@stage-labs/metro 0.1.0-beta.13 → 0.1.0-beta.130

package/runtime/node_modules/@metro-labs/threema/src/verify.ts

@@ -0,0 +1,117 @@
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import {
+  GATEWAY_API,
+  isGatewayId,
+  normalizeThreemaId,
+  parsePrivateKey,
+} from './ids.js';
+
+export { parsePrivateKey } from './ids.js';
+
+export class ThreemaGatewayError extends Error {}
+
+export interface ThreemaCredentials {
+  gatewayId: string;
+  secret: string;
+  privateKey: string;
+}
+
+export interface ThreemaGatewayIdentity {
+  gatewayId: string;
+  publicKey: string;
+  credits: number;
+}
+
+const PKCS8_X25519_PREFIX = Buffer.from(
+  '302e020100300506032b656e04220420',
+  'hex',
+);
+const TIMEOUT_MS = 10_000;
+const PUBLIC_KEY_RE = /^[0-9a-f]{64}$/;
+
+export function publicKeyOf(privateKeyHex: string): string {
+  const der = Buffer.concat([
+    PKCS8_X25519_PREFIX,
+    Buffer.from(privateKeyHex, 'hex'),
+  ]);
+  const key = createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
+  const jwk = createPublicKey(key).export({ format: 'jwk' });
+  return Buffer.from(String(jwk.x), 'base64url').toString('hex');
+}
+
+async function gatewayGet(
+  path: string,
+  gatewayId: string,
+  secret: string,
+): Promise<Response> {
+  const query = new URLSearchParams({ from: gatewayId, secret });
+  try {
+    return await fetch(`${GATEWAY_API}${path}?${query.toString()}`, {
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+  } catch {
+    throw new ThreemaGatewayError(
+      'could not reach the Threema Gateway to check those credentials',
+    );
+  }
+}
+
+function refused(res: Response, what: string): ThreemaGatewayError {
+  if (res.status === 401)
+    return new ThreemaGatewayError(
+      'Threema rejected that Gateway ID or API secret',
+    );
+  if (res.status === 404)
+    return new ThreemaGatewayError(`Threema does not know ${what}`);
+  return new ThreemaGatewayError(
+    `the Threema Gateway answered ${res.status} while checking ${what}`,
+  );
+}
+
+async function fetchCredits(gatewayId: string, secret: string): Promise<number> {
+  const res = await gatewayGet('/credits', gatewayId, secret);
+  if (!res.ok) throw refused(res, 'the credit balance');
+  const credits = Number((await res.text()).trim());
+  if (!Number.isInteger(credits))
+    throw new ThreemaGatewayError(
+      'the Threema Gateway gave an unexpected answer for the credit balance',
+    );
+  return credits;
+}
+
+async function fetchPublicKey(gatewayId: string, secret: string): Promise<string> {
+  const res = await gatewayGet(
+    `/pubkeys/${encodeURIComponent(gatewayId)}`,
+    gatewayId,
+    secret,
+  );
+  if (!res.ok) throw refused(res, `the public key of ${gatewayId}`);
+  const hex = (await res.text()).trim().toLowerCase();
+  if (!PUBLIC_KEY_RE.test(hex))
+    throw new ThreemaGatewayError(
+      'the Threema Gateway gave an unexpected answer for the public key',
+    );
+  return hex;
+}
+
+export async function verifyThreemaGateway(
+  input: ThreemaCredentials,
+): Promise<ThreemaGatewayIdentity> {
+  const gatewayId = normalizeThreemaId(input.gatewayId);
+  if (!isGatewayId(gatewayId))
+    throw new ThreemaGatewayError(
+      'a Threema Gateway ID is a * followed by 7 letters or digits, as in *ABCDEFG',
+    );
+  const privateKey = parsePrivateKey(input.privateKey);
+  if (privateKey === null)
+    throw new ThreemaGatewayError(
+      'the private key is the 64 hex characters from the key file Threema gave you, with or without its private: prefix',
+    );
+  const credits = await fetchCredits(gatewayId, input.secret);
+  const registered = await fetchPublicKey(gatewayId, input.secret);
+  if (registered !== publicKeyOf(privateKey))
+    throw new ThreemaGatewayError(
+      `that private key does not belong to ${gatewayId}: the Gateway holds a different public key for it`,
+    );
+  return { gatewayId, publicKey: registered, credits };
+}

