whale-code 6.5.6 → 6.5.7

package/dist/server/server-routes-events.js

@@ -0,0 +1,167 @@
+// server/server-routes-events.ts — Event and webhook route handlers
+// Events POST and webhook POST
+// Extracted from index.ts for domain-based modularity.
+
+import { createLogger } from "./lib/logger.js";
+import { getServiceClient } from "./lib/supabase-client.js";
+import { handleWebhookIngestion as processWebhook, executeInlineChain } from "./handlers/workflows.js";
+import { jsonResponse, readBody, safeCompare } from "./server-helpers.js";
+import { sendIpRateLimit } from "./server-rate-limit.js";
+const log = createLogger("server-routes-events");
+const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
+const SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || "";
+const FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || "";
+
+// ============================================================================
+// HELPERS
+// ============================================================================
+
+function getToken(req) {
+  const authHeader = req.headers.authorization;
+  return authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : "";
+}
+function isInternalAuth(token) {
+  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);
+}
+
+// ============================================================================
+// POST /events — Fire event (service-role or internal auth)
+// ============================================================================
+
+export async function handleFireEvent(req, res, ctx) {
+  const {
+    pathname,
+    corsHeaders
+  } = ctx;
+  if (!(pathname === "/events" && req.method === "POST")) return false;
+  const token = getToken(req);
+  const isInternal = isInternalAuth(token);
+  if (!isInternal && !token) {
+    jsonResponse(res, 401, {
+      error: "Missing authorization"
+    }, corsHeaders);
+    return true;
+  }
+  const supabase = getServiceClient();
+
+  // Verify user auth if not internal
+  if (!isInternal) {
+    const {
+      data: {
+        user: authUser
+      },
+      error: authError
+    } = await supabase.auth.getUser(token);
+    if (authError || !authUser) {
+      jsonResponse(res, 401, {
+        error: "Invalid or expired token"
+      }, corsHeaders);
+      return true;
+    }
+  }
+  let rawBody;
+  try {
+    rawBody = await readBody(req);
+  } catch {
+    jsonResponse(res, 413, {
+      error: "Request body too large"
+    }, corsHeaders);
+    return true;
+  }
+  let body;
+  try {
+    body = JSON.parse(rawBody || "{}");
+  } catch {
+    jsonResponse(res, 400, {
+      error: "Invalid JSON"
+    }, corsHeaders);
+    return true;
+  }
+  if (!body.store_id || !body.event_type) {
+    jsonResponse(res, 400, {
+      error: "store_id and event_type required"
+    }, corsHeaders);
+    return true;
+  }
+
+  // Idempotency: if client provides idempotency_key, check for duplicate
+  if (body.idempotency_key) {
+    const {
+      data: existing
+    } = await supabase.from("workflow_events").select("id").eq("idempotency_key", body.idempotency_key).limit(1);
+    if (existing && existing.length > 0) {
+      jsonResponse(res, 200, {
+        success: true,
+        event_id: existing[0].id,
+        deduplicated: true
+      }, corsHeaders);
+      return true;
+    }
+  }
+  const {
+    data: eventId,
+    error: fireErr
+  } = await supabase.rpc("fire_event", {
+    p_store_id: body.store_id,
+    p_event_type: body.event_type,
+    p_event_payload: body.payload || {},
+    p_source: body.source || "api"
+  });
+  if (fireErr) {
+    jsonResponse(res, 500, {
+      success: false,
+      error: fireErr.message
+    }, corsHeaders);
+  } else {
+    jsonResponse(res, 200, {
+      success: true,
+      event_id: eventId
+    }, corsHeaders);
+  }
+  return true;
+}
+
+// ============================================================================
