@rubytech/create-sitedesk-code 0.1.518 → 0.1.519

package/payload/server/chunk-TIIWMF5G.js

@@ -0,0 +1,4837 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  ACCOUNTS_DIR,
+  LID_MAP_FILE,
+  MAXY_DIR,
+  ensureConversation,
+  getSession,
+  getUserTimezone,
+  isValidAccountId
+} from "./chunk-PXNY2TAP.js";
+
+// app/lib/whatsapp/schema.ts
+import { z } from "zod";
+var DmPolicySchema = z.enum(["open", "allowlist", "disabled"]);
+var WhatsAppAccountSchema = z.object({
+  name: z.string().optional().describe("Display name for this WhatsApp account (e.g. 'Main', 'Sales')."),
+  enabled: z.boolean().optional().describe("If disabled, this account won't connect on startup."),
+  dmPolicy: DmPolicySchema.optional().describe("Who can message your public agent via WhatsApp DM. 'Open' lets anyone message. 'Allowlist' restricts to approved phone numbers. 'Disabled' blocks all public messages."),
+  selfChatMode: z.boolean().optional().describe("Enable if the bot uses the owner's personal WhatsApp number (same phone for admin and bot). Changes how self-messages are routed."),
+  adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone."),
+  allowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to message the public agent when DM policy is 'allowlist'. Add '*' for open access. Does not affect admin routing \u2014 use adminPhones for that."),
+  sendReadReceipts: z.boolean().optional().default(true).describe("Whether to send read receipts (blue ticks) when messages are received. Disabling may feel less responsive but preserves privacy."),
+  ackReaction: z.object({
+    emoji: z.string().optional(),
+    direct: z.boolean().optional().default(true),
+    group: z.enum(["always", "mentions", "never"]).optional().default("mentions")
+  }).strict().optional().describe("React to incoming messages with an emoji to acknowledge receipt before the agent responds."),
+  debounceMs: z.number().int().nonnegative().optional().default(2e3).describe("Wait this many milliseconds after the last message before processing, to batch rapid multi-message input into a single agent turn. Default 2000ms catches most multi-message bursts. 0 means process each message immediately."),
+  publicAgent: z.string().optional().describe("Slug of the public agent that handles WhatsApp inbound from non-admin phones for this account. Overrides the top-level publicAgent when set."),
+  afterHoursMessage: z.string().optional().describe("Auto-reply text sent to public senders when the business is closed (outside opening hours). If not set, messages received outside business hours are silently skipped with no reply."),
+  dispatchInbound: z.boolean().optional().describe("When false, this account's WhatsApp socket only observes: inbound is stored and readable but never dispatched to an agent. Default true. Set with set-dispatch-inbound.")
+}).strict().superRefine((value, ctx) => {
+  if (value.dmPolicy !== "open") return;
+  const allow = (value.allowFrom ?? []).map((v) => String(v).trim()).filter(Boolean);
+  if (allow.includes("*")) return;
+  ctx.addIssue({
+    code: z.ZodIssueCode.custom,
+    path: ["allowFrom"],
+    message: 'dmPolicy="open" requires allowFrom to include "*"'
+  });
+});
+var WhatsAppConfigSchema = z.object({
+  accounts: z.record(z.string(), WhatsAppAccountSchema.optional()).optional().describe("Per-account config keyed by account ID."),
+  dmPolicy: DmPolicySchema.optional().default("disabled").describe("Who can message your public agent via WhatsApp DM. 'Open' lets anyone message. 'Allowlist' restricts to approved phone numbers. 'Disabled' blocks all public messages."),
+  adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone. Authoritative only on the account that owns the WhatsApp paired socket; a list on any other account is inert and purged at boot \u2014 use accountManagers for sub-account routing."),
+  accountManagers: z.record(
+    z.string(),
+    z.union([
+      z.string(),
+      z.object({ managesAccount: z.string(), mode: z.enum(["active", "passive"]).optional() })
+    ])
+  ).optional().describe("Account-manager bindings: E.164 phone \u2192 sub-account. The value is a bare sub-account UUID (mode 'active', the default: a full admin session) or { managesAccount, mode } where mode 'passive' selects a constrained requirement-intake spawn (only work-create, no reply). A bare string and an object without mode both resolve to 'active'. Managed via add-account-manager / remove-account-manager. A phone here must not also be in adminPhones. Read only from the account whose account.json the manager loads its config from (the house); add-account-manager is refused on any other account, and a map left there is inert and purged at boot."),
+  allowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to message the public agent when DM policy is 'allowlist'. Add '*' for open access. Does not affect admin routing \u2014 use adminPhones for that."),
+  sendReadReceipts: z.boolean().optional().default(true).describe("Whether to send read receipts (blue ticks) when messages are received. Disabling may feel less responsive but preserves privacy."),
+  mediaMaxMb: z.number().int().positive().optional().default(50).describe("Maximum file size in MB for media the agent will download and process."),
+  textChunkLimit: z.number().int().positive().optional().default(4e3).describe("Maximum characters per outbound message. Longer replies are split into multiple messages."),
+  debounceMs: z.number().int().nonnegative().optional().default(2e3).describe("Wait this many milliseconds after the last message before processing, to batch rapid multi-message input into a single agent turn. Default 2000ms catches most multi-message bursts. 0 means process each message immediately."),
+  publicAgent: z.string().optional().describe("Slug of the public agent that handles WhatsApp inbound from non-admin phones. Per-account overrides take precedence."),
+  afterHoursMessage: z.string().optional().describe("Default auto-reply text sent to public senders when the business is closed (outside opening hours). Per-account overrides take precedence. If not set, messages received outside business hours are silently skipped.")
+}).strict().superRefine((value, ctx) => {
+  if (value.dmPolicy !== "open") return;
+  const allow = (value.allowFrom ?? []).map((v) => String(v).trim()).filter(Boolean);
+  if (allow.includes("*")) return;
+  ctx.addIssue({
+    code: z.ZodIssueCode.custom,
+    path: ["allowFrom"],
+    message: 'dmPolicy="open" requires allowFrom to include "*"'
+  });
+});
+function parseWhatsAppConfigTolerant(raw) {
+  const first = WhatsAppConfigSchema.safeParse(raw);
+  if (first.success) {
+    return { ok: true, data: first.data, droppedKeys: [] };
+  }
+  const issues = first.error.issues;
+  const onlyUnknownKeys = issues.length > 0 && issues.every((i) => i.code === "unrecognized_keys");
+  if (!onlyUnknownKeys) {
+    return { ok: false, error: first.error };
+  }
+  const clone = JSON.parse(JSON.stringify(raw));
+  const droppedKeys = [];
+  for (const issue of issues) {
+    if (issue.code !== "unrecognized_keys") continue;
+    const container = issue.path.reduce(
+      (acc, seg) => acc && typeof acc === "object" ? acc[seg] : void 0,
+      clone
+    );
+    if (!container || typeof container !== "object") continue;
+    for (const key of issue.keys) {
+      delete container[key];
+      droppedKeys.push([...issue.path, key].join("."));
+    }
+  }
+  const second = WhatsAppConfigSchema.safeParse(clone);
+  if (second.success) {
+    return { ok: true, data: second.data, droppedKeys };
+  }
+  return { ok: false, error: second.error };
+}
+
+// app/lib/whatsapp/auth-store.ts
+import fsSync from "fs";
+import fs from "fs/promises";
+import path from "path";
+import os from "os";
+var TAG = "[whatsapp:auth]";
+function resolveAuthDir(configDir2, accountId) {
+  return path.join(os.homedir(), configDir2, "credentials", "whatsapp", accountId);
+}
+function resolveCredsPath(authDir) {
+  return path.join(authDir, "creds.json");
+}
+function resolveCredsBackupPath(authDir) {
+  return path.join(authDir, "creds.json.bak");
+}
+function hasCredsSync(authDir) {
+  try {
+    const stats = fsSync.statSync(resolveCredsPath(authDir));
+    return stats.isFile() && stats.size > 1;
+  } catch {
+    return false;
+  }
+}
+async function authExists(authDir) {
+  const credsPath = resolveCredsPath(authDir);
+  try {
+    await fs.access(authDir);
+  } catch {
+    return false;
+  }
+  try {
+    const stats = await fs.stat(credsPath);
+    if (!stats.isFile() || stats.size <= 1) return false;
+    const raw = await fs.readFile(credsPath, "utf-8");
+    JSON.parse(raw);
+    return true;
+  } catch (err) {
+    console.warn(`${TAG} credential validation failed path=${credsPath}: ${String(err)}`);
+    return false;
+  }
+}
+function readCredsJsonRaw(filePath) {
+  try {
+    if (!fsSync.existsSync(filePath)) return null;
+    const stats = fsSync.statSync(filePath);
+    if (!stats.isFile() || stats.size <= 1) return null;
+    return fsSync.readFileSync(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function maybeRestoreCredsFromBackup(authDir) {
+  try {
+    const credsPath = resolveCredsPath(authDir);
+    const backupPath = resolveCredsBackupPath(authDir);
+    const raw = readCredsJsonRaw(credsPath);
+    if (raw) {
+      JSON.parse(raw);
+      return;
+    }
+    const backupRaw = readCredsJsonRaw(backupPath);
+    if (!backupRaw) return;
+    JSON.parse(backupRaw);
+    fsSync.copyFileSync(backupPath, credsPath);
+    console.error(`${TAG} restored corrupted creds.json from backup in ${authDir}`);
+  } catch (err) {
+    console.warn(`${TAG} credential restore failed authDir=${authDir}: ${String(err)}`);
+  }
+}
+function readSelfId(authDir) {
+  try {
+    const credsPath = resolveCredsPath(authDir);
+    if (!fsSync.existsSync(credsPath)) return { e164: null, jid: null, lid: null };
+    const raw = fsSync.readFileSync(credsPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    const jid = parsed?.me?.id ?? null;
+    const lidRaw = parsed?.me?.lid ?? null;
+    let e164 = null;
+    if (jid) {
+      const match = jid.match(/^(\d+)(?::\d+)?@s\.whatsapp\.net$/i);
+      if (match) e164 = match[1];
+    }
+    let lid = null;
+    if (lidRaw) {
+      const lidMatch = lidRaw.match(/^(\d+)(?::\d+)?@lid$/i);
+      if (lidMatch) lid = `${lidMatch[1]}@lid`;
+    }
+    return { e164, jid, lid };
+  } catch (err) {
+    console.warn(`${TAG} readSelfId failed authDir=${authDir}: ${String(err)}`);
+    return { e164: null, jid: null, lid: null };
+  }
+}
+function credsCensus(authDir) {
+  const raw = readCredsJsonRaw(resolveCredsPath(authDir));
+  if (!raw) return { credsPresent: false, registered: false, hasAccountSignature: false, e164: null };
+  try {
+    const parsed = JSON.parse(raw);
+    const registered = parsed?.registered === true;
+    const hasAccountSignature = parsed?.account != null;
+    let e164 = null;
+    const jid = parsed?.me?.id;
+    if (jid) {
+      const match = jid.match(/^(\d+)(?::\d+)?@s\.whatsapp\.net$/i);
+      if (match) e164 = match[1];
+    }
+    return { credsPresent: true, registered, hasAccountSignature, e164 };
+  } catch {
+    return { credsPresent: true, registered: false, hasAccountSignature: false, e164: null };
+  }
+}
+function getAuthAgeMs(authDir) {
+  try {
+    const stats = fsSync.statSync(resolveCredsPath(authDir));
+    return Date.now() - stats.mtimeMs;
+  } catch {
+    return null;
+  }
+}
+async function clearAuth(authDir) {
+  try {
+    await fs.access(authDir);
+  } catch {
+    console.error(`${TAG} no auth dir found at ${authDir}`);
+    return false;
+  }
+  await fs.rm(authDir, { recursive: true, force: true });
+  console.error(`${TAG} cleared credentials at ${authDir}`);
+  return true;
+}
+function discardAuthDirSync(authDir) {
+  try {
+    if (!fsSync.existsSync(authDir)) return false;
+    fsSync.rmSync(authDir, { recursive: true, force: true });
+    console.error(`${TAG} discarded credential dir ${authDir}`);
+    return true;
+  } catch (err) {
+    console.warn(`${TAG} discardAuthDirSync failed authDir=${authDir}: ${String(err)}`);
+    return false;
+  }
+}
+function listCredentialAccountIds(configDir2) {
+  const credsRoot = path.join(os.homedir(), configDir2, "credentials", "whatsapp");
+  try {
+    const entries = fsSync.readdirSync(credsRoot, { withFileTypes: true });
+    return entries.filter((e) => e.isDirectory() && hasCredsSync(path.join(credsRoot, e.name))).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
+
+// app/lib/whatsapp/session.ts
+import { randomUUID } from "crypto";
+import fsSync2 from "fs";
+import fs3 from "fs/promises";
+import { inspect } from "util";
+import {
+  Browsers,
+  DisconnectReason,
+  fetchLatestBaileysVersion,
+  makeCacheableSignalKeyStore,
+  makeWASocket,
+  useMultiFileAuthState
+} from "@whiskeysockets/baileys";
+import { createRequire } from "module";
+
+// app/lib/whatsapp/baileys-debug-window.ts
+import fs2 from "fs";
+import path2 from "path";
+var TAG2 = "[whatsapp:session]";
+var SENTINEL_BASENAME = "baileys-debug-until";
+var STAT_INTERVAL_MS = 1e3;
+var VALID_LEVELS = /* @__PURE__ */ new Set(["trace", "debug", "info"]);
+var INACTIVE = { active: false, level: "warn" };
+var cache = /* @__PURE__ */ new Map();
+function sentinelPath(authDir) {
+  return path2.join(authDir, SENTINEL_BASENAME);
+}
+function readSentinel(authDir, nowMs) {
+  let raw;
+  try {
+    raw = fs2.readFileSync(sentinelPath(authDir), "utf-8");
+  } catch {
+    return { state: INACTIVE, deadlineMs: null };
+  }
+  const line = raw.split("\n", 1)[0].trim();
+  if (!line) return { state: INACTIVE, deadlineMs: null };
+  const tokens = line.split(/\s+/);
+  const deadlineMs = Date.parse(tokens[0]);
+  if (Number.isNaN(deadlineMs) || deadlineMs <= nowMs) {
+    return { state: INACTIVE, deadlineMs: null };
+  }
+  let level = "trace";
+  if (tokens.length > 1) {
+    if (!VALID_LEVELS.has(tokens[1])) return { state: INACTIVE, deadlineMs: null };
+    level = tokens[1];
+  }
+  return { state: { active: true, level }, deadlineMs };
+}
+function resolveDebugWindow(authDir, nowMs = Date.now()) {
+  if (!authDir) return INACTIVE;
+  const prev = cache.get(authDir);
+  if (prev && nowMs - prev.checkedAtMs < STAT_INTERVAL_MS) {
+    return prev.state;
+  }
+  const { state, deadlineMs } = readSentinel(authDir, nowMs);
+  const wasActive = prev?.state.active ?? false;
+  if (!wasActive && state.active) {
+    console.error(
+      `${TAG2} op=baileys-debug-window-open account=${path2.basename(authDir)} level=${state.level} until=${new Date(deadlineMs).toISOString()}`
+    );
+  } else if (wasActive && !state.active) {
+    console.error(
+      `${TAG2} op=baileys-debug-window-close account=${path2.basename(authDir)}`
+    );
+  }
+  cache.set(authDir, { checkedAtMs: nowMs, state });
+  return state;
+}
+
+// app/lib/whatsapp/ingest-ledger.ts
+import { existsSync, mkdirSync, appendFileSync, readFileSync, writeFileSync, readdirSync } from "fs";
+import { join } from "path";
+var TAG3 = "[wa-ingest-ledger]";
+var LEDGER_ROOT = () => join(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-ingest-ledger");
+var ensuredRoots = /* @__PURE__ */ new Set();
+function ledgerFilePath(account) {
+  const root = LEDGER_ROOT();
+  if (!ensuredRoots.has(root)) {
+    if (!existsSync(root)) mkdirSync(root, { recursive: true });
+    ensuredRoots.add(root);
+  }
+  return join(root, `${account}.jsonl`);
+}
+function appendStanza(entry) {
+  try {
+    const row = {
+      msgId: entry.msgId,
+      from: entry.from,
+      type: entry.type,
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    appendFileSync(ledgerFilePath(entry.account), JSON.stringify(row) + "\n");
+  } catch (err) {
+    console.error(
+      `${TAG3} FAIL op=append msgId=${entry.msgId} err=${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function markDeclined(entry) {
+  try {
+    const row = {
+      declined: entry.msgId,
+      reason: entry.reason,
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    appendFileSync(ledgerFilePath(entry.account), JSON.stringify(row) + "\n");
+  } catch (err) {
+    console.error(
+      `${TAG3} FAIL op=decline msgId=${entry.msgId} err=${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function readDeclined(account) {
+  const path3 = ledgerFilePath(account);
+  const out = /* @__PURE__ */ new Set();
+  if (!existsSync(path3)) return out;
+  for (const line of readFileSync(path3, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const row = JSON.parse(line);
+      if (typeof row.declined === "string") out.add(row.declined);
+    } catch {
+    }
+  }
+  return out;
+}
+function appendNotifyEligible(entry) {
+  try {
+    const row = {
+      notifyEligible: entry.msgId,
+      upsertType: entry.upsertType,
+      fromMe: entry.fromMe,
+      allowed: entry.allowed,
+      reason: entry.reason,
+      passive: entry.passive,
+      persistAccount: entry.persistAccount,
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    appendFileSync(ledgerFilePath(entry.account), JSON.stringify(row) + "\n");
+  } catch (err) {
+    console.error(
+      `${TAG3} FAIL op=append-notify-eligible msgId=${entry.msgId} err=${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function appendNotifyPublished(entry) {
+  try {
+    const row = {
+      notifyPublished: entry.msgId,
+      subscribers: entry.subscribers,
+      ts: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    appendFileSync(ledgerFilePath(entry.account), JSON.stringify(row) + "\n");
+  } catch (err) {
+    console.error(
+      `${TAG3} FAIL op=append-notify-published msgId=${entry.msgId} err=${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function readNotifyRows(account) {
+  const path3 = ledgerFilePath(account);
+  const out = {
+    eligible: [],
+    published: []
+  };
+  if (!existsSync(path3)) return out;
+  for (const line of readFileSync(path3, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const row = JSON.parse(line);
+      if (typeof row.notifyEligible === "string") {
+        out.eligible.push(row);
+      } else if (typeof row.notifyPublished === "string") {
+        out.published.push(row);
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+function readLedger(account) {
+  const path3 = ledgerFilePath(account);
+  if (!existsSync(path3)) return [];
+  const out = [];
+  for (const line of readFileSync(path3, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const row = JSON.parse(line);
+      if (row && typeof row.msgId === "string") out.push(row);
+    } catch {
+    }
+  }
+  return out;
+}
+function pruneLedger(account, olderThanMs) {
+  const path3 = ledgerFilePath(account);
+  if (!existsSync(path3)) return 0;
+  const lines = readFileSync(path3, "utf8").split("\n").filter((l) => l.trim());
+  const cutoff = Date.now() - olderThanMs;
+  const kept = lines.filter((line) => {
+    try {
+      const row = JSON.parse(line);
+      const t = typeof row.ts === "string" ? Date.parse(row.ts) : NaN;
+      return Number.isFinite(t) && t >= cutoff;
+    } catch {
+      return false;
+    }
+  });
+  if (kept.length === lines.length) return 0;
+  writeFileSync(path3, kept.join("\n") + (kept.length ? "\n" : ""));
+  return lines.length - kept.length;
+}
+function listLedgerAccounts() {
+  const root = LEDGER_ROOT();
+  if (!existsSync(root)) return [];
+  try {
+    return readdirSync(root).filter((f) => f.endsWith(".jsonl")).map((f) => f.slice(0, -".jsonl".length));
+  } catch {
+    return [];
+  }
+}
+
+// app/lib/whatsapp/session.ts
+var TAG4 = "[whatsapp:session]";
+var WIRE_TAG = "[whatsapp:wire]";
+var baileysPkgVersion = (() => {
+  try {
+    const req = createRequire(import.meta.url);
+    return req("@whiskeysockets/baileys/package.json").version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+})();
+console.error(`${TAG4} baileys package loaded version=${baileysPkgVersion}`);
+var __BAILEYS_TAG = "[whatsapp:baileys]";
+var INSPECT_OPTS = {
+  depth: null,
+  breakLength: Infinity,
+  compact: true,
+  maxArrayLength: 100,
+  maxStringLength: 1e4
+};
+function serializeArg(arg) {
+  if (typeof arg === "string") return arg;
+  try {
+    return inspect(arg, INSPECT_OPTS);
+  } catch (err) {
+    return `[inspect-failed: ${String(err)}]`;
+  }
+}
+function bindingsToPrefix(bindings) {
+  const parts = [];
+  for (const [key, value] of Object.entries(bindings)) {
+    const rendered = typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? String(value) : serializeArg(value);
+    parts.push(`${key}=${rendered}`);
+  }
+  return parts.join(" ");
+}
+var LEVEL_RANK = { trace: 10, debug: 20, info: 30 };
+function createBaileysLogger(bindings = {}, authDir) {
+  const prefix = Object.keys(bindings).length > 0 ? bindingsToPrefix(bindings) : "";
+  const emit = (level, args) => {
+    const serialized = args.map(serializeArg).join(" ");
+    if (prefix) {
+      console.error(__BAILEYS_TAG, level, prefix, serialized);
+    } else {
+      console.error(__BAILEYS_TAG, level, serialized);
+    }
+  };
+  const emitIfWindowed = (rank, level, args) => {
+    const w = resolveDebugWindow(authDir);
+    if (w.active && rank >= LEVEL_RANK[w.level]) {
+      emit(level, args);
+    }
+  };
+  return {
+    // Live getter: Baileys reads config.logger.level per-frame and (verified on
+    // the pinned version) never shallow-copies the logger, so the window's level
+    // reaches socket.js:449/465 as it changes. A Baileys that spread the logger
+    // would freeze this to one value — revisit on upgrade.