package/runtime/node_modules/@metro-labs/webhook/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@metro-labs/webhook",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/station.ts"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "tsc --noEmit && bun test test/"
+  },
+  "dependencies": {
+    "@metro-labs/core": "workspace:*"
+  },
+  "devDependencies": {
+    "@stage-labs/config": "0.1.0-beta.2",
+    "eslint": "^10.3.0",
+    "knip": "^6.15.0",
+    "madge": "^8.0.0",
+    "typescript": "^5"
+  }
+}

package/runtime/node_modules/@metro-labs/webhook/src/station.ts

@@ -0,0 +1,37 @@
+import { randomUUID } from 'node:crypto';
+import { Line } from '@metro-labs/core/lines';
+import { mintId, type MetroEvent } from '@metro-labs/core/events';
+import type { Endpoint } from '@metro-labs/core/endpoints';
+import type { Station, Verb } from '@metro-labs/core/stations/types';
+
+export const webhookStation: Station = {
+  name: 'webhook',
+  hasAccounts: true,
+  hasTrain: false,
+  messageVerbs: new Set<Verb>(),
+  attachmentMode: 'none',
+  tools: [],
+};
+
+export function webhookEntry(
+  endpoint: Endpoint,
+  headers: Record<string, string>,
+  body: unknown,
+  method: string,
+  url: string,
+): MetroEvent {
+  const line = Line.webhook(endpoint.id);
+  return {
+    id: mintId(),
+    ts: new Date().toISOString(),
+    station: 'webhook',
+    line,
+    lineName: endpoint.label,
+    from: line,
+    to: line,
+    messageId:
+      headers['x-github-delivery'] ?? headers['x-request-id'] ?? randomUUID(),
+    text: `${headers['x-github-event'] ?? headers['x-intercom-topic'] ?? 'event'} ${method} ${url}`,
+    payload: { headers, body },
+  };
+}

package/runtime/node_modules/@metro-labs/whatsapp/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "@metro-labs/whatsapp",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "exports": {
+    ".": "./src/station.ts",
+    "./train": "./src/index.ts",
+    "./login": "./src/login.ts",
+    "./tokens": "./src/token-store.ts"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "tsc --noEmit && bun test test/"
+  },
+  "dependencies": {
+    "@metro-labs/core": "workspace:*",
+    "baileys": "7.0.0-rc14"
+  },
+  "devDependencies": {
+    "@stage-labs/config": "0.1.0-beta.2",
+    "eslint": "^10.3.0",
+    "knip": "^6.15.0",
+    "madge": "^8.0.0",
+    "typescript": "^5"
+  }
+}

package/runtime/node_modules/@metro-labs/whatsapp/src/accounts.ts

@@ -0,0 +1,66 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import {
+  makeAccountStore,
+  resolveAccountId,
+  type Die,
+} from '@metro-labs/core/stations/account-store';
+import type { WhatsAppAccount } from './types.js';
+
+const ACCOUNTS_FILE =
+  process.env.WHATSAPP_ACCOUNTS_FILE ??
+  join(homedir(), '.metro', 'whatsapp-accounts.json');
+
+const isJid = (s: string): boolean => s.includes('@');
+
+function validateAccount(
+  a: WhatsAppAccount,
+  seen: Set<string>,
+  die: Die,
+): void {
+  if (!a.id) die('account missing id');
+  if (!a.phone || typeof a.phone !== 'string')
+    die(`account '${a.id}' missing phone`);
+  if (seen.has(a.id)) die(`duplicate account id '${a.id}'`);
+  seen.add(a.id);
+}
+
+export const { loadAccounts } = makeAccountStore<WhatsAppAccount>({
+  prefix: 'whatsapp',
+  file: ACCOUNTS_FILE,
+  validate(raw, die) {
+    const seen = new Set<string>();
+    for (const a of raw) validateAccount(a, seen, die);
+  },
+});
+
+export const accounts = new Map<string, WhatsAppAccount>();
+
+export function accountFor(args: { account?: string; line?: string }): string {
+  return resolveAccountId(accounts, args, (line) => targetOf(line)?.accountId);
+}
+
+export function lineOf(accountId: string, jid: string): string {
+  return `metro://whatsapp/${accountId}/${jid}`;
+}
+
+interface Target {
+  accountId: string;
+  jid: string;
+}
+
+function splitScoped(path: string[]): { accountId: string; jid?: string } {
+  const first = path[0];
+  if (path.length >= 2 && first !== undefined && !isJid(first))
+    return { accountId: first, jid: path[1] };
+  return { accountId: 'default', jid: first };
+}
+
+export function targetOf(line: string): Target | undefined {
+  const prefix = 'metro://whatsapp/';
+  if (!line.startsWith(prefix)) return undefined;
+  const path = line.slice(prefix.length).split('/').filter(Boolean);
+  const { accountId, jid } = splitScoped(path);
+  if (jid === undefined || !isJid(jid)) return undefined;
+  return { accountId, jid };
+}

