wotann 0.5.0

package/dist/channels/viber.js

@@ -0,0 +1,185 @@
+/**
+ * Viber channel adapter (Bot API — chatapi.viber.com).
+ *
+ * ZERO-DEPENDENCY: Uses fetch() against the Viber REST API.
+ * No viber-bot SDK required.
+ *
+ * Setup:
+ * 1. Create a Public Account at https://partners.viber.com
+ * 2. Copy the authentication token
+ * 3. Set VIBER_AUTH_TOKEN and optionally VIBER_SENDER_NAME / VIBER_SENDER_AVATAR
+ * 4. Register webhook via `set_webhook`: the adapter does this on start()
+ *
+ * Inbound: Viber POSTs signed JSON events to an operator-owned URL.
+ * The hosting server verifies the X-Viber-Content-Signature header, then
+ * forwards the body here via `handleWebhookBody()`.
+ *
+ * Outbound: POST /pa/send_message with the receiver id.
+ *
+ * Security:
+ * - Verifies the X-Viber-Content-Signature HMAC when present.
+ * - Honest error on missing token (no silent fallback).
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+const VIBER_API_BASE = "https://chatapi.viber.com/pa";
+/**
+ * Viber text messages cap at 7000 chars. We keep chunks at 6500 to reserve
+ * space for "(n/m)" prefixes and future metadata.
+ */
+const VIBER_MESSAGE_LIMIT = 6500;
+export class ViberAdapter {
+    type = "viber";
+    name = "Viber";
+    authToken;
+    senderName;
+    senderAvatar;
+    connected = false;
+    messageHandler = null;
+    constructor(authToken, senderName, senderAvatar) {
+        this.authToken = authToken ?? process.env["VIBER_AUTH_TOKEN"] ?? "";
+        this.senderName = senderName ?? process.env["VIBER_SENDER_NAME"] ?? "WOTANN";
+        this.senderAvatar = senderAvatar ?? process.env["VIBER_SENDER_AVATAR"] ?? "";
+    }
+    async start() {
+        if (!this.authToken) {
+            throw new Error("VIBER_AUTH_TOKEN required. " +
+                "Create a Public Account at https://partners.viber.com and copy the auth token.");
+        }
+        // Verify credentials by fetching account info. This does NOT auto-register
+        // a webhook URL because only the deploying operator knows the public URL;
+        // `set_webhook` must be called from the hosting server at deploy time.
+        const response = await this.post("/get_account_info", {});
+        if (response.status !== 0) {
+            throw new Error(`Viber account verification failed: ${response.status_message ?? "unknown"} (code ${response.status})`);
+        }
+        this.connected = true;
+    }
+    async stop() {
+        this.connected = false;
+    }
+    async send(message) {
+        if (!this.connected)
+            return false;
+        try {
+            const chunks = splitMessage(message.content, VIBER_MESSAGE_LIMIT);
+            for (const chunk of chunks) {
+                const body = {
+                    receiver: message.channelId,
+                    type: "text",
+                    text: chunk,
+                    sender: {
+                        name: this.senderName,
+                        ...(this.senderAvatar ? { avatar: this.senderAvatar } : {}),
+                    },
+                    ...(message.replyTo ? { tracking_data: String(message.replyTo) } : {}),
+                };
+                const response = await this.post("/send_message", body);
+                if (response.status !== 0)
+                    return false;
+            }
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    onMessage(handler) {
+        this.messageHandler = handler;
+    }
+    isConnected() {
+        return this.connected;
+    }
+    /**
+     * Verify a Viber webhook signature. Viber signs the raw request body
+     * with HMAC-SHA256 using the auth token as the secret.
+     */
+    verifySignature(rawBody, signature) {
+        if (!signature)
+            return false;
+        const computed = createHmac("sha256", this.authToken).update(rawBody, "utf8").digest("hex");
+        const a = Buffer.from(computed);
+        const b = Buffer.from(signature);
+        if (a.length !== b.length)
+            return false;
+        return timingSafeEqual(a, b);
+    }
+    /**
+     * Process a raw Viber webhook body. The hosting server calls this with
+     * the JSON string and the X-Viber-Content-Signature header.