+    get level() {
+      return resolveDebugWindow(authDir).level;
+    },
+    trace: (...args) => emitIfWindowed(LEVEL_RANK.trace, "TRACE", args),
+    debug: (...args) => emitIfWindowed(LEVEL_RANK.debug, "DEBUG", args),
+    info: (...args) => emitIfWindowed(LEVEL_RANK.info, "INFO", args),
+    warn: (...args) => emit("WARN", args),
+    error: (...args) => emit("ERROR", args),
+    fatal: (...args) => emit("FATAL", args),
+    child: (childBindings) => createBaileysLogger({ ...bindings, ...childBindings ?? {} }, authDir)
+  };
+}
+var credsSaveQueue = Promise.resolve();
+async function drainCredsSaveQueue(timeoutMs = 5e3) {
+  console.error(`${TAG4} draining credential save queue\u2026`);
+  const timer = new Promise(
+    (resolve6) => setTimeout(() => resolve6("timeout"), timeoutMs)
+  );
+  const result = await Promise.race([
+    credsSaveQueue.then(() => "drained"),
+    timer
+  ]);
+  if (result === "timeout") {
+    console.error(`${TAG4} credential save queue drain timed out after ${timeoutMs}ms`);
+  } else {
+    console.error(`${TAG4} credential save queue drained`);
+  }
+}
+function readCredsJsonRaw2(filePath) {
+  try {
+    if (!fsSync2.existsSync(filePath)) return null;
+    const stats = fsSync2.statSync(filePath);
+    if (!stats.isFile() || stats.size <= 1) return null;
+    return fsSync2.readFileSync(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+async function safeSaveCreds(authDir, saveCreds) {
+  try {
+    const credsPath = resolveCredsPath(authDir);
+    const backupPath = resolveCredsBackupPath(authDir);
+    const raw = readCredsJsonRaw2(credsPath);
+    if (raw) {
+      try {
+        JSON.parse(raw);
+        fsSync2.copyFileSync(credsPath, backupPath);
+      } catch (err) {
+        console.warn(`${TAG4} backup pre-copy failed (parse or write) authDir=${authDir}: ${String(err)}`);
+      }
+    }
+  } catch (err) {
+    console.warn(`${TAG4} backup preparation failed authDir=${authDir}: ${String(err)}`);
+  }
+  try {
+    await Promise.resolve(saveCreds());
+    const credsPath = resolveCredsPath(authDir);
+    try {
+      const stats = await fs3.stat(credsPath);
+      if (stats.size <= 1) {
+        console.error(`${TAG4} WARNING: creds file empty/truncated after save path=${credsPath} size=${stats.size}`);
+      } else {
+        console.error(`${TAG4} creds saved and verified path=${credsPath} size=${stats.size}`);
+      }
+    } catch (statErr) {
+      console.error(`${TAG4} creds NOT found on disk after save path=${credsPath}: ${String(statErr)}`);
+    }
+  } catch (err) {
+    console.error(`${TAG4} failed saving creds to ${authDir}: ${String(err)}`);
+  }
+}
+function enqueueSaveCreds(authDir, saveCreds) {
+  credsSaveQueue = credsSaveQueue.then(() => safeSaveCreds(authDir, saveCreds)).catch((err) => {
+    console.error(`${TAG4} creds save queue error: ${String(err)}`);
+  });
+}
+async function createWaSocket(opts) {
+  const { authDir, onQr, onConnectionUpdate, silent, correlationId, account, getCodeIssuedTs } = opts;
+  const cid = correlationId ?? "none";
+  const acct = account ?? "unknown";
+  await fs3.mkdir(authDir, { recursive: true });
+  maybeRestoreCredsFromBackup(authDir);
+  const { state, saveCreds } = await useMultiFileAuthState(authDir);
+  const { version } = await fetchLatestBaileysVersion();
+  if (!silent) {
+    const preCensus = credsCensus(authDir);
+    console.error(
+      `${TAG4} op=creds-pre cid=${cid} account=${acct} credsPresent=${preCensus.credsPresent} registered=${preCensus.registered} hasAccount=${preCensus.hasAccountSignature}`
+    );
+  }
+  const openTs = Date.now();
+  console.error(
+    `${TAG4} op=socket-open cid=${cid} account=${acct} baileysVersion=${baileysPkgVersion} waProtocolVersion=${version.join(".")} openTs=${openTs}`
+  );
+  const baileysLogger = createBaileysLogger({}, authDir);
+  const sock = makeWASocket({
+    auth: {
+      creds: state.creds,
+      keys: makeCacheableSignalKeyStore(state.keys, baileysLogger)
+    },
+    version,
+    logger: baileysLogger,
+    printQRInTerminal: false,
+    browser: Browsers.macOS("Chrome"),
+    syncFullHistory: false,
+    markOnlineOnConnect: false,
+    fireInitQueries: false
+  });
+  sock.ev.on("creds.update", () => {
+    console.error(`${TAG4} creds.update received \u2014 saving to ${authDir}`);
+    enqueueSaveCreds(authDir, saveCreds);
+  });
+  let qrSequence = 0;
+  let everOpen = false;
+  let lastQrTs = 0;
+  let pairSuccessLogged = false;
+  sock.ev.on("connection.update", (update) => {
+    try {
+      const parts = [];
+      if (update.connection) parts.push(`connection=${update.connection}`);
+      if (update.qr) parts.push(`qr=#${++qrSequence}`);
+      if (update.isNewLogin !== void 0) parts.push(`isNewLogin=${update.isNewLogin}`);
+      if (update.receivedPendingNotifications !== void 0) parts.push(`pendingNotifications=${update.receivedPendingNotifications}`);
+      if (update.connection === "close" && update.lastDisconnect) {
+        const status = getStatusCode(update.lastDisconnect.error);
+        parts.push(`disconnectStatus=${status ?? "unknown"}`);
+        parts.push(`disconnectReason=${formatError(update.lastDisconnect.error)}`);
+      }
+      if (!silent && parts.length > 0) {
+        console.error(`${TAG4} connection.update ${parts.join(" ")}`);
+      }
+      if (update.qr && !silent) {
+        const now = Date.now();
+        const sinceLastRefMs = lastQrTs ? now - lastQrTs : null;
+        lastQrTs = now;
+        console.error(
+          `${TAG4} op=qr cid=${cid} qr=#${qrSequence} sinceOpenMs=${now - openTs} sinceLastRefMs=${sinceLastRefMs ?? "n/a"}`
+        );
+      }
+      if (update.isNewLogin === true && !pairSuccessLogged && !silent) {
+        pairSuccessLogged = true;
+        const codeIssuedTs = getCodeIssuedTs?.();
+        const sinceCodeIssuedMs = codeIssuedTs ? Date.now() - codeIssuedTs : null;
+        const afterCensus = credsCensus(authDir);
+        console.error(
+          `${TAG4} op=pair-success cid=${cid} account=${acct} sinceCodeIssuedMs=${sinceCodeIssuedMs ?? "n/a"} hasAccountAfter=${afterCensus.hasAccountSignature}`
+        );
+      }
+      if (update.qr && onQr) {
+        onQr(update.qr);
+      }
+      if (update.connection === "close") {
+        const status = getStatusCode(update.lastDisconnect?.error);
+        if (!silent) {
+          console.error(
+            `${TAG4} op=close cid=${cid} account=${acct} status=${status ?? "unknown"} reason="${formatError(update.lastDisconnect?.error)}" socketLifeMs=${Date.now() - openTs} kind=${closeKind(status, everOpen)}`
+          );
+        }
+        if (status === DisconnectReason.loggedOut && !silent) {
+          console.error(`${TAG4} session logged out (401) \u2014 re-link required`);
+        }
+      }
+      if (update.connection === "open") {
+        everOpen = true;
+        if (!silent) console.error(`${TAG4} connected`);
+      }
+      onConnectionUpdate?.(update);
+    } catch (err) {
+      console.error(`${TAG4} connection.update handler error: ${String(err)}`);
+    }
+  });
+  if (sock.ws && typeof sock.ws.on === "function") {
+    sock.ws.on("error", (err) => {
+      console.error(`${TAG4} WebSocket error: ${String(err)}`);
+    });
+    sock.ws.on("CB:message", (node) => {
+      const attrs = node?.attrs ?? {};
+      console.error(
+        `${WIRE_TAG} op=stanza msgId=${attrs.id ?? "none"} from=${attrs.from ?? "none"} type=${attrs.type ?? "none"} offline=${attrs.offline ?? "none"} account=${acct}`
+      );
+      if (attrs.id) {
+        appendStanza({
+          msgId: String(attrs.id),
+          from: String(attrs.from ?? "none"),
+          type: String(attrs.type ?? "none"),
+          account: acct
+        });
+      }
+    });
+  }
+  return sock;
+}
+async function waitForConnection(sock) {
+  return new Promise((resolve6, reject) => {
+    const handler = (update) => {
+      if (update.connection === "open") {
+        sock.ev.off("connection.update", handler);
+        resolve6();
+      }
+      if (update.connection === "close") {
+        sock.ev.off("connection.update", handler);
+        reject(update.lastDisconnect ?? new Error("Connection closed"));
+      }
+    };
+    sock.ev.on("connection.update", handler);
+  });
+}
+function getStatusCode(err) {
+  return err?.error?.output?.statusCode ?? err?.output?.statusCode ?? err?.status;
+}
+function formatError(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  if (!err || typeof err !== "object") return String(err);
+  const boom = extractBoomDetails(err) ?? extractBoomDetails(err?.error) ?? extractBoomDetails(err?.lastDisconnect?.error);
+  const status = boom?.statusCode ?? getStatusCode(err);
+  const code = err?.code;
+  const codeText = typeof code === "string" || typeof code === "number" ? String(code) : void 0;
+  const messageCandidates = [
+    boom?.message,
+    typeof err?.message === "string" ? err.message : void 0,
+    typeof err?.error?.message === "string" ? err.error.message : void 0
+  ].filter((v) => Boolean(v?.trim()));
+  const message = messageCandidates[0];
+  const pieces = [];
+  if (typeof status === "number") pieces.push(`status=${status}`);
+  if (boom?.error) pieces.push(boom.error);
+  if (message) pieces.push(message);
+  if (codeText) pieces.push(`code=${codeText}`);
+  return pieces.length > 0 ? pieces.join(" ") : String(err);
+}
+function extractBoomDetails(err) {
+  if (!err || typeof err !== "object") return null;
+  const output = err?.output;
+  if (!output || typeof output !== "object") return null;
+  const payload = output.payload;
+  const statusCode = typeof output.statusCode === "number" ? output.statusCode : typeof payload?.statusCode === "number" ? payload.statusCode : void 0;
+  const error = typeof payload?.error === "string" ? payload.error : void 0;
+  const message = typeof payload?.message === "string" ? payload.message : void 0;
+  if (!statusCode && !error && !message) return null;
+  return { statusCode, error, message };
+}
+function closeKind(status, everOpen) {
+  if (status === DisconnectReason.restartRequired) return "restart-required-515";
+  if (status === DisconnectReason.loggedOut) return "logged-out-401";
+  if (status === 408) return everOpen ? "conn-lost-408" : "qr-refs-ended-408";
+  return "other";
+}
+
+// app/lib/whatsapp/reconnect.ts
+import { DisconnectReason as DisconnectReason2 } from "@whiskeysockets/baileys";
+var STABLE_UPTIME_MS = 3e4;
+function computeReconnectNextState(input) {
+  const { reconnectAttempts, uptimeMs, stableThresholdMs, maxAttempts } = input;
+  if (uptimeMs >= stableThresholdMs) {
+    return { action: "retry", nextAttempts: 0, reason: "stable-reset" };
+  }
+  const nextAttempts = reconnectAttempts + 1;
+  if (nextAttempts >= maxAttempts) {
+    return { action: "abort", finalAttempts: maxAttempts };
+  }
+  return { action: "retry", nextAttempts, reason: "short-lived" };
+}
+function classifyDisconnect(err) {
+  const statusCode = getStatusCode(err);
+  const message = formatError(err);
+  if (statusCode === DisconnectReason2.loggedOut) {
+    return {
+      kind: "loggedOut",
+      statusCode,
+      message: "Session logged out \u2014 re-link required",
+      shouldRetry: false
+    };
+  }
+  if (statusCode === 409 || statusCode === DisconnectReason2.connectionReplaced) {
+    return {
+      kind: "conflict",
+      statusCode,
+      message: "Connection replaced by another client",
+      shouldRetry: false
+    };
+  }
+  return {
+    kind: "transient",
+    statusCode,
+    message,
+    shouldRetry: true
+  };
+}
+function computeBackoff(attempt, config = {}) {
+  const base = config.baseDelayMs ?? 2e3;
+  const max = config.maxDelayMs ?? 12e4;
+  const exponential = Math.min(base * Math.pow(2, attempt), max);
+  const jitter = exponential * (0.75 + Math.random() * 0.5);
+  return Math.round(jitter);
+}
+
+// app/lib/whatsapp/init-queries.ts
+import { inspect as inspect2 } from "util";
+
+// app/lib/whatsapp/with-timeout.ts
+function isTimeoutError(err) {
+  return Boolean(err?.__maxyTimeout);
+}
+function withTimeout(label, promise, timeoutMs) {
+  return new Promise((resolve6, reject) => {
+    const timer = setTimeout(() => {
+      const err = new Error(`${label} timed out after ${timeoutMs}ms`);
+      err.__maxyTimeout = true;
+      reject(err);
+    }, timeoutMs);
+    timer.unref?.();
+    promise.then(
+      (value) => {
+        clearTimeout(timer);
+        resolve6(value);
+      },
+      (err) => {
+        clearTimeout(timer);
+        reject(err);
+      }
+    );
+  });
+}
+
+// app/lib/whatsapp/init-queries.ts
+var TAG5 = "[whatsapp:init]";
+var DEFAULT_QUERY_TIMEOUT_MS = 15e3;
+var INSPECT_OPTS2 = {
+  depth: null,
+  breakLength: Infinity,
+  compact: true,
+  maxArrayLength: 50
+};
+function formatErr(err) {
+  if (err instanceof Error) {
+    const base = `${err.name}: ${err.message}`;
+    const inspected = inspect2(err, INSPECT_OPTS2);
+    return `${base}
+${inspected}`;
+  }
+  return inspect2(err, INSPECT_OPTS2);
+}
+async function runInitQueries(sock, ctx) {
+  const startedAt = Date.now();
+  const queryTimeoutMs = ctx.queryTimeoutMs ?? DEFAULT_QUERY_TIMEOUT_MS;
+  const result = {
+    blocklistOk: false,
+    privacySettingsOk: false,
+    aborted: false,
+    errors: {},
+    elapsedMs: 0
+  };
+  console.error(
+    `${TAG5} runInitQueries start account=${ctx.accountId} attempt=${ctx.attempt} selfPhone=${ctx.selfPhone ?? "unknown"} authDir=${ctx.authDir} queryTimeoutMs=${queryTimeoutMs}`
+  );
+  console.error(
+    `${TAG5} fetchProps SKIPPED account=${ctx.accountId} reason=no-platform-consumer`
+  );
+  if (ctx.signal?.aborted) {
+    result.aborted = true;
+    result.elapsedMs = Date.now() - startedAt;
+    console.error(
+      `${TAG5} runInitQueries aborted before start account=${ctx.accountId}`
+    );
+    return result;
+  }
+  console.error(`${TAG5} fetchBlocklist start account=${ctx.accountId}`);
+  try {
+    const blocklist = await withTimeout(
+      "fetchBlocklist",
+      sock.fetchBlocklist(),
+      queryTimeoutMs
+    );
+    const count = Array.isArray(blocklist) ? blocklist.length : 0;
+    result.blocklistOk = true;
+    console.error(
+      `${TAG5} fetchBlocklist ok account=${ctx.accountId} count=${count}`
+    );
+  } catch (err) {
+    const formatted = formatErr(err);
+    result.errors.blocklist = formatted;
+    console.error(
+      `${TAG5} fetchBlocklist FAILED account=${ctx.accountId}: ${formatted}`
+    );
+  }
+  if (ctx.signal?.aborted) {
+    result.aborted = true;
+    result.elapsedMs = Date.now() - startedAt;
+    console.error(
+      `${TAG5} runInitQueries aborted mid-sequence account=${ctx.accountId} after=fetchBlocklist`
+    );
+    return result;
+  }
+  console.error(`${TAG5} fetchPrivacySettings start account=${ctx.accountId}`);
+  try {
+    const settings = await withTimeout(
+      "fetchPrivacySettings",
+      // force=true bypasses Baileys' internal cache on first connect
+      sock.fetchPrivacySettings(true),
+      queryTimeoutMs
+    );
+    result.privacySettingsOk = true;
+    console.error(
+      `${TAG5} fetchPrivacySettings ok account=${ctx.accountId} keys=${settings ? Object.keys(settings).join(",") : ""}`
+    );
+  } catch (err) {
+    const formatted = formatErr(err);
+    result.errors.privacySettings = formatted;
+    console.error(
+      `${TAG5} fetchPrivacySettings FAILED account=${ctx.accountId}: ${formatted}`
+    );
+  }
+  result.elapsedMs = Date.now() - startedAt;
+  console.error(
+    `${TAG5} runInitQueries done account=${ctx.accountId} blocklistOk=${result.blocklistOk} privacySettingsOk=${result.privacySettingsOk} elapsedMs=${result.elapsedMs}`
+  );
+  return result;
+}
+
+// app/lib/whatsapp/normalize.ts
+var WHATSAPP_USER_JID_RE = /^(\d+)(?::\d+)?@s\.whatsapp\.net$/i;
+var WHATSAPP_LID_RE = /^(\d+)@lid$/i;
+function normalizeE164(value) {
+  let candidate = value.trim().replace(/[\s\-().]/g, "");
+  candidate = candidate.replace(/^whatsapp:/i, "");
+  if (candidate.startsWith("+")) candidate = candidate.slice(1);
+  else if (candidate.startsWith("00")) candidate = candidate.slice(2);
+  if (!/^\d+$/.test(candidate)) return "";
+  return candidate;
+}
+function toWhatsappJid(e164) {
+  const normalized = normalizeE164(e164);
+  return `${normalized}@s.whatsapp.net`;
+}
+function jidToE164(jid) {
+  const userMatch = jid.match(WHATSAPP_USER_JID_RE);
+  if (userMatch) return userMatch[1];
+  const lidMatch = jid.match(WHATSAPP_LID_RE);
+  if (lidMatch) return lidMatch[1];
+  return null;
+}
+function senderJidFromTelephone(senderTelephone) {
+  if (!senderTelephone) return null;
+  if (isGroupJid(senderTelephone)) return null;
+  if (isUserJid(senderTelephone)) return senderTelephone;
+  return null;
+}
+function isGroupJid(value) {
+  const candidate = stripWhatsAppPrefix(value);
+  const lower = candidate.toLowerCase();
+  if (!lower.endsWith("@g.us")) return false;
+  const localPart = candidate.slice(0, candidate.length - "@g.us".length);
+  if (!localPart || localPart.includes("@")) return false;
+  return /^[0-9]+(-[0-9]+)*$/.test(localPart);
+}
+function isUserJid(value) {
+  const candidate = stripWhatsAppPrefix(value);
+  return WHATSAPP_USER_JID_RE.test(candidate) || WHATSAPP_LID_RE.test(candidate);
+}
+function stripWhatsAppPrefix(value) {
+  let candidate = value.trim();
+  for (; ; ) {
+    const before = candidate;
+    candidate = candidate.replace(/^whatsapp:/i, "").trim();
+    if (candidate === before) return candidate;
+  }
+}
+function normalizeTarget(value) {
+  const candidate = stripWhatsAppPrefix(value);
+  if (!candidate) return null;
+  if (isGroupJid(candidate)) {
+    const localPart = candidate.slice(0, candidate.length - "@g.us".length);
+    return `${localPart}@g.us`;
+  }
+  if (isUserJid(candidate)) {
+    const phone = jidToE164(candidate);
+    if (!phone) return null;
+    const normalized2 = normalizeE164(phone);
+    return normalized2.length > 1 ? normalized2 : null;
+  }
+  if (candidate.includes("@")) return null;
+  const normalized = normalizeE164(candidate);
+  return normalized.length > 1 ? normalized : null;
+}
+function phonesMatch(a, b) {
+  const na = normalizeE164(a);
+  const nb = normalizeE164(b);
+  return na.length > 0 && na === nb;
+}
+function isLidJid(jid) {
+  return WHATSAPP_LID_RE.test(jid);
+}
+function withSelfLidShortcut(base, selfLid, selfJid) {
+  if (!selfLid || !selfJid) return base;
+  return {
+    getPNForLID: async (lid) => {
+      if (lid === selfLid) return selfJid;
+      try {
+        return await base?.getPNForLID(lid);
+      } catch (err) {
+        console.error(`[whatsapp:normalize] base lidMapping.getPNForLID threw lid=${lid}: ${String(err)}`);
+        return void 0;
+      }
+    }
+  };
+}
+async function resolveJidToE164(jid, lidMapping) {
+  if (!jid) return null;
+  const userMatch = jid.match(WHATSAPP_USER_JID_RE);
+  if (userMatch) return userMatch[1];
+  if (isLidJid(jid)) {
+    if (lidMapping) {
+      try {
+        const mapped = await lidMapping.getPNForLID(jid);
+        if (mapped) {
+          const phone = jidToE164(mapped);
+          if (phone) {
+            console.error(`[whatsapp:normalize] JID resolved via LID mapping jid=${jid} e164=${phone}`);
+            return phone;
+          }
+        }
+      } catch (err) {
+        console.error(`[whatsapp:normalize] LID mapping failed jid=${jid}: ${String(err)}`);
+      }
+    }
+    const lidMatch = jid.match(WHATSAPP_LID_RE);
+    if (lidMatch) {
+      console.error(`[whatsapp:normalize] LID mapping unavailable jid=${jid} using numeric=${lidMatch[1]}`);
+      return lidMatch[1];
+    }
+  }
+  return null;
+}
+async function resolveCanonicalConversationJid(remoteJid, lidMapping) {
+  if (!isLidJid(remoteJid)) return { canonical: remoteJid, resolved: "none" };
+  if (lidMapping) {
+    try {
+      const mapped = await lidMapping.getPNForLID(remoteJid);
+      if (mapped) {
+        const digits = jidToE164(mapped);
+        if (digits) return { canonical: `${digits}@s.whatsapp.net`, resolved: "lid2pn" };
+      }
+    } catch (err) {
+      console.error(`[whatsapp:normalize] canonical-jid LID mapping failed jid=${remoteJid}: ${String(err)}`);
+    }
+  }
+  return { canonical: remoteJid, resolved: "none" };
+}
+
+// app/lib/whatsapp/inbound/lid-map.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+function resolveViaLidMap(map, senderPhone) {
+  const key = normalizeE164(senderPhone);
+  if (!key) return null;
+  const mapped = map[key];
+  return mapped && mapped.length > 0 ? mapped : null;
+}
+function lidCaptureFor(senderJid, senderPhone) {
+  if (!isLidJid(senderJid)) return null;
+  const numericLid = jidToE164(senderJid);
+  if (!numericLid) return null;
+  const e164 = normalizeE164(senderPhone);
+  if (!e164 || e164 === numericLid) return null;
+  return { numericLid, e164 };
+}
+function readLidMap() {
+  try {
+    if (!existsSync2(LID_MAP_FILE)) return null;
+    const raw = readFileSync2(LID_MAP_FILE, "utf-8").trim();
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function recordLidMapping(numericLid, e164) {
+  try {
+    const key = normalizeE164(numericLid);
+    const val = normalizeE164(e164);
+    if (!key || !val) return;
+    const map = readLidMap() ?? {};
+    if (map[key] === val) return;
+    map[key] = val;
+    writeFileSync2(LID_MAP_FILE, JSON.stringify(map, null, 2));
+    console.error(`[lid-map] recorded lid=${key} userId-phone=present`);
+  } catch (err) {
+    console.error(`[lid-map] record-failed lid=${numericLid}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
+// app/lib/whatsapp/inbound/extract.ts
+import {
+  extractMessageContent,
+  getContentType,
+  normalizeMessageContent
+} from "@whiskeysockets/baileys";
+function extractQuoted(ctx) {
+  const quoted = ctx?.quotedMessage;
+  if (!quoted) return void 0;
+  const qc = extractMessageContent(quoted);
+  return {
+    id: ctx?.stanzaId ?? "",
+    text: qc?.conversation ?? qc?.extendedTextMessage?.text ?? qc?.imageMessage?.caption ?? void 0,
+    sender: ctx?.participant ?? void 0
+  };
+}
+function extractMessage(msg) {
+  const result = {
+    text: "",
+    mentionedJids: [],
+    isLocation: false
+  };
+  if (!msg.message) return result;
+  const content = normalizeMessageContent(msg.message);
+  if (!content) return result;
+  const type = getContentType(content);
+  if (!type) return result;
+  const inner = extractMessageContent(content);
