chatwoot-router 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-10-02
+
+### Added
+
+- First release: the TypeSafe Jev routing of chatwoot-discord-relay 0.28.0 as its own Cloudflare Worker. A new ticket
+  gets its owner, its topic label, and its kind (with a canned response and a status, if the kind has them), once per
+  version of its first three customer messages; people own the ticket after that. See "How it works" in the README.
+- Signed per-account Chatwoot webhooks and a five-minute sweep; per-account `startAfterConversationId` for a cutover.
+- Coordination with chatwoot-discord-relay through the conversation attributes `routing_seen`, `routing_handled`, and
+  `routing_kind`.
+- The `chatwoot-router-store-config` command and `chatwoot-router/stored-config`, for a configuration in KV.
+
+[Unreleased]: https://github.com/Phala-Network/chatwoot-workers/compare/chatwoot-router@0.1.0...HEAD
+[0.1.0]: https://github.com/Phala-Network/chatwoot-workers/releases/tag/chatwoot-router@0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Phala
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,296 @@
+# chatwoot-router
+
+Route Chatwoot support tickets with [TypeSafe Jev](https://docs.typesafe.ai) on Cloudflare Workers:
+assign owners, add topic and kind labels, and optionally send a canned response or resolve/snooze tickets.
+Runs independently of [chatwoot-discord-relay](https://github.com/Phala-Network/chatwoot-workers/tree/main/packages/chatwoot-discord-relay).
+Neither Worker calls the other: Chatwoot is their only coordination surface.
+
+## How it works
+
+The router is a level-triggered reconciler running one-time automation per input version.
+People own assignment, labels, and status after those effects, just as with a Chatwoot automation rule.
+
+- Webhooks and the all-status, newest-activity-first sweep enqueue the same deduplicated
+  `route:<account>:<conversation>` job. Every run reads Chatwoot; event payloads are not routing inputs.
+  The SQLite queue retries failed runs with backoff. Sweep pages resume within a window anchored to
+  the previous pass's start, using the same pass model as the relay.
+- Inputs are the first three customer messages with usable, redacted text, capped at 1,600 characters.
+  Their message ids form the memoization key. An unchanged key reuses Jev's answer; a new message
+  entering this window gets a new answer. There are no pending/waiting/done decision states.
+  Internal messages are filtered out; public replies are scanned within a bounded three-page read.
+  If that read cannot fill or finish the window, no automatic status action is allowed.
+- Immediately before effects, a fresh read recomputes the input key. If it changed during Jev,
+  nothing from the old plan is applied or acknowledged; the existing queue reruns the job.
+  The answer and the fresh conversation determine applicable labels, owner, reply, and status.
+  Non-open, blocked, pre-cutover, or differently assigned conversations receive no routing actions.
+  An assignment to this decision's owner is eligible on retry. Empty inputs never call Jev or snooze.
+- Every action has an effects-ledger key: `<effect>:<account>:<conversation>:<input key>` for
+  `assign`, `labels` (topic and kind together), and `status`; `reply:<account>:<conversation>` remains
+  once per ticket. Recorded effects never run again for that version, even if a person unassigns or
+  clears labels. Assignment and labels are recorded after confirmed success, or without a request when
+  already satisfied. Failed idempotent actions retry. Reply and status attempts are recorded before
+  sending; failed or uncertain attempts are not repeated. Confirmed kind actions carry their handled
+  input id in that ledger entry. There is no dispatcher.
+- `routing_seen` projects a durable, monotonic per-conversation checkpoint: the highest customer
+  message id observed after applicable effects complete. Persist it before synchronizing attributes,
+  retaining greater existing values. Later bounded reads cannot lower it. `routing_handled` and
+  `routing_kind` derive from the effects ledger, not current labels or the bounded message view.
+  Each run writes only differences; this repairs lost attributes for any status without a repair job.
+  Memo lookups use exact keys; ledger history uses indexed key ranges, never a whole-cache scan.
+- A run completes after applicable actions and attribute synchronization succeed, or after acknowledging
+  an out-of-scope conversation. Errors retry; deleted conversations are dropped. Events during a run
+  keep its job queued for another read. The sweep provides the same reconciliation if a webhook is lost.
+
+## Deploy
+
+Use Node 24 (24.15 or newer), npm 12.1.0, and the Cloudflare CLI `cf`. From this repository, run inside Docker:
+
+```sh
+npm ci
+cd packages/chatwoot-router
+npm run typecheck
+npm test
+npm run build
+npx cf deploy --prebuilt --dry-run
+```
+
+Edit `cloudflare.config.ts` with your non-secret settings. Keep required secrets out of source control;
+`.dev.vars.example` lists placeholders. For local development copy it to `.dev.vars` and use `npm run dev`.