+     */
+    async handleWebhookBody(rawBody, signature, options) {
+        if (!options?.skipSignature && !this.verifySignature(rawBody, signature)) {
+            return false;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(rawBody);
+        }
+        catch {
+            return false;
+        }
+        await this.handleEvent(parsed);
+        return true;
+    }
+    /**
+     * Process a decoded Viber event. Exposed so tests and alternate transports
+     * (e.g. log replay) can skip signature verification during dev.
+     */
+    async handleEvent(event) {
+        if (!this.messageHandler)
+            return;
+        if (event.event !== "message")
+            return;
+        if (event.message?.type !== "text" || !event.message.text)
+            return;
+        if (!event.sender?.id)
+            return;
+        const msg = {
+            channelType: "viber",
+            channelId: event.sender.id,
+            senderId: event.sender.id,
+            senderName: event.sender.name ?? event.sender.id,
+            content: event.message.text,
+            timestamp: new Date(event.timestamp ?? Date.now()),
+            replyTo: event.message_token ? String(event.message_token) : undefined,
+        };
+        await this.messageHandler(msg);
+    }
+    // ── Internal helpers ──────────────────────────────────────
+    async post(path, body) {
+        const response = await fetch(`${VIBER_API_BASE}${path}`, {
+            method: "POST",
+            headers: {
+                "X-Viber-Auth-Token": this.authToken,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            throw new Error(`Viber API error: ${response.status} ${response.statusText}`);
+        }
+        return (await response.json());
+    }
+}
+// ── Helpers ─────────────────────────────────────────────────
+function splitMessage(text, maxLength) {
+    if (text.length <= maxLength)
+        return [text];
+    const chunks = [];
+    let remaining = text;
+    while (remaining.length > 0) {
+        if (remaining.length <= maxLength) {
+            chunks.push(remaining);
+            break;
+        }
+        let splitIdx = remaining.lastIndexOf("\n", maxLength);
+        if (splitIdx <= 0)
+            splitIdx = remaining.lastIndexOf(" ", maxLength);
+        if (splitIdx <= 0)
+            splitIdx = maxLength;
+        chunks.push(remaining.slice(0, splitIdx));
+        remaining = remaining.slice(splitIdx).trim();
+    }
+    return chunks;
+}
+//# sourceMappingURL=viber.js.map

package/dist/channels/viber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viber.js","sourceRoot":"","sources":["../../src/channels/viber.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAyB1D,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAEtD;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,MAAM,OAAO,YAAY;IACd,IAAI,GAAgB,OAAO,CAAC;IAC5B,IAAI,GAAG,OAAO,CAAC;IAEP,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,YAAY,CAAS;IAC9B,SAAS,GAAG,KAAK,CAAC;IAClB,cAAc,GAAqD,IAAI,CAAC;IAEhF,YAAY,SAAkB,EAAE,UAAmB,EAAE,YAAqB;QACxE,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QACpE,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,QAAQ,CAAC;QAC7E,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,6BAA6B;gBAC3B,gFAAgF,CACnF,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAmB,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,sCAAsC,QAAQ,CAAC,cAAc,IAAI,SAAS,UAAU,QAAQ,CAAC,MAAM,GAAG,CACvG,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAwB;QACjC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAElC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAElE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG;oBACX,QAAQ,EAAE,OAAO,CAAC,SAAS;oBAC3B,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,KAAK;oBACX,MAAM,EAAE;wBACN,IAAI,EAAE,IAAI,CAAC,UAAU;wBACrB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC5D;oBACD,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvE,CAAC;gBAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAmB,eAAe,EAAE,IAAI,CAAC,CAAC;gBAC1E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,KAAK,CAAC;YAC1C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,SAAS,CAAC,OAAgD;QACxD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAChC,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,OAAe,EAAE,SAA6B;QAC5D,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAE7B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE5F,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CACrB,OAAe,EACf,SAAkB,EAClB,OAAqC;QAErC,IAAI,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,KAAwB;QACxC,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO;QACjC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACtC,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO;QAClE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE;YAAE,OAAO;QAE9B,MAAM,GAAG,GAAoB;YAC3B,WAAW,EAAE,OAAO;YACpB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;YAC1B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;YACzB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE;YAChD,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YAC3B,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;SACvE,CAAC;QAEF,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAErD,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa;QAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,GAAG,IAAI,EAAE,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,oBAAoB,EAAE,IAAI,CAAC,SAAS;gBACpC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;IACtC,CAAC;CACF;AAED,+DAA+D;AAE/D,SAAS,YAAY,CAAC,IAAY,EAAE,SAAiB;IACnD,IAAI,IAAI,CAAC,MAAM,IAAI,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,IAAI,CAAC;IAErB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,MAAM;QACR,CAAC;QAED,IAAI,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,QAAQ,IAAI,CAAC;YAAE,QAAQ,GAAG,SAAS,CAAC;QAExC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC1C,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/channels/webchat.d.ts

@@ -0,0 +1,44 @@
+/**
+ * WebChat channel adapter — HTTP/SSE-based chat interface.
