██████╗ ██████╗  ██████╗ ██╗  ██╗    ██████╗  ██████╗ ████████╗
██╔════╝ ██╔══██╗██╔═══██╗██║ ██╔╝    ██╔══██╗██╔═══██╗╚══██╔══╝
██║  ███╗██████╔╝██║   ██║█████╔╝     ██████╔╝██║   ██║   ██║
██║   ██║██╔══██╗██║   ██║██╔═██╗     ██╔══██╗██║   ██║   ██║
╚██████╔╝██║  ██║╚██████╔╝██║  ██╗    ██████╔╝╚██████╔╝   ██║
 ╚═════╝ ╚═╝  ╚═╝ ╚═════╝ ╚═╝  ╚═╝    ╚═════╝  ╚═════╝    ╚═╝

npm install @ai-sdk/xai ai zod @ai-sdk/anthropic

npm install grammy        # Telegram
npm install discord.js    # Discord
npm install openai        # optional: OpenAI-compatible path to api.x.ai/v1

# Grok — server-side only, never NEXT_PUBLIC_*
XAI_API_KEY=xai-...

# Fallback provider (codeAmani AI routing policy)
ANTHROPIC_API_KEY=sk-ant-...

# WhatsApp Cloud API
WHATSAPP_ACCESS_TOKEN=<system user token>
WHATSAPP_PHONE_NUMBER_ID=<from Meta app dashboard>
WHATSAPP_VERIFY_TOKEN=<random string you invent, echoed on GET>
WHATSAPP_APP_SECRET=<for X-Hub-Signature-256 verification>

# Telegram
TELEGRAM_BOT_TOKEN=<from @BotFather>
TELEGRAM_WEBHOOK_SECRET=<random; sent as X-Telegram-Bot-Api-Secret-Token>

# Conversation store
DATABASE_URL=<postgres connection string>

// lib/bot/model.ts
export const GROK_MODEL = "grok-4.6" as const;
export const GROK_FALLBACK_MODEL = "grok-4.3" as const;

// app/api/whatsapp/webhook/route.ts
import { createHmac, timingSafeEqual } from "node:crypto";
import { after } from "next/server";
import { handleTurn } from "@/lib/bot/turn";

// Meta's verification handshake — runs once, when you register the callback URL
export async function GET(req: Request) {
  const url = new URL(req.url);
  const mode = url.searchParams.get("hub.mode");
  const token = url.searchParams.get("hub.verify_token");
  const challenge = url.searchParams.get("hub.challenge");

  if (mode === "subscribe" && token === process.env.WHATSAPP_VERIFY_TOKEN) {
    return new Response(challenge, { status: 200 });
  }
  return new Response("forbidden", { status: 403 });
}

export async function POST(req: Request) {
  // Signature is computed over the RAW body — read text, never req.json() first
  const raw = await req.text();
  if (!verifySignature(raw, req.headers.get("x-hub-signature-256"))) {
    return new Response("invalid signature", { status: 401 });
  }

  const payload = JSON.parse(raw);
  const msg = payload.entry?.[0]?.changes?.[0]?.value?.messages?.[0];

  // ACK first; run the model after the response is sent.
  if (msg?.type === "text") {
    after(() => handleTurn({ chatId: msg.from, text: msg.text.body, messageId: msg.id }));
  }
  return new Response("ok", { status: 200 });
}

function verifySignature(raw: string, header: string | null) {
  if (!header?.startsWith("sha256=")) return false;
  const expected = createHmac("sha256", process.env.WHATSAPP_APP_SECRET as string)
    .update(raw)
    .digest("hex");
  const a = Buffer.from(header.slice(7), "hex");
  const b = Buffer.from(expected, "hex");
  return a.length === b.length && timingSafeEqual(a, b);
}

const inserted = await db
  .insertInto("bot_messages")
  .values({ chat_id: chatId, provider_message_id: messageId, role: "user", content: text })
  .onConflict((oc) => oc.column("provider_message_id").doNothing())
  .executeTakeFirst();