+// POST /webhooks/:slug — Webhook ingestion (no auth — uses HMAC verification)
+// ============================================================================
+
+export async function handleWebhookRoute(req, res, ctx) {
+  const {
+    pathname,
+    corsHeaders
+  } = ctx;
+  const webhookMatch = pathname.match(/^\/webhooks\/([a-zA-Z0-9_-]+)$/);
+  if (!(webhookMatch && req.method === "POST")) return false;
+  const whClientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+  if (sendIpRateLimit(res, whClientIp, corsHeaders)) return true;
+  const slug = webhookMatch[1];
+  let rawBody;
+  try {
+    rawBody = await readBody(req);
+  } catch {
+    jsonResponse(res, 413, {
+      error: "Request body too large"
+    }, corsHeaders);
+    return true;
+  }
+  const supabase = getServiceClient();
+  const headers = {};
+  for (const [k, v] of Object.entries(req.headers)) {
+    if (typeof v === "string") headers[k] = v;
+  }
+  const result = await processWebhook(supabase, slug, rawBody, headers);
+
+  // Phase 1: Inline execution for webhook-triggered workflows
+  if (result.body.run_id && result.status === 200) {
+    try {
+      await executeInlineChain(supabase, result.body.run_id);
+    } catch (err) {
+      log.error({
+        err: err.message
+      }, "webhook inline chain error");
+    }
+  }
+  jsonResponse(res, result.status, result.body, corsHeaders);
+  return true;
+}
+//# sourceMappingURL=server-routes-events.js.map

package/dist/server/server-routes-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-routes-events.js","names":["createLogger","getServiceClient","handleWebhookIngestion","processWebhook","executeInlineChain","jsonResponse","readBody","safeCompare","sendIpRateLimit","log","SUPABASE_SERVICE_ROLE_KEY","process","env","SERVICE_ROLE_JWT","FLY_INTERNAL_SECRET","getToken","req","authHeader","headers","authorization","startsWith","substring","isInternalAuth","token","handleFireEvent","res","ctx","pathname","corsHeaders","method","isInternal","error","supabase","data","user","authUser","authError","auth","getUser","rawBody","body","JSON","parse","store_id","event_type","idempotency_key","existing","from","select","eq","limit","length","success","event_id","id","deduplicated","eventId","fireErr","rpc","p_store_id","p_event_type","p_event_payload","payload","p_source","source","message","handleWebhookRoute","webhookMatch","match","whClientIp","toString","split","trim","socket","remoteAddress","slug","k","v","Object","entries","result","run_id","status","err"],"sources":["../../src/server/server-routes-events.ts"],"sourcesContent":["// server/server-routes-events.ts — Event and webhook route handlers\n// Events POST and webhook POST\n// Extracted from index.ts for domain-based modularity.\n\nimport http from \"node:http\";\nimport { createLogger } from \"./lib/logger.js\";\nimport { getServiceClient } from \"./lib/supabase-client.js\";\nimport { handleWebhookIngestion as processWebhook, executeInlineChain } from \"./handlers/workflows.js\";\nimport { jsonResponse, readBody, safeCompare, type ServerContext } from \"./server-helpers.js\";\nimport { sendIpRateLimit } from \"./server-rate-limit.js\";\n\nconst log = createLogger(\"server-routes-events\");\n\nconst SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY!;\nconst SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || \"\";\nconst FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || \"\";\n\n// ============================================================================\n// HELPERS\n// ============================================================================\n\nfunction getToken(req: http.IncomingMessage): string {\n  const authHeader = req.headers.authorization;\n  return authHeader?.startsWith(\"Bearer \") ? authHeader.substring(7) : \"\";\n}\n\nfunction isInternalAuth(token: string): boolean {\n  return safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);\n}\n\n// ============================================================================\n// POST /events — Fire event (service-role or internal auth)\n// ============================================================================\n\nexport async function handleFireEvent(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  if (!