+  if (!inner) return result;
+  if (inner.conversation) {
+    result.text = inner.conversation;
+  } else if (inner.extendedTextMessage) {
+    result.text = inner.extendedTextMessage.text ?? "";
+    result.mentionedJids = inner.extendedTextMessage.contextInfo?.mentionedJid ?? [];
+    result.quotedMessage = extractQuoted(inner.extendedTextMessage.contextInfo);
+  }
+  if (inner.imageMessage) {
+    result.mediaType = "image";
+    result.mimetype = inner.imageMessage.mimetype ?? void 0;
+    result.caption = inner.imageMessage.caption ?? void 0;
+    if (!result.text && result.caption) result.text = result.caption;
+    result.mentionedJids = inner.imageMessage.contextInfo?.mentionedJid ?? result.mentionedJids;
+    result.quotedMessage = extractQuoted(inner.imageMessage.contextInfo);
+  }
+  if (inner.audioMessage) {
+    result.mediaType = "audio";
+    result.mimetype = inner.audioMessage.mimetype ?? void 0;
+    result.quotedMessage = extractQuoted(inner.audioMessage.contextInfo);
+  }
+  if (inner.videoMessage) {
+    result.mediaType = "video";
+    result.mimetype = inner.videoMessage.mimetype ?? void 0;
+    result.caption = inner.videoMessage.caption ?? void 0;
+    if (!result.text && result.caption) result.text = result.caption;
+    result.quotedMessage = extractQuoted(inner.videoMessage.contextInfo);
+  }
+  if (inner.documentMessage) {
+    result.mediaType = "document";
+    result.mimetype = inner.documentMessage.mimetype ?? void 0;
+    result.caption = inner.documentMessage.caption ?? void 0;
+    if (!result.text) {
+      result.text = result.caption ?? `[document: ${inner.documentMessage.fileName ?? "file"}]`;
+    }
+    result.quotedMessage = extractQuoted(inner.documentMessage.contextInfo);
+  }
+  if (inner.stickerMessage) {
+    result.mediaType = "sticker";
+    result.mimetype = inner.stickerMessage.mimetype ?? void 0;
+    if (!result.text) result.text = "[sticker]";
+  }
+  if (inner.locationMessage) {
+    result.isLocation = true;
+    const lat = inner.locationMessage.degreesLatitude;
+    const lon = inner.locationMessage.degreesLongitude;
+    const name = inner.locationMessage.name;
+    const addr = inner.locationMessage.address;
+    const parts = [name, addr, lat && lon ? `${lat},${lon}` : null].filter(Boolean);
+    result.locationText = parts.join(" \u2014 ");
+    if (!result.text) result.text = `[location: ${result.locationText}]`;
+  }
+  if (inner.liveLocationMessage) {
+    result.isLocation = true;
+    const lat = inner.liveLocationMessage.degreesLatitude;
+    const lon = inner.liveLocationMessage.degreesLongitude;
+    result.locationText = `${lat},${lon}`;
+    if (!result.text) result.text = `[live location: ${result.locationText}]`;
+  }
+  return result;
+}
+function mediaFallbackBody(extracted) {
+  if (extracted.text) return extracted.text;
+  return extracted.mediaType ? `[${extracted.mediaType}]` : "";
+}
+
+// app/lib/whatsapp/inbound/reaction.ts
+function toMillis(v) {
+  if (v == null) return null;
+  if (typeof v === "number") return v;
+  if (typeof v.toNumber === "function") return v.toNumber();
+  if (typeof v.low === "number") return (v.low >>> 0) + (v.high ?? 0) * 4294967296;
+  return null;
+}
+function readReactionEntry(entry) {
+  const targetMsgKeyId = entry.key?.id ?? void 0;
+  if (!targetMsgKeyId) return null;
+  const chatJid = entry.key?.remoteJid ?? entry.reaction?.key?.remoteJid ?? void 0;
+  if (!chatJid) return null;
+  const isGroup = isGroupJid(chatJid);
+  const reactorKey = entry.reaction?.key;
+  const reactorJid = isGroup ? reactorKey?.participant ?? void 0 : reactorKey?.remoteJid ?? chatJid;
+  if (!reactorJid) return null;
+  const emoji = entry.reaction?.text ?? "";
+  return {
+    targetMsgKeyId,
+    chatJid,
+    reactorJid,
+    isGroup,
+    emoji,
+    removed: !emoji,
+    fromMe: !!reactorKey?.fromMe,
+    timestampMs: toMillis(entry.reaction?.senderTimestampMs)
+  };
+}
+
+// app/lib/whatsapp/message-store.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, appendFileSync as appendFileSync2, readdirSync as readdirSync2, statSync } from "fs";
+import { dirname, join as join2 } from "path";
+function isReactionRecord(r) {
+  return r.kind === "reaction";
+}
+var STORE_ROOT = () => join2(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-messages");
+function conversationFile(platformAccountId, remoteJid) {
+  return join2(STORE_ROOT(), platformAccountId, `${remoteJid}.jsonl`);
+}
+function listStoredAccountIds() {
+  const root = STORE_ROOT();
+  if (!existsSync3(root)) return [];
+  return readdirSync2(root).filter((name) => {
+    try {
+      return statSync(join2(root, name)).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+}
+function conversationFilePath(platformAccountId, remoteJid) {
+  return conversationFile(platformAccountId, remoteJid);
+}
+function parseLines(raw) {
+  const out = [];
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const rec = JSON.parse(line);
+      if (isReactionRecord(rec)) continue;
+      out.push(rec);
+    } catch {
+      console.error(`[whatsapp-message-store] skip reason=corrupt-line`);
+    }
+  }
+  return out;
+}
+var byDateSentAsc = (a, b) => a.dateSent.localeCompare(b.dateSent);
+function appendMessage(platformAccountId, record, altDedupeRemoteJids = []) {
+  const file = conversationFile(platformAccountId, record.remoteJid);
+  try {
+    mkdirSync2(dirname(file), { recursive: true });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[whatsapp-message-store] FAIL op=append reason=${reason.slice(0, 100)} messageId=${record.messageId}`);
+    return { created: false };
+  }
+  try {
+    const filesToCheck = [file, ...altDedupeRemoteJids.filter((jid) => jid && jid !== record.remoteJid).map((jid) => conversationFile(platformAccountId, jid))];
+    for (const candidate of new Set(filesToCheck)) {
+      if (!existsSync3(candidate)) continue;
+      const existing = parseLines(readFileSync3(candidate, "utf8"));
+      if (existing.some((r) => r.messageId === record.messageId)) {
+        return { created: false };
+      }
+    }
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[whatsapp-message-store] FAIL op=append reason=${reason.slice(0, 100)} messageId=${record.messageId}`);
+    return { created: false };
+  }
+  try {
+    appendFileSync2(file, JSON.stringify(record) + "\n");
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[whatsapp-message-store] FAIL op=append reason=${reason.slice(0, 100)} messageId=${record.messageId}`);
+    return { created: false };
+  }
+  return { created: true };
+}
+function readConversation(platformAccountId, remoteJid) {
+  const file = conversationFile(platformAccountId, remoteJid);
+  try {
+    if (!existsSync3(file)) return [];
+    return parseLines(readFileSync3(file, "utf8")).sort(byDateSentAsc);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[whatsapp-message-store] FAIL op=read reason=${reason.slice(0, 100)} remoteJid=${remoteJid}`);
+    return [];
+  }
+}
+function appendReaction(platformAccountId, record) {
+  const file = conversationFile(platformAccountId, record.remoteJid);
+  try {
+    mkdirSync2(dirname(file), { recursive: true });
+    appendFileSync2(file, JSON.stringify(record) + "\n");
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[whatsapp-message-store] FAIL op=append-reaction reason=${reason.slice(0, 100)} target=${record.targetMsgKeyId} reactor=${record.reactorTelephone}`
+    );
+    return { appended: false };
+  }
+  return { appended: true };
+}
+function readReactions(platformAccountId, remoteJid) {
+  const file = conversationFile(platformAccountId, remoteJid);
+  try {
+    if (!existsSync3(file)) return [];
+    const out = [];
+    for (const line of readFileSync3(file, "utf8").split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        const rec = JSON.parse(line);
+        if (isReactionRecord(rec)) out.push(rec);
+      } catch {
+      }
+    }
+    return out;
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[whatsapp-message-store] FAIL op=read-reactions reason=${reason.slice(0, 100)} remoteJid=${remoteJid}`);
+    return [];
+  }
+}
+function foldReactions(records) {
+  const latest = /* @__PURE__ */ new Map();
+  const ordered = records.slice().sort((a, b) => a.dateSent.localeCompare(b.dateSent));
+  for (const r of ordered) {
+    let byReactor = latest.get(r.targetMsgKeyId);
+    if (!byReactor) {
+      byReactor = /* @__PURE__ */ new Map();
+      latest.set(r.targetMsgKeyId, byReactor);
+    }
+    byReactor.set(r.reactorTelephone, r);
+  }
+  const out = /* @__PURE__ */ new Map();
+  for (const [target, byReactor] of latest) {
+    const surviving = [...byReactor.values()].filter((r) => !r.removed).map((r) => ({ emoji: r.emoji, reactorName: r.reactorName }));
+    if (surviving.length > 0) out.set(target, surviving);
+  }
+  return out;
+}
+var summaryCache = /* @__PURE__ */ new Map();
+function summariseRecords(records) {
+  if (records.length === 0) return null;
+  const sorted = records.slice().sort(byDateSentAsc);
+  return {
+    first: sorted[0],
+    last: sorted[sorted.length - 1],
+    firstNamedSender: sorted.find((r) => r.senderName)?.senderName ?? null
+  };
+}
+function readConversationSummaries(platformAccountId) {
+  const dir = join2(STORE_ROOT(), platformAccountId);
+  const out = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  let fullReads = 0;
+  let cacheHits = 0;
+  let bytesRead = 0;
+  try {
+    if (!existsSync3(dir)) return out;
+    for (const entry of readdirSync2(dir)) {
+      if (!entry.endsWith(".jsonl")) continue;
+      const remoteJid = entry.slice(0, -".jsonl".length);
+      const file = join2(dir, entry);
+      seen.add(file);
+      let size;
+      let mtimeMs;
+      try {
+        const st = statSync(file);
+        size = st.size;
+        mtimeMs = st.mtimeMs;
+      } catch {
+        continue;
+      }
+      const cached = summaryCache.get(file);
+      if (cached && cached.size === size && cached.mtimeMs === mtimeMs) {
+        cacheHits++;
+        out.set(remoteJid, cached.summary);
+        continue;
+      }
+      let summary;
+      try {
+        const raw = readFileSync3(file, "utf8");
+        bytesRead += Buffer.byteLength(raw);
+        fullReads++;
+        summary = summariseRecords(parseLines(raw));
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        console.error(`[whatsapp-message-store] FAIL op=summarise reason=${reason.slice(0, 100)} remoteJid=${remoteJid}`);
+        continue;
+      }
+      if (!summary) continue;
+      summaryCache.set(file, { size, mtimeMs, summary });
+      out.set(remoteJid, summary);
+    }
+    for (const key of summaryCache.keys()) {
+      if (dirname(key) === dir && !seen.has(key)) summaryCache.delete(key);
+    }
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[whatsapp-message-store] FAIL op=summaries reason=${reason.slice(0, 100)} platformAccountId=${platformAccountId}`);
+  }
+  console.log(
+    `[whatsapp-message-store] op=summaries accountId=${platformAccountId} conversations=${out.size} fullReads=${fullReads} cacheHits=${cacheHits} bytesRead=${bytesRead}`
+  );
+  return out;
+}
+function readAllConversations(platformAccountId) {
+  const dir = join2(STORE_ROOT(), platformAccountId);
+  const out = /* @__PURE__ */ new Map();
+  try {
+    if (!existsSync3(dir)) return out;
+    for (const entry of readdirSync2(dir)) {
+      if (!entry.endsWith(".jsonl")) continue;
+      const remoteJid = entry.slice(0, -".jsonl".length);
+      out.set(remoteJid, readConversation(platformAccountId, remoteJid));
+    }
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[whatsapp-message-store] FAIL op=read-all reason=${reason.slice(0, 100)} platformAccountId=${platformAccountId}`);
+  }
+  return out;
+}
+
+// app/lib/whatsapp/echo-already-recorded.ts
+function echoAlreadyRecorded(args) {
+  const messageId = `whatsapp-live:${args.accountId}:${args.remoteJid}:${args.msgKeyId}`;
+  return args.readConversation(args.platformAccountId, args.canonicalRemoteJid).some((r) => r.messageId === messageId);
+}
+
+// app/lib/whatsapp/managed-account.ts
+function normalizeEntry(v) {
+  return typeof v === "string" ? { account: v, mode: "active" } : { account: v.managesAccount, mode: v.mode ?? "active" };
+}
+function managedAccountFor(accountManagers, phone) {
+  for (const [managerPhone, entry] of Object.entries(accountManagers)) {
+    const { account, mode } = normalizeEntry(entry);
+    if (account && phonesMatch(managerPhone, phone)) return { account, mode };
+  }
+  return null;
+}
+function managerPhonesForAccount(accountManagers, subAccountId) {
+  const phones = [];
+  for (const [managerPhone, entry] of Object.entries(accountManagers)) {
+    const { account } = normalizeEntry(entry);
+    if (account && account === subAccountId) phones.push(managerPhone);
+  }
+  return phones;
+}
+
+// app/lib/whatsapp/inbound/access-control.ts
+function resolveAccountConfig(config, accountConfig) {
+  return {
+    dmPolicy: accountConfig?.dmPolicy ?? config.dmPolicy ?? "disabled",
+    adminPhones: accountConfig?.adminPhones ?? config.adminPhones ?? [],
+    allowFrom: accountConfig?.allowFrom ?? config.allowFrom ?? [],
+    selfChatMode: accountConfig?.selfChatMode ?? false,
+    // Account-manager bindings are a house-level routing table only — never a
+    // per-account override, so this reads the top-level map unconditionally.
+    accountManagers: config.accountManagers ?? {}
+  };
+}
+function isAdminPhone(phone, adminPhones) {
+  const normalized = normalizeE164(phone);
+  if (!normalized) return false;
+  return adminPhones.some((entry) => phonesMatch(entry, normalized));
+}
+function checkDmAccess(params) {
+  const { senderPhone, selfPhone, accountId } = params;
+  const cfg = resolveAccountConfig(params.config, params.accountConfig);
+  if (phonesMatch(senderPhone, selfPhone)) {
+    return { allowed: true, reason: "self-phone", agentType: "admin", effectiveAccountId: accountId };
+  }
+  if (isAdminPhone(senderPhone, cfg.adminPhones)) {
+    return { allowed: true, reason: "admin-binding", agentType: "admin", effectiveAccountId: accountId };
+  }
+  const managed = managedAccountFor(cfg.accountManagers, senderPhone);
+  if (managed) {
+    if (params.isValidAccount && !params.isValidAccount(managed.account)) {
+      return { allowed: false, reason: "account-manager-unresolved", agentType: "admin" };
+    }
+    return { allowed: true, reason: "account-manager", agentType: "admin", effectiveAccountId: managed.account, passive: managed.mode === "passive" };
+  }
+  switch (cfg.dmPolicy) {
+    case "open":
+      return { allowed: true, reason: "dm-policy-open", agentType: "public", effectiveAccountId: accountId };
+    case "allowlist": {
+      const inList = cfg.allowFrom.some((entry) => {
+        if (entry === "*") return true;
+        return phonesMatch(entry, senderPhone);
+      });
+      if (inList) {
+        return { allowed: true, reason: "allowlist-match", agentType: "public", effectiveAccountId: accountId };
+      }
+      return { allowed: false, reason: "not-in-allowlist", agentType: "public" };
+    }
+    case "disabled":
+      return { allowed: false, reason: "dm-policy-disabled", agentType: "public" };
+    default:
+      return { allowed: false, reason: "unknown-dm-policy", agentType: "public" };
+  }
+}
+async function resolveDmAccess(params) {
+  const base = checkDmAccess(params);
+  if (!base.allowed || base.agentType !== "public") return base;
+  const e164 = normalizeE164(params.senderPhone);
+  if (!e164 || !params.accountId) return base;
+  try {
+    const personId = await params.resolvePersonByPhone(params.accountId, e164);
+    return { ...base, personId };
+  } catch (err) {
+    console.error(
+      `[whatsapp:route] op=person-resolve-error senderId=${e164} err=${err instanceof Error ? err.message : String(err)}`
+    );
+    return base;
+  }
+}
+function checkGroupAccess(_params) {
+  return { allowed: false, reason: "group-observe-only", agentType: "public" };
+}
+
+// app/lib/whatsapp/inbound/dispatch-mode.ts
+function shouldDispatchInbound(config, accountId) {
+  return config.accounts?.[accountId]?.dispatchInbound ?? true;
+}
+function decideDispatch(conn, payload, deps) {
+  if (shouldDispatchInbound(deps.config, conn.accountId)) {
+    deps.emit(payload);
+    return;
+  }
+  deps.log(`[whatsapp:observe] op=dispatch-suppressed account=${conn.accountId} sender=${payload.senderPhone} agentType=${payload.agentType}`);
+}
+
+// app/lib/whatsapp/inbound/notify-frame.ts
+function decideWaNotify(input) {
+  if (input.upsertType !== "notify") return { emit: false, reason: "append" };
+  if (input.fromMe) return { emit: false, reason: "from-me" };
+  if (!input.hasPersistableContent) return { emit: false, reason: "no-content" };
+  if (!input.msgKeyId) return { emit: false, reason: "no-id" };
+  if (!input.access) return { emit: false, reason: "group" };
+  if (!input.access.allowed) return { emit: false, reason: "not-allowed" };
+  if (input.isDuplicate()) return { emit: false, reason: "duplicate" };
+  return { emit: true, senderType: classify(input.access) };
+}
+function classify(access) {
+  if (access.reason === "account-manager") {
+    return access.passive === true ? "manager-passive" : "manager-active";
+  }
+  return access.agentType === "admin" ? "admin" : "public";
+}
+function formatNotifyBody(text, mediaType) {
+  const source = text.length > 0 ? text : mediaType ?? "";
+  if (source.length === 0) return { body: "", truncated: false };
+  const lines = source.split("\n");
+  if (lines.length <= 2) return { body: source, truncated: false };
+  return { body: lines.slice(0, 2).join("\n"), truncated: true };
+}
+
+// app/lib/whatsapp/inbound/notify-dedupe.ts
+var NOTIFY_TTL_MS = 20 * 6e4;
+var NOTIFY_MAX = 5e3;
+var notifyCache = /* @__PURE__ */ new Map();
+function isNotifyDuplicate(msgKeyId) {
+  const now = Date.now();
+  const entry = notifyCache.get(msgKeyId);
+  if (entry && now - entry.ts <= NOTIFY_TTL_MS) return true;
+  for (const [key, e] of notifyCache) {
+    if (now - e.ts > NOTIFY_TTL_MS) notifyCache.delete(key);
+  }
+  if (notifyCache.size >= NOTIFY_MAX) {
+    const excess = notifyCache.size - NOTIFY_MAX + 1;
+    let dropped = 0;
+    for (const key of notifyCache.keys()) {
+      if (dropped >= excess) break;
+      notifyCache.delete(key);
+      dropped++;
+    }
+  }
+  notifyCache.set(msgKeyId, { ts: now });
+  return false;
+}
+
+// app/lib/reader/format-phone.ts
+import { parsePhoneNumberFromString } from "libphonenumber-js";
+function formatSenderPhone(senderId) {
+  const digits = normalizeE164(senderId);
+  if (!digits) return senderId;
+  const parsed = parsePhoneNumberFromString(`+${digits}`);
+  return parsed?.isPossible() ? parsed.formatInternational() : senderId;
+}
+
+// app/lib/access-gate.ts
+import neo4j from "neo4j-driver";
+import { readFileSync as readFileSync4 } from "fs";
+import { resolve } from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+var PLATFORM_ROOT = process.env.MAXY_PLATFORM_ROOT ?? resolve(process.cwd(), "..");
+var driver = null;
+function readPassword() {
+  if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
+  const passwordFile = resolve(PLATFORM_ROOT, "config/.neo4j-password");
+  try {
+    return readFileSync4(passwordFile, "utf-8").trim();
+  } catch {
+    throw new Error(
+      `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
+    );
+  }
+}
+function getDriver() {
+  if (!driver) {
+    const uri = process.env.NEO4J_URI;
+    if (!uri) {
+      throw new Error(
+        "[ui/access-gate] NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687"
+      );
+    }
+    const user = process.env.NEO4J_USER ?? "neo4j";
+    const password = readPassword();
+    console.error(`[ui/access-gate] resolved neo4j_uri=${uri}`);
+    driver = neo4j.driver(uri, neo4j.auth.basic(user, password), {
+      maxConnectionPoolSize: 5
+    });
+  }
+  return driver;
+}
+var sessionFactory = null;
+function getSession2() {
+  return sessionFactory ? sessionFactory() : getDriver().session();
+}
+process.on("SIGINT", async () => {
+  if (driver) {
+    await driver.close();
+    driver = null;
+  }
+});
+var rateLimitMap = /* @__PURE__ */ new Map();
+var ACCESS_MAX_ATTEMPTS = 5;
+var ACCESS_LOCKOUT_MS = 15 * 60 * 1e3;
+var ACCESS_WINDOW_MS = 15 * 60 * 1e3;
+function checkAccessRateLimit(ip, agentSlug) {
+  const key = `${ip}:${agentSlug}`;
+  const entry = rateLimitMap.get(key);
+  if (!entry) return null;
+  const now = Date.now();
+  if (entry.lockedUntil && now < entry.lockedUntil) {
+    const remainingMs = entry.lockedUntil - now;
+    const remainingS = Math.ceil(remainingMs / 1e3);
+    return `Too many attempts. Try again in ${remainingS}s`;
+  }
+  if (now - entry.firstAttempt > ACCESS_WINDOW_MS) {
+    rateLimitMap.delete(key);
+    return null;
+  }
+  return null;
+}
+function recordAccessFailedAttempt(ip, agentSlug) {
+  const key = `${ip}:${agentSlug}`;
+  const now = Date.now();
+  const entry = rateLimitMap.get(key);
+  if (!entry || now - entry.firstAttempt > ACCESS_WINDOW_MS) {
+    rateLimitMap.set(key, { attempts: 1, firstAttempt: now });
+    return;
+  }
+  entry.attempts++;
+  if (entry.attempts >= ACCESS_MAX_ATTEMPTS) {
+    entry.lockedUntil = now + ACCESS_LOCKOUT_MS;
+  }
+}
+function clearAccessRateLimit(ip, agentSlug) {
+  rateLimitMap.delete(`${ip}:${agentSlug}`);
+}
+var contactRateMap = /* @__PURE__ */ new Map();
+var REQUEST_LINK_MAX = 3;
+var REQUEST_LINK_WINDOW_MS = 60 * 60 * 1e3;
+function checkRequestLinkRateLimit(contactValue) {
+  const entry = contactRateMap.get(contactValue);
+  if (!entry) return null;
+  const now = Date.now();
+  if (now - entry.windowStart > REQUEST_LINK_WINDOW_MS) {
+    contactRateMap.delete(contactValue);
+    return null;
+  }
+  if (entry.count >= REQUEST_LINK_MAX) {
+    const remainingMs = REQUEST_LINK_WINDOW_MS - (now - entry.windowStart);
+    const remainingM = Math.ceil(remainingMs / 6e4);
+    return `Too many requests. Try again in ${remainingM} minute(s)`;
+  }
+  return null;
+}
+function recordRequestLinkAttempt(contactValue) {
+  const now = Date.now();
+  const entry = contactRateMap.get(contactValue);
+  if (!entry || now - entry.windowStart > REQUEST_LINK_WINDOW_MS) {
+    contactRateMap.set(contactValue, { count: 1, windowStart: now });
+    return;
+  }
+  entry.count++;
+}
+function maskContact(value) {
+  if (value.includes("@")) {
+    const [local, domain] = value.split("@");