if (Number(inserted?.numInsertedOrUpdatedRows ?? 0) === 0) return; // already handled

create table bot_conversations (
  id           uuid primary key default gen_random_uuid(),
  chat_id      text not null unique,      -- 254712345678, or Telegram chat.id
  surface      text not null,             -- 'whatsapp' | 'telegram' | 'discord'
  summary      text,                      -- rolling compression of older turns
  locale       text not null default 'en',
  last_user_at timestamptz,               -- drives the WhatsApp 24h window check
  created_at   timestamptz not null default now()
);

create table bot_messages (
  id                  bigserial primary key,
  conversation_id     uuid not null references bot_conversations(id) on delete cascade,
  role                text not null,      -- 'user' | 'assistant' | 'tool'
  content             jsonb not null,
  provider_message_id text unique,        -- idempotency key
  prompt_tokens       int,
  completion_tokens   int,
  cached_tokens       int,
  cost_usd            numeric(12,6),
  created_at          timestamptz not null default now()
);

create index on bot_messages (conversation_id, created_at desc);

// lib/bot/history.ts
import type { ModelMessage } from "ai";

const VERBATIM_TURNS = 12;

export async function buildMessages(conversationId: string): Promise<ModelMessage[]> {
  const convo = await getConversation(conversationId);
  const recent = await getRecentMessages(conversationId, VERBATIM_TURNS);

  const messages: ModelMessage[] = [];
  if (convo.summary) {
    messages.push({
      role: "user",
      content: `[Earlier in this conversation]\n${convo.summary}`,
    });
  }
  for (const m of recent) {
    messages.push({ role: m.role, content: m.content } as ModelMessage);
  }
  return messages;
}

export async function maybeCompress(conversationId: string) {
  const count = await countMessagesSinceSummary(conversationId);
  if (count < 24) return;

  const { text } = await generateText({
    model: xai(GROK_FALLBACK_MODEL), // cheap long-context model does compression fine
    instructions:
      "Compress this customer conversation into under 150 words. Preserve: names, " +
      "order numbers, amounts, phone numbers, delivery addresses, and any unresolved " +
      "request. Drop pleasantries. Write in the third person.",
    messages: await getAllMessagesSinceSummary(conversationId),
  });

  await saveSummary(conversationId, text);
}

// lib/bot/persona.ts
export function buildInstructions(ctx: {
  businessName: string;
  locale: "en" | "sw";
  hoursText: string;
}) {
  return [
    `You are the WhatsApp assistant for ${ctx.businessName}, a shop in Nairobi.`,
    "",
    "## Scope",
    "You handle: product availability, prices in KES, order status, delivery times,",
    "and M-Pesa payment. For anything else, say you'll pass it to a human and stop.",
    "",
    "## Voice",
    "Short. Two or three sentences, then a question or a next step. This is WhatsApp,",
    "not email. No markdown headings, no bullet lists, no emoji unless the customer",
    "used one first.",
    ctx.locale === "sw"
      ? "Reply in the language the customer writes in. Kiswahili and Sheng are both fine; keep numbers and product names in the original."
      : "Reply in English.",
    "",
    "## Hard rules",
    "- Never invent a price, stock level, or order status. Call a tool or say you don't know.",
    "- Never state that a payment succeeded. Only confirm what check_payment_status returns.",
    "- Never ask for an M-Pesa PIN. Nobody legitimate ever does.",
    "- Amounts are whole KES. Phone numbers are 254XXXXXXXXX.",
    `- Shop hours: ${ctx.hoursText}. Outside them, say when you reopen.`,
    "",
    "## Escalation",
    "If the customer is angry, asks for a refund, or repeats a question twice,",
    "call handoff_to_human and say a person will reply shortly. Do not keep trying.",
  ].join("\n");
}