package/runtime/node_modules/@metro-labs/whatsapp/src/ack.ts

@@ -0,0 +1,101 @@
+import { TrainError } from '@metro-labs/core/train-error';
+import type { BinaryNode, WASocket } from 'baileys';
+
+const DEFAULT_ACK_WAIT_MS = 5000;
+
+export function ackWaitMs(raw: string | undefined): number {
+  if (raw === undefined || raw.trim() === '') return DEFAULT_ACK_WAIT_MS;
+  const ms = Number(raw);
+  return Number.isFinite(ms) && ms >= 0 ? ms : DEFAULT_ACK_WAIT_MS;
+}
+
+export const ACK_WAIT_MS = ackWaitMs(process.env.METRO_WHATSAPP_ACK_WAIT_MS);
+
+const RECENT_MAX = 256;
+
+const RESTRICTION = '463';
+
+export interface SendAck {
+  messageId: string;
+  jid: string;
+  error?: string;
+}
+
+export function ackOf(node: BinaryNode): SendAck | undefined {
+  const { id, from, error } = node.attrs;
+  if (!id || !from) return undefined;
+  return { messageId: id, jid: from, ...(error ? { error } : {}) };
+}
+
+export function rejection(ack: SendAck): TrainError | undefined {
+  if (!ack.error) return undefined;
+  if (ack.error === RESTRICTION)
+    return new TrainError(
+      'whatsapp_account_restricted',
+      `WhatsApp refused the message to ${ack.jid} with ack error 463 (MessageAccountRestriction): the send carried no trusted-contact token, so WhatsApp counted it as reaching out to a stranger and this account is under a reach-out timelock. Nothing was delivered, and it must not be retried — every retry counts as another reach-out and deepens the lock.`,
+      { retryable: false },
+    );
+  return new TrainError(
+    'whatsapp_send_refused',
+    `WhatsApp refused the message to ${ack.jid} with ack error ${ack.error}, so it was not delivered`,
+    { retryable: false },
+  );
+}
+
+export interface AckWatch {
+  record(node: BinaryNode): SendAck | undefined;
+  wait(messageId: string, timeoutMs: number): Promise<SendAck | undefined>;
+}
+
+export function makeAckWatch(max: number = RECENT_MAX): AckWatch {
+  const recent = new Map<string, SendAck>();
+  const waiting = new Map<string, (ack: SendAck) => void>();
+  return {
+    record(node) {
+      const ack = ackOf(node);
+      if (!ack) return undefined;
+      const waiter = waiting.get(ack.messageId);
+      if (waiter) {
+        waiting.delete(ack.messageId);
+        waiter(ack);
+        return ack;
+      }
+      recent.delete(ack.messageId);
+      recent.set(ack.messageId, ack);
+      while (recent.size > max) {
+        const oldest = recent.keys().next().value;
+        if (oldest === undefined) break;
+        recent.delete(oldest);
+      }
+      return ack;
+    },
+    wait(messageId, timeoutMs) {
+      const seen = recent.get(messageId);
+      if (seen) {
+        recent.delete(messageId);
+        return Promise.resolve(seen);
+      }
+      return new Promise<SendAck | undefined>((resolve) => {
+        const timer = setTimeout(() => {
+          waiting.delete(messageId);
+          resolve(undefined);
+        }, timeoutMs);
+        waiting.set(messageId, (ack) => {
+          clearTimeout(timer);
+          resolve(ack);
+        });
+      });
+    },
+  };
+}
+
+export function bindAcks(
+  sock: WASocket,
+  watch: AckWatch,
+  onError: (ack: SendAck) => void,
+): void {
+  sock.ws.on('CB:ack,class:message', (node: BinaryNode) => {
+    const ack = watch.record(node);
+    if (ack?.error) onError(ack);
+  });
+}

