.asset.accountSid ||
+            number.phone_number !== this.asset.phoneNumber)
+            throw new ChannelError('asset_mismatch');
+        return number;
+    }
+    async health() {
+        const number = await this.number();
+        const response = await this.request('.json');
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new ChannelError('provider_unavailable');
+        }
+        const account = z
+            .object({ sid: z.string(), status: z.string() })
+            .safeParse(await boundedJson(response));
+        if (!account.success || account.data.sid !== this.asset.accountSid)
+            throw new ChannelError('asset_mismatch');
+        const canSend = number.capabilities.sms && account.data.status === 'active';
+        return {
+            assetId: number.sid,
+            canSend,
+            status: canSend ? 'AVAILABLE' : 'BLOCKED',
+        };
+    }
+    async inspectWebhook(url) {
+        const number = await this.number();
+        return {
+            matches: number.sms_url === url && number.sms_method === 'POST' && !number.sms_application_sid,
+            authenticated: true,
+        };
+    }
+    async configureWebhook(url) {
+        const number = await this.number();
+        if (number.sms_application_sid ||
+            (number.sms_url &&
+                number.sms_url !== url &&
+                number.sms_url !== 'https://demo.twilio.com/welcome/sms/reply'))
+            throw new ChannelError('webhook_ownership_conflict');
+        const response = await this.request(`/IncomingPhoneNumbers/${this.asset.phoneNumberSid}.json`, {
+            SmsUrl: url,
+            SmsMethod: 'POST',
+        });
+        await response.body?.cancel();
+        if (!response.ok)
+            throw new ChannelError('webhook_configuration_failed');
+    }
+    async setBlocked() {
+        return { state: 'error', code: 'provider_block_unsupported' };
+    }
+    async send(input) {
+        if (input.to.kind !== 'phone' ||
+            !phone.safeParse(input.to.value).success ||
+            !input.text ||
+            input.text.length > 600)
+            return { state: 'failed', code: 'reply_invalid' };
+        try {
+            const response = await this.request('/Messages.json', {
+                From: this.asset.phoneNumber,
+                To: input.to.value,
+                Body: input.text,
+                StatusCallback: `${this.callback}/status`,
+                ValidityPeriod: '300',
+            });
+            if (!response.ok) {
+                await response.body?.cancel();
+                return {
+                    state: response.status >= 500 || response.status === 408 ? 'unknown' : 'failed',
+                    code: `provider_http_${response.status}`,
+                };
+            }
+            const parsed = z.object({ sid: messageId }).safeParse(await boundedJson(response));
+            return parsed.success
+                ? { state: 'accepted', providerMessageId: parsed.data.sid }
+                : { state: 'unknown', code: 'provider_receipt_invalid' };
+        }
+        catch {
+            return { state: 'unknown', code: 'provider_outcome_unknown' };
+        }
+    }
+    /** Twilio callbacks lack a creation timestamp. Read the immutable resource timestamp so retries
+     * deduplicate identically and a signed callback cannot revive a message after retention expires. */
+    async receive(sid) {
+        if (!messageId.safeParse(sid).success)
+            throw new ChannelError('message_invalid');
+        const response = await this.request(`/Messages/${sid}.json`);
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new ChannelError('provider_unavailable');
+        }
+        const parsed = z
+            .object({
+            sid: messageId,
+            account_sid: z.string(),
+            direction: z.string(),
+            from: phone,
+            to: phone,
+            body: z.string().max(16_384),
+            num_media: z.string(),
+            date_created: z.string(),
+        })
+            .safeParse(await boundedJson(response));
+        if (!parsed.success)
+            throw new ChannelError('provider_response_invalid');
+        const value = parsed.data;
+        if (value.sid !== sid ||
+            value.account_sid !== this.asset.accountSid ||
+            value.to !== this.asset.phoneNumber ||
+            value.direction !== 'inbound')
+            throw new ChannelError('message_asset_mismatch');
+        const eventAt = Date.parse(value.date_created);
+        if (!Number.isSafeInteger(eventAt))
+            throw new ChannelError('timestamp_invalid');
+        const word = value.body.trim().toUpperCase();
+        const control = [
+            'STOP',
+            'STOPALL',
+            'UNSUBSCRIBE',
+            'CANCEL',
+            'END',
+            'QUIT',
+            'REVOKE',
+            'OPTOUT',
+        ].includes(word)
+            ? 'stop'
+            : ['START', 'UNSTOP'].includes(word)
+                ? 'start'
+                : ['HELP', 'INFO'].includes(word)
+                    ? 'help'
+                    : undefined;
+        return {
+            providerId: sid,
+            address: { kind: 'phone', value: value.from },
+            eventAt,
+            ...(value.num_media === '0' && value.body ? { text: value.body } : {}),
+            ...(control ? { control } : {}),
+        };
+    }
+}
+//# sourceMappingURL=twilio-sms.js.map