+ *
+ * Provides a lightweight web chat endpoint that any browser can connect to.
+ * Uses Server-Sent Events (SSE) for streaming responses.
+ *
+ * ENDPOINTS:
+ * - POST /api/chat — send a message, get streaming response via SSE
+ * - GET  /api/chat/stream — SSE stream for ongoing responses
+ * - GET  /api/status — health check and session info
+ *
+ * This makes WOTANN accessible from any web browser without installing anything.
+ */
+import type { ChannelAdapter, ChannelMessage } from "./gateway.js";
+export interface WebChatConfig {
+    readonly port: number;
+    readonly host: string;
+    readonly corsOrigin: string;
+    readonly maxMessageLength: number;
+    readonly sessionTimeout: number;
+}
+export declare class WebChatAdapter implements ChannelAdapter {
+    readonly type: "webchat";
+    readonly name = "WebChat (HTTP/SSE)";
+    connected: boolean;
+    private config;
+    private server;
+    private messageHandler;
+    private sseClients;
+    private pendingResponses;
+    private listeningPort;
+    constructor(config?: Partial<WebChatConfig>);
+    connect(): Promise<boolean>;
+    disconnect(): Promise<void>;
+    send(channelId: string, content: string, replyTo?: string): Promise<boolean>;
+    onMessage(handler: (message: ChannelMessage) => void): void;
+    getPort(): number;
+    getClientCount(): number;
+    private handleRequest;
+    private handleChatMessage;
+    private handleSSEConnection;
+    private handleStatus;
+}
+//# sourceMappingURL=webchat.d.ts.map

package/dist/channels/webchat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webchat.d.ts","sourceRoot":"","sources":["../../src/channels/webchat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAgBD,qBAAa,cAAe,YAAW,cAAc;IACnD,QAAQ,CAAC,IAAI,EAAG,SAAS,CAAU;IACnC,QAAQ,CAAC,IAAI,wBAAwB;IACrC,SAAS,UAAS;IAElB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,cAAc,CAAoD;IAC1E,OAAO,CAAC,UAAU,CAAqC;IACvD,OAAO,CAAC,gBAAgB,CAAqD;IAC7E,OAAO,CAAC,aAAa,CAAS;gBAElB,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;IAKrC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IAsB3B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAmB3B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BlF,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,IAAI;IAI3D,OAAO,IAAI,MAAM;IACjB,cAAc,IAAI,MAAM;IAIxB,OAAO,CAAC,aAAa;IA0BrB,OAAO,CAAC,iBAAiB;IA4DzB,OAAO,CAAC,mBAAmB;IA6B3B,OAAO,CAAC,YAAY;CASrB"}

package/dist/channels/webchat.js

@@ -0,0 +1,218 @@
+/**
+ * WebChat channel adapter — HTTP/SSE-based chat interface.
+ *
+ * Provides a lightweight web chat endpoint that any browser can connect to.
+ * Uses Server-Sent Events (SSE) for streaming responses.
+ *
+ * ENDPOINTS:
+ * - POST /api/chat — send a message, get streaming response via SSE
+ * - GET  /api/chat/stream — SSE stream for ongoing responses
+ * - GET  /api/status — health check and session info
+ *
+ * This makes WOTANN accessible from any web browser without installing anything.
