chatwoot-router 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] - 2026-10-18
+
+### Added
+
+- An optional signed `routing.beforeHandoff` hook lets a dependent service write context to Chatwoot before the router
+  ends a pending bot turn. The hook is idempotent per conversation turn; failures leave the ticket pending for retry.
+
+## [0.8.0] - 2026-10-08
+
+### Changed
+
+- Jev sees the contact's email domain on every channel (`Contact email domain: example.net`), not only an email's
+  sender domain: a widget visitor who gives an address at a reserved test domain, as scripted probes do, is told
+  from a person, so the spam kind can end the ticket. The address and name stay redacted.
+
 ## [0.7.0] - 2026-10-07
 
 ### Changed
@@ -148,7 +163,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `routing_kind`.
 - The `chatwoot-router-store-config` command and `chatwoot-router/stored-config`, for a configuration in KV.
 
-[Unreleased]: https://github.com/Phala-Network/chatwoot-workers/compare/chatwoot-router@0.6.0...HEAD
+[Unreleased]: https://github.com/Phala-Network/chatwoot-workers/compare/chatwoot-router@0.9.0...HEAD
+[0.9.0]: https://github.com/Phala-Network/chatwoot-workers/compare/chatwoot-router@0.8.0...chatwoot-router@0.9.0
+[0.8.0]: https://github.com/Phala-Network/chatwoot-workers/compare/chatwoot-router@0.7.0...chatwoot-router@0.8.0
 [0.6.0]: https://github.com/Phala-Network/chatwoot-workers/compare/chatwoot-router@0.5.2...chatwoot-router@0.6.0
 [0.5.2]: https://github.com/Phala-Network/chatwoot-workers/compare/chatwoot-router@0.5.1...chatwoot-router@0.5.2
 [0.5.1]: https://github.com/Phala-Network/chatwoot-workers/compare/chatwoot-router@0.5.0...chatwoot-router@0.5.1

