qarpeo 0.0.0-alpha.10

package/dist/runtime/server/utils/blob-store.mjs

@@ -0,0 +1,60 @@
+const GLOBAL_BLOB_KEY = "__qarpeo_dev_mock_blob__";
+export function getDevMockBlobStore() {
+  const g = globalThis;
+  if (!g[GLOBAL_BLOB_KEY]) {
+    g[GLOBAL_BLOB_KEY] = /* @__PURE__ */ new Map([
+      [
+        "uploads/avatar-usr_1.png",
+        {
+          key: "uploads/avatar-usr_1.png",
+          size: 48320,
+          contentType: "image/png",
+          uploaded: new Date(Date.now() - 864e5 * 2).toISOString(),
+          access: "public"
+        }
+      ],
+      [
+        "uploads/hero-image.webp",
+        {
+          key: "uploads/hero-image.webp",
+          size: 129840,
+          contentType: "image/webp",
+          uploaded: new Date(Date.now() - 864e5 * 5).toISOString(),
+          access: "public"
+        }
+      ],
+      [
+        "documents/report-q3.pdf",
+        {
+          key: "documents/report-q3.pdf",
+          size: 512e3,
+          contentType: "application/pdf",
+          uploaded: new Date(Date.now() - 864e5 * 10).toISOString(),
+          access: "public"
+        }
+      ],
+      [
+        "exports/cms-backup-2026.json",
+        {
+          key: "exports/cms-backup-2026.json",
+          size: 24576,
+          contentType: "application/json",
+          uploaded: new Date(Date.now() - 36e5).toISOString(),
+          data: new TextEncoder().encode(
+            JSON.stringify(
+              {
+                collections: ["posts", "authors"],
+                exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                stats: { totalArticles: 42, published: 38 }
+              },
+              null,
+              2
+            )
+          ),
+          access: "public"
+        }
+      ]
+    ]);
+  }
+  return g[GLOBAL_BLOB_KEY];
+}

package/dist/runtime/server/utils/bots.d.ts

@@ -0,0 +1,21 @@
+import type { BotProvider, BotHandlerConfig, BotReplyOptions } from "../../../types";
+/** Verifies a Slack signature (v0=...) against the signing secret with timestamp replay protection. */
+export declare function verifySlackSignature(signingSecret: string, timestamp: string | number, body: string, signature: string): Promise<boolean>;
+/** Verifies a GitHub webhook signature (sha256=...). */
+export declare function verifyGitHubSignature(secret: string, body: string, signatureHeader: string): Promise<boolean>;
+/** Verifies a Discord Ed25519 signature using native Web Crypto. */
+export declare function verifyDiscordSignature(publicKeyHex: string, timestamp: string, body: string, signatureHex: string): Promise<boolean>;
+/** Verifies a Telegram secret token against the x-telegram-bot-api-secret-token header. */
+export declare function verifyTelegramSecret(secretToken: string, headerToken: string): boolean;
+/** Verifies a WhatsApp Cloud API webhook signature (sha256=...). */
+export declare function verifyWhatsAppSignature(appSecret: string, body: string, signatureHeader: string): Promise<boolean>;
+/** Verifies incoming webhook signature according to provider rules. */
+export declare function verifyWebhookSignature(provider: BotProvider, event: any, rawBody: string, secret?: string): Promise<boolean>;
+/** Dispatches a message to Telegram using Bot API */
+export declare function sendTelegramMessage(botToken: string, chatId: string | number, text: string, options?: BotReplyOptions): Promise<any>;
+/** Dispatches a message to Slack via chat.postMessage or response_url */
+export declare function sendSlackMessage(target: string, // botToken or response_url
+channelOrPayload: string | Record<string, any>, text?: string, options?: BotReplyOptions): Promise<any>;
+/** Dispatches a message to WhatsApp via Cloud API */
+export declare function sendWhatsAppMessage(accessToken: string, phoneNumberId: string, to: string, text: string): Promise<any>;
+export declare function defineBotHandler<TPayload = any>(config: BotHandlerConfig<TPayload>): import("nuxt/server").EventHandler<Promise<any>>;