(pathname === \"/events\" && req.method === \"POST\")) return false;\n\n  const token = getToken(req);\n  const isInternal = isInternalAuth(token);\n\n  if (!isInternal && !token) {\n    jsonResponse(res, 401, { error: \"Missing authorization\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n\n  // Verify user auth if not internal\n  if (!isInternal) {\n    const { data: { user: authUser }, error: authError } = await supabase.auth.getUser(token);\n    if (authError || !authUser) {\n      jsonResponse(res, 401, { error: \"Invalid or expired token\" }, corsHeaders);\n      return true;\n    }\n  }\n\n  let rawBody: string;\n  try {\n    rawBody = await readBody(req);\n  } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  let body: any;\n  try { body = JSON.parse(rawBody || \"{}\"); } catch {\n    jsonResponse(res, 400, { error: \"Invalid JSON\" }, corsHeaders);\n    return true;\n  }\n  if (!body.store_id || !body.event_type) {\n    jsonResponse(res, 400, { error: \"store_id and event_type required\" }, corsHeaders);\n    return true;\n  }\n\n  // Idempotency: if client provides idempotency_key, check for duplicate\n  if (body.idempotency_key) {\n    const { data: existing } = await supabase.from(\"workflow_events\")\n      .select(\"id\")\n      .eq(\"idempotency_key\", body.idempotency_key)\n      .limit(1);\n    if (existing && existing.length > 0) {\n      jsonResponse(res, 200, { success: true, event_id: existing[0].id, deduplicated: true }, corsHeaders);\n      return true;\n    }\n  }\n\n  const { data: eventId, error: fireErr } = await supabase.rpc(\"fire_event\", {\n    p_store_id: body.store_id,\n    p_event_type: body.event_type,\n    p_event_payload: body.payload || {},\n    p_source: body.source || \"api\",\n  });\n\n  if (fireErr) {\n    jsonResponse(res, 500, { success: false, error: fireErr.message }, corsHeaders);\n  } else {\n    jsonResponse(res, 200, { success: true, event_id: eventId }, corsHeaders);\n  }\n  return true;\n}\n\n// ============================================================================\n// POST /webhooks/:slug — Webhook ingestion (no auth — uses HMAC verification)\n// ============================================================================\n\nexport async function handleWebhookRoute(\n  req: http.IncomingMessage,\n  res: http.ServerResponse,\n  ctx: ServerContext,\n): Promise<boolean> {\n  const { pathname, corsHeaders } = ctx;\n\n  const webhookMatch = pathname.match(/^\\/webhooks\\/([a-zA-Z0-9_-]+)$/);\n  if (!(webhookMatch && req.method === \"POST\")) return false;\n\n  const whClientIp = req.headers[\"x-forwarded-for\"]?.toString().split(\",\")[0]?.trim() || req.socket.remoteAddress || \"unknown\";\n  if (sendIpRateLimit(res, whClientIp, corsHeaders)) return true;\n\n  const slug = webhookMatch[1];\n  let rawBody: string;\n  try {\n    rawBody = await readBody(req);\n  } catch {\n    jsonResponse(res, 413, { error: \"Request body too large\" }, corsHeaders);\n    return true;\n  }\n\n  const supabase = getServiceClient();\n  const headers: Record<string, string> = {};\n  for (const [k, v] of Object.entries(req.headers)) {\n    if (typeof v === \"string\") headers[k] = v;\n  }\n\n  const result = await processWebhook(supabase, slug, rawBody, headers);\n\n  // Phase 1: Inline execution for webhook-triggered workflows\n  if (result.body.run_id && result.status === 200) {\n    try {\n      await executeInlineChain(supabase, result.body.run_id as string);\n    } catch (err) {\n      log.error({ err: (err as Error).message }, \"webhook