+    return `${local[0]}***@${domain}`;
+  }
+  return "****";
+}
+function readGrant(record) {
+  const g = record.get("g").properties;
+  const personId = record.get("personId");
+  return {
+    grantId: record.get("grantId"),
+    agentSlug: String(g.agentSlug),
+    accountId: String(g.accountId),
+    contactValue: String(g.contactValue),
+    displayName: record.get("givenName") ?? null,
+    personId,
+    expiresAt: g.expiresAt ? new Date(String(g.expiresAt)).getTime() : null,
+    status: String(g.status),
+    sliceToken: String(g.sliceToken ?? "")
+  };
+}
+async function findGrantByMagicToken(token) {
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant {magicToken: $token})
+       RETURN g, p.givenName AS givenName,
+              elementId(g) AS grantId,
+              elementId(p) AS personId`,
+      { token }
+    );
+    if (result.records.length === 0) return null;
+    return readGrant(result.records[0]);
+  } finally {
+    await session.close();
+  }
+}
+async function findActiveGrantByContact(contactValue, agentSlug, accountId) {
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant {
+        contactValue: $contactValue,
+        agentSlug: $agentSlug,
+        accountId: $accountId
+      })
+      WHERE g.status IN ['invited', 'active']
+      RETURN g, p.givenName AS givenName,
+             elementId(g) AS grantId,
+             elementId(p) AS personId`,
+      { contactValue, agentSlug, accountId }
+    );
+    if (result.records.length === 0) return null;
+    return readGrant(result.records[0]);
+  } finally {
+    await session.close();
+  }
+}
+async function findGrantByContact(contactValue, agentSlug, accountId) {
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant {
+        contactValue: $contactValue,
+        agentSlug: $agentSlug,
+        accountId: $accountId
+      })
+      RETURN g, p.givenName AS givenName,
+             elementId(g) AS grantId,
+             elementId(p) AS personId
+      LIMIT 1`,
+      { contactValue, agentSlug, accountId }
+    );
+    if (result.records.length === 0) return null;
+    return readGrant(result.records[0]);
+  } finally {
+    await session.close();
+  }
+}
+async function resolvePersonByPhone(accountId, phone) {
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (p:Person {accountId: $accountId, phone: $phone})
+       RETURN elementId(p) AS personId
+       LIMIT 1`,
+      { accountId, phone }
+    );
+    if (result.records.length === 0) return null;
+    return result.records[0].get("personId");
+  } finally {
+    await session.close();
+  }
+}
+async function ensureManagerPerson(accountId, phone) {
+  const session = getSession2();
+  const normalized = normalizeE164(phone) || phone;
+  try {
+    const result = await session.run(
+      `MERGE (p:Person {accountId: $accountId, phone: $phone})
+       ON CREATE SET p.source = 'wa-passive-manager'
+       RETURN elementId(p) AS personId`,
+      { accountId, phone: normalized }
+    );
+    if (result.records.length === 0) return null;
+    return result.records[0].get("personId");
+  } finally {
+    await session.close();
+  }
+}
+async function enrolPerson(input) {
+  const session = getSession2();
+  const sliceToken = randomUUID2();
+  const phone = normalizeE164(input.phone) || input.phone;
+  try {
+    const result = await session.run(
+      `MERGE (p:Person {accountId: $accountId, phone: $phone})
+       MERGE (p)-[:HAS_ACCESS]->(g:AccessGrant {
+         accountId: $accountId, agentSlug: $agentSlug, contactValue: $email
+       })
+       ON CREATE SET g.status = 'invited', g.sliceToken = $sliceToken
+       RETURN elementId(p) AS personId`,
+      {
+        accountId: input.accountId,
+        phone,
+        email: input.email,
+        agentSlug: input.agentSlug,
+        sliceToken
+      }
+    );
+    return result.records[0].get("personId");
+  } finally {
+    await session.close();
+  }
+}
+async function consumeMagicTokenAndActivate(grantId) {
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (g:AccessGrant) WHERE elementId(g) = $grantId
+       SET g.magicToken = null,
+           g.magicTokenExpiresAt = null,
+           g.status = "active"
+       RETURN count(g) AS affected`,
+      { grantId }
+    );
+    const affected = result.records[0]?.get("affected");
+    const count = typeof affected === "number" ? affected : affected?.toNumber?.() ?? 0;
+    if (count === 0) {
+      throw new Error(`[access-gate] consumeMagicTokenAndActivate: no grant matched grantId=${grantId}`);
+    }
+  } finally {
+    await session.close();
+  }
+}
+async function generateNewMagicToken(grantId) {
+  const token = randomUUID2();
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (g:AccessGrant) WHERE elementId(g) = $grantId
+       SET g.magicToken = $token,
+           g.magicTokenExpiresAt = datetime() + duration('PT15M')
+       RETURN count(g) AS affected`,
+      { grantId, token }
+    );
+    const affected = result.records[0]?.get("affected");
+    const count = typeof affected === "number" ? affected : affected?.toNumber?.() ?? 0;
+    if (count === 0) {
+      throw new Error(`[access-gate] generateNewMagicToken: no grant matched grantId=${grantId}`);
+    }
+  } finally {
+    await session.close();
+  }
+  return token;
+}
+
+// app/lib/whatsapp/inbound/dedupe.ts
+var AGENT_SENT_TTL_MS = 2 * 6e4;
+var AGENT_SENT_MAX = 500;
+var INBOUND_TTL_MS = 20 * 6e4;
+var INBOUND_MAX = 5e3;
+var agentSentCache = /* @__PURE__ */ new Map();
+var inboundCache = /* @__PURE__ */ new Map();
+function pruneCache(cache3, ttl, max) {
+  const now = Date.now();
+  for (const [key, entry] of cache3) {
+    if (now - entry.ts > ttl) cache3.delete(key);
+  }
+  if (cache3.size > max) {
+    const excess = cache3.size - max;
+    let count = 0;
+    for (const key of cache3.keys()) {
+      if (count >= excess) break;
+      cache3.delete(key);
+      count++;
+    }
+  }
+}
+function trackAgentSentMessage(messageId) {
+  pruneCache(agentSentCache, AGENT_SENT_TTL_MS, AGENT_SENT_MAX);
+  agentSentCache.set(messageId, { ts: Date.now() });
+}
+function isAgentSentMessage(messageId) {
+  const entry = agentSentCache.get(messageId);
+  if (!entry) return false;
+  if (Date.now() - entry.ts > AGENT_SENT_TTL_MS) {
+    agentSentCache.delete(messageId);
+    return false;
+  }
+  return true;
+}
+function isDuplicateInbound(key) {
+  const entry = inboundCache.get(key);
+  if (!entry) {
+    pruneCache(inboundCache, INBOUND_TTL_MS, INBOUND_MAX);
+    inboundCache.set(key, { ts: Date.now() });
+    return false;
+  }
+  if (Date.now() - entry.ts > INBOUND_TTL_MS) {
+    inboundCache.delete(key);
+    inboundCache.set(key, { ts: Date.now() });
+    return false;
+  }
+  return true;
+}
+
+// app/lib/whatsapp/inbound/self-chat.ts
+var TAG6 = "[whatsapp:self-chat]";
+function normalizeJid(jid) {
+  const m = jid.match(/^(\d+)(?::\d+)?@(s\.whatsapp\.net|lid)$/i);
+  return m ? `${m[1]}@${m[2].toLowerCase()}` : jid;
+}
+function isSelfChatJid(remoteJid, self) {
+  const candidates = /* @__PURE__ */ new Set();
+  if (self.selfJid) candidates.add(normalizeJid(self.selfJid));
+  if (self.selfLid) candidates.add(normalizeJid(self.selfLid));
+  if (self.selfPhone) candidates.add(`${self.selfPhone}@s.whatsapp.net`);
+  if (candidates.size === 0) return false;
+  return candidates.has(normalizeJid(remoteJid));
+}
+function evaluateSelfChatCommand(input) {
+  if (!input.fromMe) return { kind: "not-self-chat" };
+  if (!isSelfChatJid(input.remoteJid, input)) return { kind: "not-self-chat" };
+  const tsMs = input.messageTimestampSec ? input.messageTimestampSec * 1e3 : 0;
+  const connAtMs = input.lastConnectedAtMs ?? 0;
+  const msgId = input.msgId ?? "?";
+  console.error(
+    `${TAG6} op=seen account=${input.accountId} msgId=${msgId} tsMs=${tsMs} connAtMs=${connAtMs} fromMe=true`
+  );
+  const skip = (reason) => {
+    console.error(`${TAG6} op=skip account=${input.accountId} msgId=${msgId} reason=${reason}`);
+    return { kind: "skip", reason };
+  };
+  if (input.msgId && isAgentSentMessage(input.msgId)) return skip("echo");
+  if (!(tsMs > connAtMs)) return skip("backfill");
+  if (isDuplicateInbound(`${input.accountId}:${input.remoteJid}:${input.msgId}`)) return skip("duplicate");
+  if (!input.text) return skip("no-text");
+  console.error(
+    `${TAG6} op=dispatch account=${input.accountId} msgId=${msgId} bytes=${Buffer.byteLength(input.text, "utf8")} agentType=admin`
+  );
+  return { kind: "dispatch", text: input.text };
+}
+
+// app/lib/whatsapp/activity.ts
+var TAG7 = "[whatsapp:activity]";
+var RECENT_EVENTS_MAX = 200;
+var counters = /* @__PURE__ */ new Map();
+var recentEvents = [];
+function recordActivity(event) {
+  try {
+    const now = Date.now();
+    const { accountId, direction, jid, messageType } = event;
+    let acct = counters.get(accountId);
+    if (!acct) {
+      acct = { inbound: 0, outbound: 0, firstEventAt: now, lastEventAt: now };
+      counters.set(accountId, acct);
+    }
+    acct[direction]++;
+    acct.lastEventAt = now;
+    const entry = {
+      channel: "whatsapp",
+      accountId,
+      direction,
+      jid,
+      timestamp: now,
+      messageType
+    };
+    recentEvents.push(entry);
+    if (recentEvents.length > RECENT_EVENTS_MAX) {
+      recentEvents.splice(0, recentEvents.length - RECENT_EVENTS_MAX);
+    }
+    console.error(
+      `${TAG7} channel-activity: direction=${direction} account=${accountId} jid=${jid}` + (messageType ? ` type=${messageType}` : "")
+    );
+  } catch (err) {
+    console.error(`${TAG7} recording failed: ${String(err)}`);
+  }
+}
+function getChannelActivity(accountId) {
+  const accounts = [];
+  for (const [id, acct] of counters) {
+    if (accountId && id !== accountId) continue;
+    accounts.push({
+      accountId: id,
+      inbound: acct.inbound,
+      outbound: acct.outbound,
+      total: acct.inbound + acct.outbound,
+      firstEventAt: acct.firstEventAt,
+      lastEventAt: acct.lastEventAt
+    });
+  }
+  const events = accountId ? recentEvents.filter((e) => e.accountId === accountId) : [...recentEvents];
+  return { accounts, recentEvents: events };
+}
+
+// app/lib/whatsapp/outbound/send.ts
+var TAG8 = "[whatsapp:outbound]";
+function buildQuoted(q) {
+  return {
+    key: {
+      remoteJid: q.remoteJid,
+      id: q.id,
+      fromMe: q.fromMe,
+      ...q.participant ? { participant: q.participant } : {}
+    },
+    message: { conversation: q.body ?? "" }
+  };
+}
+async function sendTextMessage(sock, to, text, opts) {
+  try {
+    const jid = to.includes("@") ? to : toWhatsappJid(to);
+    const payload = { text };
+    const options = opts?.quoted ? { quoted: buildQuoted(opts.quoted) } : void 0;
+    const result = await sock.sendMessage(jid, payload, options);
+    const messageId = result?.key?.id;
+    if (messageId) {
+      trackAgentSentMessage(messageId);
+      console.error(`${TAG8} sent text to=${jid} id=${messageId}`);
+    }
+    if (opts?.accountId) {
+      recordActivity({ accountId: opts.accountId, direction: "outbound", jid, messageType: "text" });
+    }
+    return { success: true, messageId: messageId ?? void 0 };
+  } catch (err) {
+    console.error(`${TAG8} send failed to=${to}: ${String(err)}`);
+    return { success: false, error: String(err) };
+  }
+}
+async function sendComposing(sock, to) {
+  try {
+    const jid = to.includes("@") ? to : toWhatsappJid(to);
+    await sock.sendPresenceUpdate("composing", jid);
+  } catch {
+  }
+}
+async function sendPaused(sock, to) {
+  try {
+    const jid = to.includes("@") ? to : toWhatsappJid(to);
+    await sock.sendPresenceUpdate("paused", jid);
+  } catch {
+  }
+}
+async function sendReadReceipt(sock, chatJid, messageIds, participant, accountId) {
+  const idTag = messageIds[0] ?? "?";
+  try {
+    await sock.readMessages([
+      ...messageIds.map((id) => ({
+        remoteJid: chatJid,
+        id,
+        participant
+      }))
+    ]);
+    console.error(
+      `[whatsapp:receipt] op=ack account=${accountId ?? "?"} jid=${chatJid} id=${idTag} ok=true`
+    );
+  } catch (err) {
+    console.error(
+      `[whatsapp:receipt] op=ack account=${accountId ?? "?"} jid=${chatJid} id=${idTag} ok=false reason=${String(err).slice(0, 120)}`
+    );
+  }
+}
+async function sendMediaMessage(sock, to, media, opts) {
+  try {
+    const jid = to.includes("@") ? to : toWhatsappJid(to);
+    let payload;
+    switch (media.type) {
+      case "image":
+        payload = {
+          image: media.buffer,
+          mimetype: media.mimetype,
+          caption: media.caption
+        };
+        break;
+      case "audio":
+        payload = {
+          audio: media.buffer,
+          mimetype: media.mimetype,
+          ptt: media.ptt ?? false
+        };
+        break;
+      case "video":
+        payload = {
+          video: media.buffer,
+          mimetype: media.mimetype,
+          caption: media.caption
+        };
+        break;
+      case "document":
+        payload = {
+          document: media.buffer,
+          mimetype: media.mimetype,
+          fileName: media.filename ?? "file",
+          caption: media.caption
+        };
+        break;
+    }
+    const options = opts?.quoted ? { quoted: buildQuoted(opts.quoted) } : void 0;
+    const result = await sock.sendMessage(jid, payload, options);
+    const messageId = result?.key?.id;
+    if (messageId) {
+      trackAgentSentMessage(messageId);
+      console.error(`${TAG8} sent ${media.type} to=${jid} id=${messageId}`);
+    }
+    if (opts?.accountId) {
+      recordActivity({ accountId: opts.accountId, direction: "outbound", jid, messageType: media.type });
+    }
+    return { success: true, messageId: messageId ?? void 0 };
+  } catch (err) {
+    console.error(`${TAG8} send media failed to=${to}: ${String(err)}`);
+    return { success: false, error: String(err) };
+  }
+}
+
+// app/lib/whatsapp/persist-message.ts
+var TAG9 = "[whatsapp-persist]";
+var sessionWriteLocks = /* @__PURE__ */ new Map();
+async function persistWhatsAppMessage(input) {
+  if (!input.body && !input.attachmentId || !input.msgKeyId) return null;
+  const messageId = `whatsapp-live:${input.accountId}:${input.remoteJid}:${input.msgKeyId}`;
+  const canonicalRemoteJid = input.canonicalRemoteJid;
+  const keyResolved = canonicalRemoteJid !== input.remoteJid ? "lid2pn" : "none";
+  console.error(
+    `[whatsapp-message-store] op=key raw=${input.remoteJid} canonical=${canonicalRemoteJid} resolved=${keyResolved}`
+  );
+  const senderTelephone = input.fromMe && input.selfPhone ? input.selfPhone : input.senderPhone;
+  const dateSentIso = new Date(input.timestamp * 1e3).toISOString();
+  const scope = deriveScope(input.cacheKey);
+  const { givenName, familyName } = splitName(input.pushName);
+  const prev = sessionWriteLocks.get(input.cacheKey);
+  let release;
+  const mine = new Promise((resolve6) => {
+    release = resolve6;
+  });
+  const chained = (prev ?? Promise.resolve()).then(() => mine);
+  sessionWriteLocks.set(input.cacheKey, chained);
+  await prev;
+  const t0 = Date.now();
+  let session = null;
+  try {
+    session = getSession();
+    const cypher = `
+      MATCH (c:Conversation {sessionId: $sessionId})
+      OPTIONAL MATCH (existingS:Person {telephone: $senderTelephone, accountId: $platformAccountId})
+      WITH c, existingS IS NOT NULL AS senderReused
+      MERGE (s:Person {telephone: $senderTelephone, accountId: $platformAccountId})
+        ON CREATE SET
+          s.givenName        = $givenName,
+          s.familyName       = $familyName,
+          s.source           = 'whatsapp-live',
+          s.scope            = $scope,
+          s.createdByAgent   = 'whatsapp-live',
+          s.createdBySource  = 'whatsapp-live',
+          s.createdAt        = datetime()
+      RETURN elementId(s) AS senderElementId, senderReused
+    `;
+    const params = {
+      sessionId: input.sessionId,
+      platformAccountId: input.platformAccountId,
+      senderTelephone,
+      givenName,
+      familyName,
+      scope
+    };
+    const result = await session.run(cypher, params);
+    if (result.records.length === 0) {
+      console.error(`${TAG9} skip reason=conversation-not-found accountId=${input.platformAccountId} cacheKey=${input.cacheKey} messageId=${messageId}`);
+      return null;
+    }
+    const rec = result.records[0];
+    const senderElementId = rec.get("senderElementId");
+    const senderReused = rec.get("senderReused") === true;
+    console.error(
+      `${TAG9} sender-resolved telephone=${senderTelephone} nodeKind=Person elementId=${senderElementId} reused=${senderReused}`
+    );
+    const diskRecord = {
+      messageId,
+      sessionId: input.sessionId,
+      dateSent: dateSentIso,
+      body: input.body,
+      fromMe: input.fromMe,
+      senderTelephone,
+      senderName: input.pushName ?? null,
+      remoteJid: canonicalRemoteJid,
+      msgKeyId: input.msgKeyId,
+      quotedId: input.quoted?.id ?? null,
+      quotedSender: input.quoted?.sender ?? null,
+      scope,
+      ...input.attachmentId ? { attachmentId: input.attachmentId } : {},
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const altDedupeRemoteJids = canonicalRemoteJid !== input.remoteJid ? [input.remoteJid] : [];
+    const { created } = appendMessage(input.platformAccountId, diskRecord, altDedupeRemoteJids);
+    const ms = Date.now() - t0;
+    if (!created) {
+      console.error(`${TAG9} noop reason=existing-message messageId=${messageId}`);
+      return { messageId, created: false, senderElementId };
+    }
+    console.error(
+      `${TAG9} write messageId=${messageId} accountId=${input.platformAccountId} cacheKey=${input.cacheKey} fromMe=${input.fromMe} dateSent=${dateSentIso} bodyBytes=${Buffer.byteLength(input.body, "utf8")} attachment=${input.attachmentId ?? "none"} ms=${ms}`
+    );
+    return { messageId, created: true, senderElementId };
+  } catch (err) {
+    const ms = Date.now() - t0;
+    const reason = sanitizeReason(err);
+    console.error(
+      `${TAG9} FAIL accountId=${input.platformAccountId} waname=${input.accountId} remoteJid=${input.remoteJid} msgKey=${input.msgKeyId} reason=${reason} ms=${ms}`
+    );
+    return null;
+  } finally {
+    release();
+    if (sessionWriteLocks.get(input.cacheKey) === chained) {
+      sessionWriteLocks.delete(input.cacheKey);
+    }
+    if (session) await session.close();
+  }
+}
+function deriveScope(cacheKey) {
+  const segments = cacheKey.split(":");
+  return segments.length <= 2 ? "admin" : "public";
+}
+function splitName(pushName) {
+  if (!pushName) return { givenName: null, familyName: null };
+  const trimmed = pushName.trim();
+  if (!trimmed) return { givenName: null, familyName: null };
+  const firstSpace = trimmed.search(/\s/);
+  if (firstSpace === -1) return { givenName: trimmed, familyName: null };
+  return {
+    givenName: trimmed.slice(0, firstSpace).trim(),
+    familyName: trimmed.slice(firstSpace + 1).trim() || null
+  };
+}
+function sanitizeReason(err) {
+  if (!(err instanceof Error)) return String(err).slice(0, 200);
+  const msg = err.message.replace(/bolt:\/\/[^\s)]+/g, "bolt://<redacted>").replace(/\b(neo4j|admin|password)=[^\s)]+/gi, "$1=<redacted>").slice(0, 200);
+  return `${err.name}:${msg}`;
+}
+
+// app/lib/whatsapp/ensure-conversation.ts
+var TAG10 = "[whatsapp-persist]";
+async function ensureWhatsAppConversation(input) {
+  const t0 = Date.now();
+  try {
+    const result = await ensureConversation(
+      input.platformAccountId,
+      input.agentType,
+      input.cacheKey
+    );
+    const ms = Date.now() - t0;
+    if (!result.sessionId) {
+      console.error(
+        `${TAG10} conversation-merged FAIL cacheKey=${input.cacheKey} reason=null-sessionId ms=${ms}`
+      );
+      return null;
+    }
+    console.error(
+      `${TAG10} conversation-merged cacheKey=${input.cacheKey} agentType=${input.agentType} channel=whatsapp accountId=${input.platformAccountId} connectionAccountId=${input.connectionAccountId ?? input.platformAccountId} created=${result.created} ms=${ms}`
+    );
+    return { sessionId: result.sessionId, created: result.created };
+  } catch (err) {
+    const ms = Date.now() - t0;
+    const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
+    console.error(
+      `${TAG10} conversation-merged FAIL cacheKey=${input.cacheKey} reason=${reason} ms=${ms}`
+    );
+    return null;
+  }
+}
+
+// ../lib/account-enumeration/src/index.ts
+import { readdirSync as readdirSync3, readFileSync as readFileSync5 } from "fs";
+import { resolve as resolve2 } from "path";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var cache2 = /* @__PURE__ */ new Map();
+function enumerateValidAccountIds(accountsDir) {
+  const cached = cache2.get(accountsDir);
+  if (cached !== void 0) return cached;
+  let names;
+  try {
+    names = readdirSync3(accountsDir);
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      cache2.set(accountsDir, []);
+      return [];
+    }
+    throw err;
+  }
+  const valid = [];
+  for (const name of names) {
+    if (!UUID_RE.test(name)) continue;
+    const configPath = resolve2(accountsDir, name, "account.json");
+    try {
+      JSON.parse(readFileSync5(configPath, "utf-8"));
+      valid.push(name);
+    } catch (err) {
+      const code = err.code;
+      if (code === "ENOENT") continue;
+    }
+  }
+  cache2.set(accountsDir, valid);
+  return valid;
+}
+function resolveHouseOrSoleAccountId(accountsDir) {
+  const valid = enumerateValidAccountIds(accountsDir);
+  const houses = [];
+  for (const id of valid) {
+    const configPath = resolve2(accountsDir, id, "account.json");
+    try {
+      const cfg = JSON.parse(readFileSync5(configPath, "utf-8"));
+      if (cfg.role === "house") houses.push(id);
+    } catch {
+    }
+  }
+  if (houses.length === 1) return houses[0];
+  if (houses.length === 0 && valid.length === 1) return valid[0];
+  throw new Error(
+    `[account-registry] resolveHouseOrSoleAccountId: houses=${houses.length} total=${valid.length} under ${accountsDir} \u2014 expected exactly one role:"house" (or a single unlabelled account). Loud-fail rather than picking one silently.`
+  );
+}
+function getAccountsDirFromEnv() {
+  const root = process.env.MAXY_PLATFORM_ROOT;
+  if (!root) {
+    throw new Error(
+      "[graph-write] MAXY_PLATFORM_ROOT not set \u2014 cannot enforce accountId gate. Set MAXY_PLATFORM_ROOT in the spawning process or pass `accountsDir` explicitly."