// lib/bot/tools.ts
import { tool } from "ai";
import { z } from "zod";

export const botTools = {
  check_stock: tool({
    description: "Look up whether a product is in stock and its current price in KES.",
    inputSchema: z.object({
      query: z.string().describe("Product name or SKU as the customer said it"),
    }),
    execute: async ({ query }) => {
      const items = await searchInventory(query);
      return items.map((i) => ({ sku: i.sku, name: i.name, qty: i.qty, price_kes: i.priceKes }));
    },
  }),

  request_mpesa_payment: tool({
    description:
      "Send an M-Pesa STK Push to the customer's phone for a confirmed order. " +
      "Only call this after the customer has explicitly agreed to the total.",
    inputSchema: z.object({
      order_id: z.string().uuid(),
      amount_kes: z.number().int().positive().describe("Whole KES only — Daraja rejects decimals"),
      phone: z.string().regex(/^254\d{9}$/, "Must be 254XXXXXXXXX"),
    }),
    execute: async ({ order_id, amount_kes, phone }) => {
      // Idempotency: one live STK per order. See MPESA_PATTERNS.md.
      const existing = await getLiveCheckout(order_id);
      if (existing) return { status: "already_pending", checkout_request_id: existing.id };

      const res = await stkPush({ order_id, amount: amount_kes, phone });
      await saveCheckoutRequestId(order_id, res.CheckoutRequestID);
      return { status: "prompt_sent", checkout_request_id: res.CheckoutRequestID };
    },
  }),

  check_payment_status: tool({
    description: "Read the recorded status of an M-Pesa checkout. Never guess payment status.",
    inputSchema: z.object({ checkout_request_id: z.string() }),
    execute: async ({ checkout_request_id }) => getCheckoutStatus(checkout_request_id),
  }),

  handoff_to_human: tool({
    description: "Escalate to a human agent. Use for refunds, complaints, or repeated confusion.",
    inputSchema: z.object({ reason: z.string(), urgency: z.enum(["normal", "high"]) }),
    execute: async ({ reason, urgency }) => {
      await openSupportTicket({ reason, urgency });
      return { escalated: true };
    },
  }),
};

// lib/bot/generate.ts
import { xai } from "@ai-sdk/xai";
import { generateText, isStepCount } from "ai";
import { botTools } from "./tools";
import { buildInstructions } from "./persona";
import { GROK_MODEL } from "./model";

export async function runTurn(conversationId: string, ctx: PersonaCtx) {
  const result = await generateText({
    model: xai(GROK_MODEL),
    instructions: buildInstructions(ctx),
    messages: await buildMessages(conversationId),
    tools: botTools,
    // Default is isStepCount(1) — WITHOUT this the loop stops after the first
    // tool call and your user gets an empty reply.
    stopWhen: isStepCount(5),
    temperature: 0.3,
  });

  return {
    text: result.text,
    usage: result.usage,        // v7: totals across ALL steps
    finalUsage: result.finalStep?.usage,
    steps: result.steps.length,
  };
}

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.XAI_API_KEY,
  baseURL: "https://api.x.ai/v1",
  timeout: 360_000, // reasoning models think before they answer
});

let messages = [...history];

for (let step = 0; step < 5; step++) {
  const completion = await client.chat.completions.create({
    model: "grok-4.6",
    messages,
    tools: toolSchemas,        // tool_choice: "auto" is the default
  });

  const message = completion.choices[0].message;
  if (!message.tool_calls) break;

  messages.push(message);
  // Parallel tool calls are ON by default — resolve ALL of them before looping.
  for (const tc of message.tool_calls) {
    const result = await runTool(tc.function.name, JSON.parse(tc.function.arguments));
    messages.push({ role: "tool", tool_call_id: tc.id, content: JSON.stringify(result) });
  }
}