inline chain error\");\n    }\n  }\n\n  jsonResponse(res, result.status, result.body, corsHeaders);\n  return true;\n}\n"],"mappings":"AAAA;AACA;AACA;;AAGA,SAASA,YAAY,QAAQ,iBAAiB;AAC9C,SAASC,gBAAgB,QAAQ,0BAA0B;AAC3D,SAASC,sBAAsB,IAAIC,cAAc,EAAEC,kBAAkB,QAAQ,yBAAyB;AACtG,SAASC,YAAY,EAAEC,QAAQ,EAAEC,WAAW,QAA4B,qBAAqB;AAC7F,SAASC,eAAe,QAAQ,wBAAwB;AAExD,MAAMC,GAAG,GAAGT,YAAY,CAAC,sBAAsB,CAAC;AAEhD,MAAMU,yBAAyB,GAAGC,OAAO,CAACC,GAAG,CAACF,yBAA0B;AACxE,MAAMG,gBAAgB,GAAGF,OAAO,CAACC,GAAG,CAACC,gBAAgB,IAAI,EAAE;AAC3D,MAAMC,mBAAmB,GAAGH,OAAO,CAACC,GAAG,CAACE,mBAAmB,IAAI,EAAE;;AAEjE;AACA;AACA;;AAEA,SAASC,QAAQA,CAACC,GAAyB,EAAU;EACnD,MAAMC,UAAU,GAAGD,GAAG,CAACE,OAAO,CAACC,aAAa;EAC5C,OAAOF,UAAU,EAAEG,UAAU,CAAC,SAAS,CAAC,GAAGH,UAAU,CAACI,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE;AACzE;AAEA,SAASC,cAAcA,CAACC,KAAa,EAAW;EAC9C,OAAOhB,WAAW,CAACgB,KAAK,EAAET,mBAAmB,CAAC,IAAIP,WAAW,CAACgB,KAAK,EAAEb,yBAAyB,CAAC,IAAIH,WAAW,CAACgB,KAAK,EAAEV,gBAAgB,CAAC;AACzI;;AAEA;AACA;AACA;;AAEA,OAAO,eAAeW,eAAeA,CACnCR,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,IAAI,EAAEC,QAAQ,KAAK,SAAS,IAAIX,GAAG,CAACa,MAAM,KAAK,MAAM,CAAC,EAAE,OAAO,KAAK;EAEpE,MAAMN,KAAK,GAAGR,QAAQ,CAACC,GAAG,CAAC;EAC3B,MAAMc,UAAU,GAAGR,cAAc,CAACC,KAAK,CAAC;EAExC,IAAI,CAACO,UAAU,IAAI,CAACP,KAAK,EAAE;IACzBlB,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAwB,CAAC,EAAEH,WAAW,CAAC;IACvE,OAAO,IAAI;EACb;EAEA,MAAMI,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;;EAEnC;EACA,IAAI,CAAC6B,UAAU,EAAE;IACf,MAAM;MAAEG,IAAI,EAAE;QAAEC,IAAI,EAAEC;MAAS,CAAC;MAAEJ,KAAK,EAAEK;IAAU,CAAC,GAAG,MAAMJ,QAAQ,CAACK,IAAI,CAACC,OAAO,CAACf,KAAK,CAAC;IACzF,IAAIa,SAAS,IAAI,CAACD,QAAQ,EAAE;MAC1B9B,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;QAAEM,KAAK,EAAE;MAA2B,CAAC,EAAEH,WAAW,CAAC;MAC1E,OAAO,IAAI;IACb;EACF;EAEA,IAAIW,OAAe;EACnB,IAAI;IACFA,OAAO,GAAG,MAAMjC,QAAQ,CAACU,GAAG,CAAC;EAC/B,CAAC,CAAC,MAAM;IACNX,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAyB,CAAC,EAAEH,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,IAAIY,IAAS;EACb,IAAI;IAAEA,IAAI,GAAGC,IAAI,CAACC,KAAK,CAACH,OAAO,IAAI,IAAI,CAAC;EAAE,CAAC,CAAC,MAAM;IAChDlC,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAe,CAAC,EAAEH,WAAW,CAAC;IAC9D,OAAO,IAAI;EACb;EACA,IAAI,CAACY,IAAI,CAACG,QAAQ,IAAI,CAACH,IAAI,CAACI,UAAU,EAAE;IACtCvC,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAmC,CAAC,EAAEH,WAAW,CAAC;IAClF,OAAO,IAAI;EACb;;EAEA;EACA,IAAIY,IAAI,CAACK,eAAe,EAAE;IACxB,MAAM;MAAEZ,IAAI,EAAEa;IAAS,CAAC,GAAG,MAAMd,QAAQ,CAACe,IAAI,CAAC,iBAAiB,CAAC,CAC9DC,MAAM,CAAC,IAAI,CAAC,CACZC,EAAE,CAAC,iBAAiB,EAAET,IAAI,CAACK,eAAe,CAAC,CAC3CK,KAAK,CAAC,CAAC,CAAC;IACX,IAAIJ,QAAQ,IAAIA,QAAQ,CAACK,MAAM,GAAG,CAAC,EAAE;MACnC9C,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;QAAE2B,OAAO,EAAE,IAAI;QAAEC,QAAQ,EAAEP,QAAQ,CAAC,CAAC,CAAC,CAACQ,EAAE;QAAEC,YAAY,EAAE;MAAK,CAAC,EAAE3B,WAAW,CAAC;MACpG,OAAO,IAAI;IACb;EACF;EAEA,MAAM;IAAEK,IAAI,EAAEuB,OAAO;IAAEzB,KAAK,EAAE0B;EAAQ,CAAC,GAAG,MAAMzB,QAAQ,CAAC0B,GAAG,CAAC,YAAY,EAAE;IACzEC,UAAU,EAAEnB,IAAI,CAACG,QAAQ;IACzBiB,YAAY,EAAEpB,IAAI,CAACI,UAAU;IAC7BiB,eAAe,EAAErB,IAAI,CAACsB,OAAO,IAAI,CAAC,CAAC;IACnCC,QAAQ,EAAEvB,IAAI,CAACwB,MAAM,IAAI;EAC3B,CAAC,CAAC;EAEF,IAAIP,OAAO,EAAE;IACXpD,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAE2B,OAAO,EAAE,KAAK;MAAErB,KAAK,EAAE0B,OAAO,CAACQ;IAAQ,CAAC,EAAErC,WAAW,CAAC;EACjF,CAAC,MAAM;IACLvB,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAE2B,OAAO,EAAE,IAAI;MAAEC,QAAQ,EAAEG;IAAQ,CAAC,EAAE5B,WAAW,CAAC;EAC3E;EACA,OAAO,IAAI;AACb;;AAEA;AACA;AACA;;AAEA,OAAO,eAAesC,kBAAkBA,CACtClD,GAAyB,EACzBS,GAAwB,EACxBC,GAAkB,EACA;EAClB,MAAM;IAAEC,QAAQ;IAAEC;EAAY,CAAC,GAAGF,GAAG;EAErC,MAAMyC,YAAY,GAAGxC,QAAQ,CAACyC,KAAK,CAAC,gCAAgC,CAAC;EACrE,IAAI,EAAED,YAAY,IAAInD,GAAG,CAACa,MAAM,KAAK,MAAM,CAAC,EAAE,OAAO,KAAK;EAE1D,MAAMwC,UAAU,GAAGrD,GAAG,CAACE,OAAO,CAAC,iBAAiB,CAAC,EAAEoD,QAAQ,CAAC,CAAC,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAEC,IAAI,CAAC,CAAC,IAAIxD,GAAG,CAACyD,MAAM,CAACC,aAAa,IAAI,SAAS;EAC5H,IAAIlE,eAAe,CAACiB,GAAG,EAAE4C,UAAU,EAAEzC,WAAW,CAAC,EAAE,OAAO,IAAI;EAE9D,MAAM+C,IAAI,GAAGR,YAAY,CAAC,CAAC,CAAC;EAC5B,IAAI5B,OAAe;EACnB,IAAI;IACFA,OAAO,GAAG,MAAMjC,QAAQ,CAACU,GAAG,CAAC;EAC/B,CAAC,CAAC,MAAM;IACNX,YAAY,CAACoB,GAAG,EAAE,GAAG,EAAE;MAAEM,KAAK,EAAE;IAAyB,CAAC,EAAEH,WAAW,CAAC;IACxE,OAAO,IAAI;EACb;EAEA,MAAMI,QAAQ,GAAG/B,gBAAgB,CAAC,CAAC;EACnC,MAAMiB,OAA+B,GAAG,CAAC,CAAC;EAC1C,KAAK,MAAM,CAAC0D,CAAC,EAAEC,CAAC,CAAC,IAAIC,MAAM,CAACC,OAAO,CAAC/D,GAAG,CAACE,OAAO,CAAC,EAAE;IAChD,IAAI,OAAO2D,CAAC,KAAK,QAAQ,EAAE3D,OAAO,CAAC0D,CAAC,CAAC,GAAGC,CAAC;EAC3C;EAEA,MAAMG,MAAM,GAAG,MAAM7E,cAAc,CAAC6B,QAAQ,EAAE2C,IAAI,EAAEpC,OAAO,EAAErB,OAAO,CAAC;;EAErE;EACA,IAAI8D,MAAM,CAACxC,IAAI,CAACyC,MAAM,IAAID,MAAM,CAACE,MAAM,KAAK,GAAG,EAAE;IAC/C,IAAI;MACF,MAAM9E,kBAAkB,CAAC4B,QAAQ,EAAEgD,MAAM,CAACxC,IAAI,CAACyC,MAAgB,CAAC;IAClE,CAAC,CAAC,OAAOE,GAAG,EAAE;MACZ1E,GAAG,CAACsB,KAAK,CAAC;QAAEoD,GAAG,EAAGA,GAAG,CAAWlB;MAAQ,CAAC,EAAE,4BAA4B,CAAC;IAC1E;EACF;EAEA5D,YAAY,CAACoB,GAAG,EAAEuD,MAAM,CAACE,MAAM,EAAEF,MAAM,CAACxC,IAAI,EAAEZ,WAAW,CAAC;EAC1D,OAAO,IAAI;AACb","ignoreList":[]}

package/dist/server/server-routes-public.d.ts

@@ -0,0 +1,24 @@
+import http from "node:http";
+import type { SupabaseClient } from "@supabase/supabase-js";
+declare let webchatAgentInvoker: ((supabase: SupabaseClient, agentId: string, message: string, storeId: string, conversationId: string, senderContext?: any) => Promise<{
+    success: boolean;
+    response?: string;
+    error?: string;
+}>) | null;
+export declare function setWebchatAgentInvoker(invoker: typeof webchatAgentInvoker): void;
+/**
+ * Handle SSE workflow stream route.
+ * Returns true if route was handled, false otherwise.
+ */
+export declare function handleSseStreamRoute(req: http.IncomingMessage, res: http.ServerResponse, pathname: string, corsHeaders: Record<string, string>): Promise<boolean>;
+/**
+ * Handle guest approval route.
+ * Returns true if route was handled, false otherwise.
+ */
+export declare function handleGuestApprovalRoute(req: http.IncomingMessage, res: http.ServerResponse, pathname: string, corsHeaders: Record<string, string>): Promise<boolean>;
+/**
+ * Handle webchat routes (messages, history, widget.js).
+ * Returns true if route was handled, false otherwise.
+ */
+export declare function handleWebchatRoutes(req: http.IncomingMessage, res: http.ServerResponse, pathname: string, url: URL, corsHeaders: Record<string, string>): Promise<boolean>;
+export {};

package/dist/server/server-routes-public.js

@@ -0,0 +1,453 @@
+// server/server-routes-public.ts — Public/unauthenticated route handlers
+// SSE streaming, guest approvals, webchat, billing, node routes
+// Extracted from index.ts for modularity.
+
+import { randomUUID } from "node:crypto";
+import { createLogger } from "./lib/logger.js";
+import { getServiceClient } from "./lib/supabase-client.js";
+import { checkPlanLimits, incrementUsage } from "./handlers/billing.js";
+import { verifyGuestApprovalSignature, executeInlineChain } from "./handlers/workflows.js";
+import { jsonResponse, readBody, safeCompare } from "./server-helpers.js";
+import { sendIpRateLimit } from "./server-rate-limit.js";
+import { getSseClients, sendWorkflowSSE, safeSseWrite, MAX_SSE_CLIENTS_PER_RUN, MAX_SSE_TOTAL_CLIENTS, getTotalSseClients } from "./server-sse.js";
+const log = createLogger("server-routes-public");
+
+// Webchat agent invoker — set later to avoid circular deps
+let webchatAgentInvoker = null;
+export function setWebchatAgentInvoker(invoker) {
+  webchatAgentInvoker = invoker;
+}
+
+// Env secrets (needed for auth checks)
+const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY;
+const SERVICE_ROLE_JWT = process.env.SERVICE_ROLE_JWT || "";
+const FLY_INTERNAL_SECRET = process.env.FLY_INTERNAL_SECRET || "";
+
+/**
+ * Handle SSE workflow stream route.
+ * Returns true if route was handled, false otherwise.