+    );
+  }
+  return resolve2(root, "..", "data/accounts");
+}
+function validateAccountIdEnv(envValue, diskIds) {
+  if (!envValue) {
+    return { ok: false, reason: "missing", envId: null, diskIds };
+  }
+  if (diskIds.length === 0) {
+    return { ok: false, reason: "no-on-disk-account", envId: envValue, diskIds };
+  }
+  if (!diskIds.includes(envValue)) {
+    return { ok: false, reason: "mismatch", envId: envValue, diskIds };
+  }
+  return { ok: true, envId: envValue, diskIds };
+}
+
+// app/lib/whatsapp/platform-account-id.ts
+import { readFileSync as readFileSync6 } from "fs";
+import { resolve as resolve3 } from "path";
+var cachedHouseId = null;
+var cachedHouseAccountsDir = null;
+function resolveHouseId(accountsDir) {
+  if (cachedHouseId !== null && cachedHouseAccountsDir === accountsDir) return cachedHouseId;
+  const resolved = resolveHouseOrSoleAccountId(accountsDir);
+  cachedHouseId = resolved;
+  cachedHouseAccountsDir = accountsDir;
+  return cachedHouseId;
+}
+function readChannelRoutingOverride(accountsDir, houseId) {
+  const configPath = resolve3(accountsDir, houseId, "account.json");
+  let raw;
+  try {
+    raw = readFileSync6(configPath, "utf-8");
+  } catch {
+    return null;
+  }
+  let cfg;
+  try {
+    cfg = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  const target = cfg.channelRoutingAccountId;
+  if (typeof target !== "string" || !target) return null;
+  const validIds = enumerateValidAccountIds(accountsDir);
+  if (!validIds.includes(target)) {
+    console.error(`[platform-account-id] channel-routing-invalid target=${target.slice(0, 8)} \u2014 falling back to house`);
+    return null;
+  }
+  return target;
+}
+function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
+  const houseId = resolveHouseId(accountsDir);
+  const routed = readChannelRoutingOverride(accountsDir, houseId);
+  return routed ?? houseId;
+}
+function resolveHouseAccountId(accountsDir = ACCOUNTS_DIR) {
+  return resolveHouseId(accountsDir);
+}
+
+// app/lib/whatsapp/account-id-shape.ts
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isUuidAccountId(id) {
+  return UUID_RE2.test(id);
+}
+function warnNonUuidAccount(caller, accountId) {
+  if (isUuidAccountId(accountId)) return;
+  console.error(
+    `[whatsapp-account-scope] op=non-uuid-account caller=${caller} accountId=${accountId}`
+  );
+}
+
+// app/lib/managed-service.ts
+import { join as join3 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+function isHouseManagedService(accountsDir = ACCOUNTS_DIR) {
+  let houseId;
+  try {
+    houseId = resolvePlatformAccountId(accountsDir);
+  } catch {
+    return false;
+  }
+  try {
+    const cfg = JSON.parse(
+      readFileSync7(join3(accountsDir, houseId, "account.json"), "utf-8")
+    );
+    return cfg.managedService === true;
+  } catch {
+    return false;
+  }
+}
+function isCustomerTurnSuppressed(role, managedService) {
+  return managedService === true && role !== "admin";
+}
+
+// app/lib/whatsapp/inbound/media.ts
+import { randomUUID as randomUUID4, createHash } from "crypto";
+import { writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { join as join5 } from "path";
+import {
+  downloadMediaMessage,
+  downloadContentFromMessage,
+  normalizeMessageContent as normalizeMessageContent2
+} from "@whiskeysockets/baileys";
+
+// app/lib/attachments.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { mkdir, writeFile } from "fs/promises";
+import { realpathSync as realpathSync2, existsSync as existsSync4, readFileSync as readFileSync8, readdirSync as readdirSync4 } from "fs";
+import { resolve as resolve5, extname } from "path";
+
+// app/lib/data-path.ts
+import { realpathSync } from "fs";
+import { resolve as resolve4, normalize, sep, relative, basename, join as join4 } from "path";
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "../platform");
+var DATA_ROOT = resolve4(PLATFORM_ROOT2, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve4(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["accounts"]);
+var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function crossesForeignAccountPartition(relPath, accountId) {
+  const segs = relPath.split("/").filter(Boolean);
+  if (segs.length < 2) return false;
+  if (!ACCOUNT_PARTITION_DIRS.has(segs[0])) return false;
+  const owner = segs[1];
+  if (!ACCOUNT_UUID_RE.test(owner)) return false;
+  return owner !== accountId;
+}
+function isWithinOwnAccountPartition(relPath, accountId) {
+  const segs = relPath.split("/").filter(Boolean);
+  return segs.length >= 2 && segs[0] === "accounts" && segs[1] === accountId;
+}
+function resolveUnderRoot(raw, rootAbs, rootLabel) {
+  const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
+  const absolute = resolve4(rootAbs, cleaned);
+  let rootReal;
+  try {
+    rootReal = realpathSync(rootAbs);
+  } catch (err) {
+    return {
+      ok: false,
+      status: 500,
+      error: `${rootLabel} not accessible: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  let resolvedReal;
+  try {
+    resolvedReal = realpathSync(absolute);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      if (absolute !== rootReal && !absolute.startsWith(rootReal + sep)) {
+        return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: absolute };
+      }
+      return { ok: false, status: 404, error: "Not found" };
+    }
+    return {
+      ok: false,
+      status: 500,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+  if (resolvedReal !== rootReal && !resolvedReal.startsWith(rootReal + sep)) {
+    return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: resolvedReal };
+  }
+  const relPath = relative(rootReal, resolvedReal) || ".";
+  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath };
+}
+function resolveDataPath(raw) {
+  return resolveUnderRoot(raw, DATA_ROOT, "DATA_ROOT");
+}
+function resolveClaudeUploadsPath(raw) {
+  if (!CLAUDE_UPLOADS_ROOT) {
+    return { ok: false, status: 404, error: "Not found" };
+  }
+  return resolveUnderRoot(raw, CLAUDE_UPLOADS_ROOT, "CLAUDE_UPLOADS_ROOT");
+}
+function scratchpadTmpBase() {
+  return process.env.MAXY_SCRATCHPAD_BASE ?? "/tmp";
+}
+function sessionScratchpadRoot(projectDir, sessionId) {
+  const uid = typeof process.geteuid === "function" ? process.geteuid() : 0;
+  return join4(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
+}
+function resolveScratchpadPath(raw, scratchpadRootAbs) {
+  return resolveUnderRoot(raw, scratchpadRootAbs, "scratchpad");
+}
+
+// app/lib/doc-to-text.ts
+import { unzipSync, strFromU8 } from "fflate";
+var DOCX = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+var ODT = "application/vnd.oasis.opendocument.text";
+var XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+var ODS = "application/vnd.oasis.opendocument.spreadsheet";
+var CONVERTIBLE_DOC_MIME = /* @__PURE__ */ new Set([
+  DOCX,
+  ODT,
+  "text/rtf",
+  "application/rtf",
+  XLSX,
+  ODS
+]);
+function bareMime(mimeType) {
+  return mimeType.split(";")[0].trim().toLowerCase();
+}
+function unescapeXml(s) {
+  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function unzipEntry(buffer, entry) {
+  const files = unzipSync(new Uint8Array(buffer));
+  const bytes = files[entry];
+  if (!bytes) throw new Error(`zip entry not found: ${entry}`);
+  return strFromU8(bytes);
+}
+function docxToText(buffer) {
+  const xml = unzipEntry(buffer, "word/document.xml");
+  const paras = [];
+  for (const p of xml.split("</w:p>")) {
+    const withBreaks = p.replace(/<w:tab\b[^>]*\/?>/g, "	").replace(/<w:br\b[^>]*\/?>/g, "\n");
+    let line = "";
+    for (const m of withBreaks.matchAll(/<w:t\b[^>]*>([\s\S]*?)<\/w:t>/g)) {
+      line += unescapeXml(m[1]);
+    }
+    if (line.length > 0) paras.push(line);
+  }
+  return paras.join("\n");
+}
+function odtToText(buffer) {
+  const xml = unzipEntry(buffer, "content.xml");
+  const body = xml.replace(/^[\s\S]*?<office:text\b[^>]*>/, "").replace(/<\/office:text>[\s\S]*$/, "");
+  const withBreaks = body.replace(/<text:line-break\b[^>]*\/?>/g, "\n").replace(/<text:tab\b[^>]*\/?>/g, "	").replace(/<\/text:(?:p|h)>/g, "\n");
+  const stripped = withBreaks.replace(/<[^>]+>/g, "");
+  return unescapeXml(stripped).replace(/\n{3,}/g, "\n\n").trim();
+}
+function sheetOrdinal(name) {
+  const m = name.match(/sheet(\d+)\.xml$/);
+  return m ? parseInt(m[1], 10) : 0;
+}
+function xlsxToText(buffer) {
+  const files = unzipSync(new Uint8Array(buffer));
+  const shared = [];
+  const sharedBytes = files["xl/sharedStrings.xml"];
+  if (sharedBytes) {
+    for (const si of strFromU8(sharedBytes).split("</si>")) {
+      if (!si.includes("<si")) continue;
+      const base = si.replace(/<rPh\b[\s\S]*?<\/rPh>/g, "");
+      let s = "";
+      for (const m of base.matchAll(/<t\b[^>]*>([\s\S]*?)<\/t>/g)) s += m[1];
+      shared.push(unescapeXml(s));
+    }
+  }
+  const sheetKeys = Object.keys(files).filter((n) => /^xl\/worksheets\/sheet\d+\.xml$/.test(n)).sort((a, b) => sheetOrdinal(a) - sheetOrdinal(b));
+  const sheets = [];
+  for (const key of sheetKeys) {
+    const xml = strFromU8(files[key]);
+    const rows = [];
+    for (const rowXml of xml.split("</row>")) {
+      if (!rowXml.includes("<row")) continue;
+      const cells = [];
+      for (const c of rowXml.matchAll(/<c\b([^>]*)>([\s\S]*?)<\/c>/g)) {
+        const attrs = c[1];
+        const body = c[2];
+        if (/\bt="inlineStr"/.test(attrs)) {
+          let s = "";
+          for (const m of body.matchAll(/<t\b[^>]*>([\s\S]*?)<\/t>/g)) s += m[1];
+          cells.push(unescapeXml(s));
+          continue;
+        }
+        const v = body.match(/<v\b[^>]*>([\s\S]*?)<\/v>/);
+        if (!v) {
+          cells.push("");
+          continue;
+        }
+        if (/\bt="s"/.test(attrs)) {
+          const idx = parseInt(v[1], 10);
+          cells.push(Number.isInteger(idx) && idx >= 0 && idx < shared.length ? shared[idx] : "");
+        } else {
+          cells.push(unescapeXml(v[1]));
+        }
+      }
+      while (cells.length && cells[cells.length - 1] === "") cells.pop();
+      if (cells.length) rows.push(cells.join("	"));
+    }
+    if (rows.length) sheets.push(rows.join("\n"));
+  }
+  return sheets.join("\n\n");
+}
+function odsToText(buffer) {
+  const xml = unzipEntry(buffer, "content.xml");
+  const tables = [];
+  for (const tableXml of xml.split(/<table:table(?=[\s>])/).slice(1)) {
+    const rows = [];
+    for (const rowXml of tableXml.split(/<table:table-row\b/).slice(1)) {
+      const cells = rowXml.split(/<table:(?:covered-)?table-cell\b/).slice(1).map((frag) => {
+        const withBreaks = frag.replace(/<text:line-break\b[^>]*\/?>/g, "\n").replace(/<text:tab\b[^>]*\/?>/g, "	");
+        let s = "";
+        for (const m of withBreaks.matchAll(/<text:p\b[^>]*>([\s\S]*?)<\/text:p>/g)) {
+          s += (s ? "\n" : "") + m[1].replace(/<[^>]+>/g, "");
+        }
+        return unescapeXml(s);
+      });
+      while (cells.length && cells[cells.length - 1] === "") cells.pop();
+      if (cells.length) rows.push(cells.join("	"));
+    }
+    if (rows.length) tables.push(rows.join("\n"));
+  }
+  return tables.join("\n\n");
+}
+var RTF_DROP_DEST = /^\\(?:\*|fonttbl|colortbl|stylesheet|listtable|info|pict)\b/;
+function stripRtfDestinations(s) {
+  let out = "";
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (ch === "\\" && i + 1 < s.length) {
+      out += ch + s[i + 1];
+      i++;
+      continue;
+    }
+    if (ch === "{" && RTF_DROP_DEST.test(s.slice(i + 1))) {
+      let depth = 1;
+      let j = i + 1;
+      for (; j < s.length && depth > 0; j++) {
+        if (s[j] === "\\") {
+          j++;
+          continue;
+        }
+        if (s[j] === "{") depth++;
+        else if (s[j] === "}") depth--;
+      }
+      i = j - 1;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+function rtfToText(rtf) {
+  let s = stripRtfDestinations(rtf);
+  s = s.replace(/\\par[d]?\b/g, "\n").replace(/\\line\b/g, "\n").replace(/\\tab\b/g, "	");
+  s = s.replace(/\\'([0-9a-fA-F]{2})/g, (_m, h) => String.fromCharCode(parseInt(h, 16)));
+  s = s.replace(/\\[a-zA-Z]+-?\d* ?/g, "");
+  s = s.replace(/\\([{}\\])/g, "$1").replace(/[{}]/g, "");
+  return s.replace(/[ \t]{2,}/g, " ").replace(/\n{3,}/g, "\n\n").trim();
+}
+function docToText(buffer, mimeType) {
+  const mime = bareMime(mimeType);
+  if (mime === DOCX) return docxToText(buffer);
+  if (mime === ODT) return odtToText(buffer);
+  if (mime === XLSX) return xlsxToText(buffer);
+  if (mime === ODS) return odsToText(buffer);
+  if (mime === "text/rtf" || mime === "application/rtf") return rtfToText(buffer.toString("latin1"));
+  return null;
+}
+
+// app/lib/attachments.ts
+function uploadsDirFor(accountId, subPath, attachmentId) {
+  return subPath ? resolve5(DATA_ROOT, "accounts", accountId, "uploads", subPath, attachmentId) : resolve5(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
+}
+var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "application/pdf",
+  "text/plain",
+  "text/markdown",
+  "text/csv",
+  "text/html",
+  "text/calendar",
+  "application/zip",
+  "application/x-zip-compressed",
+  // Task 1347 — Word/OpenDocument/RTF text documents. The bytes are converted to
+  // a readable-text sibling at ingestion (writeAttachment → doc-to-text.ts)
+  // because the on-device Read tool cannot parse the binary containers. rtf is
+  // reported by browsers as either text/rtf or application/rtf.
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.oasis.opendocument.text",
+  "text/rtf",
+  "application/rtf",
+  // Task 1607 — spreadsheets + presentations operators send. These land
+  // download-only in the reader; the Read tool cannot parse the binary
+  // containers and agent-readable text extraction for them is task 1608.
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  // xlsx
+  "application/vnd.ms-excel",
+  // xls
+  "application/vnd.oasis.opendocument.spreadsheet",
+  // ods
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  // pptx
+  "application/vnd.ms-powerpoint",
+  // ppt
+  "application/vnd.oasis.opendocument.presentation",
+  // odp
+  // Task 1240 — voice recordings persist as playable clips in the admin bubble.
+  // These match AUDIO_MIME_TYPES in app/lib/stt/audio-mime.ts exactly.
+  "audio/ogg",
+  "audio/opus",
+  "audio/webm",
+  "audio/mp4",
+  "audio/x-m4a",
+  "audio/mpeg",
+  "audio/wav",
+  "video/mp4"
+]);
+var MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024;
+var MAX_FILES_PER_MESSAGE = 5;
+var MAX_DATA_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
+var MAX_ZIP_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
+var EXTRACTED_TEXT_SUFFIX = ".extracted.txt";
+var ATTACHMENT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function assertSupportedMime(mimeType) {
+  const bare = mimeType.split(";")[0].trim().toLowerCase();
+  if (!SUPPORTED_MIME_TYPES.has(bare)) {
+    throw new Error(
+      `Unsupported file type: "${mimeType}". Supported types: ${[...SUPPORTED_MIME_TYPES].join(", ")}.`
+    );
+  }
+}
+function isInlineSafeMime(mimeType) {
+  const bare = mimeType.split(";")[0].trim().toLowerCase();
+  if (bare === "image/svg+xml") return false;
+  return bare.startsWith("image/") || bare === "application/pdf" || bare.startsWith("audio/") || bare === "video/mp4";
+}
+async function storeMediaBuffer(accountId, attachmentId, filename, mimeType, buffer) {
+  if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `Media exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
+    );
+  }
+  return writeAttachment(accountId, "", filename, mimeType, buffer.byteLength, buffer, attachmentId);
+}
+function attachmentExists(accountId, attachmentId) {
+  return existsSync4(resolve5(uploadsDirFor(accountId, "", attachmentId), `${attachmentId}.meta.json`));
+}
+function resolveStoredAttachment(accountId, attachmentId) {
+  if (!ATTACHMENT_ID_RE.test(attachmentId)) return null;
+  const dir = uploadsDirFor(accountId, "", attachmentId);
+  let meta;
+  try {
+    meta = JSON.parse(readFileSync8(resolve5(dir, `${attachmentId}.meta.json`), "utf8"));
+  } catch {
+    return null;
+  }
+  if (!meta || typeof meta !== "object") return null;
+  const { filename, mimeType, sizeBytes } = meta;
+  if (typeof filename !== "string" || typeof mimeType !== "string") return null;
+  const resolvedSizeBytes = typeof sizeBytes === "number" ? sizeBytes : void 0;
+  let entries;
+  try {
+    entries = readdirSync4(dir, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  const dataFile = entries.find((e) => e.isFile() && !e.name.endsWith(".meta.json") && !e.name.endsWith(EXTRACTED_TEXT_SUFFIX));
+  if (!dataFile) return null;
+  const readableSibling = `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`;
+  const readableTextPath = entries.some((e) => e.isFile() && e.name === readableSibling) ? resolve5(dir, readableSibling) : void 0;
+  return { attachmentId, filename, mimeType, sizeBytes: resolvedSizeBytes, path: resolve5(dir, dataFile.name), readableTextPath };
+}
+async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer, explicitId) {
+  const attachmentId = explicitId ?? randomUUID3();
+  const dir = uploadsDirFor(accountId, subPath, attachmentId);
+  await mkdir(dir, { recursive: true });
+  const ext = extname(filename) || "";
+  const storagePath = resolve5(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve5(dir, `${attachmentId}.meta.json`);
+  const meta = {
+    attachmentId,
+    scope: subPath || accountId,
+    filename,
+    mimeType,
+    sizeBytes,
+    storedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeFile(storagePath, buffer);
+  await writeFile(metaPath, JSON.stringify(meta, null, 2));
+  let readableTextPath;
+  const bare = mimeType.split(";")[0].trim().toLowerCase();
+  if (CONVERTIBLE_DOC_MIME.has(bare)) {
+    let text = null;
+    try {
+      text = docToText(buffer, mimeType);
+    } catch {
+      text = null;
+    }
+    console.error(`[doc-to-text] op=convert mime=${bare} ok=${text !== null} chars=${text?.length ?? 0}`);
+    if (text) {
+      const siblingPath = resolve5(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
+      try {
+        await writeFile(siblingPath, text);
+        readableTextPath = siblingPath;
+      } catch (err) {
+        console.error(`[doc-to-text] op=sibling-write mime=${bare} ok=false reason=${String(err).slice(0, 80)}`);
+      }
+    }
+  }
+  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes, readableTextPath };
+}
+async function storeAttachment(accountId, file) {
+  assertSupportedMime(file.type);
+  if (file.size > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
+    );
+  }
+  const buffer = Buffer.from(await file.arrayBuffer());
+  return writeAttachment(accountId, "", file.name, file.type, file.size, buffer);
+}
+async function storePublicAttachment(accountId, sessionId, file, buffer) {
+  assertSupportedMime(file.type);
+  if (file.size > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
+    );
+  }
+  return writeAttachment(accountId, `public/${sessionId}`, file.name, file.type, file.size, buffer);
+}
+var MIME_BY_EXT = {
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".css": "text/css",
+  ".js": "application/javascript",
+  ".json": "application/json",
+  ".csv": "text/csv",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".xml": "text/xml",
+  ".zip": "application/zip",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".odt": "application/vnd.oasis.opendocument.text",
+  ".rtf": "text/rtf",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  // Task 1607 — legacy + OpenDocument office extensions, so a device-stored file
+  // attached to a WhatsApp reply (detectMimeType → isMimeAdmitted, whatsapp-reader.ts)
+  // resolves to the mime now admitted in SUPPORTED_MIME_TYPES rather than octet-stream.
