@teamscala/service-boot 0.23.408 → 0.23.409

package/package.json

@@ -6,7 +6,7 @@
   },
   "name": "@teamscala/service-boot",
   "type": "module",
-  "version": "0.23.408",
+  "version": "0.23.409",
   "sideEffects": false,
   "imports": {
     "#service-boot/*": "./src/*",

package/src/fn-routers/index.ts

@@ -30,6 +30,7 @@ import { publicGptSessionRouter } from "./public-gpt-session-router.ts";
 import { signInFlowRouter } from "./sign-in-flow-router.ts";
 import { userPreferencesRouter } from "./user-preferences-router.ts";
 import { workItemsRouter } from "./work-items-router.ts";
+import { messagingWhatsappRouter } from "./messaging-whatsapp-router.ts";
 
 export function registerFnRouters(): void {
 	registerCustomRouter("fn", {
@@ -38,6 +39,7 @@ export function registerFnRouters(): void {
 		auth: authRouter,
 		cacheAdmin: cacheAdminRouter,
 		chatSession: chatSessionRouter,
+		messagingWhatsappSend: messagingWhatsappRouter.messagingWhatsappSend,
 		publicAgreement: publicAgreementRouter,
 		publicAssessment: publicAssessmentRouter,
 		publicGptSession: publicGptSessionRouter,

package/src/fn-routers/messaging-whatsapp-router.test.ts

@@ -0,0 +1,119 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Proves fn.messagingWhatsappSend routes through scala-messaging-service: the
+ * URL is DERIVED from the service_install row (never spelled), the sealed-row
+ * credential is passed through the decrypt mock (identity, matching the
+ * public-assessment-router test pattern), the request carries the internal
+ * auth header, and the caller receives WhatsApp's message_id — the only thing
+ * that makes delivery provable. Failure modes (401, blank input) fail loudly
+ * with named causes, never a generic send error.
+ */
+
+import { createRouterClient } from "@orpc/server";
+import { afterAll, describe, expect, mock, test } from "bun:test";
+
+const SEND_CALLS: Array<{ url: string; headers: Record<string, string>; body: unknown }> = [];
+
+mock.module("@teamscala/db/registry/load-config", () => ({
+	loadRegistryConfig: async (type: string, slug: string) => {
+		if (type === "service_install" && slug === "scala-messaging-service") {
+			return { deploy_target: "railway", port: 8080 };
+		}
+		if (type === "secret" && slug === "railway-scala-messaging-whatsapp-webhook-secret") {
+			return { token: "test-token" };
+		}
+		throw new Error(`unexpected loadRegistryConfig(${type}, ${slug})`);
+	},
+}));
+
+// Identity decrypt (the public-assessment-router test pattern).
+mock.module("@teamscala/encryption/crypto/secret-config", () => ({
+	decryptSecretConfig: (raw: unknown) => raw,
+}));
+
+mock.module("@teamscala/logger/app-loggers", () => ({
+	getAppLogger: () => ({
+		info: () => {},
+		warn: () => {},
+		error: () => {},
+		debug: () => {},
+	}),
+}));
+
+const originalFetch = globalThis.fetch;
+(globalThis as { fetch: unknown }).fetch = async (url: string, init: RequestInit) => {
+	SEND_CALLS.push({
+		url,
+		headers: init.headers as Record<string, string>,
+		body: JSON.parse(init.body as string),
+	});
+	const body = JSON.parse(init.body as string) as { phone?: string };
+	if (body.phone === "0-0-1-refuse") {
+		return new Response("no", { status: 401 });
+	}
+	return Response.json({ message_id: "3EB07EE8TESTID" });
+};
+
+const { messagingWhatsappRouter } = await import("./messaging-whatsapp-router.ts");
+
+// Invoke through a real ORPC client so the authed middleware runs too —
+// calling the DecoratedProcedure directly is not a round trip.
+const client = createRouterClient(
+	{ messagingWhatsappSend: messagingWhatsappRouter.messagingWhatsappSend } as never,
+	{
+		context: {
+			user: { id: "system", organisationId: null },
+			headers: new Headers(),
+			prisma: {},
+		} as never,
+	},
+) as { messagingWhatsappSend: (a: unknown) => Promise<unknown> };
+
+describe("fn.messagingWhatsappSend", () => {
+	test("derives the URL from service_install, sends with the decrypted header value, returns the message_id", async () => {
+		SEND_CALLS.length = 0;
+		const result = await client.messagingWhatsappSend({
+			phone: "61428193498",
+			message: "migration probe",
+		});
+
+		expect(SEND_CALLS).toHaveLength(1);
+		expect(SEND_CALLS[0]?.url).toBe(
+			"http://scala-messaging-service.railway.internal:8080/api/messaging/whatsapp/send",
+		);
+		expect(SEND_CALLS[0]?.headers["x-webhook-secret"]).toBe("test-token");
+		expect(SEND_CALLS[0]?.body).toEqual({ phone: "61428193498", message: "migration probe" });
+		expect(result).toEqual({ ok: true, message_id: "3EB07EE8TESTID" });
+	});
+
+	test("a 401 from the messaging service names the credential, not a generic failure", async () => {
+		SEND_CALLS.length = 0;
+		const result = await client.messagingWhatsappSend({
+			phone: "0-0-1-refuse",
+			message: "x",
+		});
+		expect(result).toEqual({
+			ok: false,
+			error: "messaging service refused the webhook secret (401)",
+		});
+	});
+
+	test("blank phone or message is refused before any request is made", async () => {
+		SEND_CALLS.length = 0;
+		const blank = await client.messagingWhatsappSend({
+			phone: "   ",
+			message: "x",
+		});
+		expect(blank).toEqual({ ok: false, error: "phone and message are required" });
+		expect(SEND_CALLS).toHaveLength(0);
+	});
+});
+
+// Restore INSIDE afterAll — a top-level restore would run before the tests
+// (all top-level code executes first) and hand the router back the real fetch.
+afterAll(() => {
+	(globalThis as { fetch: unknown }).fetch = originalFetch;
+});