+ */
+import { createServer } from "node:http";
+import { randomUUID } from "node:crypto";
+const DEFAULT_CONFIG = {
+    port: 3847,
+    host: "127.0.0.1",
+    corsOrigin: "http://localhost:1420",
+    maxMessageLength: 100_000,
+    sessionTimeout: 30 * 60 * 1000, // 30 minutes
+};
+export class WebChatAdapter {
+    type = "webchat";
+    name = "WebChat (HTTP/SSE)";
+    connected = false;
+    config;
+    server = null;
+    messageHandler = null;
+    sseClients = new Map();
+    pendingResponses = new Map();
+    listeningPort;
+    constructor(config) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+        this.listeningPort = this.config.port;
+    }
+    async connect() {
+        return new Promise((resolve) => {
+            this.server = createServer((req, res) => {
+                this.handleRequest(req, res);
+            });
+            this.server.on("error", () => {
+                this.connected = false;
+                resolve(false);
+            });
+            this.server.listen(this.config.port, this.config.host, () => {
+                this.connected = true;
+                const address = this.server?.address();
+                if (address && typeof address === "object") {
+                    this.listeningPort = address.port;
+                }
+                resolve(true);
+            });
+        });
+    }
+    async disconnect() {
+        // Close all SSE connections
+        for (const client of this.sseClients.values()) {
+            client.res.end();
+        }
+        this.sseClients.clear();
+        return new Promise((resolve) => {
+            if (this.server) {
+                this.server.close(() => {
+                    this.connected = false;
+                    resolve();
+                });
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+    async send(channelId, content, replyTo) {
+        // Send to specific SSE client
+        const client = this.sseClients.get(channelId);
+        if (client) {
+            const data = JSON.stringify({ type: "message", content, replyTo, timestamp: Date.now() });
+            client.res.write(`data: ${data}\n\n`);
+            return true;
+        }
+        // Check for pending response resolver
+        const resolver = replyTo ? this.pendingResponses.get(replyTo) : undefined;
+        if (resolver) {
+            resolver(content);
+            this.pendingResponses.delete(replyTo);
+            return true;
+        }
+        // Broadcast to all SSE clients as fallback
+        let sent = false;
+        for (const c of this.sseClients.values()) {
+            const data = JSON.stringify({ type: "message", content, replyTo, timestamp: Date.now() });
+            c.res.write(`data: ${data}\n\n`);
+            sent = true;
+        }
+        return sent;
+    }
+    onMessage(handler) {
+        this.messageHandler = handler;
+    }
+    getPort() { return this.listeningPort; }
+    getClientCount() { return this.sseClients.size; }
+    // ── HTTP Request Handler ───────────────────────────────────
+    handleRequest(req, res) {
+        // CORS headers
+        res.setHeader("Access-Control-Allow-Origin", this.config.corsOrigin);
+        res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+        res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+        if (req.method === "OPTIONS") {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        const url = req.url ?? "/";
+        if (req.method === "POST" && url === "/api/chat") {
+            this.handleChatMessage(req, res);
+        }
+        else if (req.method === "GET" && url.startsWith("/api/chat/stream")) {
+            this.handleSSEConnection(req, res);
+        }
+        else if (req.method === "GET" && url === "/api/status") {
+            this.handleStatus(res);
+        }
+        else {
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Not found" }));
+        }
+    }
+    handleChatMessage(req, res) {
+        let body = "";
+        req.on("data", (chunk) => {
+            body += chunk.toString();
+            if (body.length > this.config.maxMessageLength) {
+                res.writeHead(413, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Message too large" }));
+                req.destroy();
+            }
+        });
+        req.on("end", () => {
+            try {
+                const parsed = JSON.parse(body);
+                const content = parsed.message ?? "";
+                if (!content.trim()) {
+                    res.writeHead(400, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ error: "Empty message" }));
+                    return;
+                }
+                const messageId = randomUUID();
+                const message = {
+                    id: messageId,
+                    channelType: "webchat",
+                    channelId: "webchat-default",
+                    senderId: parsed.senderId ?? "webchat-user",
+                    content,
+                    timestamp: Date.now(),
+                };
+                // Create a promise that resolves when the response is ready
+                const responsePromise = new Promise((resolve) => {
+                    this.pendingResponses.set(messageId, resolve);
+                    // Timeout after 60 seconds
+                    setTimeout(() => {
+                        if (this.pendingResponses.has(messageId)) {
+                            this.pendingResponses.delete(messageId);
+                            resolve("Request timed out");
+                        }
+                    }, 60_000);
+                });
+                // Send to message handler
+                if (this.messageHandler) {
+                    this.messageHandler(message);
+                }
+                // Wait for response and send back
+                void responsePromise.then((response) => {
+                    res.writeHead(200, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({ id: messageId, response, timestamp: Date.now() }));