+  ".xls": "application/vnd.ms-excel",
+  ".ods": "application/vnd.oasis.opendocument.spreadsheet",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".odp": "application/vnd.oasis.opendocument.presentation",
+  ".ics": "text/calendar"
+};
+function detectMimeType(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  return MIME_BY_EXT[ext] ?? "application/octet-stream";
+}
+function validateFilePathInAccount(filePath, accountDir) {
+  const resolved = realpathSync2(filePath);
+  const accountResolved = realpathSync2(accountDir);
+  if (!resolved.startsWith(accountResolved + "/")) {
+    throw new Error(`File path is outside the account directory`);
+  }
+  return resolved;
+}
+async function storeComponentArtefact(accountId, attachmentId, mimeType, content, filename) {
+  const buffer = Buffer.from(content, "utf-8");
+  if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `Component artefact exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
+    );
+  }
+  const dir = uploadsDirFor(accountId, "", attachmentId);
+  await mkdir(dir, { recursive: true });
+  const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
+  const storagePath = resolve5(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve5(dir, `${attachmentId}.meta.json`);
+  const meta = {
+    attachmentId,
+    scope: accountId,
+    filename,
+    mimeType,
+    sizeBytes: buffer.byteLength,
+    storedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeFile(storagePath, buffer);
+  await writeFile(metaPath, JSON.stringify(meta, null, 2));
+  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes: buffer.byteLength };
+}
+
+// app/lib/whatsapp/inbound/media-download-guard.ts
+var TAG11 = "[media-guard]";
+var inFlight = 0;
+var containedCount = 0;
+function containedSinceBoot() {
+  return containedCount;
+}
+function beginMediaDownload() {
+  inFlight += 1;
+}
+function endMediaDownload() {
+  if (inFlight > 0) inFlight -= 1;
+}
+function mediaDownloadsInFlight() {
+  return inFlight;
+}
+function stackOf(err) {
+  if (err instanceof Error) return err.stack ?? err.message;
+  return String(err);
+}
+function causeCode(err) {
+  const cause = err?.cause;
+  const code = cause?.code;
+  return typeof code === "string" ? code : "none";
+}
+function handleEscapedMediaError(err, channel) {
+  const stack = stackOf(err);
+  const undiciFrame = /node_modules[\\/]undici|node:internal[\\/]deps[\\/]undici/.test(stack);
+  if (undiciFrame && inFlight > 0) {
+    containedCount += 1;
+    console.error(
+      `${TAG11} op=contained channel=${channel} inFlight=${inFlight} err=${err instanceof Error ? err.message : String(err)} cause=${causeCode(err)}
+${stack}`
+    );
+    return true;
+  }
+  console.error(
+    `${TAG11} op=escaped channel=${channel} inFlight=${inFlight} undiciFrame=${undiciFrame} err=${err instanceof Error ? err.message : String(err)} cause=${causeCode(err)} contained=false`
+  );
+  return false;
+}
+var installed = false;
+function guardInstalled() {
+  return installed;
+}
+function installMediaDownloadGuard() {
+  if (installed) return;
+  installed = true;
+  process.on("uncaughtException", (err) => {
+    if (handleEscapedMediaError(err, "uncaughtException")) return;
+    process.stderr.write(`${err instanceof Error ? err.stack ?? err.message : String(err)}
+`);
+    process.exit(1);
+  });
+  process.on("unhandledRejection", (reason) => {
+    if (handleEscapedMediaError(reason, "unhandledRejection")) return;
+    process.stderr.write(
+      `Unhandled rejection: ${reason instanceof Error ? reason.stack ?? reason.message : String(reason)}
+`
+    );
+    process.exit(1);
+  });
+  console.error(`${TAG11} op=installed`);
+}
+
+// app/lib/whatsapp/inbound/media.ts
+var TAG12 = "[whatsapp:media]";
+var MEDIA_DIR = "/tmp/maxy-media";
+var DOWNLOAD_TIMEOUT_MS = 45e3;
+var DETACHED_GRACE_MS = 3e5;
+function deterministicAttachmentId(seed) {
+  const h = createHash("sha256").update(seed).digest("hex");
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
+}
+var CACHE_RETAIN_MS = 5e3;
+var inflightDownloads = /* @__PURE__ */ new Map();
+function downloadInboundMediaBufferCached(msg, sock, opts) {
+  const key = msg.key.id ? `${msg.key.remoteJid ?? ""}:${msg.key.id}` : null;
+  if (!key) return downloadInboundMediaBuffer(msg, sock, opts);
+  const existing = inflightDownloads.get(key);
+  if (existing) return existing;
+  const p = downloadInboundMediaBuffer(msg, sock, opts);
+  inflightDownloads.set(key, p);
+  void p.then(
+    (res) => {
+      if (res === void 0) {
+        inflightDownloads.delete(key);
+      } else {
+        const t = setTimeout(() => inflightDownloads.delete(key), CACHE_RETAIN_MS);
+        t.unref?.();
+      }
+    },
+    () => inflightDownloads.delete(key)
+    // downloadInboundMediaBuffer never rejects, but be safe
+  );
+  return p;
+}
+function mimeToExt(mimetype) {
+  const map = {
+    "image/jpeg": "jpg",
+    "image/png": "png",
+    "image/webp": "webp",
+    "image/gif": "gif",
+    "audio/ogg; codecs=opus": "ogg",
+    "audio/mpeg": "mp3",
+    "audio/mp4": "m4a",
+    "video/mp4": "mp4",
+    "application/pdf": "pdf",
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document": "docx",
+    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": "xlsx"
+  };
+  return map[mimetype] ?? mimetype.split("/").pop()?.replace(/[^a-z0-9]/gi, "") ?? "bin";
+}
+function getDownloadableContent(message) {
+  const msg = message;
+  if (msg.imageMessage) return { downloadable: msg.imageMessage, mediaType: "image" };
+  if (msg.videoMessage) return { downloadable: msg.videoMessage, mediaType: "video" };
+  if (msg.audioMessage) return { downloadable: msg.audioMessage, mediaType: "audio" };
+  if (msg.documentMessage) return { downloadable: msg.documentMessage, mediaType: "document" };
+  if (msg.stickerMessage) return { downloadable: msg.stickerMessage, mediaType: "sticker" };
+  return void 0;
+}
+async function streamToBuffer(stream) {
+  const chunks = [];
+  for await (const chunk of stream) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks);
+}
+async function downloadInboundMediaBuffer(msg, sock, opts) {
+  const rawMessage = msg.message;
+  if (!rawMessage) return void 0;
+  const content = normalizeMessageContent2(rawMessage);
+  if (!content) return void 0;
+  const inner = content;
+  const mimetype = inner.imageMessage?.mimetype ?? inner.videoMessage?.mimetype ?? inner.audioMessage?.mimetype ?? inner.documentMessage?.mimetype ?? inner.stickerMessage?.mimetype ?? void 0;
+  if (!inner.imageMessage && !inner.videoMessage && !inner.audioMessage && !inner.documentMessage && !inner.stickerMessage) {
+    return void 0;
+  }
+  const maxBytes = opts?.maxBytes ?? 50 * 1024 * 1024;
+  const timeoutMs = opts?.timeoutMs ?? DOWNLOAD_TIMEOUT_MS;
+  beginMediaDownload();
+  try {
+    const settled = await withTimeout(
+      `whatsapp media download (${mimetype ?? "unknown"})`,
+      (async () => {
+        let buffer = await downloadMediaMessage(
+          msg,
+          "buffer",
+          {},
+          {
+            reuploadRequest: sock.updateMediaMessage,
+            logger: sock.logger
+          }
+        );
+        if (!buffer || buffer.length === 0) {
+          console.error(`${TAG12} primary download returned empty, trying direct fallback`);
+          const downloadable = getDownloadableContent(content);
+          if (downloadable) {
+            try {
+              const stream = await downloadContentFromMessage(downloadable.downloadable, downloadable.mediaType);
+              buffer = await streamToBuffer(stream);
+            } catch (fallbackErr) {
+              console.error(`${TAG12} direct download fallback failed: ${String(fallbackErr)}`);
+            }
+          }
+        }
+        if (!buffer || buffer.length === 0) {
+          console.error(`${TAG12} download failed: empty buffer for ${mimetype ?? "unknown"}`);
+          return void 0;
+        }
+        if (buffer.length > maxBytes) {
+          const sizeMB = (buffer.length / (1024 * 1024)).toFixed(1);
+          const limitMB = (maxBytes / (1024 * 1024)).toFixed(0);
+          console.error(`${TAG12} media too large type=${mimetype ?? "unknown"} size=${sizeMB}MB limit=${limitMB}MB`);
+          return void 0;
+        }
+        return {
+          buffer,
+          mimetype: mimetype ?? "application/octet-stream",
+          filename: inner.documentMessage?.fileName ?? void 0
+        };
+      })(),
+      timeoutMs
+    );
+    endMediaDownload();
+    return settled;
+  } catch (err) {
+    console.error(`${TAG12} media download failed type=${mimetype ?? "unknown"} error=${String(err)}`);
+    if (isTimeoutError(err)) {
+      const t = setTimeout(endMediaDownload, DETACHED_GRACE_MS);
+      t.unref?.();
+      return void 0;
+    }
+    endMediaDownload();
+    return void 0;
+  }
+}
+async function downloadInboundMedia(msg, sock, opts) {
+  const res = await downloadInboundMediaBufferCached(msg, sock, opts);
+  if (!res) return void 0;
+  await mkdir2(MEDIA_DIR, { recursive: true });
+  const ext = mimeToExt(res.mimetype);
+  const filePath = join5(MEDIA_DIR, `${randomUUID4()}.${ext}`);
+  await writeFile2(filePath, res.buffer);
+  const sizeKB = (res.buffer.length / 1024).toFixed(0);
+  console.error(`${TAG12} media downloaded type=${res.mimetype} size=${sizeKB}KB path=${filePath}`);
+  return { path: filePath, mimetype: res.mimetype, size: res.buffer.length };
+}
+async function storeInboundMediaServable(msg, sock, accountId, seed, opts) {
+  const attachmentId = deterministicAttachmentId(seed);
+  try {
+    if (attachmentExists(accountId, attachmentId)) return attachmentId;
+    const res = await downloadInboundMediaBufferCached(msg, sock, opts);
+    if (!res) {
+      console.error(`${TAG12} servable-store skip reason=no-buffer id=${attachmentId}`);
+      return null;
+    }
+    const filename = res.filename ?? `${attachmentId}.${mimeToExt(res.mimetype)}`;
+    await storeMediaBuffer(accountId, attachmentId, filename, res.mimetype, res.buffer);
+    console.error(`${TAG12} servable-store ok id=${attachmentId} mime=${res.mimetype} bytes=${res.buffer.length}`);
+    return attachmentId;
+  } catch (err) {
+    console.error(`${TAG12} servable-store FAIL id=${attachmentId} reason=${String(err).slice(0, 120)}`);
+    return null;
+  }
+}
+
+// app/lib/whatsapp/outbound/document-limits.ts
+var WHATSAPP_DOCUMENT_MAX_BYTES = 100 * 1024 * 1024;
+
+// app/lib/whatsapp/echo-store-max-bytes.ts
+function echoStoreMaxBytes(args) {
+  return args.fromMe ? WHATSAPP_DOCUMENT_MAX_BYTES : (args.mediaMaxMb ?? 50) * 1024 * 1024;
+}
+
+// app/lib/whatsapp/inbound/bounded-queue.ts
+function createBoundedQueue(limit, opts) {
+  if (!Number.isInteger(limit) || limit < 1) {
+    throw new Error(`createBoundedQueue: limit must be a positive integer, got ${limit}`);
+  }
+  const maxPending = opts?.maxPending ?? Infinity;
+  if (maxPending !== Infinity && (!Number.isInteger(maxPending) || maxPending < 1)) {
+    throw new Error(`createBoundedQueue: maxPending must be a positive integer or omitted, got ${maxPending}`);
+  }
+  const queue = [];
+  let running = 0;
+  const pump = () => {
+    while (running < limit && queue.length > 0) {
+      const task = queue.shift();
+      running++;
+      void Promise.resolve().then(task).catch(() => {
+      }).finally(() => {
+        running--;
+        pump();
+      });
+    }
+  };
+  return {
+    schedule(task) {
+      if (queue.length >= maxPending) return false;
+      queue.push(task);
+      pump();
+      return true;
+    },
+    active: () => running,
+    pending: () => queue.length
+  };
+}
+
+// app/lib/whatsapp/inbound/debounce.ts
+var TAG13 = "[whatsapp:debounce]";
+var STT_TAG = "[whatsapp:stt-await]";
+function createInboundDebouncer(opts) {
+  const { debounceMs, buildKey, onFlush, onError } = opts;
+  const awaitTimeoutMs = opts.awaitTimeoutMs ?? 3e4;
+  const pending = /* @__PURE__ */ new Map();
+  const pendingAwaits = /* @__PURE__ */ new Map();
+  let destroyed = false;
+  async function flushKey(key) {
+    const awaiting = pendingAwaits.get(key);
+    if (awaiting) {
+      const start = Date.now();
+      try {
+        await Promise.race([
+          awaiting,
+          new Promise(
+            (_, reject) => setTimeout(() => reject(new Error("stt-await-timeout")), awaitTimeoutMs)
+          )
+        ]);
+        console.error(`${STT_TAG} resolved key=${key} waited_ms=${Date.now() - start}`);
+      } catch {
+        console.error(`${STT_TAG} timeout key=${key} waited_ms=${Date.now() - start}`);
+      }
+      pendingAwaits.delete(key);
+    }
+    const batch = pending.get(key);
+    if (!batch) return;
+    clearTimeout(batch.timer);
+    pending.delete(key);
+    const batchSize = batch.entries.length;
+    try {
+      console.error(`${TAG13} debounce flush key=${key} batchSize=${batchSize}`);
+      const result = onFlush(batch.entries);
+      if (result && typeof result.catch === "function") {
+        result.catch(onError);
+      }
+    } catch (err) {
+      onError(err);
+    }
+  }
+  async function flush() {
+    const keys = Array.from(pending.keys());
+    await Promise.all(keys.map((key) => flushKey(key)));
+  }
+  function enqueue(msg) {
+    if (destroyed) return;
+    if (debounceMs <= 0) {
+      try {
+        const result = onFlush([msg]);
+        if (result && typeof result.catch === "function") {
+          result.catch(onError);
+        }
+      } catch (err) {
+        onError(err);
+      }
+      return;
+    }
+    const key = buildKey(msg);
+    if (!key) {
+      try {
+        const result = onFlush([msg]);
+        if (result && typeof result.catch === "function") {
+          result.catch(onError);
+        }
+      } catch (err) {
+        onError(err);
+      }
+      return;
+    }
+    const existing = pending.get(key);
+    if (existing) {
+      existing.entries.push(msg);
+      clearTimeout(existing.timer);
+      existing.timer = setTimeout(() => {
+        flushKey(key).catch(onError);
+      }, debounceMs);
+    } else {
+      const timer = setTimeout(() => {
+        flushKey(key).catch(onError);
+      }, debounceMs);
+      pending.set(key, { entries: [msg], timer });
+    }
+  }
+  function registerPending(key, promise) {
+    if (destroyed) return;
+    const existing = pendingAwaits.get(key);
+    if (existing) {
+      pendingAwaits.set(key, Promise.all([existing, promise]).then(() => {
+      }));
+    } else {
+      pendingAwaits.set(key, promise);
+    }
+    console.error(`${STT_TAG} pending key=${key}`);
+  }
+  async function destroy() {
+    if (destroyed) return;
+    destroyed = true;
+    await flush();
+  }
+  return { enqueue, flush, destroy, registerPending };
+}
+
+// app/lib/whatsapp/inbound/combine-batch.ts
+function combineInboundBatch(entries) {
+  const last = entries[entries.length - 1];
+  const combinedText = entries.map((e) => e.text).filter(Boolean).join("\n");
+  const media = entries.flatMap((e) => e.media);
+  return { ...last, text: combinedText, media };
+}
+
+// app/lib/whatsapp/opening-hours.ts
+var TAG14 = "[whatsapp:hours]";
+async function isBusinessOpen(accountId) {
+  try {
+    const timezone = await resolveTimezone(accountId);
+    const now = /* @__PURE__ */ new Date();
+    const dayOfWeek = getDayOfWeek(now, timezone);
+    const previousDayOfWeek = getPreviousDayOfWeek(now, timezone);
+    const currentTime = getCurrentTime(now, timezone);
+    const session = getSession();
+    try {
+      const result = await session.run(
+        `MATCH (b:LocalBusiness {accountId: $accountId})
+         OPTIONAL MATCH (b)-[:HAS_HOURS]->(hours:OpeningHoursSpecification)
+         WHERE hours.dayOfWeek IN [$dayOfWeek, $previousDayOfWeek]
+         RETURN hours.dayOfWeek AS dayOfWeek, hours.opens AS opens, hours.closes AS closes`,
+        { accountId, dayOfWeek, previousDayOfWeek }
+      );
+      if (result.records.length === 0) {
+        console.error(`${TAG14} [${accountId}] business hours check: no opening hours configured, treating as open`);
+        return { open: true, reason: "no opening hours configured" };
+      }
+      const specs = result.records.filter((r) => r.get("opens") != null && r.get("closes") != null).map((r) => ({
+        day: String(r.get("dayOfWeek")).trim(),
+        opens: String(r.get("opens")).trim(),
+        closes: String(r.get("closes")).trim()
+      }));
+      if (specs.length === 0) {
+        console.error(`${TAG14} [${accountId}] business hours check: no opening hours configured, treating as open`);
+        return { open: true, reason: "no opening hours configured" };
+      }
+      for (const spec of specs) {
+        if (!spec.opens || !spec.closes || spec.opens === spec.closes) continue;
+        const isYesterday = spec.day === previousDayOfWeek;
+        if (isYesterday) {
+          if (spec.opens > spec.closes && currentTime < spec.closes) {
+            const hoursStr = `${spec.opens}-${spec.closes} (${spec.day})`;
+            console.error(
+              `${TAG14} [${accountId}] business hours check: open (day=${dayOfWeek}, time=${currentTime}, hours=${hoursStr})`
+            );
+            return {
+              open: true,
+              reason: "within business hours",
+              dayOfWeek,
+              currentTime,
+              matchedHours: hoursStr
+            };
+          }
+        } else if (isTimeInRange(currentTime, spec.opens, spec.closes)) {
+          const hoursStr = `${spec.opens}-${spec.closes}`;
+          console.error(
+            `${TAG14} [${accountId}] business hours check: open (day=${dayOfWeek}, time=${currentTime}, hours=${hoursStr})`
+          );
+          return {
+            open: true,
+            reason: "within business hours",
+            dayOfWeek,
+            currentTime,
+            matchedHours: hoursStr
+          };
+        }
+      }
+      const todaySpecs = specs.filter((s) => s.day === dayOfWeek);
+      const allHours = todaySpecs.map((s) => `${s.opens}-${s.closes}`).join(", ") || "none today";
+      console.error(
+        `${TAG14} [${accountId}] business hours check: closed (day=${dayOfWeek}, time=${currentTime}, hours=${allHours})`
+      );
+      return {
+        open: false,
+        reason: "outside business hours",
+        dayOfWeek,
+        currentTime,
+        matchedHours: allHours
+      };
+    } finally {
+      await session.close();
+    }
+  } catch (err) {
+    console.error(
+      `${TAG14} [${accountId}] business hours check failed, treating as open: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return { open: true, reason: "hours check failed (treating as open)" };
+  }
+}
+async function resolveTimezone(accountId) {
+  try {
+    const tz = await getUserTimezone(accountId);
+    if (tz) {
+      Intl.DateTimeFormat("en-US", { timeZone: tz });
+      return tz;
+    }
+  } catch {
+  }
+  return Intl.DateTimeFormat().resolvedOptions().timeZone;
+}
+function getDayOfWeek(date, timezone) {
+  return new Intl.DateTimeFormat("en-US", { weekday: "long", timeZone: timezone }).format(date);
+}
+function getPreviousDayOfWeek(date, timezone) {
+  const yesterday = new Date(date.getTime() - 24 * 60 * 60 * 1e3);
+  return getDayOfWeek(yesterday, timezone);
+}
+function getCurrentTime(date, timezone) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    hour: "2-digit",
+    minute: "2-digit",
+    hour12: false,
+    timeZone: timezone
+  }).formatToParts(date);
+  const hour = parts.find((p) => p.type === "hour")?.value ?? "00";
+  const minute = parts.find((p) => p.type === "minute")?.value ?? "00";
+  return `${hour}:${minute}`;
+}
+function isTimeInRange(time, opens, closes) {
+  if (opens <= closes) {
+    return time >= opens && time < closes;
+  }
+  return time >= opens || time < closes;
+}
+
+// app/lib/stt/index.ts
+import { execFile } from "child_process";
+import { unlink, stat } from "fs/promises";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var TAG15 = "[stt]";
+var WHISPER_BINARY = process.env.WHISPER_BINARY ?? "/opt/whisper.cpp/build/bin/whisper-cli";
+var WHISPER_MODEL = process.env.WHISPER_MODEL ?? "/opt/whisper.cpp/models/ggml-base.bin";
+var WHISPER_TIMEOUT_MS = 20 * 60 * 1e3;
+var SPECIAL_TOKEN_RE = /\[_[A-Z]+(?:_\d+)?_?\]/g;
+function stripSpecialTokens(input) {
+  const matches = input.match(SPECIAL_TOKEN_RE);
+  const count = matches ? matches.length : 0;
+  if (!count) return { text: input, count: 0 };
+  const text = input.replace(SPECIAL_TOKEN_RE, "").replace(/[ \t]{2,}/g, " ").trim();
+  return { text, count };
+}
+async function transcribe(audioPath, mimetype) {
+  const startMs = Date.now();
+  let audioBytes = 0;
+  try {
+    const s = await stat(audioPath);
+    audioBytes = s.size;
+  } catch {
+    console.error(`${TAG15} failed: file not readable path=${audioPath}`);
+    return void 0;
+  }
+  console.error(
+    `${TAG15} start provider=whisper-local audio_bytes=${audioBytes} mimetype=${mimetype} path=${audioPath}`
+  );
+  const wavPath = audioPath.replace(/\.[^.]+$/, "") + ".wav";
+  try {
+    await execFileAsync("ffmpeg", [
+      "-i",
+      audioPath,
+      "-ar",
+      "16000",
+      "-ac",
+      "1",
+      "-c:a",
+      "pcm_s16le",
+      "-y",
+      // overwrite without prompting
+      wavPath
+    ], { timeout: 3e4 });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`${TAG15} failed: ffmpeg conversion error=${reason}`);
+    return void 0;
+  }
+  try {
+    const { stdout, stderr } = await execFileAsync(WHISPER_BINARY, [
+      "-m",
+      WHISPER_MODEL,
+      "-f",
+      wavPath,
+      "--no-timestamps",
+      "-l",
+      "auto"
+    ], { timeout: WHISPER_TIMEOUT_MS, maxBuffer: 10 * 1024 * 1024 });
+    const durationMs = Date.now() - startMs;
+    const { text, count: stripped } = stripSpecialTokens(stdout.trim());
+    if (!text) {
+      console.error(`${TAG15} failed: whisper returned empty output duration_ms=${durationMs}`);
+      return void 0;
+    }
+    const langMatch = stderr.match(/auto-detected language:\s*(\w+)/);
+    const language = langMatch?.[1] ?? "unknown";
+    const words = text.split(/\s+/).filter(Boolean).length;
+    console.error(
+      `${TAG15} done provider=whisper-local duration_ms=${durationMs} words=${words} stripped=${stripped} lang=${language}`
+    );
+    return { text, language, durationMs };
+  } catch (err) {
+    const durationMs = Date.now() - startMs;
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`${TAG15} failed provider=whisper-local duration_ms=${durationMs} error=${reason}`);
+    return void 0;
+  } finally {
+    unlink(wavPath).catch(() => {
+    });
+  }
+}
+
+// app/lib/whatsapp/reply-error.ts
+var WaReplyError = class extends Error {
+  terminal;
+  constructor(message, terminal) {
+    super(message);
+    this.name = "WaReplyError";
+    this.terminal = terminal;
+  }
+};
+
+// app/lib/whatsapp/manager.ts
+var TAG16 = "[whatsapp:manager]";
+var MAX_RECONNECT_ATTEMPTS = 10;
+var MESSAGE_STORE_MAX = 500;
+var APPEND_MEDIA_CONCURRENCY = 3;
+var APPEND_MEDIA_MAX_PENDING = 24;
+var appendMediaQueue = createBoundedQueue(APPEND_MEDIA_CONCURRENCY, {
+  maxPending: APPEND_MEDIA_MAX_PENDING
+});
+var connections = /* @__PURE__ */ new Map();
+var configDir = null;
+var whatsAppConfig = {};
+var onInboundMessage = null;
+var onNotify = null;
+function buildNotifyPending(args) {
+  const { body, truncated } = formatNotifyBody(args.text, args.mediaType);
+  const trimmed = args.pushName?.trim() ?? "";
+  return {
+    waMessageId: args.msgKeyId,
+    accountId: args.persistAccountId,
+    ledgerAccount: args.ledgerAccount,
+    senderType: args.senderType,
+    senderDisplay: trimmed.length > 0 ? trimmed : formatSenderPhone(args.senderPhone),
+    body,
+    truncated,
+    ts: args.ts
+  };
+}
+var initialized = false;
+function dispatchInboundPayload(conn, payload) {
+  if (!onInboundMessage) return;
+  decideDispatch(conn, payload, { config: whatsAppConfig, emit: onInboundMessage, log: (l) => console.error(l) });
+}
+function isObserveAccount(accountId) {
+  return !shouldDispatchInbound(whatsAppConfig, accountId);
+}
+function getWhatsAppConfig() {
+  return whatsAppConfig;
+}
+var messageStore = /* @__PURE__ */ new Map();
+function messageStoreKey(accountId, remoteJid) {
+  return `${accountId}:${remoteJid}`;
+}
+function storeMessage(storeKey, entry) {
+  let entries = messageStore.get(storeKey);
+  if (!entries) {
+    entries = [];
+    messageStore.set(storeKey, entries);
+  }
+  entries.push(entry);
+  if (entries.length > MESSAGE_STORE_MAX) {
+    const trimmed = entries.length - MESSAGE_STORE_MAX;
+    entries.splice(0, trimmed);
+    console.error(`${TAG16} message store trimmed for ${storeKey}: ${trimmed} oldest messages removed`);
+  }
+}
+function deriveCacheKey(input) {
+  if (input.isOwnerMirror || input.agentType === "admin") {
+    return `whatsapp:${input.accountId}`;
+  }
+  if (input.isGroup) {
+    if (!input.groupJid) {
+      throw new Error(
+        `deriveCacheKey: isGroup=true requires groupJid (accountId=${input.accountId}, senderPhone=${input.senderPhone})`
+      );
+    }
+    return `whatsapp:${input.accountId}:group:${input.groupJid}`;
+  }
+  return `whatsapp:${input.accountId}:${input.senderPhone}`;
+}
+function buildSelfChatDispatch(input) {
+  const senderPhone = input.selfPhone ?? "owner";
+  return {
+    accountId: input.accountId,
+    agentType: "admin",
+    senderPhone,
+    text: input.text,
+    isGroup: false,
+    reply: input.reply,
+    composing: input.composing,
+    cacheKey: deriveCacheKey({
+      agentType: "admin",
+      accountId: input.accountId,
+      senderPhone,
+      isGroup: false
+    }),
+    media: [],
+    // Self-chat is the owner: the session scopes to the house account (Task 1383),
+    // named by its platform UUID (Task 1850).
+    effectiveAccountId: input.platformAccountId,
+    // Task 1575 — self-chat is unambiguously the owner, so attribute the spawn
+    // to the owner userId even when the owner phone is unbound in users.json.