package/src/fn-routers/messaging-whatsapp-router.ts

@@ -0,0 +1,180 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * fn.messagingWhatsappSend — the agent-facing WhatsApp send that routes through
+ * scala-messaging-service (the Rust owner of the channel), replacing the
+ * retired TS @teamscala/api-gowa SDK send path (operator ruling 2026-08-26:
+ * "make sure the migration is finished, i cant have half ts and half rust").
+ *
+ * The messaging service's POST /api/messaging/whatsapp/send is the single send
+ * surface: it resolves the sending device, returns WhatsApp's message_id for
+ * delivery correlation, and records the send in messaging_logs itself (Rust,
+ * `write_outbound_tracked`) — better than the deleted TS recorder, which only
+ * ran when the send happened to flow through tool-executor.
+ *
+ * Both facts this procedure needs are DERIVED at call time, never spelled:
+ * - the service URL comes from the service_install row (slug + port +
+ *   deploy_target → Railway private DNS <slug>.railway.internal:<port>), the
+ *   same derivation every *.railway.internal consumer uses;
+ * - the auth credential is the existing sealed secret row
+ *   railway-scala-messaging-whatsapp-webhook-secret, decrypted per
+ *   registry-via-helper + the agreement-send precedent.
+ *
+ * Registered flat under the `fn` namespace (two-segment procedure
+ * "fn.messagingWhatsappSend") because the tool-executor ORPC dispatch resolves
+ * "model.method" — nested routers would not be reachable as a tool procedure.
+ */
+
+import { os } from "@orpc/server";
+import * as v from "valibot";
+import {
+	decryptSecretConfig,
+	type SecretConfigLike,
+} from "@teamscala/encryption/crypto/secret-config";
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+
+interface User {
+	id: string;
+	organisationId: string | null;
+}
+
+interface Context {
+	user: User | null | undefined;
+	headers: Headers;
+	resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
+	prisma: any;
+}
+
+const authed = os.$context<Context>().use(async (opt) => {
+	const { context } = opt;
+	let user = context.user;
+	if (!user && context.headers && context.resolveUser) {
+		user = await context.resolveUser(context.headers, context.prisma);
+	}
+	if (!user) {
+		const { ORPCError } = await import("@orpc/server");
+		throw new ORPCError("UNAUTHORIZED", { message: "Authentication required" });
+	}
+	return await opt.next({ context: { ...context, user } });
+});
+
+/** service_install shape for deriving the messaging service's internal URL. */
+const MessagingInstallSchema = v.looseObject({
+	port: v.optional(v.number(), 8080),
+	deploy_target: v.string(),
+});
+
+/** The sealed webhook-secret row shape (value is decryptSecretConfig input). */
+const MessagingSecretSchema = v.looseObject({});
+
+/** Derive the messaging service base URL from its service_install row. */
+async function resolveMessagingBaseUrl(): Promise<string> {
+	const install = await loadRegistryConfig(
+		"service_install",
+		"scala-messaging-service",
+		MessagingInstallSchema,
+	);
+	if (install.deploy_target !== "railway") {
+		throw new Error(
+			`scala-messaging-service deploy_target is "${install.deploy_target}", not "railway" — ` +
+				"the private-DNS URL derivation only holds on Railway. Fix the service_install row.",
+		);
+	}
+	return `http://scala-messaging-service.railway.internal:${install.port}`;
+}
+
+const sendSchema = v.object({
+	/** Destination phone number in E.164 (e.g. 61428193498). */