package/dist/runtime/server/utils/bots.mjs

@@ -0,0 +1,491 @@
+import {
+  defineEventHandler,
+  getRequestHeader,
+  getQuery,
+  createError
+} from "nuxt/server";
+import { getCloudflareEnv } from "../../bindings.mjs";
+import { timingSafeEqualString } from "./crypto.mjs";
+import { useAgent } from "./ai.mjs";
+async function computeHmacSha256Hex(secret, data) {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(data));
+  return Array.from(new Uint8Array(signature)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function hexToBytes(hex) {
+  const cleanHex = hex.startsWith("0x") ? hex.slice(2) : hex;
+  const bytes = new Uint8Array(Math.floor(cleanHex.length / 2));
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = parseInt(cleanHex.substring(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+export async function verifySlackSignature(signingSecret, timestamp, body, signature) {
+  if (!signingSecret || !timestamp || !signature) return false;
+  const now = Math.floor(Date.now() / 1e3);
+  const ts = typeof timestamp === "number" ? timestamp : parseInt(timestamp, 10);
+  if (isNaN(ts) || Math.abs(now - ts) > 300) return false;
+  const baseString = `v0:${ts}:${body}`;
+  const hash = await computeHmacSha256Hex(signingSecret, baseString);
+  const expected = `v0=${hash}`;
+  return timingSafeEqualString(signature, expected);
+}
+export async function verifyGitHubSignature(secret, body, signatureHeader) {
+  if (!secret || !signatureHeader) return false;
+  const hash = await computeHmacSha256Hex(secret, body);
+  const expected = `sha256=${hash}`;
+  return timingSafeEqualString(signatureHeader, expected);
+}
+export async function verifyDiscordSignature(publicKeyHex, timestamp, body, signatureHex) {
+  if (!publicKeyHex || !timestamp || !signatureHex) return false;
+  try {
+    const keyBytes = hexToBytes(publicKeyHex);
+    const sigBytes = hexToBytes(signatureHex);
+    const dataBytes = new TextEncoder().encode(timestamp + body);
+    let key;
+    try {
+      key = await crypto.subtle.importKey("raw", keyBytes, { name: "Ed25519" }, false, ["verify"]);
+    } catch {
+      key = await crypto.subtle.importKey(
+        "raw",
+        keyBytes,
+        { name: "NODE-ED25519" },
+        false,
+        ["verify"]
+      );
+    }
+    return await crypto.subtle.verify({ name: key.algorithm.name }, key, sigBytes, dataBytes);
+  } catch {
+    return false;
+  }
+}
+export function verifyTelegramSecret(secretToken, headerToken) {
+  if (!secretToken || !headerToken) return false;
+  return timingSafeEqualString(secretToken, headerToken);
+}
+export async function verifyWhatsAppSignature(appSecret, body, signatureHeader) {
+  if (!appSecret || !signatureHeader) return false;
+  const hash = await computeHmacSha256Hex(appSecret, body);
+  const expected = `sha256=${hash}`;
+  return timingSafeEqualString(signatureHeader, expected);
+}
+export async function verifyWebhookSignature(provider, event, rawBody, secret) {
+  const env = getCloudflareEnv(event);
+  switch (provider) {
+    case "telegram": {
+      const sec = secret || env.TELEGRAM_SECRET_TOKEN || globalThis.process?.env?.TELEGRAM_SECRET_TOKEN;
+      if (!sec) return true;
+      const header = getRequestHeader(event, "x-telegram-bot-api-secret-token") || "";
+      return verifyTelegramSecret(sec, header);
+    }
+    case "slack": {
+      const sec = secret || env.SLACK_SIGNING_SECRET || globalThis.process?.env?.SLACK_SIGNING_SECRET;
+      if (!sec) return true;
+      const sig = getRequestHeader(event, "x-slack-signature") || "";
+      const ts = getRequestHeader(event, "x-slack-request-timestamp") || "";
+      return await verifySlackSignature(sec, ts, rawBody, sig);
+    }
+    case "discord": {
+      const pk = secret || env.DISCORD_PUBLIC_KEY || globalThis.process?.env?.DISCORD_PUBLIC_KEY;
+      if (!pk) return true;
+      const sig = getRequestHeader(event, "x-signature-ed25519") || "";
+      const ts = getRequestHeader(event, "x-signature-timestamp") || "";