package/README.md

@@ -12,14 +12,16 @@ is each routed account's native agent bot, connected to the inboxes it should ro
 1. A new ticket in a connected inbox is pending, so Chatwoot sends its events to the router's
    `/chatwoot/agent-bot` webhook. Each conversation is routed by a Durable Object of its own, so a slow request
    for one conversation never delays another.
-2. The router reads the customer's first messages of this turn (redacted, at most three and 1,600 characters; an
-   email's sender domain leads them)
+2. The router reads the customer's first messages of this turn (redacted, at most three and 1,600 characters; the
+   contact's email domain leads them)
    and asks TypeSafe's System One API (`/v1/systemone`, model `routing.model`, Jev by default; `routing.endpoint`
    may point to another deployment) for the owner, topic, kind, and whether there is a request yet.
 3. It applies the topic and kind labels, sends the kind's canned reply if it has one (at most once per
-   conversation), and ends the turn: the kind's resolved or snoozed status, the confident owner, or a handoff to
-   people (`status=open`). A greeting with no request yet stays pending until the customer says more, for up to 30
-   minutes (an email that asks for nothing will not say more); then it is routed on. A resolved
+   conversation), then optionally calls the configured before-handoff service. The service can write context to the
+   conversation before the turn ends: it returns success only after its write is complete. The router then ends the
+   turn: the kind's resolved or snoozed status, the confident owner, or a handoff to people (`status=open`). A greeting
+   with no request yet stays pending until the customer says more, for up to 30 minutes (an email that asks for nothing
+   will not say more); then it is routed on. A resolved
    ticket that a customer message reopens keeps its owner: its kind may still end it (a thanks is resolved),
    otherwise it goes back to the owner.
 4. Anything uncertain hands off to people: an unclear owner, a failed or unconfirmed reply, a human replying,
@@ -107,6 +109,7 @@ no unpublished shared package needs installing.
     },
     "topics": { "billing": "Invoices and payments.", "technical": "Product troubleshooting." },
     "minConfidence": 0.7,
+    "beforeHandoff": { "url": "https://service.example.com/router/before-handoff", "timeoutSeconds": 20 },
     "kinds": { "1": { "spam": { "covers": "Unsolicited advertising.", "status": "resolved" } } }
   }
 }
@@ -119,6 +122,9 @@ no unpublished shared package needs installing.
 | `routing.endpoint` | HTTPS URL | `https://api.typesafe.ai/v1/systemone` | TypeSafe's System One API endpoint; may point to another deployment of that API, for example a proxy or gateway. Redirects are refused. |
 | `routing.model` | non-empty string | `jev-1.13.0` | Model sent to TypeSafe's System One API; Jev by default. |
 | `routing.minConfidence` | number 0.5–1 | `0.7` | Probability an answer needs before it is applied. |
+| `routing.beforeHandoff` | object | unset | Optional service call completed before the router ends a pending bot turn. |
+| `routing.beforeHandoff.url` | HTTPS URL | required when configured | Endpoint that writes any context needed before handoff. |
+| `routing.beforeHandoff.timeoutSeconds` | positive integer | `20` | Maximum time for the endpoint request, including its response body. |
 | `routing.botIds` | object: account id → positive safe integer | required | Brand bot id for every routed account, and no others. |
 | `routing.accounts` | object: account id → (owner name → owner) | required | Routed accounts and the owners Jev chooses from. Owner names are 1–40 lower-case letters, digits, or `_`; `unclear` is reserved. |
 | `routing.accounts.<id>.<name>.assignee` | integer > 0 | required | Chatwoot user id to assign. |
@@ -138,10 +144,59 @@ no unpublished shared package needs installing.
 | `CHATWOOT_AGENT_BOT_TOKENS` | Yes | JSON object of bot access tokens by account id, e.g. `{"1":"<token>"}`. All mutations use the bot token. |
 | `CHATWOOT_AGENT_BOT_SECRETS` | Yes | JSON object of bot webhook secrets by account id, e.g. `{"1":"<secret>"}`. |
 | `TYPESAFE_API_KEY` | Yes | TypeSafe API key for System One API requests. |
+| `BEFORE_HANDOFF_SECRET` | When `routing.beforeHandoff.url` is set | At least 32 characters; signs requests to that endpoint. |
 
 Both bot-secret maps require nonempty values and exactly the `routing.accounts` keys. Missing/invalid entries
 fail startup; `/healthz` returns 503 without credentials in its response. All secrets use `bindings.secret()`.
 
+### Before-handoff hook
+
+When `routing.beforeHandoff` is configured, the router calls its HTTPS endpoint once before each successful pending-turn
+release. This covers a handoff to people (`status=open`), a kind's `resolved` or `snoozed` status, an owner assignment,
+and the open mutation used when the inbox bot is disconnected. A person or another bot taking over a ticket, and the
+unassignment of a bot from an already non-pending conversation, do not end a pending bot turn and do not call the hook.
+
+The request is a `POST` with this JSON body. `turnId` is the status-activity boundary returned by the router's turn read;
+it is `0` for the first turn, remains stable when that turn is retried, and changes when a conversation is reopened.
+`channel` and `hmacVerified` are `null` when Chatwoot has no value; `hmacVerified` otherwise carries Chatwoot's
+boolean contact-inbox verification result.
+
+```json
+{
+  "accountId": 42,
+  "conversationId": 9001,
+  "turnId": 17,
+  "contact": { "email": "customer@example.com", "blocked": false },
+  "channel": "Channel::WebWidget",
+  "hmacVerified": true
+}
+```
+
+The exact UTF-8 body bytes are signed with HMAC-SHA256 using `BEFORE_HANDOFF_SECRET` and the Unix timestamp:
+`HMAC-SHA256(secret, "<x-timestamp>.<raw body>")`. Headers are:
+
+```text
+x-timestamp: 1760000000
+x-signature: sha256=<64 lowercase hexadecimal characters>
+content-type: application/json
+```
+
+For example, a receiver can verify and handle a request with the same raw body before returning success:
+
+```sh
+body='{"accountId":42,"conversationId":9001,"turnId":17,"contact":{"email":"customer@example.com","blocked":false},"channel":"Channel::WebWidget","hmacVerified":true}'
+timestamp="$(date +%s)"
+signature="$(printf '%s.%s' "$timestamp" "$body" | openssl dgst -sha256 -hmac "$BEFORE_HANDOFF_SECRET" -hex | sed 's/^.* //')"
+curl --fail-with-body -X POST "https://service.example.com/router/before-handoff" \
+  -H "content-type: application/json" -H "x-timestamp: $timestamp" -H "x-signature: sha256=$signature" \
+  --data "$body"
+```
+
+The receiver must be idempotent for `(accountId, conversationId, turnId)` because retries can repeat a request after a
+timeout or network failure. It should return a 2xx response only after all context it adds for that turn is written (or
+when nothing is due). A non-2xx response, timeout, or network error is logged without credentials or request body and
+is raised by the router; the pending ticket then remains pending for the existing Durable Object retry and sweep.
+
 ## Upgrade and rollback
 