+A maintainer deploys with `npx cf deploy --secrets-file <private-file>`.
+The default Worker name is `chatwoot-router`; it exports one SQLite Durable Object, `Router`, bound as `ROUTER`.
+Keep the `*/5 * * * *` cron trigger for reconciliation. `GET /healthz` returns 200 for a valid, readable
+configuration and 503 otherwise; it does not test upstream credentials or connectivity.
+
+For a private deployment repository, depend on the public `chatwoot-router` npm package plus `cf`, Vite, and
+`@cloudflare/vite-plugin`. Its Worker entry is:
+
+```ts
+export { default, Router } from "chatwoot-router";
+```
+
+Use the same `cloudflare.config.ts` and `vite.config.ts` structure as this package. Pin compatible tooling versions
+from the workspace and root manifests. Declare `Router` with `exports.durableObject({ storage: "sqlite" })`, bind it as
+`ROUTER`, declare required secrets with `bindings.secret()`, and put `CONFIG` in `bindings.json(...)`.
+
+For a configuration larger than a Worker JSON binding, use immutable KV configuration instead:
+
+```sh
+npx cf kv namespaces create --title chatwoot-router-config
+npx chatwoot-router-store-config config.jsonc --namespace-id <namespace-id>
+```
+
+```ts
+import { storedConfig } from "chatwoot-router/stored-config";
+```
+
+Set `CONFIG_STORE: bindings.kv({ id: "<namespace-id>" })` and
+`CONFIG_KEY: bindings.text(storedConfig("config.jsonc").key)` in the Worker's `env`, removing `CONFIG`.
+The CLI validates JSONC, uploads through the deployment project's `cf`, and prints the content-addressed key.
+Keep older keys for rollbacks. The JavaScript and type declarations in each npm tarball are self-contained;
+no unpublished shared package needs installing.
+
+## Chatwoot setup
+
+- `CHATWOOT_TOKEN` belongs to an agent in every routed inbox or an administrator.
+- In each routed account, add a signed webhook pointing to `POST /chatwoot/webhook`. Subscribe to
+  `message_created`, `conversation_created`, `conversation_updated`, and `conversation_status_changed`.
+- Put that webhook's secret in `CHATWOOT_WEBHOOK_SECRETS`, keyed by account id. Webhooks use HMAC-SHA256 of
+  `<timestamp>.<raw body>`, a ±5-minute timestamp window, and account matching. Only public incoming messages
+  whose sender is a contact, and the relevant conversation events, queue routing; the API is re-read before acting.
+- Create the topic and kind labels in Chatwoot. Create the following **conversation** custom attribute definitions:
+
+| Fixed name | Type | Meaning |
+| --- | --- | --- |
+| `routing_seen` | Number | Latest customer message id observed by a completed run, including skipped tickets, written after applicable actions. The relay's sole completion signal. |
+| `routing_handled` | Number | Latest customer message id handled by a kind's successful reply or set-aside action. |
+| `routing_kind` | Text | Kind label added by the router, preserved by the relay's Manage card. |
+
+Every public incoming contact `message_created` in a routed account queues reconciliation, even for an
+assigned, closed, pre-cutover, or already-routed ticket. Skipped messages and no-owner decisions also advance
+`routing_seen`; only eligible tickets ask Jev. When a kind handles messages, `routing_handled`
+and `routing_kind` are included in the same update as `routing_seen`, after its reply/status/label actions.
+
+Attributes are updated through Chatwoot's `custom_attributes` API with `merge: true`. Chatwoot v4.18 implements
+this as read-merge-save, not an atomic merge: concurrent relay/router writes can still lose keys. Every run
+projects its durable `routing_seen` checkpoint and effects ledger again. This repairs assigned, resolved, and
+snoozed tickets too, without a separate repair job. The checkpoint retains the greatest observed customer id
+and existing `routing_seen` value, even after that message leaves the bounded read window. The handled id and
+kind label come from ledger history, independently of current labels or visible inputs. Greater existing
+watermarks are retained in Chatwoot; unchanged attributes are not written again.
+The relay similarly repairs its missing or different post URL on sync. Recovery is eventual, not a cross-Worker
+transaction. Failed reads and writes retry without reclassifying unchanged inputs or repeating irreversible actions.
+With the relay, set `router.accounts` there; its default wait is 30 seconds from each customer's message time.