+                });
+            }
+            catch {
+                res.writeHead(400, { "Content-Type": "application/json" });
+                res.end(JSON.stringify({ error: "Invalid JSON" }));
+            }
+        });
+    }
+    handleSSEConnection(_req, res) {
+        const clientId = randomUUID();
+        res.writeHead(200, {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            "Connection": "keep-alive",
+        });
+        // Send connected event
+        res.write(`data: ${JSON.stringify({ type: "connected", clientId })}\n\n`);
+        this.sseClients.set(clientId, { id: clientId, res, connectedAt: Date.now() });
+        // Clean up on disconnect
+        res.on("close", () => {
+            this.sseClients.delete(clientId);
+        });
+        // Keep alive ping every 30 seconds
+        const keepAlive = setInterval(() => {
+            if (this.sseClients.has(clientId)) {
+                res.write(":keepalive\n\n");
+            }
+            else {
+                clearInterval(keepAlive);
+            }
+        }, 30_000);
+    }
+    handleStatus(res) {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({
+            connected: this.connected,
+            clients: this.sseClients.size,
+            port: this.listeningPort,
+            uptime: Date.now(),
+        }));
+    }
+}
+//# sourceMappingURL=webchat.js.map

package/dist/channels/webchat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webchat.js","sourceRoot":"","sources":["../../src/channels/webchat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAWzC,MAAM,cAAc,GAAkB;IACpC,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,WAAW;IACjB,UAAU,EAAE,uBAAuB;IACnC,gBAAgB,EAAE,OAAO;IACzB,cAAc,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;CAC9C,CAAC;AAQF,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,SAAkB,CAAC;IAC1B,IAAI,GAAG,oBAAoB,CAAC;IACrC,SAAS,GAAG,KAAK,CAAC;IAEV,MAAM,CAAgB;IACtB,MAAM,GAA2C,IAAI,CAAC;IACtD,cAAc,GAA+C,IAAI,CAAC;IAClE,UAAU,GAA2B,IAAI,GAAG,EAAE,CAAC;IAC/C,gBAAgB,GAA2C,IAAI,GAAG,EAAE,CAAC;IACrE,aAAa,CAAS;IAE9B,YAAY,MAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,cAAc,EAAE,GAAG,MAAM,EAAE,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACtC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC3B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;gBACvB,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC1D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;gBACtB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;gBACvC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAC3C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;gBACpC,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU;QACd,4BAA4B;QAC5B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAExB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;oBACrB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;oBACvB,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,OAAe,EAAE,OAAgB;QAC7D,8BAA8B;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1F,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,sCAAsC;QACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAQ,CAAC,CAAC;YACvC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1F,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;YACjC,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,CAAC,OAA0C;QAClD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAChC,CAAC;IAED,OAAO,KAAa,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAChD,cAAc,KAAa,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAEzD,8DAA8D;IAEtD,aAAa,CAAC,GAAoB,EAAE,GAAmB;QAC7D,eAAe;QACf,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAE9D,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAE3B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACzD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,GAAoB,EAAE,GAAmB;QACjE,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;gBAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;gBACxD,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4C,CAAC;gBAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;gBACrC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;oBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBAED,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAmB;oBAC9B,EAAE,EAAE,SAAS;oBACb,WAAW,EAAE,SAAS;oBACtB,SAAS,EAAE,iBAAiB;oBAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,cAAc;oBAC3C,OAAO;oBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB,CAAC;gBAEF,4DAA4D;gBAC5D,MAAM,eAAe,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;oBACtD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;oBAC9C,2BAA2B;oBAC3B,UAAU,CAAC,GAAG,EAAE;wBACd,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;4BACzC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;4BACxC,OAAO,CAAC,mBAAmB,CAAC,CAAC;wBAC/B,CAAC;oBACH,CAAC,EAAE,MAAM,CAAC,CAAC;gBACb,CAAC,CAAC,CAAC;gBAEH,0BAA0B;gBAC1B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;oBACxB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;gBAC/B,CAAC;gBAED,kCAAkC;gBAClC,KAAK,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;oBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9E,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,mBAAmB,CAAC,IAAqB,EAAE,GAAmB;QACpE,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;QAE9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,UAAU;YAC3B,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;QAEH,uBAAuB;QACvB,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QAE1E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAE9E,yBAAyB;QACzB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QAEH,mCAAmC;QACnC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,aAAa,CAAC,SAAS,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC,EAAE,MAAM,CAAC,CAAC;IACb,CAAC;IAEO,YAAY,CAAC,GAAmB;QACtC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI;YAC7B,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;CACF"}

package/dist/channels/webhook-router.d.ts

@@ -0,0 +1,155 @@
+/**
+ * V9 T1.6 — Channel Webhook Router.