 Keep Worker names, Durable Object namespaces/storage and old KV configuration keys. The Router DO holds
@@ -151,7 +206,7 @@ the Router DO during rollback. If its state is lost or restored to an older reco
 and isolate conversations with uncertain attempts/turns for owner review; a currently empty history does not
 prove another send is safe. Existing pending conversations are reconciled; non-pending conversations stay with people. The user token must see all relevant inboxes.
 
-Redaction is best effort, not anonymization: other personal information can still reach TypeSafe, and an email's
-sender domain is sent on purpose (never the address or name). Logs contain
+Redaction is best effort, not anonymization: other personal information can still reach TypeSafe, and the
+contact's email domain is sent on purpose (never the address or name). Logs contain
 ids and outcomes, never message bodies or credentials. See [SECURITY.md](https://github.com/Phala-Network/chatwoot-workers/blob/main/SECURITY.md),
 [CONTRIBUTING.md](https://github.com/Phala-Network/chatwoot-workers/blob/main/CONTRIBUTING.md) and [CHANGELOG.md](https://github.com/Phala-Network/chatwoot-workers/blob/main/packages/chatwoot-router/CHANGELOG.md). Licensed under [MIT](https://github.com/Phala-Network/chatwoot-workers/blob/main/packages/chatwoot-router/LICENSE).

package/lib/packages/chatwoot-router/scripts/store-config.js

@@ -120,6 +120,11 @@ var configSchema = z2.strictObject({
       z2.string().regex(/^[a-z0-9_-]{1,255}$/, "must be a Chatwoot label name (lower case)"),
       z2.string().min(1).max(1e3)
     ).optional(),
+    /** A signed service call that must complete before a pending bot turn is handed off or assigned. */
+    beforeHandoff: z2.strictObject({
+      url: z2.url({ protocol: /^https$/ }),
+      timeoutSeconds: z2.number().int().min(1).default(20)
+    }).optional(),
     /**
      * Per Chatwoot account id: kinds of ticket Jev recognizes, by a short name, and what is done,
      * once, when it does (see src/routing.ts). Unset: none.
@@ -170,7 +175,8 @@ var secretsSchema = z2.object({
   CHATWOOT_TOKEN: z2.string().min(1),
   CHATWOOT_AGENT_BOT_SECRETS: jsonRecord,
   TYPESAFE_API_KEY: z2.string().min(1),
-  CHATWOOT_AGENT_BOT_TOKENS: jsonRecord
+  CHATWOOT_AGENT_BOT_TOKENS: jsonRecord,
+  BEFORE_HANDOFF_SECRET: z2.string().min(32).optional()
 });
 