+Assignment and status changes never release that wait; only `routing_seen` or the timeout does.
+The three attribute names are fixed. The relay's link attribute must not use any of them.
+Watermarks accept non-negative safe integers stored as numbers or numeric strings; other values count as absent.
+
+## Configuration reference
+
+`CONFIG` accepts a JSON object or JSON string, or use `CONFIG_STORE` + `CONFIG_KEY` instead. Do not set both.
+
+```json
+{
+  "chatwoot": { "baseUrl": "https://chatwoot.example.com" },
+  "routing": {
+    "accounts": {
+      "1": {
+        "support": { "assignee": 6, "covers": "Product support, billing, and account access." },
+        "sales": { "assignee": 7, "covers": "Sales questions and purchase enquiries." }
+      }
+    },
+    "topics": { "billing": "Invoices and payments.", "technical": "Product troubleshooting." },
+    "minConfidence": 0.7,
+    "snoozeUnclear": true,
+    "kinds": { "1": { "spam": { "covers": "Unsolicited advertising.", "status": "resolved" } } }
+  },
+  "startAfterConversationId": { "1": 0 }
+}
+```
+
+| Setting | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `chatwoot.baseUrl` | HTTP(S) URL | required | Final Chatwoot API URL; redirects are refused. |
+| `startAfterConversationId` | object: routed account id → integer ≥ 0 | `{}` | Each account's conversation display id at cutover; omitted accounts default to `0`. At or below it, routing actions and Jev are skipped, but customer messages still advance `routing_seen`. |
+| `reconcile.lookbackSeconds` | integer ≥ 60 | `3600` | Minimum activity window for the five-minute sweep. |
+| `reconcile.maxCatchUpSeconds` | integer ≥ 60 | `604800` | Maximum activity window after downtime. |
+| `subrequestBudget` | integer 20–1000 | `45` | Per-alarm outbound budget; keep under your Workers plan's limit. |
+| `routing` | object | required | TypeSafe Jev owner, topic, and kind configuration. |
+| `routing.model` | non-empty string | `jev-1.13.0` | TypeSafe model. |
+| `routing.minConfidence` | number 0.5–1 | `0.7` | Probability an answer needs before it is applied. |
+| `routing.snoozeUnclear` | boolean | `false` | Snooze a ticket with no clear owner in which the customer asked for nothing yet (a greeting, a test) until their next message. |
+| `routing.accounts` | object: account id → (owner name → owner) | required | Routed accounts and the owners Jev chooses from. Owner names are 1–40 lower-case letters, digits, or `_`; `unclear` is reserved. |
+| `routing.accounts.<id>.<name>.assignee` | integer > 0 | required | Chatwoot user id to assign. |
+| `routing.accounts.<id>.<name>.covers` | 1–1000 characters | required | What the owner handles: Jev's criterion for choosing them. |
+| `routing.topics` | object: label → what it covers | unset | Topic labels (Chatwoot label names, lower case) Jev chooses from; one is added when a ticket has no label other than its kinds (an automation rule's label is kept alone). The separate relay can display them using its `forumTags` configuration. Unset: no topic. |
+| `routing.kinds` | object: account id → (kind name → kind) | unset | Kinds of ticket Jev recognizes in routed accounts, added as labels beside the topic, and what is done once when it does ([Routing behavior](#routing-behavior)). Kind names are the account's label names (1–40 lower-case letters, digits, `_`, or `-`); `none` is reserved. Unset: none. |
+| `routing.kinds.<id>.<name>.covers` | 1–1000 characters | required | What the kind is: Jev's criterion for recognizing it. |
+| `routing.kinds.<id>.<name>.cannedResponse` | short code | unset | The account's Chatwoot canned response sent to the customer once, by the account's agent bot (`CHATWOOT_BOT_TOKENS`); none while it does not exist. |
+| `routing.kinds.<id>.<name>.status` | `resolved` or `snoozed` | unset | Set instead of routing the ticket (`snoozed`: until the customer's next message), after the reply of a `cannedResponse`; a new customer message reopens it. |
+
+### Secrets
+
+| Secret | Required | Meaning |
+| --- | --- | --- |
+| `CHATWOOT_TOKEN` | Yes | Chatwoot agent/admin access token for reading and applying decisions. |
+| `CHATWOOT_WEBHOOK_SECRETS` | Yes | JSON object with a webhook secret for every routed account id. Missing entries fail configuration validation and `/healthz` returns 503. |
+| `TYPESAFE_API_KEY` | Yes | TypeSafe Jev API key. |
+| `CHATWOOT_BOT_TOKENS` | For kinds that reply | JSON object of Chatwoot agent bot tokens by account id; default `{}`. |
+
+Required secrets are declared with `bindings.secret()`. Optional bot tokens are declared only in development
+so deployment without canned replies does not require one. Do not connect a reply-only agent bot to an inbox.
+
+## Routing behavior
+
+The [reconciliation model](#how-it-works) defines the flow. Jev answers multiple-choice questions about the
+account's owner (or `unclear`), topic (with `topics`), kind (with `kinds`), and whether the customer asks for
+anything yet (with `snoozeUnclear`). Inputs include email subjects and the first three customer messages with
+usable text. Before they leave the Worker, emails, URLs, hex and base58 addresses, long tokens, phone numbers,
+IP addresses (and four-part version numbers, which read as one), @handles, and the contact's name (each word
+of two characters or more) are replaced with `[REDACTED]`. Identifier patterns run before name replacement
+so a name cannot split an identifier. This is best-effort redaction, not anonymization: other personal details
+can still reach TypeSafe. Attachment-only and redacted-only messages are acknowledged but do not consume
+the text window, call Jev, or cause snoozing.
+
+An owner at `minConfidence` or above is assigned unless the kind sets the ticket aside. A confident topic is
+added when there are no labels other than kinds; labels set by an automation rule or a person are kept.
+New messages entering the three-text-message window get a new memoized answer, even after an earlier
+assignment; later messages outside that window do not change it. When no owner fits, the ticket is left for
+a person. With `snoozeUnclear`, a confident `no request` answer can snooze an unassigned ticket until a
+customer writes again, but not once all three inputs have been used. Reopening with the same inputs never
+repeats that status action. A new window can apply a new status action. Before effects, the run re-reads the
+input window and compares its key. If a new message entered, the existing queue job is deferred immediately,
+without actions or acknowledgment of the old plan. The next run decides the new inputs. Messages outside a
+full window do not change the key. Chatwoot provides no atomic snapshot across message reads and actions.
+
+Router message reads set `filter_internal_messages=true`: Chatwoot v4.18's controller passes it to
+`MessageFinder`, which filters private notes and activity lines before paging. The generated OpenAPI schema
+omits it, so the shared typed client extends the query type; relay reads are unchanged. The forward scan is
+bounded to 300 public messages, including agent replies. If it cannot fill or finish the input window, labels,
+assignment, and a kind reply can still apply, but no status action does; the ticket stays for a person.
+
+Immediately before actions a fresh read must show an open ticket, with an unblocked contact, unassigned or
+assigned to this answer's owner. Otherwise only coordination attributes are synchronized. Routing resumes
+after reopening using memoized inputs and the effects ledger, not a saved decision state. Recorded assignment,
+label, and status effects are never repeated for that input version: a person unassigning or clearing labels
+via Manage has the final say. A new input version permits new effects. Actions run in order: assignment/labels,
+reply, status, then the checkpoint and attributes. Lost assignment/label responses are recovered by observing
+Chatwoot and recording an already-satisfied effect without another request. Routing uses `CHATWOOT_TOKEN`,
+whose user must be an agent in the routed inboxes; Chatwoot records the assignment as made by that user.
+
+
+With `kinds`, Jev is also asked which of the account's kinds the ticket is (or `none`). Kinds are
+labels of a second family: a ticket has one topic label, the category, and a kind Jev is confident
+about is added beside it (create each kind as a label in its account; it needs no forum tag, and
+the card shows it). It also acts with the decision: a kind with a `status` (spam, for example) sets the
+ticket aside, resolved or snoozed until the customer's next message, instead of routing it; the
+contact is not blocked, so a new message reopens the ticket as usual. A kind with a `cannedResponse` sends that
+Chatwoot canned response (Settings → Canned Responses, by its short code) to the customer, for
+example to acknowledge an application or point a security report to its process; a kind with both
+replies, then sets the ticket aside (a templated security report: acknowledged, then resolved). It is read when
+it is sent, so it is edited in Chatwoot, can use Chatwoot's variables such as `{{contact.name}}`,
+and a missing response leaves the job retrying without recording a send attempt. It is sent as the account's
+Chatwoot agent bot (`CHATWOOT_BOT_TOKENS`): customers see the bot's name, such as "Acme Support"; a
+bot's message assigns nobody and is no human first reply, and Chatwoot then counts the customer as
+answered (no longer waiting) until they write again. Create the bot in the account (Settings →
+Bots), without connecting it to an inbox. A reply goes out at most once per ticket: it is recorded
+before it is sent, so a failed send is not retried. Once a kind replied or set the ticket aside, the
+customer messages it handled (those Jev was given) are relayed without calling the triage bot, with a
+note, through the coordination attributes below. The relay waits up to its configured deadline;
+if routing is unavailable or slower than that, the message proceeds with its usual mention. Rules that need no judgement of the text (by inbox, sender, or
+subject) are Chatwoot's automation rules.