package/node_modules/@noodle-borg/service/dist/channels/twilio-webhook.js

@@ -0,0 +1,16 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+/** Twilio's documented form signature: the exact public URL plus every sorted POST parameter.
+ * Duplicate parameters are rejected before this boundary; unknown provider fields stay signed. */
+export function verifyTwilioSignature(url, params, signature, token) {
+    if (typeof signature !== 'string' || !/^[A-Za-z0-9+/]{27}=$/.test(signature))
+        return false;
+    const payload = url +
+        [...params.keys()]
+            .sort()
+            .map((key) => key + params.get(key))
+            .join('');
+    const expected = createHmac('sha1', token).update(payload).digest();
+    const provided = Buffer.from(signature, 'base64');
+    return provided.length === expected.length && timingSafeEqual(provided, expected);
+}
+//# sourceMappingURL=twilio-webhook.js.map

package/node_modules/@noodle-borg/service/dist/conversation-history/contracts.js

@@ -10,6 +10,7 @@ export const ALL_CONVERSATION_SOURCES = {
     signed_in_customers: true,
     whatsapp: true,
     instagram: true,
+    sms: true,
 };
 /**
  * The latest expiry a shorter window allows an item from `at`; Off (0 days) ends every item now. The

package/node_modules/@noodle-borg/service/dist/routes/business-information-channels.js

@@ -59,9 +59,10 @@ export async function projectBusinessChannels(installation, canEdit, base, deps)
     };
     const registered = await deps.registry.getActiveByTenant(tenant);
     const target = registered && (await resolveTargetOrigins(registered));
-    const [whatsapp, instagram] = await Promise.all([
+    const [whatsapp, instagram, sms] = await Promise.all([
         deps.readMessaging?.(tenant, 'whatsapp'),
         deps.readMessaging?.(tenant, 'instagram'),
+        deps.readMessaging?.(tenant, 'sms'),
     ]);
     // Pausing agent channels pauses every messaging channel with them.
     const intake = (view) => installation.intakeActive ? view : { ...view, status: 'paused' };
@@ -74,6 +75,7 @@ export async function projectBusinessChannels(installation, canEdit, base, deps)
             : {}),
         ...(whatsapp ? { whatsapp: intake(whatsapp) } : {}),
         ...(instagram ? { instagram: intake(instagram) } : {}),
+        ...(sms ? { sms: intake(sms) } : {}),
     };
     if (!target?.deploymentId)
         return {

package/node_modules/@noodle-borg/service/dist/routes/service-probes.js

@@ -28,6 +28,7 @@ function handleServiceProbe(req, res, url, { tls, moduleHost, buildInfo, options
         applySecurityHeaders(res, tls);
         return sendJson(res, 200, serviceInfoPayload(buildInfo, options.developerMcp === true, {
             whatsapp: whatsapp !== undefined,
+            sms: whatsapp !== undefined,
             instagram: whatsapp?.options.meta !== undefined,
         }));
     }