+	phone: v.string(),
+	/** Text body to send. */
+	message: v.string(),
+});
+
+export const messagingWhatsappRouter = {
+	messagingWhatsappSend: authed
+		.input(sendSchema)
+		.handler(async ({ input }) => {
+			const log = getAppLogger();
+			const phone = input.phone.trim();
+			const message = input.message;
+			if (!phone || !message) {
+				return { ok: false as const, error: "phone and message are required" };
+			}
+
+			try {
+				const [baseUrl, rawSecret] = await Promise.all([
+					resolveMessagingBaseUrl(),
+					loadRegistryConfig(
+						"secret",
+						"railway-scala-messaging-whatsapp-webhook-secret",
+						MessagingSecretSchema,
+					).catch(() => {
+						throw new Error(
+							"secret row railway-scala-messaging-whatsapp-webhook-secret is missing — " +
+								"the messaging service send endpoint cannot be authenticated",
+						);
+					}),
+				]);
+				const decrypted = decryptSecretConfig(
+					rawSecret as SecretConfigLike,
+				) as { token?: string };
+				if (!decrypted.token) {
+					return {
+						ok: false as const,
+						error: "whatsapp webhook secret row has no token",
+					};
+				}
+
+				const response = await fetch(
+					`${baseUrl}/api/messaging/whatsapp/send`,
+					{
+						method: "POST",
+						headers: {
+							"Content-Type": "application/json",
+							// The Rust handler accepts x-webhook-secret (or
+							// x-api-key) against WHATSAPP_WEBHOOK_SECRET.
+							"x-webhook-secret": decrypted.token,
+						},
+						body: JSON.stringify({ phone, message }),
+						signal: AbortSignal.timeout(30_000),
+					},
+				);
+				if (response.status === 401) {
+					return {
+						ok: false as const,
+						error: "messaging service refused the webhook secret (401)",
+					};
+				}
+				const body = (await response.json().catch(() => null)) as {
+					message_id?: string;
+					error?: string;
+				} | null;
+				if (!response.ok) {
+					return {
+						ok: false as const,
+						error:
+							body?.error ??
+							`messaging service send failed: ${response.status}`,
+					};
+				}
+				// The message_id is the only thing that makes delivery provable —
+				// hand it back so the caller can correlate the ack (gowa.rs
+				// parse_message_id contract).
+				log.info("[fn.messagingWhatsappSend] sent", {
+					phone,
+					message_id: body?.message_id ?? null,
+				});
+				return {
+					ok: true as const,
+					message_id: body?.message_id ?? null,
+				};
+			} catch (err) {
+				const errorMessage = err instanceof Error ? err.message : String(err);
+				log.error(`[fn.messagingWhatsappSend] failed: ${errorMessage}`);
+				return { ok: false as const, error: errorMessage };
+			}
+		}),
+};

package/src/mount-orpc-router.ts

@@ -87,6 +87,14 @@ export async function mountOrpcRouter(
 		configureToolExecutor({
 			getAppRouter: () => getAppRouter(),
 			getPrisma: () => getConfiguredPrisma(),
+			// Central MCP gateway URL — sdk:* tool calls from any non-host service
+			// forward here (scala-mcp owns every @teamscala/api-* adapter per
+			// operator ruling 2026-08-26). The HTTP layer reads from the
+			// per-request config surface (the same place getAppRouter / getPrisma
+			// are resolved from), not the ambient environment, to honour
+			// `configured-primitives`.
+			getMcpGatewayUrl: () =>
+				(ctx as { config?: { MCP_GATEWAY_URL?: string } }).config?.MCP_GATEWAY_URL,
 		});
 
 		const resolveUser = async (headers: Headers) => {