+
+```jsonc
+"routing": {
+  "accounts": {
+    "1": {
+      "cloud": { "assignee": 6, "covers": "Cloud support and billing: deployments, invoices, account access." },
+      "sales": { "assignee": 7, "covers": "Sales and partnerships: pricing, capacity, volume deals." }
+    }
+  },
+  "topics": { "technical-support": "Something does not work.", "billing": "Payments, invoices, refunds." },
+  "kinds": {
+    "1": {
+      "spam": { "covers": "Unsolicited promotion or scams.", "status": "resolved" },
+      "startup-program": { "covers": "A Startup Program application.", "cannedResponse": "startup-program" }
+    }
+  }
+}
+```
+
+
+## Reliability and cutover
+
+The Worker acknowledges after a SQLite job is queued. Alarms serialize decisions, preserve work across failures,
+and retry with exponential backoff capped at 30 minutes. The subrequest budget reserves 15 requests for the
+worst-case route and yields to a fresh invocation before starting work it cannot finish.
+Chatwoot's conversation-not-found response (JSON HTTP 404) is logged and the job is dropped, including a deletion
+during a message read or write. Other failures, including proxy errors and account-level API failures, keep their backoff.
+A sweep every five minutes pages **all statuses**, newest activity first, using the same shared Chatwoot client
+and pass-window/cursor logic as the relay. It queues the same route job for every listed conversation,
+regardless of status or assignment; reconciliation includes attribute repair.
+Closing a ticket does not remove it from this list. Activity can move it to the front, so it may be seen again;
+the next window starts from the previous pass's **start**, with a 60-second overlap, bounded by
+`reconcile.lookbackSeconds` and `reconcile.maxCatchUpSeconds`.
+The persisted page cursor survives budget yields and failed-page backoff. Route jobs run between
+pages; a failed sweep does not hold due jobs in its own account or any other account.
+Memoized answers, effects-ledger entries, and checkpoints remain in the Router's own Durable Object without expiry.
+
+When splitting an existing relay deployment, **deploy the new relay first**, removing its old `routing` setting and
+routing secrets and adding `router.accounts`. Keep its existing Worker `name` and `Hub` export to preserve state.
+Then find the newest Chatwoot conversation display id **in each routed account** at cutover and record the map in
+`startAfterConversationId`, for example `{ "1": 1200, "2": 85 }`. Deploy the router with the old routing configuration and its secrets, then add its
+Chatwoot webhook. Do not start the router while the old embedded routing is active. The cutover watermark
+intentionally leaves pre-cutover conversations to humans; old relay routing decisions are not imported. New
+customer messages on those tickets are still acknowledged with `routing_seen`. Set the relay's `router.keepLabels`
+(for example `["spam", "security", "beg-bounty"]`) to keep legacy kind labels even without `routing_kind`.
+
+Chatwoot conversation display ids are account-local: never use one account's id as another account's cutoff.
+The map accepts only accounts in `routing.accounts`, with non-negative integer ids. An omitted account defaults
+to `0`, so include every account whose pre-cutover history must be left alone. In the example, account 1 starts
+at conversation 1201 and account 2 at 86, independently of the other account's counter.
+
+Redaction is best effort, not anonymization: other personal information can still reach TypeSafe. Review its
+policy before enabling routing. Logs contain ids and outcomes, never message bodies or credentials.
+See [SECURITY.md](https://github.com/Phala-Network/chatwoot-workers/blob/main/SECURITY.md) to report vulnerabilities,
+[CONTRIBUTING.md](https://github.com/Phala-Network/chatwoot-workers/blob/main/CONTRIBUTING.md) for development,
+and [CHANGELOG.md](https://github.com/Phala-Network/chatwoot-workers/blob/main/packages/chatwoot-router/CHANGELOG.md) for releases. Licensed under [MIT](https://github.com/Phala-Network/chatwoot-workers/blob/main/packages/chatwoot-router/LICENSE).