 // scripts/stored-config.ts

package/lib/packages/chatwoot-router/scripts/stored-config.js

@@ -72,6 +72,11 @@ var configSchema = z2.strictObject({
       z2.string().regex(/^[a-z0-9_-]{1,255}$/, "must be a Chatwoot label name (lower case)"),
       z2.string().min(1).max(1e3)
     ).optional(),
+    /** A signed service call that must complete before a pending bot turn is handed off or assigned. */
+    beforeHandoff: z2.strictObject({
+      url: z2.url({ protocol: /^https$/ }),
+      timeoutSeconds: z2.number().int().min(1).default(20)
+    }).optional(),
     /**
      * Per Chatwoot account id: kinds of ticket Jev recognizes, by a short name, and what is done,
      * once, when it does (see src/routing.ts). Unset: none.
@@ -122,7 +127,8 @@ var secretsSchema = z2.object({
   CHATWOOT_TOKEN: z2.string().min(1),
   CHATWOOT_AGENT_BOT_SECRETS: jsonRecord,
   TYPESAFE_API_KEY: z2.string().min(1),
-  CHATWOOT_AGENT_BOT_TOKENS: jsonRecord
+  CHATWOOT_AGENT_BOT_TOKENS: jsonRecord,
+  BEFORE_HANDOFF_SECRET: z2.string().min(32).optional()
 });
 
 // scripts/stored-config.ts

package/lib/packages/chatwoot-router/src/before-handoff.d.ts

@@ -0,0 +1,19 @@
+import type { Settings } from "./config.ts";
+export interface BeforeHandoffConversation {
+    contact: {
+        email?: string | null;
+        blocked?: boolean;
+    };
+    channel?: string | null;
+    hmacVerified?: boolean | null;
+}
+export interface BeforeHandoffContext {
+    settings: Settings;
+    /** Counts toward the invocation's subrequest budget. */
+    fetch: (request: Request) => Promise<Response>;
+}
+/**
+ * Let a dependent service finish its per-turn write before the router releases the pending bot turn.
+ * An unset URL deliberately does nothing, preserving the router's existing behavior.
+ */
+export declare function beforeHandoff(ctx: BeforeHandoffContext, accountId: number, conversationId: number, turnId: number, conversation: BeforeHandoffConversation): Promise<void>;

package/lib/packages/chatwoot-router/src/config.d.ts

@@ -14,6 +14,10 @@ export declare const configSchema: z.ZodObject<{
             covers: z.ZodString;
         }, z.core.$strict>>>;
         topics: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        beforeHandoff: z.ZodOptional<z.ZodObject<{
+            url: z.ZodURL;
+            timeoutSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strict>>;
         kinds: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodObject<{
             covers: z.ZodString;
             cannedResponse: z.ZodOptional<z.ZodString>;
@@ -30,6 +34,7 @@ export declare const secretsSchema: z.ZodObject<{
     CHATWOOT_AGENT_BOT_SECRETS: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<unknown, string>>, z.ZodRecord<z.ZodString, z.ZodString>>;
     TYPESAFE_API_KEY: z.ZodString;
     CHATWOOT_AGENT_BOT_TOKENS: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<unknown, string>>, z.ZodRecord<z.ZodString, z.ZodString>>;
+    BEFORE_HANDOFF_SECRET: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type Config = z.infer<typeof configSchema>;
 type Secrets = z.infer<typeof secretsSchema>;

package/lib/packages/chatwoot-router/src/env.d.ts

@@ -6,4 +6,5 @@ export interface Env extends ConfigEnv {
     CHATWOOT_AGENT_BOT_SECRETS: string;
     TYPESAFE_API_KEY: string;
     CHATWOOT_AGENT_BOT_TOKENS: string;
+    BEFORE_HANDOFF_SECRET?: string;
 }