+ */
+export async function handleSseStreamRoute(req, res, pathname, corsHeaders) {
+  if (!(req.method === "GET" && pathname.match(/^\/workflows\/runs\/[a-f0-9-]+\/stream$/))) return false;
+  const runId = pathname.split("/")[3];
+  const authHeader = req.headers.authorization;
+  const token = authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : "";
+  const isInternal = safeCompare(token, FLY_INTERNAL_SECRET) || safeCompare(token, SUPABASE_SERVICE_ROLE_KEY) || safeCompare(token, SERVICE_ROLE_JWT);
+  if (!isInternal && !token) {
+    jsonResponse(res, 401, {
+      error: "Missing authorization"
+    }, corsHeaders);
+    return true;
+  }
+  if (!isInternal) {
+    const sb = getServiceClient();
+    const {
+      data: {
+        user: authUser
+      },
+      error: authError
+    } = await sb.auth.getUser(token);
+    if (authError || !authUser) {
+      jsonResponse(res, 401, {
+        error: "Invalid or expired token"
+      }, corsHeaders);
+      return true;
+    }
+    const {
+      data: sseRun
+    } = await sb.from("workflow_runs").select("store_id").eq("id", runId).single();
+    if (sseRun) {
+      const {
+        data: membership
+      } = await sb.from("store_members").select("id").eq("store_id", sseRun.store_id).eq("user_id", authUser.id).single();
+      if (!membership) {
+        jsonResponse(res, 403, {
+          error: "Not authorized to view this run"
+        }, corsHeaders);
+        return true;
+      }
+    }
+  }
+  const sseClients = getSseClients();
+  const existingClients = sseClients.get(runId)?.size || 0;
+  if (existingClients >= MAX_SSE_CLIENTS_PER_RUN) {
+    jsonResponse(res, 429, {
+      error: "Too many SSE clients for this run"
+    }, corsHeaders);
+    return true;
+  }
+  if (getTotalSseClients() >= MAX_SSE_TOTAL_CLIENTS) {
+    jsonResponse(res, 429, {
+      error: "Too many total SSE connections"
+    }, corsHeaders);
+    return true;
+  }
+  res.writeHead(200, {
+    "Content-Type": "text/event-stream",
+    "Cache-Control": "no-cache",
+    Connection: "keep-alive",
+    ...corsHeaders
+  });
+  const sb = getServiceClient();
+  const {
+    data: run
+  } = await sb.from("workflow_runs").select("id, workflow_id, status, trigger_type, current_step_key, error_message, error_step_key, started_at, completed_at, duration_ms").eq("id", runId).single();
+  const {
+    data: stepRuns
+  } = await sb.from("workflow_step_runs").select("id, step_key, step_type, status, error_message, duration_ms, started_at, completed_at").eq("run_id", runId).order("created_at", {
+    ascending: true
+  });
+  sendWorkflowSSE(res, {
+    type: "snapshot",
+    run,
+    steps: stepRuns || []
+  });
+  if (!sseClients.has(runId)) sseClients.set(runId, new Set());
+  sseClients.get(runId).add(res);
+  const cleanup = () => {
+    clearInterval(heartbeat);
+    const clients = sseClients.get(runId);
+    if (clients) {
+      clients.delete(res);
+      if (clients.size === 0) sseClients.delete(runId);
+    }
+  };
+  const heartbeat = setInterval(() => {
+    if (!safeSseWrite(res, `: heartbeat\n\n`, cleanup)) clearInterval(heartbeat);
+  }, 15_000);
+  req.on("close", cleanup);
+  req.on("error", cleanup);
+  return true;
+}
+
+/**
+ * Handle guest approval route.
+ * Returns true if route was handled, false otherwise.
+ */
+export async function handleGuestApprovalRoute(req, res, pathname, corsHeaders) {
+  const guestApprovalMatch = pathname.match(/^\/approvals\/guest\/([a-f0-9-]+)$/);
+  if (!(guestApprovalMatch && req.method === "GET")) return false;
+  const clientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+  if (sendIpRateLimit(res, clientIp, corsHeaders)) return true;
+  const stepRunId = guestApprovalMatch[1];
+  const urlParams = new URL(req.url || "", `http://${req.headers.host}`).searchParams;
+  const action = urlParams.get("action") || "";
+  const expires = urlParams.get("expires") || "";
+  const sig = urlParams.get("sig") || "";
+  if (!action || !expires || !sig) {
+    jsonResponse(res, 400, {
+      error: "Missing action, expires, or sig parameter"
+    }, corsHeaders);
+    return true;
+  }
+  if (new Date(expires) < new Date()) {
+    jsonResponse(res, 410, {
+      error: "This approval link has expired"
+    }, corsHeaders);
+    return true;
+  }
+  if (!verifyGuestApprovalSignature(stepRunId, action, expires, sig)) {
+    jsonResponse(res, 403, {
+      error: "Invalid signature"
+    }, corsHeaders);
+    return true;
+  }
+  const guestSupabase = getServiceClient();
+  const {
+    data: approval
+  } = await guestSupabase.from("workflow_approval_requests").select("id, store_id, run_id, status").eq("step_run_id", stepRunId).limit(1);
+  if (!approval?.length) {
+    jsonResponse(res, 404, {
+      error: "Approval not found"
+    }, corsHeaders);
+    return true;
+  }
+  if (approval[0].status !== "pending") {
+    jsonResponse(res, 409, {
+      error: `Approval already ${approval[0].status}`
+    }, corsHeaders);
+    return true;
+  }
+  const isApprove = action === "approve" || action === "approved";
+  const {
+    data: guestResult,
+    error: guestErr
+  } = await guestSupabase.rpc("respond_to_approval", {
+    p_approval_id: approval[0].id,
+    p_store_id: approval[0].store_id,
+    p_response: isApprove ? "approved" : "rejected",
+    p_response_data: {
+      guest: true,
+      action
+    },
+    p_responded_by: null
+  });
+  if (guestErr) {
+    jsonResponse(res, 500, {
+      success: false,
+      error: guestErr.message
+    }, corsHeaders);
+    return true;
+  }
+  if (guestResult?.success && approval[0].run_id) {
+    try {
+      await executeInlineChain(guestSupabase, approval[0].run_id);
+    } catch (err) {
+      log.error({
+        err: err.message,
+        runId: approval[0].run_id
+      }, "inline chain failed after guest approval");
+    }
+  }
+  res.writeHead(200, {
+    "Content-Type": "text/html",
+    ...corsHeaders
+  });
+  res.end(`<!DOCTYPE html><html><body style="font-family:system-ui;text-align:center;padding:40px">
+    <h2>${isApprove ? "Approved" : "Rejected"}</h2>
+    <p>Your response has been recorded. You can close this window.</p>
+  </body></html>`);
+  return true;
+}
+
+/**
+ * Handle webchat routes (messages, history, widget.js).