package/lib/packages/chatwoot-router/scripts/store-config.js

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+
+// ../../shared/store-config.ts
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+function storeConfig(storedConfig2, command) {
+  const { values, positionals } = parseArgs({
+    options: { "namespace-id": { type: "string" } },
+    allowPositionals: true
+  });
+  const [file] = positionals;
+  const namespaceId = values["namespace-id"];
+  if (!file || !namespaceId) {
+    console.error(`Usage: ${command} <config.jsonc> --namespace-id <id>`);
+    process.exit(2);
+  }
+  let stored;
+  try {
+    stored = storedConfig2(file);
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exit(1);
+  }
+  const dir = mkdtempSync(join(tmpdir(), "store-config-"));
+  try {
+    const path = join(dir, "config.json");
+    writeFileSync(path, stored.value);
+    const put = spawnSync(
+      "npx",
+      ["cf", "kv", "keys", "put", stored.key, "--namespace-id", namespaceId, "--file", path],
+      {
+        stdio: ["ignore", process.stderr, process.stderr]
+      }
+    );
+    if (put.status === 0) {
+      console.log(stored.key);
+    } else {
+      console.error(`Storing ${stored.key} failed: cf exited with ${put.status ?? put.signal}`);
+      process.exitCode = 1;
+    }
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+// ../../shared/stored-config.ts
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { parse, printParseErrorCode } from "jsonc-parser";
+function readStoredConfig(file, configSchema2) {
+  const errors = [];
+  const config = parse(readFileSync(file, "utf8"), errors, { allowTrailingComma: true });
+  if (errors.length > 0) {
+    throw new Error(
+      `${file} is not JSON: ${errors.map((e) => `${printParseErrorCode(e.error)} at ${e.offset}`).join("; ")}`
+    );
+  }
+  const result = configSchema2.safeParse(config);
+  if (!result.success) {
+    throw new Error(
+      `Invalid CONFIG: ${result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`
+    );
+  }
+  const value = JSON.stringify(config);
+  return { key: `config-${createHash("sha256").update(value).digest("hex")}`, value };
+}
+
+// src/config.ts
+import { z as z2 } from "zod";
+
+// ../../shared/config.ts
+import { z } from "zod";
+var jsonRecord = z.string().transform((value, ctx) => {
+  try {
+    return JSON.parse(value);
+  } catch {
+    ctx.addIssue({ code: "custom", message: "must be a JSON object" });
+    return z.NEVER;
+  }
+}).pipe(z.record(z.string(), z.string().min(1)));
+var reconcileSchema = z.strictObject({
+  /** The sweep looks at conversations with activity within at least this window. */
+  lookbackSeconds: z.number().int().min(60).default(3600),
+  /** After downtime, the sweep catches up at most this far back. */
+  maxCatchUpSeconds: z.number().int().min(60).default(7 * 24 * 3600)
+}).prefault({});
+
+// src/config.ts
+var accountId = z2.string().regex(/^[1-9]\d*$/, "must be a Chatwoot account id").refine((value) => Number.isSafeInteger(Number(value)), "must be a safe integer");
+var configSchema = z2.strictObject({
+  chatwoot: z2.strictObject({ baseUrl: z2.url({ protocol: /^https?$/ }) }),
+  reconcile: reconcileSchema,
+  startAfterConversationId: z2.record(accountId, z2.number().int().min(0)).default({}),
+  subrequestBudget: z2.number().int().min(20).max(1e3).default(45),
+  routing: z2.strictObject({
+    model: z2.string().min(1).default("jev-1.13.0"),
+    /** Jev's probability an answer needs before it is applied. */
+    minConfidence: z2.number().min(0.5).max(1).default(0.7),
+    /**
+     * Snooze a ticket Jev cannot assign yet, and in which the customer asked for nothing yet, until
+     * their next message (see src/routing.ts).
+     */
+    snoozeUnclear: z2.boolean().default(false),
+    /** Per Chatwoot account id: the owners Jev chooses from, by a short name. */
+    accounts: z2.record(
+      accountId,
+      z2.record(
+        z2.string().regex(/^[a-z0-9_]{1,40}$/, "must be a short lower-case name").refine((name) => name !== "unclear", "unclear is reserved"),
+        z2.strictObject({
+          /** Chatwoot user id to assign. */
+          assignee: z2.number().int().positive(),
+          /** What the owner handles, as Jev's criterion for choosing them. */
+          covers: z2.string().min(1).max(1e3)
+        })
+      ).refine((owners) => Object.keys(owners).length > 0, "needs at least one owner")
+    ),
+    /** Topic labels (Chatwoot label names, lower case) and what each covers. Unset: no topic. */
+    topics: z2.record(
+      z2.string().regex(/^[a-z0-9_-]{1,255}$/, "must be a Chatwoot label name (lower case)"),
+      z2.string().min(1).max(1e3)
+    ).optional(),
+    /**
+     * Per Chatwoot account id: kinds of ticket Jev recognizes, by a short name, and what is done,
+     * once, when it does (see src/routing.ts). Unset: none.