package/lib/packages/chatwoot-router/src/index.js

@@ -108,7 +108,8 @@ var Budget = class {
       this.timeoutMs
     );
     try {
-      const response = await this.fetchImpl(new Request(request, { signal: controller.signal }));
+      const signal = AbortSignal.any([request.signal, controller.signal]);
+      const response = await this.fetchImpl(new Request(request, { signal }));
       if (!response.body) {
         clearTimeout(timer);
         return response;
@@ -162,7 +163,7 @@ var emailSchema = z2.object({
   subject: text,
   auto_reply: z2.boolean().nullish(),
   text_content: z2.object({ quoted: text }).nullish().catch(null),
-  html_content: z2.object({ quoted: text }).nullish().catch(null)
+  html_content: z2.object({ quoted: text, full: text }).nullish().catch(null)
 });
 var messageSchema = z2.object({
   id: z2.number(),
@@ -457,6 +458,7 @@ function toRelayConversation(conversationId, conversation) {
     id: conversationId,
     status: conversation.status,
     channel: meta?.channel ?? null,
+    hmacVerified: meta?.hmac_verified ?? null,
     priority: conversation.priority ?? null,
     labels: conversation.labels ?? [],
     contact: {
@@ -474,9 +476,10 @@ function toRelayConversation(conversationId, conversation) {
     customAttributes: conversation.custom_attributes ?? {}
   };
 }
-function messageContent(message) {
+function messageContent(message, dropCidPlaceholders = false) {
   const email = message.content_attributes?.email;
-  return email?.text_content?.quoted ?? email?.html_content?.quoted ?? message.content ?? "";
+  const content = email?.text_content?.quoted ?? email?.html_content?.quoted ?? message.content ?? "";
+  return dropCidPlaceholders ? content.replace(/\[cid:[^\]\r\n]+\]/gi, "") : content;
 }
 
 // ../../shared/json.ts
@@ -601,6 +604,56 @@ var QueueStore = class {
 import ipRegex from "ip-regex";
 import { z as z4 } from "zod";
 