+      return await verifyDiscordSignature(pk, ts, rawBody, sig);
+    }
+    case "github": {
+      const sec = secret || env.GITHUB_WEBHOOK_SECRET || globalThis.process?.env?.GITHUB_WEBHOOK_SECRET;
+      if (!sec) return true;
+      const sig = getRequestHeader(event, "x-hub-signature-256") || "";
+      return await verifyGitHubSignature(sec, rawBody, sig);
+    }
+    case "whatsapp": {
+      const sec = secret || env.WHATSAPP_APP_SECRET || globalThis.process?.env?.WHATSAPP_APP_SECRET;
+      if (!sec) return true;
+      const sig = getRequestHeader(event, "x-hub-signature-256") || "";
+      return await verifyWhatsAppSignature(sec, rawBody, sig);
+    }
+    case "generic":
+    default: {
+      const sec = secret || env.WEBHOOK_SECRET || globalThis.process?.env?.WEBHOOK_SECRET;
+      if (!sec) return true;
+      const sig = getRequestHeader(event, "x-webhook-signature") || getRequestHeader(event, "x-hub-signature-256") || getRequestHeader(event, "authorization")?.replace(/^Bearer\s+/i, "") || "";
+      if (sig.startsWith("sha256=")) {
+        return await verifyGitHubSignature(sec, rawBody, sig);
+      }
+      return timingSafeEqualString(sec, sig);
+    }
+  }
+}
+export async function sendTelegramMessage(botToken, chatId, text, options) {
+  const url = `https://api.telegram.org/bot${botToken}/sendMessage`;
+  const body = {
+    chat_id: chatId,
+    text,
+    parse_mode: options?.parseMode || "HTML"
+  };
+  if (options?.replyToMessageId) {
+    body.reply_to_message_id = options.replyToMessageId;
+  }
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  return await res.json();
+}
+export async function sendSlackMessage(target, channelOrPayload, text, options) {
+  if (target.startsWith("https://hooks.slack.com/") || target.startsWith("https://")) {
+    const res2 = await fetch(target, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        text: typeof channelOrPayload === "string" ? channelOrPayload : text,
+        response_type: options?.ephemeral ? "ephemeral" : "in_channel"
+      })
+    });
+    return await res2.text();
+  }
+  const res = await fetch("https://slack.com/api/chat.postMessage", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${target}`
+    },
+    body: JSON.stringify({
+      channel: typeof channelOrPayload === "string" ? channelOrPayload : channelOrPayload.channel,
+      text: text || ""
+    })
+  });
+  return await res.json();
+}
+export async function sendWhatsAppMessage(accessToken, phoneNumberId, to, text) {
+  const url = `https://graph.facebook.com/v21.0/${phoneNumberId}/messages`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${accessToken}`
+    },
+    body: JSON.stringify({
+      messaging_product: "whatsapp",
+      recipient_type: "individual",
+      to,
+      type: "text",
+      text: { preview_url: false, body: text }
+    })
+  });
+  return await res.json();
+}
+function normalizeMessage(provider, payload) {
+  if (!payload || typeof payload !== "object") return void 0;
+  switch (provider) {
+    case "telegram": {
+      const msg = payload.message || payload.edited_message || payload.channel_post;
+      if (!msg) return void 0;
+      const text = msg.text || msg.caption || "";
+      const isCmd = text.startsWith("/");
+      const parts = text.trim().split(/\s+/);
+      const command = isCmd ? parts[0] : void 0;
+      const args = isCmd ? parts.slice(1) : void 0;
+      return {
+        id: String(msg.message_id),
+        text,
+        chatId: String(msg.chat?.id || ""),
+        channelId: String(msg.chat?.id || ""),
+        sender: msg.from ? {
+          id: String(msg.from.id),
+          name: [msg.from.first_name, msg.from.last_name].filter(Boolean).join(" "),
+          username: msg.from.username
+        } : void 0,
+        isCommand: isCmd,
+        command,
+        args,
+        raw: msg
+      };
+    }
+    case "slack": {
+      if (payload.event && payload.event.type === "message" && !payload.event.bot_id) {
+        const ev = payload.event;