+ *
+ * One HTTP server that fronts every channel adapter that wants webhook-style
+ * inbound delivery. Each adapter (Slack, Telegram, Discord, WhatsApp, Teams,
+ * SMS) ships its own `verifySignature(...)` helper that knows the provider's
+ * exact signing scheme. THIS module is what actually CALLS those helpers —
+ * before T1.6 they were dead code reachable only from unit tests.
+ *
+ * Dispatch model:
+ *   POST /webhook/slack    -> slack.verifySignature(body, ts, sig, secret)
+ *   POST /webhook/telegram -> telegram.verifySignature(remoteIp)
+ *   POST /webhook/discord  -> discord.verifySignature(body, sig, ts, pubKey)
+ *   POST /webhook/whatsapp -> whatsapp.verifySignature(body, sig, secret)
+ *   POST /webhook/teams    -> teams.verifySignature(authHeader)
+ *   POST /webhook/sms      -> sms.verifySignature(url, params, sig, token)
+ *
+ * Quality bars:
+ *   QB #6  honest stubs        — failures return 401/400 with explicit reason
+ *   QB #7  per-instance state  — each createWebhookRouter returns a fresh closure
+ *   QB #13 env via constructor — port + secrets injected, NEVER read from
+ *                                process.env inside the module
+ *   QB #14 real contract test  — tests assert HMAC paths fire on actual vectors
+ *
+ * Security posture:
+ *   - Reject unknown paths with 404 (no route enumeration leak).
+ *   - Reject non-POST methods with 405.
+ *   - Reject missing/invalid signatures with 401.
+ *   - Cap raw body size (default 1 MiB) so a malicious sender can't OOM.
+ *   - Body is read as raw bytes; signature paths sign over exact bytes per
+ *     spec — re-serializing JSON would break Slack/WhatsApp signatures.
+ *
+ * Forward model:
+ *   On a verified delivery, the router invokes the registered `handler(...)`
+ *   with `{ provider, rawBody, headers }`. The handler is a single callback
+ *   shared across providers; it is up to the caller (DispatchPlane) to route
+ *   into the matching adapter's `processIncoming` path.
+ */
+import { type IncomingMessage, type ServerResponse } from "node:http";
+/**
+ * One of the six providers this router fronts. Adding a new provider means:
+ *   1. extend this union
+ *   2. add the matching path in DEFAULT_ROUTES
+ *   3. add a verify-and-dispatch branch in handleRequest()
+ *   4. extend WebhookRouterSecrets with the provider's required material
+ */
+export type WebhookProvider = "slack" | "telegram" | "discord" | "whatsapp" | "teams" | "sms";
+/**
+ * Verified-delivery payload handed to the registered handler. The router
+ * never tries to parse JSON for the caller — different providers ship
+ * different content types (Slack: JSON; SMS: form-encoded). The caller's
+ * processIncoming knows its own provider's body shape.
+ */
+export interface VerifiedDelivery {
+    readonly provider: WebhookProvider;
+    readonly rawBody: string;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly remoteIp: string;
+}
+export type WebhookHandler = (delivery: VerifiedDelivery) => Promise<void> | void;
+/**
+ * Provider-specific signature-verification helpers. We accept ALREADY-WIRED
+ * verifiers as injected functions rather than constructing adapter instances
+ * ourselves — keeps the router decoupled from adapter constructors and lets
+ * tests pass mocks (a fake `() => true` for known-good cases, `() => false`
+ * for known-bad cases) without standing up a Slack bot.
+ *
+ * The shape of each verifier matches exactly what the adapter exposes today,
+ * so wiring is `verifiers.slack = adapter.verifySignature.bind(adapter)`.