+// src/before-handoff.ts
+var encoder2 = new TextEncoder();
+async function beforeHandoff(ctx, accountId2, conversationId, turnId, conversation) {
+  const config = ctx.settings.config.routing.beforeHandoff;
+  if (!config) return;
+  const secret = ctx.settings.secrets.BEFORE_HANDOFF_SECRET;
+  if (!secret) throw new Error("before-handoff secret is not configured");
+  const body = JSON.stringify({
+    accountId: accountId2,
+    conversationId,
+    turnId,
+    contact: { email: conversation.contact.email ?? null, blocked: conversation.contact.blocked ?? false },
+    channel: conversation.channel ?? null,
+    hmacVerified: conversation.hmacVerified ?? null
+  });
+  const timestamp = String(Math.floor(Date.now() / 1e3));
+  const key = await crypto.subtle.importKey("raw", encoder2.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
+    "sign"
+  ]);
+  const signed = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder2.encode(`${timestamp}.${body}`)));
+  const signature = Array.from(signed, (byte) => byte.toString(16).padStart(2, "0")).join("");
+  const controller = new AbortController();
+  const timer = setTimeout(
+    () => controller.abort(new DOMException("The request timed out", "TimeoutError")),
+    config.timeoutSeconds * 1e3
+  );
+  try {
+    const response = await ctx.fetch(
+      new Request(config.url, {
+        method: "POST",
+        redirect: "manual",
+        signal: controller.signal,
+        headers: {
+          "content-type": "application/json",
+          "x-timestamp": timestamp,
+          "x-signature": `sha256=${signature}`
+        },
+        body
+      })
+    );
+    await response.arrayBuffer();
+    if (!response.ok) throw new Error(`before-handoff HTTP ${response.status}`);
+  } catch (error) {
+    log.warn("before-handoff failed", { accountId: accountId2, conversationId, turnId, ...errorFields(error) });
+    throw error;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // src/reply.ts
 function confirmedReply(message, botId) {
   return message !== void 0 && Number.isSafeInteger(message.id) && message.id > 0 && message.message_type === 1 && message.private === false && message.sender?.type === "agent_bot" && message.sender.id === botId && message.status !== "failed" && !message.content_attributes?.deleted;
@@ -824,8 +877,12 @@ async function routeConversation(ctx, accountId2, conversationId) {
     if ((await chatwoot.inboxBot(accountId2, raw.inbox_id))?.id !== botId) {
       if (owns(raw)) {
         const latest = await chatwoot.getConversation(accountId2, conversationId);
-        if (latest?.status === "pending" && latest.inbox_id === raw.inbox_id && owns(latest))
+        if (latest?.status === "pending" && latest.inbox_id === raw.inbox_id && owns(latest)) {
+          const conversation2 = toRelayConversation(conversationId, latest);
+          const turnId = routing.beforeHandoff ? (await readTurn(chatwoot, store, accountId2, conversationId)).boundary : 0;
+          await beforeHandoff(ctx, accountId2, conversationId, turnId, conversation2);
           await bot.setStatus(accountId2, conversationId, { status: "open" });
+        }
       }
       return;
     }
@@ -836,7 +893,7 @@ async function routeConversation(ctx, accountId2, conversationId) {
   const initial = await snapshot();
   if (!initial) return;
   const identities = [initial.conversation.contact.name, initial.conversation.contact.email];
-  const senderDomain = initial.conversation.channel === "Channel::Email" ? initial.conversation.contact.email?.split("@")[1] : void 0;
+  const contactDomain = initial.conversation.contact.email?.split("@")[1];
   const inputs = (messages) => {
     const texts = messages.filter(isCustomer).flatMap((message) => {
       const text3 = sanitize(
@@ -848,7 +905,7 @@ async function routeConversation(ctx, accountId2, conversationId) {
     const text2 = texts.map((entry) => entry.text).join(" ");
     return {
       key: texts.map((entry) => entry.id).join(","),
-      text: (senderDomain ? `Email sender domain: ${senderDomain}
+      text: (contactDomain ? `Contact email domain: ${contactDomain}
 ${text2}` : text2).slice(0, MAX_TEXT),
       count: texts.length
     };
@@ -869,7 +926,10 @@ ${text2}` : text2).slice(0, MAX_TEXT),
     requestHandoff(store, accountId2, conversationId);
     current2 ??= await fresh();
     if (current2 === "defer") return "defer";
-    if (current2) await bot.setStatus(accountId2, conversationId, { status: "open" });
+    if (current2) {
+      await beforeHandoff(ctx, accountId2, conversationId, turn.boundary, current2.conversation);
+      await bot.setStatus(accountId2, conversationId, { status: "open" });
+    }
     return void 0;
   };
   if (turn.handoff || requiresHandoff(turn.messages) || input.count === 0) return handoff();
@@ -931,10 +991,12 @@ ${text2}` : text2).slice(0, MAX_TEXT),
   if (current === "defer" || !current) return current;
   if (current.handoff) return handoff(current);
   if (kind?.status) {
+    await beforeHandoff(ctx, accountId2, conversationId, turn.boundary, current.conversation);
     await bot.setStatus(accountId2, conversationId, { status: kind.status });
     expectActivity(store, accountId2, conversationId, { status: kind.status });
     await release();
   } else if (assignee !== void 0 && current.raw.meta?.assignee_type === "AgentBot") {
+    await beforeHandoff(ctx, accountId2, conversationId, turn.boundary, current.conversation);
     await bot.assign(accountId2, conversationId, assignee);
     expectActivity(store, accountId2, conversationId, { status: "open" });
   } else {
@@ -1079,6 +1141,11 @@ var configSchema = z5.strictObject({
       z5.string().regex(/^[a-z0-9_-]{1,255}$/, "must be a Chatwoot label name (lower case)"),
       z5.string().min(1).max(1e3)
     ).optional(),
+    /** A signed service call that must complete before a pending bot turn is handed off or assigned. */
+    beforeHandoff: z5.strictObject({
+      url: z5.url({ protocol: /^https$/ }),
+      timeoutSeconds: z5.number().int().min(1).default(20)
+    }).optional(),
     /**
      * Per Chatwoot account id: kinds of ticket Jev recognizes, by a short name, and what is done,
      * once, when it does (see src/routing.ts). Unset: none.
@@ -1129,7 +1196,8 @@ var secretsSchema = z5.object({
   CHATWOOT_TOKEN: z5.string().min(1),
   CHATWOOT_AGENT_BOT_SECRETS: jsonRecord,
   TYPESAFE_API_KEY: z5.string().min(1),
-  CHATWOOT_AGENT_BOT_TOKENS: jsonRecord
+  CHATWOOT_AGENT_BOT_TOKENS: jsonRecord,
+  BEFORE_HANDOFF_SECRET: z5.string().min(32).optional()
 });
 function parseSettings(rawConfig, rawSecrets) {
   const config = configSchema.safeParse(rawConfig);
@@ -1145,6 +1213,9 @@ function buildSettings(config, secrets) {
       throw new ConfigError(`Invalid secrets: ${name}: needs exactly the routed accounts`);
     }
   }
+  if (config.routing.beforeHandoff && !secrets.BEFORE_HANDOFF_SECRET) {
+    throw new ConfigError("Invalid secrets: BEFORE_HANDOFF_SECRET: required when routing.beforeHandoff.url is set");
+  }
   return { config, secrets };
 }
 