+    ownerSelfPhone: true
+  };
+}
+async function init(opts) {
+  if (initialized) {
+    console.error(`${TAG16} already initialized`);
+    return;
+  }
+  configDir = opts.configDir;
+  onInboundMessage = opts.onMessage;
+  onNotify = opts.onNotify ?? null;
+  loadConfig(opts.accountConfig);
+  const accountIds = listCredentialAccountIds(configDir);
+  if (accountIds.length === 0) {
+    console.error(`${TAG16} init: no stored WhatsApp credentials found`);
+    initialized = true;
+    return;
+  }
+  console.error(`${TAG16} init: found ${accountIds.length} credentialed account(s): ${accountIds.join(", ")}`);
+  initialized = true;
+  for (const accountId of accountIds) {
+    const accountCfg = whatsAppConfig.accounts?.[accountId];
+    if (accountCfg?.enabled === false) {
+      console.error(`${TAG16} skipping disabled account=${accountId}`);
+      continue;
+    }
+    startConnection(accountId).catch((err) => {
+      console.error(`${TAG16} failed to auto-start account=${accountId}: ${formatError(err)}`);
+    });
+  }
+}
+async function startConnection(accountId) {
+  if (!configDir) throw new Error("WhatsApp manager not initialized");
+  const authDir = resolveAuthDir(configDir, accountId);
+  const hasAuth = await authExists(authDir);
+  if (!hasAuth) {
+    console.error(`${TAG16} no credentials for account=${accountId}`);
+    return;
+  }
+  let platformAccountId;
+  let houseAccountId;
+  try {
+    platformAccountId = resolvePlatformAccountId();
+    houseAccountId = resolveHouseAccountId();
+    console.error(
+      `[whatsapp-persist] resolved-account-id waname=${accountId} uuid=${platformAccountId} house=${houseAccountId}`
+    );
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[whatsapp-persist] resolved-account-id FAIL waname=${accountId} reason=${reason}`
+    );
+    throw err;
+  }
+  await stopConnection(accountId);
+  const conn = {
+    accountId,
+    platformAccountId,
+    houseAccountId,
+    accountName: whatsAppConfig.accounts?.[accountId]?.name,
+    authDir,
+    sock: null,
+    connected: false,
+    selfPhone: null,
+    selfJid: null,
+    selfLid: null,
+    reconnectAttempts: 0,
+    abortController: new AbortController(),
+    debouncer: null,
+    lidMapping: null
+  };
+  connections.set(accountId, conn);
+  await connectWithReconnect(conn);
+}
+async function stopConnection(accountId) {
+  const conn = connections.get(accountId);
+  if (!conn) return;
+  conn.abortController.abort();
+  if (conn.debouncer) {
+    await conn.debouncer.destroy();
+    conn.debouncer = null;
+  }
+  if (conn.sock) {
+    try {
+      conn.sock.ev.removeAllListeners("messages.upsert");
+      conn.sock.ev.removeAllListeners("messages.reaction");
+      conn.sock.ev.removeAllListeners("connection.update");
+      conn.sock.ev.removeAllListeners("creds.update");
+      conn.sock.ws?.close?.();
+    } catch (err) {
+      console.warn(`${TAG16} socket cleanup error during stop account=${accountId}: ${String(err)}`);
+    }
+  }
+  connections.delete(accountId);
+  console.error(`${TAG16} stopped account=${accountId}`);
+}
+function getStatus() {
+  return Array.from(connections.values()).map((conn) => ({
+    accountId: conn.accountId,
+    accountName: conn.accountName,
+    connected: conn.connected,
+    selfPhone: conn.selfPhone ?? void 0,
+    selfJid: conn.selfJid ?? void 0,
+    reconnectAttempts: conn.reconnectAttempts,
+    lastConnectedAt: conn.lastConnectedAt,
+    lastError: conn.lastError,
+    sessionStuckReason: conn.sessionStuckReason,
+    terminalReason: conn.terminalReason
+  }));
+}
+function getSocket(accountId) {
+  return connections.get(accountId)?.sock ?? null;
+}
+function findConnectionByKey(conns, accountId) {
+  return conns.find((c) => c.accountId === accountId) ?? conns.find((c) => c.platformAccountId === accountId);
+}
+function selectConnection(conns, accountId) {
+  const presentKeys = conns.map((c) => c.accountId);
+  const conn = findConnectionByKey(conns, accountId);
+  if (!conn) return { ok: false, reason: "key-miss", presentKeys };
+  if (!conn.sock) return { ok: false, reason: "disconnected", presentKeys };
+  return { ok: true, sock: conn.sock, accountId: conn.accountId };
+}
+function resolveSocket(accountId) {
+  return selectConnection(Array.from(connections.values()), accountId);
+}
+function selectStoreAccountKey(conns, accountId) {
+  const conn = findConnectionByKey(conns, accountId);
+  return conn ? conn.platformAccountId : accountId;
+}
+function resolveReadStoreKey(accountId) {
+  return selectStoreAccountKey(Array.from(connections.values()), accountId);
+}
+function resolveInboundPersistAccount(args) {
+  const result = args.accessResult;
+  const account = result?.allowed && result.reason === "account-manager" && result.effectiveAccountId ? result.effectiveAccountId : args.connPlatformAccountId;
+  warnNonUuidAccount("inbound-persist", account);
+  return account;
+}
+function isManagerRoutedToHouse(args) {
+  const result = args.accessResult;
+  return result?.allowed === true && result.reason === "account-manager" && result.effectiveAccountId === args.houseAccountId;
+}
+function resolveConversationPersistAccount(sendAccountId, counterpartyPhone) {
+  const conn = findConnectionByKey(Array.from(connections.values()), sendAccountId);
+  if (!conn) {
+    warnNonUuidAccount("reply-append-no-connection", sendAccountId);
+    return sendAccountId;
+  }
+  const access = checkDmAccess({
+    senderPhone: counterpartyPhone,
+    selfPhone: conn.selfPhone ?? "",
+    config: whatsAppConfig,
+    // The per-number sub-config is keyed by the credential DIRNAME.
+    accountConfig: whatsAppConfig.accounts?.[conn.accountId],
+    // Task 1850 — the account SCOPE is the platform UUID. The gate assigns this
+    // to `effectiveAccountId` for every non-manager admit, and that value reaches
+    // the graph and the spawn; the dirname is a credential path, not an account.
+    accountId: conn.platformAccountId,
+    isValidAccount: (id) => isValidAccountId(id)
+  });
+  return resolveInboundPersistAccount({
+    accessResult: access,
+    connPlatformAccountId: conn.platformAccountId
+  });
+}
+function isAnyConnected() {
+  for (const conn of connections.values()) {
+    if (conn.connected) return true;
+  }
+  return false;
+}
+function listConnectionPlatformAccountIds() {
+  return [...connections.values()].map((conn) => conn.platformAccountId);
+}
+async function registerLoginSocket(accountId, sock, authDir) {
+  if (!configDir) throw new Error("WhatsApp manager not initialized");
+  let platformAccountId;
+  let houseAccountId;
+  try {
+    platformAccountId = resolvePlatformAccountId();
+    houseAccountId = resolveHouseAccountId();
+    console.error(
+      `[whatsapp-persist] resolved-account-id waname=${accountId} uuid=${platformAccountId} house=${houseAccountId}`
+    );
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[whatsapp-persist] resolved-account-id FAIL waname=${accountId} reason=${reason}`
+    );
+    throw err;
+  }
+  await stopConnection(accountId);
+  const conn = {
+    accountId,
+    platformAccountId,
+    houseAccountId,
+    accountName: whatsAppConfig.accounts?.[accountId]?.name,
+    authDir,
+    sock,
+    connected: true,
+    selfPhone: null,
+    selfJid: null,
+    selfLid: null,
+    reconnectAttempts: 0,
+    lastConnectedAt: Date.now(),
+    abortController: new AbortController(),
+    debouncer: null,
+    lidMapping: null
+  };
+  applySelfIdentity(conn, sock, "register");
+  connections.set(accountId, conn);
+  monitorInbound(conn);
+  try {
+    await sock.sendPresenceUpdate("available");
+    console.error(`${TAG16} presence set to available account=${accountId}`);
+  } catch (err) {
+    console.error(`${TAG16} presence update failed account=${accountId}: ${String(err)}`);
+  }
+  await runInitQueries(sock, {
+    accountId,
+    authDir,
+    selfPhone: conn.selfPhone,
+    attempt: 0,
+    signal: conn.abortController.signal
+  });
+  watchForDisconnect(conn);
+  attachSelfIdRefreshOnCredsUpdate(conn);
+  console.error(`${TAG16} registered login socket for account=${accountId} phone=${conn.selfPhone ?? "unknown"}`);
+}
+function attachSelfIdRefreshOnCredsUpdate(conn) {
+  if (!conn.sock) return;
+  const sock = conn.sock;
+  const handler = () => {
+    setTimeout(() => {
+      try {
+        const fresh = readSelfId(conn.authDir);
+        const lidChanged = fresh.lid !== conn.selfLid;
+        conn.selfPhone = fresh.e164;
+        conn.selfJid = fresh.jid;
+        conn.selfLid = fresh.lid;
+        const rawLidMapping = sock?.signalRepository?.lidMapping ?? null;
+        conn.lidMapping = withSelfLidShortcut(rawLidMapping, fresh.lid, fresh.jid);
+        if (lidChanged) {
+          if (fresh.lid) {
+            console.error(`[whatsapp:lid] resolved self-lid accountId=${conn.accountId} selfLid=${fresh.lid} source=creds-update`);
+          } else {
+            console.error(`[whatsapp:lid] FAIL self-lid-resolution accountId=${conn.accountId} reason=creds-update-cleared-lid`);
+          }
+        }
+      } catch (err) {
+        console.error(`[whatsapp:lid] FAIL self-lid-refresh accountId=${conn.accountId} reason=${String(err).slice(0, 80)}`);
+      }
+    }, 1e3).unref?.();
+  };
+  sock.ev.on("creds.update", handler);
+}
+function reloadConfig(accountConfig) {
+  loadConfig(accountConfig);
+}
+function getMessages(accountId, jid, limit) {
+  const entries = messageStore.get(messageStoreKey(accountId, jid)) ?? [];
+  return limit ? entries.slice(-limit) : entries.slice();
+}
+function listConversationJids(accountId) {
+  const prefix = messageStoreKey(accountId, "");
+  const jids = [];
+  for (const key of messageStore.keys()) {
+    if (key.startsWith(prefix)) {
+      jids.push(key.slice(prefix.length));
+    }
+  }
+  return jids;
+}
+function listStoreAccountKeys() {
+  const accounts = /* @__PURE__ */ new Set();
+  for (const key of messageStore.keys()) {
+    const i = key.indexOf(":");
+    if (i > 0) accounts.add(key.slice(0, i));
+  }
+  return [...accounts];
+}
+async function shutdown() {
+  await drainCredsSaveQueue();
+  const ids = Array.from(connections.keys());
+  await Promise.all(ids.map((id) => stopConnection(id)));
+  initialized = false;
+  console.error(`${TAG16} shutdown complete`);
+}
+function loadConfig(accountConfig) {
+  try {
+    const raw = accountConfig?.whatsapp;
+    if (raw && typeof raw === "object") {
+      const wa = raw;
+      const result = parseWhatsAppConfigTolerant(wa);
+      if (result.ok) {
+        whatsAppConfig = result.data;
+        if (result.droppedKeys.length > 0) {
+          console.error(`${TAG16} config: dropped unknown keys=[${result.droppedKeys.join(",")}] preserved known config`);
+        }
+      } else {
+        console.error(`${TAG16} config validation failed: ${result.error.message}`);
+        whatsAppConfig = {};
+      }
+      const diskAdmin = Array.isArray(wa.adminPhones) ? wa.adminPhones : [];
+      if (diskAdmin.length > 0 && (whatsAppConfig.adminPhones?.length ?? 0) === 0) {
+        console.error(`${TAG16} WARN adminPhones present on disk but empty after load`);
+      }
+    }
+  } catch (err) {
+    console.error(`${TAG16} config load error: ${String(err)}`);
+    whatsAppConfig = {};
+  }
+}
+async function connectWithReconnect(conn) {
+  const maxAttempts = MAX_RECONNECT_ATTEMPTS;
+  while (!conn.abortController.signal.aborted) {
+    let uptimeMs = 0;
+    let cycleError = null;
+    let connectedAt;
+    try {
+      console.error(`${TAG16} connecting account=${conn.accountId} attempt=${conn.reconnectAttempts}`);
+      if (conn.debouncer) {
+        await conn.debouncer.destroy();
+        conn.debouncer = null;
+      }
+      const sock = await createWaSocket({
+        authDir: conn.authDir,
+        silent: true,
+        account: conn.accountId
+      });
+      conn.sock = sock;
+      applySelfIdentity(conn, sock, "pre-listener");
+      monitorInbound(conn);
+      console.error(`${TAG16} socket created account=${conn.accountId} \u2014 waiting for connection`);
+      await waitForConnection(sock);
+      connectedAt = Date.now();
+      conn.connected = true;
+      conn.lastConnectedAt = connectedAt;
+      conn.lastError = void 0;
+      conn.terminalReason = void 0;
+      applySelfIdentity(conn, sock, "post-connect");
+      console.error(`${TAG16} connected account=${conn.accountId} phone=${conn.selfPhone ?? "unknown"}`);
+      try {
+        await sock.sendPresenceUpdate("available");
+        console.error(`${TAG16} presence set to available account=${conn.accountId}`);
+      } catch (err) {
+        console.error(`${TAG16} presence update failed account=${conn.accountId}: ${String(err)}`);
+      }
+      await runInitQueries(sock, {
+        accountId: conn.accountId,
+        authDir: conn.authDir,
+        selfPhone: conn.selfPhone,
+        attempt: conn.reconnectAttempts,
+        signal: conn.abortController.signal
+      });
+      attachSelfIdRefreshOnCredsUpdate(conn);
+      await waitForDisconnectEvent(conn);
+      uptimeMs = Date.now() - connectedAt;
+      conn.connected = false;
+      conn.sock = null;
+    } catch (err) {
+      conn.connected = false;
+      conn.sock = null;
+      cycleError = err;
+      if (connectedAt) {
+        uptimeMs = Date.now() - connectedAt;
+      }
+      const classification = classifyDisconnect(err);
+      conn.lastError = classification.message;
+      console.error(`${TAG16} disconnect account=${conn.accountId}: ${classification.kind} \u2014 ${classification.message}`);
+      if (!classification.shouldRetry) {
+        conn.terminalReason = classification.message;
+        console.error(`${TAG16} terminal disconnect for account=${conn.accountId}, stopping reconnection`);
+        return;
+      }
+    }
+    const decision = computeReconnectNextState({
+      reconnectAttempts: conn.reconnectAttempts,
+      uptimeMs,
+      stableThresholdMs: STABLE_UPTIME_MS,
+      maxAttempts
+    });
+    if (decision.action === "abort") {
+      const stuckReason = `GIVING UP account=${conn.accountId} attempts=${decision.finalAttempts}/${maxAttempts} uptimeMsLast=${uptimeMs} stableThresholdMs=${STABLE_UPTIME_MS} lastError=${conn.lastError ?? "(none)"}`;
+      console.error(
+        `${TAG16} ${stuckReason} \u2014 re-pair via QR or restart required; WhatsApp will not reconnect automatically`
+      );
+      conn.sessionStuckReason = stuckReason;
+      conn.lastError = stuckReason;
+      return;
+    }
+    conn.reconnectAttempts = decision.nextAttempts;
+    if (decision.reason === "short-lived") {
+      console.error(
+        `${TAG16} short-lived session account=${conn.accountId} uptimeMs=${uptimeMs} attempt=${decision.nextAttempts}/${maxAttempts} lastError=${conn.lastError ?? "(clean disconnect)"}`
+      );
+    } else {
+      console.error(
+        `${TAG16} session stable account=${conn.accountId} uptimeMs=${uptimeMs} \u2014 reconnect counter reset`
+      );
+    }
+    if (decision.reason === "short-lived" || cycleError) {
+      const delay = computeBackoff(Math.max(1, decision.nextAttempts));
+      console.error(
+        `${TAG16} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
+      );
+      await new Promise((resolve6) => {
+        const timer = setTimeout(resolve6, delay);
+        conn.abortController.signal.addEventListener("abort", () => {
+          clearTimeout(timer);
+          resolve6();
+        }, { once: true });
+      });
+    }
+    if (conn.abortController.signal.aborted) return;
+  }
+}
+function waitForDisconnectEvent(conn) {
+  return new Promise((resolve6) => {
+    if (!conn.sock) {
+      resolve6();
+      return;
+    }
+    const sock = conn.sock;
+    const handler = (update) => {
+      if (update.connection === "close") {
+        sock.ev.off("connection.update", handler);
+        resolve6();
+      }
+    };
+    sock.ev.on("connection.update", handler);
+  });
+}
+function watchForDisconnect(conn) {
+  if (!conn.sock) return;
+  conn.sock.ev.on("connection.update", (update) => {
+    if (update.connection === "close") {
+      if (connections.get(conn.accountId) !== conn) return;
+      console.error(`${TAG16} socket disconnected for account=${conn.accountId}`);
+      conn.connected = false;
+      conn.sock = null;
+      connectWithReconnect(conn).catch((err) => {
+        console.error(`${TAG16} reconnection failed for account=${conn.accountId}: ${formatError(err)}`);
+      });
+    }
+  });
+}
+function applySelfIdentity(conn, sock, phase) {
+  const selfId = readSelfId(conn.authDir);
+  conn.selfPhone = selfId.e164;
+  conn.selfJid = selfId.jid;
+  conn.selfLid = selfId.lid;
+  const rawLidMapping = sock.signalRepository?.lidMapping ?? null;
+  conn.lidMapping = withSelfLidShortcut(rawLidMapping, selfId.lid, selfId.jid);
+  if (selfId.lid) {
+    console.error(
+      `[whatsapp:lid] resolved self-lid accountId=${conn.accountId} selfLid=${selfId.lid} source=creds phase=${phase}`
+    );
+  } else {
+    console.error(
+      `[whatsapp:lid] FAIL self-lid-resolution accountId=${conn.accountId} reason=creds-missing-lid phase=${phase}`
+    );
+  }
+}
+function monitorInbound(conn) {
+  if (!conn.sock || !onInboundMessage) return;
+  const sock = conn.sock;
+  const debounceMs = whatsAppConfig.accounts?.[conn.accountId]?.debounceMs ?? whatsAppConfig.debounceMs ?? 0;
+  console.error(`${TAG16} monitorInbound started account=${conn.accountId} debounceMs=${debounceMs}`);
+  conn.debouncer = createInboundDebouncer({
+    debounceMs,
+    buildKey: (payload) => {
+      const conversationKey = payload.isGroup ? payload.groupJid : payload.senderPhone;
+      return `${payload.accountId}:${conversationKey ?? payload.senderPhone}:${payload.senderPhone}`;
+    },
+    onFlush: (entries) => {
+      if (!onInboundMessage) return;
+      if (entries.length > 1) {
+        console.error(`${TAG16} debounce: combining ${entries.length} messages account=${conn.accountId} from=${entries[0].senderPhone}`);
+      }
+      dispatchInboundPayload(conn, combineInboundBatch(entries));
+    },
+    onError: (err) => {
+      console.error(`${TAG16} debounce flush error account=${conn.accountId}: ${String(err)}`);
+    }
+  });
+  sock.ev.on("messages.upsert", async (upsert) => {
+    if (upsert.type !== "notify" && upsert.type !== "append") return;
+    for (const msg of upsert.messages) {
+      try {
+        const remoteJid = msg.key.remoteJid;
+        if (!remoteJid || remoteJid === "status@broadcast") continue;
+        if (!msg.message) continue;
+        let receiptDeferredToWorker = false;
+        let dmAccess = null;
+        const extracted = extractMessage(msg);
+        const mediaServable = !!(extracted.mediaType && extracted.mimetype);
+        if (!extracted.text && !mediaServable && msg.key.id) {
+          markDeclined({
+            msgId: msg.key.id,
+            account: conn.accountId,
+            reason: "no-persistable-content"
+          });
+        }
+        if (extracted.text || mediaServable) {
+          const isGroup = isGroupJid(remoteJid);
+          const senderJid = isGroup ? msg.key.participant ?? remoteJid : remoteJid;
+          const senderPhone = await resolveJidToE164(senderJid, conn.lidMapping) ?? senderJid;
+          const ts = msg.messageTimestamp ? Number(msg.messageTimestamp) : Math.floor(Date.now() / 1e3);
+          const fromMe = Boolean(msg.key.fromMe);
+          dmAccess = isGroup ? null : checkDmAccess({
+            senderPhone,
+            selfPhone: conn.selfPhone ?? "",
+            config: whatsAppConfig,
+            // Keyed by the credential DIRNAME — a per-number sub-config.
+            accountConfig: whatsAppConfig.accounts?.[conn.accountId],
+            // Task 1850 — the account SCOPE is the platform UUID, never the
+            // dirname. See resolveConversationPersistAccount.
+            accountId: conn.platformAccountId,
+            isValidAccount: (id) => isValidAccountId(id)
+          });
+          const persistAccountId = resolveInboundPersistAccount({
+            accessResult: dmAccess,
+            connPlatformAccountId: conn.platformAccountId
+          });
+          const managerScoped = dmAccess?.allowed === true && dmAccess.reason === "account-manager";
+          {
+            const notifyDecision = decideWaNotify({
+              upsertType: upsert.type,
+              fromMe,
+              msgKeyId: msg.key.id,
+              // This block only runs when the persist gate at :1286 passed.
+              hasPersistableContent: true,
+              // A callback, not a boolean: `isNotifyDuplicate` marks the id it
+              // is asked about, and the gate calls this last so only a message
+              // that actually notifies burns its id.
+              isDuplicate: () => msg.key.id ? isNotifyDuplicate(msg.key.id) : false,
+              access: dmAccess
+            });
+            if (msg.key.id && !(notifyDecision.emit === false && notifyDecision.reason === "duplicate")) {
+              appendNotifyEligible({
+                msgId: msg.key.id,
+                account: conn.accountId,
+                upsertType: upsert.type,
+                fromMe,
+                allowed: dmAccess?.allowed === true,
+                reason: dmAccess?.reason ?? "group",
+                passive: dmAccess?.passive === true,
+                persistAccount: persistAccountId
+              });
+            }
+            if (notifyDecision.emit && msg.key.id) {
+              console.error(
+                `[wa-notify] op=eligible msgId=${msg.key.id} account=${persistAccountId} senderType=${notifyDecision.senderType} reason=${dmAccess?.reason ?? "none"} passive=${dmAccess?.passive === true}`
+              );
+              if (onNotify) {
+                try {
+                  onNotify(
+                    buildNotifyPending({
+                      msgKeyId: msg.key.id,
+                      pushName: msg.pushName ?? void 0,
+                      senderPhone,
+                      text: extracted.text,
+                      mediaType: extracted.mediaType,
+                      senderType: notifyDecision.senderType,
+                      persistAccountId,
+                      ledgerAccount: conn.accountId,
+                      ts
+                    })
+                  );
+                } catch (err) {
+                  console.error(
+                    `[wa-notify] op=emit-failed msgId=${msg.key.id} detail=${err instanceof Error ? err.message : String(err)}`
+                  );
+                }
+              }
+            } else if (!notifyDecision.emit) {
+              console.error(
+                `[wa-notify] op=skip msgId=${msg.key.id ?? "none"} reason=${notifyDecision.reason}`
+              );
+            }
+          }
+          const storeKey = messageStoreKey(persistAccountId, remoteJid);
+          if (extracted.text) {
+            storeMessage(storeKey, {
+              id: msg.key.id ?? `${remoteJid}-${ts}`,
+              sender: senderPhone,
+              senderName: msg.pushName ?? void 0,
+              body: extracted.text,
+              timestamp: ts,
+              fromMe: Boolean(msg.key.fromMe),
+              quoted: extracted.quotedMessage ? { id: extracted.quotedMessage.id, body: extracted.quotedMessage.text, sender: extracted.quotedMessage.sender } : void 0
+            });
+          }
+          const entries = messageStore.get(storeKey);
+          console.error(
+            `${TAG16} stored message ${msg.key.id ?? "?"} for ${remoteJid} (type: ${upsert.type}, store size: ${entries?.length ?? 0}/${MESSAGE_STORE_MAX}) storeAccount=${persistAccountId} socketOwner=${conn.platformAccountId}`
+          );
+          recordActivity({
+            accountId: conn.accountId,
+            direction: "inbound",
+            jid: remoteJid
+          });
+          const cacheKeyAgentType = isGroup ? "public" : fromMe ? "admin" : dmAccess?.agentType ?? "public";
+          const cacheKey = deriveCacheKey({
+            agentType: cacheKeyAgentType,
+            // Task 1786 — an account-manager keys on its bound sub-account, so a
+            // manager gets its own `:Conversation` instead of merging into the
+            // owner's bare `whatsapp:<dirname>` owner-mirror row. `deriveCacheKey`
+            // returns `whatsapp:<accountId>` for admin; a UUID contains no colon,
+            // so the key stays 2 segments and `deriveScope` still reads "admin".