+ * Returns true if route was handled, false otherwise.
+ */
+export async function handleWebchatRoutes(req, res, pathname, url, corsHeaders) {
+  const webchatCors = {
+    ...corsHeaders,
+    "Access-Control-Allow-Origin": "*"
+  };
+
+  // POST /webchat/channels/:id/messages
+  const webchatMsgMatch = pathname.match(/^\/webchat\/channels\/([a-f0-9-]+)\/messages$/);
+  if (webchatMsgMatch && req.method === "POST") {
+    const clientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+    if (sendIpRateLimit(res, clientIp, webchatCors)) return true;
+    let rawBody;
+    try {
+      rawBody = await readBody(req);
+    } catch {
+      jsonResponse(res, 413, {
+        error: "Request body too large"
+      }, webchatCors);
+      return true;
+    }
+    const channelId = webchatMsgMatch[1];
+    let wcBody;
+    try {
+      wcBody = JSON.parse(rawBody);
+    } catch {
+      jsonResponse(res, 400, {
+        error: "Invalid JSON"
+      }, webchatCors);
+      return true;
+    }
+    if (!wcBody.content || typeof wcBody.content !== "string") {
+      jsonResponse(res, 400, {
+        error: "content (string) is required"
+      }, webchatCors);
+      return true;
+    }
+    if (wcBody.content.length > 5000) {
+      jsonResponse(res, 400, {
+        error: "Message too long (max 5000 characters)"
+      }, webchatCors);
+      return true;
+    }
+    const supabase = getServiceClient();
+    const {
+      data: channel
+    } = await supabase.from("channels").select("id, store_id, node_id, agent_id, type, config").eq("id", channelId).eq("type", "webchat").single();
+    if (!channel) {
+      jsonResponse(res, 404, {
+        error: "Webchat channel not found"
+      }, webchatCors);
+      return true;
+    }
+    try {
+      const planCheck = await checkPlanLimits(supabase, channel.store_id, "message");
+      if (!planCheck.allowed) {
+        jsonResponse(res, 429, {
+          error: planCheck.reason || "Plan limit reached"
+        }, webchatCors);
+        return true;
+      }
+    } catch {/* billing tables may not exist yet */}
+    const senderId = wcBody.sender_id || "anonymous";
+    let conversationId = wcBody.conversation_id || "";
+    if (!conversationId) {
+      const thirtyMinAgo = new Date(Date.now() - 30 * 60 * 1000).toISOString();
+      const {
+        data: recent
+      } = await supabase.from("channel_messages").select("conversation_id").eq("channel_id", channelId).eq("sender_id", senderId).gt("created_at", thirtyMinAgo).not("conversation_id", "is", null).order("created_at", {
+        ascending: false
+      }).limit(1);
+      conversationId = recent?.length && recent[0].conversation_id || randomUUID();
+    }
+    const {
+      data: message,
+      error: msgErr
+    } = await supabase.from("channel_messages").insert({
+      store_id: channel.store_id,
+      channel_id: channelId,
+      direction: "inbound",
+      sender_id: senderId,
+      sender_name: wcBody.sender_name || "Visitor",
+      content: wcBody.content,
+      content_type: "text",
+      metadata: {
+        source: "webchat",
+        ip: clientIp,
+        widget_version: "1.0.0"
+      },
+      agent_id: channel.agent_id,
+      conversation_id: conversationId
+    }).select("id, direction, content, conversation_id, created_at").single();
+    if (msgErr) {
+      jsonResponse(res, 500, {
+        error: msgErr.message
+      }, webchatCors);
+      return true;
+    }
+    incrementUsage(supabase, channel.store_id, {
+      messages_in: 1
+    }).catch(() => {});
+    try {
+      await supabase.rpc("increment_channel_stats", {
+        p_channel_id: channelId
+      });
+    } catch {/* ok */}
+    let agentResponse = null;
+    if (channel.agent_id && webchatAgentInvoker) {
+      try {
+        const result = await webchatAgentInvoker(supabase, channel.agent_id, wcBody.content, channel.store_id, conversationId);
+        if (result.success && result.response) {
+          const {
+            data: outMsg
+          } = await supabase.from("channel_messages").insert({
+            store_id: channel.store_id,
+            channel_id: channelId,
+            direction: "outbound",
+            sender_id: "agent",