+ */
+export interface WebhookVerifiers {
+    readonly slack?: (rawBody: string, timestamp: string, signature: string, secret: string) => boolean;
+    readonly telegram?: (remoteIp: string) => boolean;
+    readonly discord?: (rawBody: string, signatureHex: string, timestamp: string, publicKeyHex: string) => boolean;
+    readonly whatsapp?: (rawBody: string, signature: string, secret: string) => boolean;
+    readonly teams?: (authHeader: string) => boolean;
+    readonly sms?: (fullUrl: string, postParams: Readonly<Record<string, string>>, signature: string, authToken: string) => boolean;
+}
+/**
+ * Per-provider secrets. Always passed in via constructor (QB #13) — never
+ * loaded from process.env inside the module. Only the secrets the caller
+ * actually configured need to be present; missing ones cause 503 rather
+ * than 500 because the failure is "not configured" not "broken".
+ */
+export interface WebhookRouterSecrets {
+    readonly slackSigningSecret?: string;
+    readonly discordPublicKeyHex?: string;
+    readonly whatsappAppSecret?: string;
+    readonly twilioAuthToken?: string;
+}
+export interface WebhookRouterOptions {
+    /** TCP port to listen on. Required — no env-var fallback (QB #13). */
+    readonly port: number;
+    /** Bind address. Defaults to `127.0.0.1` (loopback only). */
+    readonly host?: string;
+    /** Per-provider verify functions. Undefined providers return 404. */
+    readonly verifiers: WebhookVerifiers;
+    /** Per-provider secrets. */
+    readonly secrets: WebhookRouterSecrets;
+    /** Forward callback invoked on verified deliveries. */
+    readonly handler: WebhookHandler;
+    /** Cap on raw body size in bytes. Default 1_048_576 (1 MiB). */
+    readonly maxBodyBytes?: number;
+    /**
+     * Path → provider override. If supplied, REPLACES the default routes;
+     * use this for white-label deployments that want non-default paths.
+     * The route matcher is exact-match — no regex/parameter parsing.
+     */
+    readonly routes?: Readonly<Record<string, WebhookProvider>>;
+    /**
+     * If provided, the public URL the router is reachable at — used to build
+     * the `fullUrl` argument for the Twilio (`sms`) verifier, which signs the
+     * exact URL Twilio called. When omitted, SMS verification falls back to
+     * `${host}:${port}${path}` which is fine for loopback tests but wrong for
+     * production behind a reverse proxy. Production callers MUST set this.
+     */
+    readonly publicBaseUrl?: string;
+}
+export interface WebhookRouter {
+    readonly start: () => Promise<void>;
+    readonly stop: () => Promise<void>;
+    readonly address: () => {
+        readonly host: string;
+        readonly port: number;
+    } | null;
+    readonly isListening: () => boolean;
+    /**
+     * Synchronous handler exposed for unit tests that don't want to bind a real
+     * port. Tests construct a fake req/res pair and invoke this directly.
+     */
+    readonly handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+}
+/**
+ * Create a fresh webhook router with its own server + closure state.
+ *
+ * Per QB #7, every call returns a brand-new instance. No module-level
+ * mutable globals: two routers in the same process can listen on
+ * different ports without interfering.
+ */
+export declare function createWebhookRouter(options: WebhookRouterOptions): WebhookRouter;
+/**
+ * Compute the Slack signature header value (`v0=<hex>`) for a body+timestamp
+ * pair. Exposed so tests can synthesize valid headers without standing up
+ * a real Slack instance. Mirrors `SlackAdapter.verifySignature`'s scheme.
+ *
+ * NOT used at runtime — production servers receive the signature from
+ * Slack and verify it; they never compute it themselves.
+ */
+export declare function slackTestSignature(rawBody: string, timestamp: string, secret: string): string;
+/**
+ * WhatsApp (Meta Cloud API) signature header value (`sha256=<hex>`) for a
+ * body. Mirrors `WhatsAppAdapter.verifySignature` exactly.
+ */
+export declare function whatsappTestSignature(rawBody: string, secret: string): string;
+//# sourceMappingURL=webhook-router.d.ts.map

package/dist/channels/webhook-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-router.d.ts","sourceRoot":"","sources":["../../src/channels/webhook-router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAe,MAAM,WAAW,CAAC;AAIjG;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,KAAK,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAElF;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,CACf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,KACX,OAAO,CAAC;IACb,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAClD,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC;IACb,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,QAAQ,CAAC,GAAG,CAAC,EAAE,CACb,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC5C,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,KACd,OAAO,CAAC;CACd;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,oBAAoB;IACnC,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,4BAA4B;IAC5B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,gEAAgE;IAChE,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IAC5D;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChF,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACtF;AAkBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAqKhF;AAqMD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAG7F;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7E"}