+     */
+    kinds: z2.record(
+      accountId,
+      z2.record(
+        z2.string().regex(/^[a-z0-9_-]{1,40}$/, "must be a short lower-case name").refine((name) => name !== "none", "none is reserved"),
+        z2.strictObject({
+          /** What the kind is, as Jev's criterion for recognizing it. */
+          covers: z2.string().min(1).max(1e3),
+          /**
+           * Short code of the account's Chatwoot canned response sent to the customer once, as
+           * the account's agent bot (CHATWOOT_BOT_TOKENS). None is sent while it does not exist.
+           */
+          cannedResponse: z2.string().trim().min(1).max(255).optional(),
+          /**
+           * Set instead of routing the ticket (after the reply, with cannedResponse): `resolved`,
+           * or `snoozed` until the customer's next message. A new message from the customer
+           * reopens either.
+           */
+          status: z2.enum(["resolved", "snoozed"]).optional()
+        })
+      )
+    ).optional()
+  })
+}).refine((config) => Object.keys(config.startAfterConversationId).every((id) => config.routing.accounts[id]), {
+  path: ["startAfterConversationId"],
+  message: "must only name routed accounts"
+}).refine((config) => Object.keys(config.routing?.kinds ?? {}).every((id) => config.routing?.accounts[id]), {
+  path: ["routing", "kinds"],
+  message: "must only name routed accounts"
+}).refine(
+  (config) => Object.values(config.routing?.kinds ?? {}).every(
+    (kinds) => Object.keys(kinds).every((kind) => !Object.hasOwn(config.routing?.topics ?? {}, kind))
+  ),
+  { path: ["routing", "kinds"], message: "a kind cannot be named as a topic: they are labels of two families" }
+);
+var secretsSchema = z2.object({
+  CHATWOOT_TOKEN: z2.string().min(1),
+  CHATWOOT_WEBHOOK_SECRETS: jsonRecord,
+  TYPESAFE_API_KEY: z2.string().min(1),
+  CHATWOOT_BOT_TOKENS: jsonRecord.default({})
+});
+
+// scripts/stored-config.ts
+function storedConfig(file) {
+  return readStoredConfig(file, configSchema);
+}
+
+// scripts/store-config.ts
+storeConfig(storedConfig, "chatwoot-router-store-config");

package/lib/packages/chatwoot-router/scripts/stored-config.d.ts

@@ -0,0 +1,4 @@
+export declare function storedConfig(file: string | URL): {
+    key: string;
+    value: string;
+};

package/lib/packages/chatwoot-router/scripts/stored-config.js

@@ -0,0 +1,128 @@
+// ../../shared/stored-config.ts
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { parse, printParseErrorCode } from "jsonc-parser";
+function readStoredConfig(file, configSchema2) {
+  const errors = [];
+  const config = parse(readFileSync(file, "utf8"), errors, { allowTrailingComma: true });
+  if (errors.length > 0) {
+    throw new Error(
+      `${file} is not JSON: ${errors.map((e) => `${printParseErrorCode(e.error)} at ${e.offset}`).join("; ")}`
+    );
+  }
+  const result = configSchema2.safeParse(config);
+  if (!result.success) {
+    throw new Error(
+      `Invalid CONFIG: ${result.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ")}`
+    );
+  }
+  const value = JSON.stringify(config);
+  return { key: `config-${createHash("sha256").update(value).digest("hex")}`, value };
+}
+
+// src/config.ts
+import { z as z2 } from "zod";
+
+// ../../shared/config.ts
+import { z } from "zod";
+var jsonRecord = z.string().transform((value, ctx) => {
+  try {
+    return JSON.parse(value);
+  } catch {
+    ctx.addIssue({ code: "custom", message: "must be a JSON object" });
+    return z.NEVER;
+  }
+}).pipe(z.record(z.string(), z.string().min(1)));
+var reconcileSchema = z.strictObject({
+  /** The sweep looks at conversations with activity within at least this window. */
+  lookbackSeconds: z.number().int().min(60).default(3600),
+  /** After downtime, the sweep catches up at most this far back. */
+  maxCatchUpSeconds: z.number().int().min(60).default(7 * 24 * 3600)
+}).prefault({});
+
+// src/config.ts
+var accountId = z2.string().regex(/^[1-9]\d*$/, "must be a Chatwoot account id").refine((value) => Number.isSafeInteger(Number(value)), "must be a safe integer");
+var configSchema = z2.strictObject({
+  chatwoot: z2.strictObject({ baseUrl: z2.url({ protocol: /^https?$/ }) }),
+  reconcile: reconcileSchema,
+  startAfterConversationId: z2.record(accountId, z2.number().int().min(0)).default({}),
+  subrequestBudget: z2.number().int().min(20).max(1e3).default(45),
+  routing: z2.strictObject({
+    model: z2.string().min(1).default("jev-1.13.0"),
+    /** Jev's probability an answer needs before it is applied. */
+    minConfidence: z2.number().min(0.5).max(1).default(0.7),
+    /**
+     * Snooze a ticket Jev cannot assign yet, and in which the customer asked for nothing yet, until
+     * their next message (see src/routing.ts).