+        return {
+          id: String(ev.ts || ""),
+          text: ev.text || "",
+          chatId: String(ev.channel || ""),
+          channelId: String(ev.channel || ""),
+          sender: ev.user ? { id: String(ev.user) } : void 0,
+          raw: ev
+        };
+      }
+      if (payload.command) {
+        return {
+          id: String(payload.trigger_id || Date.now()),
+          text: payload.text || "",
+          chatId: String(payload.channel_id || ""),
+          channelId: String(payload.channel_id || ""),
+          sender: { id: String(payload.user_id || ""), username: payload.user_name },
+          isCommand: true,
+          command: payload.command,
+          args: payload.text ? payload.text.trim().split(/\s+/) : [],
+          raw: payload
+        };
+      }
+      return void 0;
+    }
+    case "discord": {
+      if (payload.type === 2) {
+        const data = payload.data || {};
+        return {
+          id: String(payload.id || ""),
+          text: data.name || "",
+          chatId: String(payload.channel_id || ""),
+          channelId: String(payload.channel_id || ""),
+          sender: payload.member?.user ? {
+            id: String(payload.member.user.id),
+            username: payload.member.user.username
+          } : void 0,
+          isCommand: true,
+          command: `/${data.name}`,
+          raw: payload
+        };
+      }
+      return void 0;
+    }
+    case "whatsapp": {
+      const entry = payload.entry?.[0];
+      const change = entry?.changes?.[0];
+      const message = change?.value?.messages?.[0];
+      if (!message) return void 0;
+      const contact = change?.value?.contacts?.[0];
+      return {
+        id: String(message.id || ""),
+        text: message.text?.body || "",
+        chatId: String(message.from || ""),
+        channelId: String(change?.value?.metadata?.phone_number_id || ""),
+        sender: {
+          id: String(message.from || ""),
+          name: contact?.profile?.name
+        },
+        raw: message
+      };
+    }
+    case "github": {
+      const comment = payload.comment;
+      const issue = payload.issue;
+      if (comment && comment.body) {
+        return {
+          id: String(comment.id),
+          text: comment.body,
+          chatId: String(issue?.number || payload.repository?.full_name || ""),
+          sender: comment.user ? {
+            id: String(comment.user.id),
+            username: comment.user.login,
+            avatarUrl: comment.user.avatar_url
+          } : void 0,
+          raw: comment
+        };
+      }
+      return void 0;
+    }
+    case "generic":
+    default: {
+      if (payload.text || payload.message) {
+        return {
+          id: String(payload.id || Date.now()),
+          text: typeof payload.text === "string" ? payload.text : String(payload.message || ""),
+          chatId: String(payload.chatId || payload.chat_id || payload.channelId || "default"),
+          sender: payload.sender,
+          raw: payload
+        };
+      }
+      return void 0;
+    }
+  }
+}
+async function readEventRawBody(event) {
+  if (event.request?.text) {
+    try {
+      return await event.request.clone().text();
+    } catch {
+      try {
+        return await event.request.text();
+      } catch {
+      }
+    }
+  }
+  if (typeof event.node?.req?.text === "function") {
+    return await event.node.req.text();
+  }
+  if (event.node?.req) {
+    return new Promise((resolve) => {
+      let data = "";
+      event.node.req.on("data", (chunk) => {
+        data += chunk;
+      });
+      event.node.req.on("end", () => resolve(data));
+      event.node.req.on("error", () => resolve(""));
+    });
+  }
+  return "";
+}
+export function defineBotHandler(config) {
+  return defineEventHandler(async (event) => {
+    const ev = event;
+    const method = (ev.method || ev.node?.req?.method || "GET").toUpperCase();
+    const env = getCloudflareEnv(event);
+    if (config.provider === "whatsapp" && method === "GET") {
