Migrate from YCloud

curl https://api.kapso.ai/platform/v1/whatsapp/phone_numbers \
  -H "X-API-Key: YOUR_API_KEY"

{
  "data": [
    {
      "id": "1234567890",
      "phone_number_id": "1234567890",
      "name": "Support Line",
      "business_account_id": "98765432109",
      "display_phone_number": "+1 555-123-4567",
      "quality_rating": "GREEN",
      "throughput_tier": "TIER_10K",
      "status": "CONNECTED"
    }
  ]
}

{ "messaging_product": "whatsapp", "messages": [{ "id": "wamid.HBgNMTU1..." }] }

curl -X POST https://api.kapso.ai/platform/v1/whatsapp/phone_numbers/1234567890/webhooks \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "whatsapp_webhook": {
      "url": "https://yourapp.com/webhooks/whatsapp",
      "events": [
        "whatsapp.message.received",
        "whatsapp.message.sent",
        "whatsapp.message.delivered",
        "whatsapp.message.read",
        "whatsapp.message.failed"
      ],
      "secret_key": "your-signing-secret"
    }
  }'

curl -X POST https://api.kapso.ai/platform/v1/whatsapp/phone_numbers/1234567890/webhooks \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "whatsapp_webhook": {
      "kind": "meta",
      "url": "https://yourapp.com/webhooks/meta",
      "secret_key": "your-signing-secret"
    }
  }'

// YCloud-Signature: t=1654084800,s=8eb70f2a...
const [t, received] = signatureHeader.split(',').map((part) => part.split('=')[1]);

const expected = crypto
  .createHmac('sha256', secret)
  .update(`${t}.${rawBody}`)   // timestamp, a dot, then the body
  .digest('hex');

const crypto = require('crypto');

// express.raw, not express.json: Kapso signs the exact bytes it sent, and
// re-serializing a parsed body does not reproduce them
app.post('/webhooks/whatsapp', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');

  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(req.headers['x-webhook-signature'] ?? '', 'utf8');

  // timingSafeEqual throws on length mismatch, so compare lengths first
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  res.sendStatus(200);
});

curl -X POST https://api.ycloud.com/v2/whatsapp/templates \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "wabaId": "98765432109",
    "name": "order_update",
    "language": "en_US",
    "category": "UTILITY",
    "components": [
      {
        "type": "BODY",
        "text": "Hi {{1}}, your order is confirmed.",
        "example": { "body_text": [["John"]] }
      }
    ]
  }'

curl -X POST https://api.kapso.ai/meta/whatsapp/v24.0/98765432109/message_templates \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "order_update",
    "category": "UTILITY",
    "language": "en_US",
    "components": [
      {
        "type": "BODY",
        "text": "Hi {{1}}, your order is confirmed.",
        "example": { "body_text": [["John"]] }
      }
    ]
  }'

curl -X POST https://api.kapso.ai/platform/v1/whatsapp/contacts \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "contact": {
      "wa_id": "+15551234567",
      "profile_name": "John Doe",
      "metadata": { "plan": "pro", "crm_id": "CUS-12345" }
    }
  }'

curl -X POST https://api.kapso.ai/platform/v1/customers \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customer": {"name": "Acme Corporation", "external_customer_id": "CUS-12345"}}'

curl -X POST https://api.kapso.ai/platform/v1/customers/CUSTOMER_ID/setup_links \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "setup_link": {
      "success_redirect_url": "https://your-app.com/whatsapp/success",
      "meta_billing_mode": "partner_managed"
    }
  }'

POST /platform/v1/whatsapp/broadcasts
POST /platform/v1/whatsapp/broadcasts/{id}/recipients
POST /platform/v1/whatsapp/broadcasts/{id}/send
GET  /platform/v1/whatsapp/broadcasts/{id}

curl -X PATCH https://api.kapso.ai/platform/v1/whatsapp/broadcasts/BROADCAST_ID \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"whatsapp_broadcast": {"status": "stopped"}}'

const crypto = require('crypto');
const express = require('express');

const app = express();

// Any durable queue works. YCloud queued sends for you; Kapso does not.
const queue = require('./queue');

const KAPSO = 'https://api.kapso.ai/meta/whatsapp/v24.0';
const headers = {
  'X-API-Key': process.env.KAPSO_API_KEY,
  'Content-Type': 'application/json',
};

// YCloud: POST /v2/whatsapp/messages with { from, to, type, template, externalId }
async function sendTemplate({ phoneNumberId, to, name, params = [], externalId }) {
  const res = await fetch(`${KAPSO}/${phoneNumberId}/messages`, {
    method: 'POST',
    headers,
    body: JSON.stringify({
      messaging_product: 'whatsapp',
      to,                                       // forwarded to Meta as-is; '+1555...' is fine
      type: 'template',
      biz_opaque_callback_data: externalId,     // YCloud: externalId
      template: {
        name,
        language: { code: 'en_US' },
        components: [
          {
            type: 'body',
            parameters: params.map((text) => ({ type: 'text', text })),
          },
        ],
      },
    }),
  });
  const body = await res.json();

  // A 4xx or 5xx returns an error object, not `messages`. Reading
  // messages[0] there throws a TypeError that hides the real cause.
  if (!res.ok) {
    throw new Error(`Send failed (${res.status}): ${JSON.stringify(body.error ?? body)}`);
  }

  return body.messages[0].id; // wamid, not a YCloud object ID
}

// YCloud: one endpoint, switch on event.type and whatsappMessage.status.
// Kapso: event name in the header, raw body signed without a timestamp.
app.post('/webhooks/whatsapp', express.raw({ type: 'application/json' }), async (req, res) => {
  const expected = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');

  const a = Buffer.from(expected, 'utf8');
  const b = Buffer.from(req.headers['x-webhook-signature'] ?? '', 'utf8');

  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).send('Invalid signature');
  }

  const event = req.headers['x-webhook-event'];
  const payload = JSON.parse(req.body);

  // YCloud: event.id. Delivery is at-least-once, so every job carries the
  // key and the worker has to be idempotent on it.
  const idempotencyKey = req.headers['x-idempotency-key'];

  if (event === 'whatsapp.message.failed') {
    // YCloud: whatsappMessage.errorCode / errorMessage
    const errors = (payload.message.kapso.statuses ?? []).flatMap((s) => s.errors ?? []);
    await queue.add('send-failed', {
      idempotencyKey,
      id: payload.message.id,
      phoneNumberId: payload.phone_number_id,
      errors,
    });
    return res.sendStatus(200);
  }

  if (event !== 'whatsapp.message.received') {
    return res.sendStatus(200);
  }

  const { message, conversation, phone_number_id } = payload;

  await queue.add('inbound', {
    idempotencyKey,
    // `from` can be absent on a BSUID-only contact, so carry the scoped
    // IDs too or the job cannot tell you who wrote in.
    from: message.from ?? conversation.phone_number ?? null,
    fromUserId: message.from_user_id ?? conversation.business_scoped_user_id ?? null,
    fromParentUserId:
      message.from_parent_user_id ?? conversation.parent_business_scoped_user_id ?? null,
    username: conversation.username ?? null,
    text: message.text?.body,
    mediaUrl: message.kapso.media_url,
    conversationId: conversation.id,
    phoneNumberId: phone_number_id,
  });

  res.sendStatus(200);
});