+            sender_name: "AI Agent",
+            content: result.response,
+            content_type: "text",
+            metadata: {
+              agent_id: channel.agent_id,
+              auto_response: true,
+              source: "webchat"
+            },
+            agent_id: channel.agent_id,
+            conversation_id: conversationId
+          }).select("id, direction, content, conversation_id, created_at").single();
+          agentResponse = outMsg;
+          incrementUsage(supabase, channel.store_id, {
+            messages_out: 1,
+            agent_invocations: 1
+          }).catch(() => {});
+        }
+      } catch (err) {
+        log.error({
+          err: err.message
+        }, "webchat agent error");
+      }
+    }
+    jsonResponse(res, 201, {
+      success: true,
+      message,
+      agent_response: agentResponse,
+      conversation_id: conversationId
+    }, webchatCors);
+    return true;
+  }
+
+  // GET /webchat/channels/:id/history
+  const webchatHistoryMatch = pathname.match(/^\/webchat\/channels\/([a-f0-9-]+)\/history$/);
+  if (webchatHistoryMatch && req.method === "GET") {
+    const clientIp = req.headers["x-forwarded-for"]?.toString().split(",")[0]?.trim() || req.socket.remoteAddress || "unknown";
+    if (sendIpRateLimit(res, clientIp, webchatCors)) return true;
+    const channelId = webchatHistoryMatch[1];
+    const senderId = url.searchParams.get("sender_id") || "";
+    const reqConvId = url.searchParams.get("conversation_id") || "";
+    if (!senderId) {
+      jsonResponse(res, 400, {
+        error: "sender_id query parameter required"
+      }, webchatCors);
+      return true;
+    }
+    const supabase = getServiceClient();
+    const {
+      data: wcChannel
+    } = await supabase.from("channels").select("id, type").eq("id", channelId).eq("type", "webchat").single();
+    if (!wcChannel) {
+      jsonResponse(res, 404, {
+        error: "Webchat channel not found"
+      }, webchatCors);
+      return true;
+    }
+    if (!/^[a-zA-Z0-9_-]+$/.test(senderId)) {
+      jsonResponse(res, 400, {
+        error: "Invalid sender_id format"
+      }, webchatCors);
+      return true;
+    }
+    let query = supabase.from("channel_messages").select("id, direction, sender_id, sender_name, content, content_type, created_at").eq("channel_id", channelId);
+    if (reqConvId) {
+      query = query.eq("conversation_id", reqConvId).in("sender_id", [senderId, "agent"]);
+    } else {
+      query = query.in("sender_id", [senderId, "agent"]);
+    }
+    const {
+      data: messages,
+      error: histErr
+    } = await query.order("created_at", {
+      ascending: true
+    }).limit(50);
+    if (histErr) {
+      jsonResponse(res, 500, {
+        error: histErr.message
+      }, webchatCors);
+      return true;
+    }
+    jsonResponse(res, 200, {
+      success: true,
+      messages: messages || []
+    }, webchatCors);
+    return true;
+  }
+
+  // GET /webchat/widget.js
+  if (pathname === "/webchat/widget.js" && req.method === "GET") {
+    const fs = await import("node:fs");
+    const path = await import("node:path");
+    const possiblePaths = [path.join(import.meta.dirname || __dirname, "../../dist/webchat/widget.js"), path.join(import.meta.dirname || __dirname, "../../../dist/webchat/widget.js"), path.join(process.cwd(), "dist/webchat/widget.js")];
+    let widgetJs = null;
+    for (const p of possiblePaths) {
+      try {
+        widgetJs = fs.readFileSync(p, "utf-8");
+        break;
+      } catch {/* try next */}
+    }
+    if (widgetJs) {
+      res.writeHead(200, {
+        "Content-Type": "application/javascript",
+        "Cache-Control": "public, max-age=3600",
+        ...webchatCors
+      });
+      res.end(widgetJs);
+    } else {
+      res.writeHead(200, {
+        "Content-Type": "application/javascript",
+        ...webchatCors
+      });
+      res.end('console.warn("[WhaleChat] Widget JS not built. Run: npx esbuild src/webchat/widget.ts --bundle --minify --outfile=dist/webchat/widget.js");');
+    }
+    return true;
+  }
+  return false;
+}
+
+// Billing and node route handling is in the main index.ts to keep this file under 300 lines
+//# sourceMappingURL=server-routes-public.js.map