package/runtime/node_modules/@metro-labs/whatsapp/src/actions.ts

@@ -0,0 +1,190 @@
+import { TrainError } from '@metro-labs/core/train-error';
+import { errMsg } from '@metro-labs/core/log';
+import { kindOf } from '@metro-labs/core/stations/attachments';
+import {
+  makeStation,
+  respond,
+  type CallMsg,
+  type StationHandler,
+} from '@metro-labs/core/stations/station-runtime';
+import { accountFor, accounts, targetOf } from './accounts.js';
+import { normalizeWhatsApp } from './normalize.js';
+import { phoneNumberOf, senderLookup } from './resolve.js';
+import type { WAClient } from './client.js';
+
+type Args = Record<string, unknown>;
+
+interface Resolved {
+  accountId: string;
+  client: WAClient;
+  jid: string;
+}
+
+type ClientFor = (accountId: string) => WAClient;
+
+function str(v: unknown): string | undefined {
+  return typeof v === 'string' ? v : undefined;
+}
+
+function resolve(args: Args, clientFor: ClientFor): Resolved {
+  const line = str(args.line);
+  if (!line) throw new TrainError('bad_request', 'missing line');
+  const target = targetOf(line);
+  if (!target) throw new TrainError('bad_request', `bad line '${line}'`);
+  const accountId = accountFor({ account: str(args.account), line });
+  return { accountId, client: clientFor(accountId), jid: target.jid };
+}
+
+async function guard<T>(run: () => Promise<T>): Promise<T> {
+  try {
+    return await run();
+  } catch (e) {
+    if (e instanceof TrainError) throw e;
+    const msg = errMsg(e);
+    if (/rate.?over.?limit|too many|429/i.test(msg))
+      throw new TrainError('rate_limited', msg);
+    throw new TrainError('whatsapp_call', msg);
+  }
+}
+
+interface WireAttachment {
+  kind?: string;
+  path?: string;
+  url?: string;
+  mime?: string;
+  name?: string;
+}
+
+function attachmentsOf(args: Args): WireAttachment[] {
+  const raw = args.attachments;
+  if (!Array.isArray(raw)) return [];
+  return (raw as WireAttachment[]).filter((a) => Boolean(a.path ?? a.url));
+}
+
+async function sendMediaSet(
+  client: WAClient,
+  jid: string,
+  atts: WireAttachment[],
+  text: string,
+  replyTo: string | undefined,
+): Promise<{ messageId: string; labels: string[] }> {
+  const labels: string[] = [];
+  let messageId = '';
+  for (let i = 0; i < atts.length; i++) {
+    const att = atts[i];
+    if (!att) continue;
+    const path = att.path ?? att.url ?? '';
+    const kind = att.kind ?? kindOf(att.mime ?? '', path);
+    messageId = await guard(() =>
+      client.sendMedia(
+        jid,
+        {
+          kind,
+          path,
+          mime: att.mime ?? 'application/octet-stream',
+          name: att.name ?? path.split('/').pop() ?? 'attachment',
+          ...(i === 0 && text ? { caption: text } : {}),
+        },
+        replyTo,
+      ),
+    );
+    labels.push(kind);
+  }
+  return { messageId, labels };
+}
+
+function makeSend(clientFor: ClientFor): StationHandler {
+  return async (id, args) => {
+    const { accountId, client, jid } = resolve(args, clientFor);
+    const text = str(args.text) ?? '';
+    const replyTo = str(args.replyTo);
+    const atts = attachmentsOf(args);
+    if (atts.length) {
+      const { messageId, labels } = await sendMediaSet(
+        client,
+        jid,
+        atts,
+        text,
+        replyTo,
+      );
+      respond(id, {
+        result: { messageId, account: accountId, attachments: labels },
+      });
+      return;
+    }
+    const messageId = await guard(() => client.sendText(jid, text, replyTo));
+    respond(id, { result: { messageId, account: accountId } });
+  };
+}
+
+function makeReact(clientFor: ClientFor): StationHandler {
+  return async (id, args) => {
+    const { accountId, client, jid } = resolve(args, clientFor);
+    const messageId = str(args.messageId) ?? '';
+    const emoji = str(args.emoji) ?? '';
+    await guard(() => client.sendReaction(jid, messageId, emoji));
+    respond(id, { result: { ok: true, account: accountId } });
+  };
+}
+
+function makeEdit(clientFor: ClientFor): StationHandler {
+  return async (id, args) => {
+    const { accountId, client, jid } = resolve(args, clientFor);
+    const messageId = str(args.messageId) ?? '';
+    const text = str(args.text) ?? '';
+    await guard(() => client.editMessage(jid, messageId, text));
+    respond(id, { result: { ok: true, account: accountId } });
+  };
+}
+
+function makeDelete(clientFor: ClientFor): StationHandler {
+  return async (id, args) => {
+    const { accountId, client, jid } = resolve(args, clientFor);
+    const messageId = str(args.messageId) ?? '';
+    await guard(() => client.deleteMessage(jid, messageId));
+    respond(id, { result: { ok: true, account: accountId } });
+  };
+}
+
+function makeAccounts(clientFor: ClientFor): StationHandler {
+  return (id) => {
+    const list = [...accounts.values()].map((a) => {
+      const phone = clientFor(a.id).self();
+      return {
+        id: a.id,
+        handle: phone === null ? null : `+${phone}`,
+        url: phone === null ? null : `https://wa.me/${phone}`,
+        connected: phone !== null,
+        owner: a.owner ?? null,
+      };
+    });
+    respond(id, { result: { accounts: list } });
+    return Promise.resolve();
+  };
+}
+
+function makeResolveSender(clientFor: ClientFor): StationHandler {
+  return async (id, args) => {
+    const accountId = accountFor({ account: str(args.account) });
+    const query = str(args.query) ?? '';
+    const number = phoneNumberOf(query);
+    const found = await guard(() => clientFor(accountId).lookupSender(number));
+    respond(id, { result: { account: accountId, ...senderLookup(query, number, found) } });
+  };
+}
+
+export function makeHandleCall(
+  clientFor: ClientFor,
+): (msg: CallMsg) => Promise<void> {
+  return makeStation({
+    handlers: {
+      accounts: makeAccounts(clientFor),
+      send: makeSend(clientFor),
+      react: makeReact(clientFor),
+      edit: makeEdit(clientFor),
+      delete: makeDelete(clientFor),
+      resolve_sender: makeResolveSender(clientFor),
+    },
+    normalize: normalizeWhatsApp,
+  });
+}