+            // Every non-manager case passes conn.accountId, byte-identical.
+            accountId: managerScoped ? persistAccountId : conn.accountId,
+            senderPhone,
+            isGroup,
+            groupJid: isGroup ? remoteJid : void 0,
+            isOwnerMirror: fromMe && !isGroup
+          });
+          if (msg.key.id) {
+            const merged = await ensureWhatsAppConversation({
+              accountId: conn.accountId,
+              platformAccountId: persistAccountId,
+              // Task 1786 — the socket owner, logged beside the stamped account
+              // so a divergence between the two is one greppable line.
+              connectionAccountId: conn.platformAccountId,
+              cacheKey,
+              agentType: cacheKeyAgentType,
+              groupJid: isGroup ? remoteJid : void 0
+            });
+            if (merged) {
+              const { canonical: canonicalRemoteJid } = await resolveCanonicalConversationJid(
+                remoteJid,
+                conn.lidMapping
+              );
+              const alreadyRecorded = fromMe && echoAlreadyRecorded({
+                readConversation,
+                // Task 1786 — read the account /reply now APPENDS under. The
+                // echo gate asks "did /reply already store this?", so it must
+                // look in the same store file the reply landed in; reading the
+                // socket owner's file would report every manager echo as
+                // unrecorded and store a duplicate copy.
+                platformAccountId: persistAccountId,
+                canonicalRemoteJid,
+                accountId: conn.accountId,
+                remoteJid,
+                msgKeyId: msg.key.id
+              });
+              const wantsServableMedia = mediaServable && !!conn.sock && (!fromMe || !alreadyRecorded);
+              if (fromMe && mediaServable && !!conn.sock) {
+                console.error(
+                  `${TAG16} fromMe-media-echo msgKey=${msg.key.id} decision=${alreadyRecorded ? "skip" : "store"} reason=${alreadyRecorded ? "already-recorded" : "no-prior-record"}`
+                );
+              }
+              const mediaSeed = `whatsapp-live:${conn.accountId}:${canonicalRemoteJid}:${msg.key.id}`;
+              const maxBytes = echoStoreMaxBytes({
+                fromMe,
+                mediaMaxMb: whatsAppConfig.mediaMaxMb
+              });
+              const basePersist = {
+                accountId: conn.accountId,
+                platformAccountId: persistAccountId,
+                remoteJid,
+                canonicalRemoteJid,
+                cacheKey,
+                sessionId: merged.sessionId,
+                msgKeyId: msg.key.id,
+                fromMe,
+                senderPhone,
+                selfPhone: conn.selfPhone,
+                timestamp: ts,
+                pushName: msg.pushName ?? void 0,
+                quoted: extracted.quotedMessage ? {
+                  id: extracted.quotedMessage.id,
+                  body: extracted.quotedMessage.text,
+                  sender: extracted.quotedMessage.sender
+                } : void 0
+              };
+              if (wantsServableMedia && upsert.type === "append") {
+                const sock2 = conn.sock;
+                const platformAccountId = persistAccountId;
+                const caption = extracted.caption ?? "";
+                const fallbackBody = mediaFallbackBody(extracted);
+                const msgKeyId = msg.key.id;
+                const participant = isGroupJid(remoteJid) ? msg.key.participant ?? void 0 : void 0;
+                const sendReceipts = whatsAppConfig.accounts?.[conn.accountId]?.sendReadReceipts ?? whatsAppConfig.sendReadReceipts ?? true;
+                const sendAppendReceipt = () => {
+                  if (sendReceipts && msgKeyId) {
+                    sendReadReceipt(sock2, remoteJid, [msgKeyId], participant, conn.accountId);
+                  }
+                };
+                const accepted = appendMediaQueue.schedule(async () => {
+                  const id = await storeInboundMediaServable(msg, sock2, platformAccountId, mediaSeed, { maxBytes }) ?? void 0;
+                  const persisted = await persistWhatsAppMessage({
+                    ...basePersist,
+                    body: id ? caption : fallbackBody,
+                    attachmentId: id
+                  });
+                  if (persisted) sendAppendReceipt();
+                });
+                receiptDeferredToWorker = true;
+                if (!accepted) {
+                  console.error(
+                    `${TAG16} append-media overflow account=${conn.platformAccountId} msgKey=${msgKeyId ?? "?"} \u2014 pending cap ${APPEND_MEDIA_MAX_PENDING} reached, text-fallback persist, inline media shed`
+                  );
+                  const persisted = await persistWhatsAppMessage({
+                    ...basePersist,
+                    body: fallbackBody,
+                    attachmentId: void 0
+                  });
+                  if (persisted) sendAppendReceipt();
+                }
+              } else {
+                let mediaAttachmentId;
+                if (wantsServableMedia) {
+                  mediaAttachmentId = await storeInboundMediaServable(
+                    msg,
+                    conn.sock,
+                    // Task 1786 — attachment bytes follow the record's account.
+                    persistAccountId,
+                    mediaSeed,
+                    { maxBytes }
+                  ) ?? void 0;
+                }
+                await persistWhatsAppMessage({
+                  ...basePersist,
+                  body: mediaAttachmentId ? extracted.caption ?? "" : extracted.text,
+                  attachmentId: mediaAttachmentId
+                });
+              }
+            }
+          }
+        }
+        if (upsert.type === "append") {
+          const sendReceipts = whatsAppConfig.accounts?.[conn.accountId]?.sendReadReceipts ?? whatsAppConfig.sendReadReceipts ?? true;
+          if (sendReceipts && msg.key.id && !receiptDeferredToWorker) {
+            sendReadReceipt(
+              sock,
+              remoteJid,
+              [msg.key.id],
+              isGroupJid(remoteJid) ? msg.key.participant ?? void 0 : void 0,
+              conn.accountId
+            );
+          }
+          const decision = evaluateSelfChatCommand({
+            accountId: conn.accountId,
+            remoteJid,
+            fromMe: Boolean(msg.key.fromMe),
+            msgId: msg.key.id ?? null,
+            messageTimestampSec: msg.messageTimestamp ? Number(msg.messageTimestamp) : null,
+            lastConnectedAtMs: conn.lastConnectedAt ?? null,
+            selfJid: conn.selfJid,
+            selfLid: conn.selfLid,
+            selfPhone: conn.selfPhone,
+            text: extracted.text || null
+          });
+          if (decision.kind === "dispatch" && onInboundMessage) {
+            const reply = async (text) => {
+              const currentSock = conn.sock;
+              if (!currentSock) throw new Error("WhatsApp disconnected \u2014 cannot reply");
+              await sendTextMessage(currentSock, remoteJid, text, { accountId: conn.accountId });
+            };
+            const composing = async () => {
+              const currentSock = conn.sock;
+              if (currentSock) await sendComposing(currentSock, remoteJid);
+            };
+            dispatchInboundPayload(conn, buildSelfChatDispatch({
+              accountId: conn.accountId,
+              platformAccountId: conn.platformAccountId,
+              selfPhone: conn.selfPhone,
+              remoteJid,
+              text: decision.text,
+              reply,
+              composing
+            }));
+            continue;
+          }
+          const skippedSenderJid = isGroupJid(remoteJid) ? msg.key.participant ?? remoteJid : remoteJid;
+          const skippedSenderPhone = await resolveJidToE164(skippedSenderJid, conn.lidMapping) ?? skippedSenderJid;
+          console.error(
+            `${TAG16} append-type message ${msg.key.id ?? "?"} dispatch skipped from=${skippedSenderPhone}${msg.pushName ? ` name=${msg.pushName}` : ""} account=${conn.accountId} (persistence not confirmed here)`
+          );
+          continue;
+        }
+        await handleInboundMessage(conn, msg);
+      } catch (err) {
+        console.error(`${TAG16} inbound handler error account=${conn.accountId}: ${String(err)}`);
+      }
+    }
+  });
+  console.error(`[whatsapp-reaction] op=subscribed account=${conn.platformAccountId}`);
+  sock.ev.on("messages.reaction", async (reactions) => {
+    for (const entry of reactions) {
+      try {
+        const sig = readReactionEntry(entry);
+        if (!sig) continue;
+        if (sig.fromMe) continue;
+        const reactorTelephone = await resolveJidToE164(sig.reactorJid, conn.lidMapping) ?? sig.reactorJid;
+        const { canonical: canonicalRemoteJid } = await resolveCanonicalConversationJid(
+          sig.chatJid,
+          conn.lidMapping
+        );
+        console.error(
+          `[whatsapp-reaction] op=recv account=${conn.platformAccountId} target=${sig.targetMsgKeyId} reactor=${reactorTelephone} emoji=${sig.emoji || "EMPTY"} group=${sig.isGroup}`
+        );
+        const convo = readConversation(conn.platformAccountId, canonicalRemoteJid);
+        const target = convo.find((m) => m.msgKeyId === sig.targetMsgKeyId);
+        const reactorName = target && !target.fromMe && target.senderTelephone === reactorTelephone ? target.senderName : convo.find((m) => m.senderTelephone === reactorTelephone && m.senderName)?.senderName ?? null;
+        if (target) {
+          console.error(`[whatsapp-reaction] op=target-ok account=${conn.platformAccountId} target=${sig.targetMsgKeyId}`);
+        } else {
+          console.error(`[whatsapp-reaction] op=orphan account=${conn.platformAccountId} target=${sig.targetMsgKeyId} reason=target-not-found`);
+        }
+        const dateSent = sig.timestampMs ? new Date(sig.timestampMs).toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+        const { appended } = appendReaction(conn.platformAccountId, {
+          kind: "reaction",
+          targetMsgKeyId: sig.targetMsgKeyId,
+          reactorTelephone,
+          reactorName,
+          emoji: sig.emoji,
+          removed: sig.removed,
+          dateSent,
+          remoteJid: canonicalRemoteJid
+        });
+        if (appended) {
+          console.error(
+            `[whatsapp-reaction] op=persist account=${conn.platformAccountId} target=${sig.targetMsgKeyId} reactor=${reactorTelephone} emoji=${sig.emoji || "EMPTY"} removed=${sig.removed}`
+          );
+        } else {
+          console.error(`[whatsapp-reaction] op=persist-fail account=${conn.platformAccountId} target=${sig.targetMsgKeyId} reason=append-failed`);
+        }
+      } catch (err) {
+        console.error(`[whatsapp-reaction] op=persist-fail account=${conn.platformAccountId} reason=${String(err).slice(0, 120)}`);
+      }
+    }
+  });
+}
+async function handleInboundMessage(conn, msg) {
+  if (!conn.sock || !onInboundMessage) return;
+  const remoteJid = msg.key.remoteJid;
+  if (!remoteJid) return;
+  if (remoteJid === "status@broadcast") {
+    console.error(`${TAG16} drop: status broadcast account=${conn.accountId}`);
+    return;
+  }
+  if (!msg.message) {
+    console.error(`${TAG16} drop: empty message account=${conn.accountId} from=${remoteJid}`);
+    return;
+  }
+  const dedupKey = `${conn.accountId}:${remoteJid}:${msg.key.id}`;
+  if (isDuplicateInbound(dedupKey)) {
+    console.error(`${TAG16} drop: duplicate account=${conn.accountId} key=${dedupKey}`);
+    return;
+  }
+  if (msg.key.fromMe) {
+    if (msg.key.id && isAgentSentMessage(msg.key.id)) {
+      console.error(`${TAG16} drop: echo suppression account=${conn.accountId} msgId=${msg.key.id}`);
+      return;
+    }
+    const extracted2 = extractMessage(msg);
+    if (!extracted2.text) {
+      console.error(`${TAG16} owner reply skipped \u2014 no text content account=${conn.accountId}`);
+      return;
+    }
+    const isGroup2 = isGroupJid(remoteJid);
+    const senderPhone2 = conn.selfPhone ?? "owner";
+    console.error(`${TAG16} owner reply mirrored to session from=${senderPhone2} account=${conn.accountId}`);
+    const reply2 = async (text) => {
+      const currentSock = conn.sock;
+      if (!currentSock) throw new Error("WhatsApp disconnected \u2014 cannot reply");
+      await sendTextMessage(currentSock, remoteJid, text, { accountId: conn.accountId });
+    };
+    const composing2 = async () => {
+      const currentSock = conn.sock;
+      if (currentSock) await sendComposing(currentSock, remoteJid);
+    };
+    dispatchInboundPayload(conn, {
+      accountId: conn.accountId,
+      agentType: "admin",
+      senderPhone: senderPhone2,
+      text: `[Owner reply] ${extracted2.text}`,
+      isGroup: isGroup2,
+      groupJid: isGroup2 ? remoteJid : void 0,
+      reply: reply2,
+      composing: composing2,
+      cacheKey: deriveCacheKey({
+        agentType: "admin",
+        accountId: conn.accountId,
+        senderPhone: senderPhone2,
+        isGroup: isGroup2,
+        groupJid: isGroup2 ? remoteJid : void 0,
+        isOwnerMirror: true
+      }),
+      media: [],
+      isOwnerMirror: true
+    });
+    return;
+  }
+  const extracted = extractMessage(msg);
+  if (!extracted.text && !extracted.mediaType) {
+    console.error(`${TAG16} drop: no text or media account=${conn.accountId} from=${remoteJid}`);
+    return;
+  }
+  const isGroup = isGroupJid(remoteJid);
+  const senderJid = isGroup ? msg.key.participant ?? remoteJid : remoteJid;
+  const senderPhone = await resolveJidToE164(senderJid, conn.lidMapping) ?? senderJid;
+  const lidCapture = lidCaptureFor(senderJid, senderPhone);
+  if (lidCapture) recordLidMapping(lidCapture.numericLid, lidCapture.e164);
+  const selfPhone = conn.selfPhone ?? "";
+  let accessResult;
+  if (isGroup) {
+    accessResult = checkGroupAccess({ groupJid: remoteJid });
+  } else {
+    accessResult = await resolveDmAccess({
+      senderPhone,
+      selfPhone,
+      config: whatsAppConfig,
+      accountConfig: whatsAppConfig.accounts?.[conn.accountId],
+      accountId: conn.platformAccountId,
+      isValidAccount: (id) => isValidAccountId(id),
+      resolvePersonByPhone
+    });
+  }
+  console.error(
+    `${TAG16} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
+  );
+  if (!accessResult.allowed && accessResult.reason === "account-manager-unresolved") {
+    console.error(
+      `[whatsapp-native] op=account-manager-reject senderId=${senderPhone} reason=unresolved-effective-account`
+    );
+  }
+  if (isManagerRoutedToHouse({
+    accessResult,
+    houseAccountId: conn.houseAccountId
+  })) {
+    console.error(
+      `[whatsapp-native] op=escalation-tripwire senderId=${senderPhone} reason=account-manager-routed-to-house effectiveAccount=${accessResult.effectiveAccountId}`
+    );
+    return;
+  }
+  if (!accessResult.allowed) return;
+  if (isCustomerTurnSuppressed(accessResult.agentType, isHouseManagedService())) {
+    console.error(
+      `[channel-house] op=inbound from=${senderPhone} accountId=${conn.platformAccountId} autoReply=suppressed`
+    );
+    return;
+  }
+  const sendReceipts = whatsAppConfig.accounts?.[conn.accountId]?.sendReadReceipts ?? whatsAppConfig.sendReadReceipts ?? true;
+  if (sendReceipts && msg.key.id) {
+    sendReadReceipt(conn.sock, remoteJid, [msg.key.id], isGroup ? senderJid : void 0, conn.accountId);
+  }
+  let mediaResult;
+  if (extracted.mediaType && conn.sock) {
+    const maxMb = whatsAppConfig.mediaMaxMb ?? 50;
+    mediaResult = await downloadInboundMedia(msg, conn.sock, {
+      maxBytes: maxMb * 1024 * 1024
+    });
+    if (!mediaResult) {
+      console.error(`${TAG16} media download returned undefined account=${conn.accountId} type=${extracted.mediaType} from=${remoteJid}`);
+    }
+  }
+  if (extracted.mediaType === "audio" && mediaResult?.path) {
+    const conversationKey = isGroup ? remoteJid : senderPhone;
+    const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
+    let resolvePending;
+    const sttPending = new Promise((resolve6) => {
+      resolvePending = resolve6;
+    });
+    if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
+    try {
+      const sttResult = await transcribe(mediaResult.path, mediaResult.mimetype);
+      if (sttResult?.text) {
+        extracted.text = sttResult.text;
+      }
+    } finally {
+      resolvePending();
+    }
+  }
+  const reply = async (text) => {
+    if (isGroupJid(remoteJid)) {
+      console.error(`${TAG16} op=group-reply-blocked jid=${remoteJid}`);
+      throw new WaReplyError("group reply blocked \u2014 observe-only", false);
+    }
+    const currentSock = conn.sock;
+    if (!currentSock) {
+      const reason = conn.terminalReason;
+      throw new WaReplyError(reason ?? "WhatsApp disconnected \u2014 cannot reply", Boolean(reason));
+    }
+    await sendTextMessage(currentSock, remoteJid, text, { accountId: conn.accountId });
+  };
+  const composing = async () => {
+    const currentSock = conn.sock;
+    if (currentSock) await sendComposing(currentSock, remoteJid);
+  };
+  const cacheKey = deriveCacheKey({
+    agentType: accessResult.agentType,
+    accountId: conn.accountId,
+    senderPhone,
+    isGroup,
+    groupJid: isGroup ? remoteJid : void 0
+  });
+  conn.lastMessageAt = Date.now();
+  const payload = {
+    accountId: conn.accountId,
+    agentType: accessResult.agentType,
+    passive: accessResult.passive === true,
+    personId: accessResult.personId ?? null,
+    senderPhone,
+    text: extracted.text,
+    isGroup,
+    groupJid: isGroup ? remoteJid : void 0,
+    reply,
+    composing,
+    cacheKey,
+    media: mediaResult?.path ? [{ path: mediaResult.path, type: extracted.mediaType, mimetype: mediaResult.mimetype }] : [],
+    replyContext: extracted.quotedMessage,
+    // Task 1383 — the gate's single resolution feeds the spawn (house or the
+    // bound sub-account); the router never re-resolves.
+    effectiveAccountId: accessResult.effectiveAccountId,
+    // Task 1575 — the gate's owner-self verdict. Only reason:'self-phone' is the
+    // owner's own number; adminPhones/account-manager admits are other admins
+    // and must not inherit the owner userId.
+    ownerSelfPhone: accessResult.reason === "self-phone"
+  };
+  if (accessResult.agentType === "public") {
+    const hoursResult = await isBusinessOpen(conn.accountId);
+    if (!hoursResult.open) {
+      console.error(`${TAG16} [${conn.accountId}] dispatch skipped: business closed`);
+      const afterHoursMessage = whatsAppConfig.accounts?.[conn.accountId]?.afterHoursMessage ?? whatsAppConfig.afterHoursMessage;
+      if (afterHoursMessage) {
+        try {
+          await reply(afterHoursMessage);
+          console.error(`${TAG16} [${conn.accountId}] after-hours auto-reply sent to ${remoteJid}`);
+        } catch (err) {
+          console.error(
+            `${TAG16} [${conn.accountId}] after-hours auto-reply failed: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
+      }
+      return;
+    }
+  }
+  if (conn.debouncer) {
+    conn.debouncer.enqueue(payload);
+  } else {
+    dispatchInboundPayload(conn, payload);
+  }
+}
+
+export {
+  STORE_ROOT,
+  listStoredAccountIds,
+  conversationFilePath,
+  appendMessage,
+  readConversation,
+  readReactions,
+  foldReactions,
+  readConversationSummaries,
+  readAllConversations,
+  enumerateValidAccountIds,
+  resolveHouseOrSoleAccountId,
+  getAccountsDirFromEnv,
+  validateAccountIdEnv,
+  containedSinceBoot,
+  mediaDownloadsInFlight,
+  guardInstalled,
+  installMediaDownloadGuard,
+  readDeclined,
+  appendNotifyPublished,
+  readNotifyRows,
+  readLedger,
+  pruneLedger,
+  listLedgerAccounts,
+  decideWaNotify,
+  WhatsAppAccountSchema,
+  WhatsAppConfigSchema,
+  parseWhatsAppConfigTolerant,
+  hasCredsSync,
+  authExists,
+  readSelfId,
+  credsCensus,
+  getAuthAgeMs,
+  clearAuth,
+  discardAuthDirSync,
+  drainCredsSaveQueue,
+  createWaSocket,
+  waitForConnection,
+  getStatusCode,
+  formatError,
+  closeKind,
+  classifyDisconnect,
+  normalizeE164,
+  toWhatsappJid,
+  jidToE164,
+  senderJidFromTelephone,
+  isGroupJid,
+  isUserJid,
+  normalizeTarget,
+  phonesMatch,
+  resolveViaLidMap,
+  readLidMap,
+  managedAccountFor,
+  managerPhonesForAccount,
+  isAdminPhone,
+  shouldDispatchInbound,
+  checkAccessRateLimit,
+  recordAccessFailedAttempt,
+  clearAccessRateLimit,
+  checkRequestLinkRateLimit,
+  recordRequestLinkAttempt,
+  maskContact,
+  findGrantByMagicToken,
+  findActiveGrantByContact,
+  findGrantByContact,
+  ensureManagerPerson,
+  enrolPerson,
+  consumeMagicTokenAndActivate,
+  generateNewMagicToken,
+  getChannelActivity,
+  sendTextMessage,
+  sendComposing,
+  sendPaused,
+  sendMediaMessage,
+  resolvePlatformAccountId,
+  warnNonUuidAccount,
+  isHouseManagedService,
+  isCustomerTurnSuppressed,
+  DATA_ROOT,
+  crossesForeignAccountPartition,
+  isWithinOwnAccountPartition,
+  resolveDataPath,
+  resolveClaudeUploadsPath,
+  sessionScratchpadRoot,
+  resolveScratchpadPath,
+  SUPPORTED_MIME_TYPES,
+  MAX_FILE_SIZE_BYTES,
+  MAX_FILES_PER_MESSAGE,
+  MAX_DATA_UPLOAD_BYTES,
+  EXTRACTED_TEXT_SUFFIX,
+  assertSupportedMime,
+  isInlineSafeMime,
+  resolveStoredAttachment,
+  storeAttachment,
+  storePublicAttachment,
+  detectMimeType,
+  validateFilePathInAccount,
+  storeComponentArtefact,
+  WHATSAPP_DOCUMENT_MAX_BYTES,
+  transcribe,
+  WaReplyError,
+  buildNotifyPending,
+  isObserveAccount,
+  getWhatsAppConfig,
+  messageStoreKey,
+  storeMessage,
+  deriveCacheKey,
+  buildSelfChatDispatch,
+  init,
+  startConnection,
+  stopConnection,
+  getStatus,
+  getSocket,
+  selectConnection,
+  resolveSocket,
+  selectStoreAccountKey,
+  resolveReadStoreKey,
+  resolveInboundPersistAccount,
+  isManagerRoutedToHouse,
+  resolveConversationPersistAccount,
+  isAnyConnected,
+  listConnectionPlatformAccountIds,
+  registerLoginSocket,
+  reloadConfig,
+  getMessages,
+  listConversationJids,
+  listStoreAccountKeys,
+  shutdown
+};