+      const query2 = getQuery(event);
+      const mode = query2["hub.mode"];
+      const token = query2["hub.verify_token"];
+      const challenge = query2["hub.challenge"];
+      const expectedToken = config.verifyToken || env.WHATSAPP_VERIFY_TOKEN || globalThis.process?.env?.WHATSAPP_VERIFY_TOKEN;
+      if (mode === "subscribe" && token && expectedToken && timingSafeEqualString(String(token), expectedToken)) {
+        return String(challenge || "");
+      }
+      throw createError({ statusCode: 403, statusMessage: "Verification token mismatch" });
+    }
+    const rawBody = await readEventRawBody(event) || "";
+    if (config.verifySignature) {
+      const isValid = await config.verifySignature(event, rawBody);
+      if (!isValid) {
+        throw createError({ statusCode: 401, statusMessage: "Invalid webhook signature" });
+      }
+    } else {
+      const isValid = await verifyWebhookSignature(config.provider, event, rawBody, config.secret);
+      if (!isValid) {
+        throw createError({ statusCode: 401, statusMessage: "Invalid webhook signature" });
+      }
+    }
+    let payload = {};
+    if (rawBody) {
+      const contentType = getRequestHeader(event, "content-type") || "";
+      if (contentType.includes("application/x-www-form-urlencoded")) {
+        const params = new URLSearchParams(rawBody);
+        const parsed = {};
+        for (const [k, v] of params.entries()) {
+          parsed[k] = v;
+        }
+        payload = parsed;
+      } else {
+        try {
+          payload = JSON.parse(rawBody);
+        } catch {
+          payload = { raw: rawBody };
+        }
+      }
+    }
+    if (config.provider === "slack" && payload?.type === "url_verification") {
+      return { challenge: payload.challenge };
+    }
+    if (config.provider === "discord" && payload?.type === 1) {
+      return { type: 1 };
+    }
+    const message = normalizeMessage(config.provider, payload);
+    const query = getQuery(event);
+    const headers = {};
+    if (ev.node?.req?.headers) {
+      for (const [k, v] of Object.entries(ev.node.req.headers)) {
+        headers[k.toLowerCase()] = Array.isArray(v) ? v[0] : v;
+      }
+    }
+    const reply = async (textOrOptions) => {
+      const opts = typeof textOrOptions === "string" ? { text: textOrOptions } : textOrOptions;
+      const text = opts.text;
+      switch (config.provider) {
+        case "telegram": {
+          const token = config.botToken || env.TELEGRAM_BOT_TOKEN || globalThis.process?.env?.TELEGRAM_BOT_TOKEN;
+          if (!token) throw new Error("[defineBotHandler] TELEGRAM_BOT_TOKEN is required to send replies");
+          const targetChatId = message?.chatId || payload.chat_id || payload.chat?.id;
+          if (!targetChatId) throw new Error("[defineBotHandler] Chat ID not found for Telegram reply");
+          return await sendTelegramMessage(token, targetChatId, text, opts);
+        }
+        case "slack": {
+          const token = config.botToken || env.SLACK_BOT_TOKEN || globalThis.process?.env?.SLACK_BOT_TOKEN;
+          const responseUrl = payload.response_url;
+          if (responseUrl) {
+            return await sendSlackMessage(responseUrl, text, void 0, opts);
+          }
+          if (token && message?.chatId) {
+            return await sendSlackMessage(token, message.chatId, text, opts);
+          }
+          return { text };
+        }
+        case "whatsapp": {
+          const token = config.botToken || env.WHATSAPP_ACCESS_TOKEN || globalThis.process?.env?.WHATSAPP_ACCESS_TOKEN;
+          const phoneId = config.phoneNumberId || env.WHATSAPP_PHONE_NUMBER_ID || globalThis.process?.env?.WHATSAPP_PHONE_NUMBER_ID;
+          if (!token || !phoneId) {
+            throw new Error("[defineBotHandler] WHATSAPP_ACCESS_TOKEN and WHATSAPP_PHONE_NUMBER_ID are required to send replies");
+          }
+          const to = message?.chatId;
+          if (!to) throw new Error("[defineBotHandler] Recipient phone number not found for WhatsApp reply");