package/runtime/node_modules/@metro-labs/whatsapp/src/attachments.ts

@@ -0,0 +1,72 @@
+import { downloadMediaMessage, type WAMessage } from 'baileys';
+import {
+  assertAttachmentSize,
+  saveStreamToCache,
+  type SavedAttachment,
+} from '@metro-labs/core/stations/attachments';
+import { TrainError } from '@metro-labs/core/train-error';
+import { baileysLogger } from './logger.js';
+import type { WAMediaRef } from './media.js';
+
+export type { SavedAttachment };
+
+const IDLE_TIMEOUT_MS = 60_000;
+
+export type ReuploadRequest = (m: WAMessage) => Promise<WAMessage>;
+
+export async function* withIdleTimeout(
+  chunks: AsyncIterable<Uint8Array>,
+  ms: number,
+): AsyncGenerator<Uint8Array> {
+  const iterator = chunks[Symbol.asyncIterator]();
+  for (;;) {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    const idle = new Promise<never>((_resolve, reject) => {
+      timer = setTimeout(() => {
+        reject(
+          new TrainError(
+            'whatsapp_media_stalled',
+            `WhatsApp sent no media bytes for ${ms}ms, so the download was abandoned`,
+          ),
+        );
+      }, ms);
+    });
+    try {
+      const next = await Promise.race([iterator.next(), idle]);
+      if (next.done === true) return;
+      yield next.value;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+}
+
+export async function saveWhatsAppMedia(
+  accountId: string,
+  raw: WAMessage,
+  ref: WAMediaRef,
+  messageId: string,
+  index = 0,
+  reupload?: ReuploadRequest,
+): Promise<SavedAttachment> {
+  if (ref.bytes !== undefined) assertAttachmentSize(ref.bytes);
+  const stream = await downloadMediaMessage(
+    raw,
+    'stream',
+    {},
+    reupload
+      ? { reuploadRequest: reupload, logger: baileysLogger(accountId) }
+      : undefined,
+  );
+  try {
+    return await saveStreamToCache(
+      withIdleTimeout(stream, IDLE_TIMEOUT_MS),
+      messageId,
+      index,
+      { mime: ref.mime, name: ref.name },
+    );
+  } catch (err) {
+    stream.destroy();
+    throw err;
+  }
+}