+     */
+    snoozeUnclear: z2.boolean().default(false),
+    /** Per Chatwoot account id: the owners Jev chooses from, by a short name. */
+    accounts: z2.record(
+      accountId,
+      z2.record(
+        z2.string().regex(/^[a-z0-9_]{1,40}$/, "must be a short lower-case name").refine((name) => name !== "unclear", "unclear is reserved"),
+        z2.strictObject({
+          /** Chatwoot user id to assign. */
+          assignee: z2.number().int().positive(),
+          /** What the owner handles, as Jev's criterion for choosing them. */
+          covers: z2.string().min(1).max(1e3)
+        })
+      ).refine((owners) => Object.keys(owners).length > 0, "needs at least one owner")
+    ),
+    /** Topic labels (Chatwoot label names, lower case) and what each covers. Unset: no topic. */
+    topics: z2.record(
+      z2.string().regex(/^[a-z0-9_-]{1,255}$/, "must be a Chatwoot label name (lower case)"),
+      z2.string().min(1).max(1e3)
+    ).optional(),
+    /**
+     * Per Chatwoot account id: kinds of ticket Jev recognizes, by a short name, and what is done,
+     * once, when it does (see src/routing.ts). Unset: none.
+     */
+    kinds: z2.record(
+      accountId,
+      z2.record(
+        z2.string().regex(/^[a-z0-9_-]{1,40}$/, "must be a short lower-case name").refine((name) => name !== "none", "none is reserved"),
+        z2.strictObject({
+          /** What the kind is, as Jev's criterion for recognizing it. */
+          covers: z2.string().min(1).max(1e3),
+          /**
+           * Short code of the account's Chatwoot canned response sent to the customer once, as
+           * the account's agent bot (CHATWOOT_BOT_TOKENS). None is sent while it does not exist.
+           */
+          cannedResponse: z2.string().trim().min(1).max(255).optional(),
+          /**
+           * Set instead of routing the ticket (after the reply, with cannedResponse): `resolved`,
+           * or `snoozed` until the customer's next message. A new message from the customer
+           * reopens either.
+           */
+          status: z2.enum(["resolved", "snoozed"]).optional()
+        })
+      )
+    ).optional()
+  })
+}).refine((config) => Object.keys(config.startAfterConversationId).every((id) => config.routing.accounts[id]), {
+  path: ["startAfterConversationId"],
+  message: "must only name routed accounts"
+}).refine((config) => Object.keys(config.routing?.kinds ?? {}).every((id) => config.routing?.accounts[id]), {
+  path: ["routing", "kinds"],
+  message: "must only name routed accounts"
+}).refine(
+  (config) => Object.values(config.routing?.kinds ?? {}).every(
+    (kinds) => Object.keys(kinds).every((kind) => !Object.hasOwn(config.routing?.topics ?? {}, kind))
+  ),
+  { path: ["routing", "kinds"], message: "a kind cannot be named as a topic: they are labels of two families" }
+);
+var secretsSchema = z2.object({
+  CHATWOOT_TOKEN: z2.string().min(1),
+  CHATWOOT_WEBHOOK_SECRETS: jsonRecord,
+  TYPESAFE_API_KEY: z2.string().min(1),
+  CHATWOOT_BOT_TOKENS: jsonRecord.default({})
+});
+
+// scripts/stored-config.ts
+function storedConfig(file) {
+  return readStoredConfig(file, configSchema);
+}
+export {
+  storedConfig
+};