+          return await sendWhatsAppMessage(token, phoneId, to, text);
+        }
+        case "discord": {
+          return {
+            type: 4,
+            // CHANNEL_MESSAGE_WITH_SOURCE
+            data: {
+              content: text,
+              flags: opts.ephemeral ? 64 : void 0
+            }
+          };
+        }
+        case "generic":
+        case "github":
+        default: {
+          return { reply: text };
+        }
+      }
+    };
+    const ctx = {
+      provider: config.provider,
+      event,
+      rawBody,
+      payload,
+      message,
+      query,
+      headers,
+      reply,
+      agent: (agentName, id) => {
+        const sessionId = id || message?.chatId || "default";
+        return useAgent(agentName, sessionId, event);
+      }
+    };
+    if (config.agent && message?.text) {
+      try {
+        const sessionId = config.agentSessionId ? config.agentSessionId(message, event) : message.chatId || "default";
+        const agentClient = useAgent(config.agent, sessionId, event);
+        const agentRes = await agentClient.chat(message.text);
+        const agentData = await agentRes.json();
+        const replyText = agentData.reply || agentData.response || "";
+        if (replyText) {
+          const replyResult = await reply(replyText);
+          if (config.provider === "discord") {
+            return replyResult;
+          }
+        }
+      } catch (agentErr) {
+        console.error(`[defineBotHandler] Agent execution failed:`, agentErr);
+      }
+    }
+    if (message && config.onMessage) {
+      const hookResult = await config.onMessage(ctx);
+      if (hookResult !== void 0) {
+        return hookResult;
+      }
+    }
+    if (config.onEvent) {
+      const eventName = getRequestHeader(event, "x-github-event") || payload.event?.type || payload.type || "message";
+      const eventResult = await config.onEvent(eventName, ctx);
+      if (eventResult !== void 0) {
+        return eventResult;
+      }
+    }
+    return { ok: true };
+  });
+}

package/dist/runtime/server/utils/cache.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Access Nitro's persistent Edge Cache storage. Connected to Cloudflare KV in production and local
+ * filesystem (.data/cache) in dev.
+ */
+export declare function useCacheStorage(): any;
+/** Parses duration strings like '15m', '1h', '7d' or raw seconds into integer seconds. */
+export declare function parseDurationSeconds(duration: string | number): number;
+/**
+ * Invalidate or purge a specific key, prefix, wildcard pattern, or all entries from the edge cache.
+ *
+ * @param pattern Optional cache key, route path, or wildcard (e.g. '/api/products/**',
+ *   'dashboard:*'). If omitted, clears the entire edge cache.
+ * @returns Array of keys that were purged from storage.
+ */
+export declare function purgeCache(pattern?: string): Promise<string[]>;
+/**
+ * Remember and cache the result of an async computation or database query. If cached and not
+ * expired, returns the cached value. Otherwise, executes the fetcher, saves to edge cache with TTL,
+ * and returns the result.
+ *
+ * @param key Unique cache key (e.g. 'dashboard:stats')
+ * @param ttl Time-to-live (e.g. '5m', '1h', or seconds)
+ * @param fetcher Async function producing the data
+ */
+export declare function rememberCache<T>(key: string, ttl: number | string, fetcher: () => Promise<T>): Promise<T>;
+/** Retrieves a typed value from the edge cache if not expired. */
+export declare function getCacheItem<T = unknown>(key: string): Promise<T | null>;
+/** Stores a typed value in the edge cache with an expiration TTL. */
+export declare function setCacheItem<T = unknown>(key: string, value: T, ttl?: number | string): Promise<void>;
+/** Removes an item from the edge cache by key. */
+export declare function removeCacheItem(key: string): Promise<void>;
+/** Checks whether an unexpired key exists in the edge cache. */
+export declare function hasCacheItem(key: string): Promise<boolean>;