package/lib/packages/chatwoot-router/src/turn.d.ts

@@ -27,6 +27,7 @@ export declare function readTurn(chatwoot: ChatwootClient, store: RoutingStore,
                 } | null | undefined;
                 html_content?: {
                     quoted?: string | null | undefined;
+                    full?: string | null | undefined;
                 } | null | undefined;
             } | null | undefined;
             deleted?: boolean | null | undefined;

package/lib/shared/chatwoot/api.d.ts

@@ -38,6 +38,7 @@ declare const messageSchema: z.ZodObject<{
             }, z.core.$strip>>>>;
             html_content: z.ZodCatch<z.ZodOptional<z.ZodNullable<z.ZodObject<{
                 quoted: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                full: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             }, z.core.$strip>>>>;
         }, z.core.$strip>>>;
         deleted: z.ZodOptional<z.ZodNullable<z.ZodBoolean>>;
@@ -240,6 +241,7 @@ export declare function toRelayMessage(message: ChatwootMessage, context: {
         id: number;
         name: string;
     };
+    chatwootBaseUrl?: string;
     inboxName?: string | null;
     conversation: RelayConversation;
     mentionedAgents?: ReadonlyMap<number, string>;
@@ -249,5 +251,5 @@ export declare function toRelayMessage(message: ChatwootMessage, context: {
  * What Chatwoot itself shows and forwards (Message#ensure_processed_message_content, used by its
  * Slack integration at v4.18.0): for an email, the reply without its quoted history.
  */
-export declare function messageContent(message: ChatwootMessage): string;
+export declare function messageContent(message: ChatwootMessage, dropCidPlaceholders?: boolean): string;
 export {};

package/lib/shared/types.d.ts

@@ -39,6 +39,8 @@ export interface RelayConversation {
     /** open, pending, snoozed, or resolved. */
     status?: string | undefined;
     channel?: string | null;
+    /** Whether Chatwoot verified the contact's HMAC for this inbox. */
+    hmacVerified?: boolean | null;
     /** urgent, high, medium, low, or null. */
     priority?: string | null;
     labels: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chatwoot-router",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Route Chatwoot conversations with TypeSafe Jev on Cloudflare Workers.",
   "keywords": [
     "chatwoot",
@@ -58,10 +58,10 @@
     "prepack": "npm run build:package"
   },
   "devDependencies": {
-    "@cloudflare/vite-plugin": "2.0.0-beta.sha-805ec1ff3"
+    "@cloudflare/vite-plugin": "2.0.0-beta.sha-91c870c02"
   },
   "dependencies": {
-    "hono": "^4.13.10",
+    "hono": "^4.13.13",
     "ip-regex": "^5.0.0",
     "jsonc-parser": "^3.3.1",
     "openapi-fetch": "^0.17.0",