// lib/bot/stream-telegram.ts
import { xai } from "@ai-sdk/xai";
import { streamText, isStepCount } from "ai";

export async function streamToTelegram(bot: Bot, chatId: number, opts: TurnOpts) {
  await bot.api.sendChatAction(chatId, "typing"); // clears after ~5s; re-send on long turns

  const result = streamText({
    model: xai(GROK_MODEL),
    instructions: opts.instructions,
    messages: opts.messages,
    tools: botTools,
    stopWhen: isStepCount(5),
  });

  let buffer = "";
  let sent: { message_id: number } | null = null;
  let lastEdit = 0;

  for await (const part of result.stream) {
    if (part.type !== "text-delta") continue;
    buffer += part.text;

    const now = Date.now();
    if (now - lastEdit < 1200) continue;   // Telegram throttles edits; ~1/sec is safe
    lastEdit = now;

    const body = buffer.slice(0, 4096);     // hard cap: 4096 chars per message
    sent = sent
      ? (await bot.api.editMessageText(chatId, sent.message_id, body), sent)
      : await bot.api.sendMessage(chatId, body);
  }

  if (sent && buffer.length) {
    await bot.api.editMessageText(chatId, sent.message_id, buffer.slice(0, 4096));
  }
}

const { text, usage } = await runTurn(conversationId, ctx);

await fetch(
  `https://graph.facebook.com/v26.0/${process.env.WHATSAPP_PHONE_NUMBER_ID}/messages`,
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.WHATSAPP_ACCESS_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      messaging_product: "whatsapp",
      to: chatId,                                    // 254XXXXXXXXX, no + and no leading 0
      type: "text",
      text: { body: text.slice(0, 4096) },
    }),
  },
);

const stale = Date.now() - convo.last_user_at.getTime() > 24 * 60 * 60 * 1000;
if (stale) {
  await sendTemplate(chatId, "conversation_resume", []); // pre-approved, re-opens the window
  return; // don't burn a Grok call on a message you can't deliver
}

// lib/bot/retry.ts
export async function withBackoff<T>(fn: () => Promise<T>, attempts = 4): Promise<T> {
  let lastErr: unknown;
  for (let i = 0; i < attempts; i++) {
    try {
      return await fn();
    } catch (err: any) {
      lastErr = err;
      const status = err?.status ?? err?.statusCode;
      if (status !== 429 && !(status >= 500 && status < 600)) throw err;
      const wait = Math.min(2 ** i * 500, 8000) + Math.random() * 250; // full jitter
      await new Promise((r) => setTimeout(r, wait));
    }
  }
  throw lastErr;
}

// lib/bot/cost.ts
// Rates per 1M tokens. Verify against https://docs.x.ai/developers/models before trusting.
// grok-4.6 prices step UP above a ~200k-token prompt threshold — the tier matters for
// long transcripts, which is exactly what a bot accumulates.
const RATES = {
  "grok-4.6": { input: 2.0, cachedInput: 0.5, output: 6.0 },
  "grok-4.3": { input: 1.25, cachedInput: 0.2, output: 2.5 },
} as const;

export function turnCostUsd(model: keyof typeof RATES, u: {
  inputTokens: number; outputTokens: number; cachedInputTokens?: number;
}) {
  const r = RATES[model];
  const cached = u.cachedInputTokens ?? 0;
  const fresh = Math.max(0, u.inputTokens - cached);
  return (fresh * r.input + cached * r.cachedInput + u.outputTokens * r.output) / 1_000_000;
}

await db.insertInto("bot_messages").values({
  conversation_id: conversationId,
  role: "assistant",
  content: text,
  prompt_tokens: usage.inputTokens,
  completion_tokens: usage.outputTokens,
  cached_tokens: usage.cachedInputTokens ?? 0,
  cost_usd: turnCostUsd(GROK_MODEL, usage),
}).execute();

// lib/bot/brain.ts
import { xai } from "@ai-sdk/xai";
import { anthropic } from "@ai-sdk/anthropic";
import { generateText, isStepCount } from "ai";

type TurnInput = { instructions: string; messages: ModelMessage[] };

async function grokTurn(input: TurnInput) {
  return generateText({
    model: xai(GROK_MODEL),
    ...input,
    tools: botTools,
    stopWhen: isStepCount(5),
  });
}

async function claudeTurn(input: TurnInput) {
  return generateText({
    model: anthropic("claude-sonnet-4-6"), // pin the current ID — see anthropic/CLAUDE_CODE_INTEGRATION.md
    ...input,
    tools: botTools,                        // identical schemas — this is the whole point
    stopWhen: isStepCount(5),
  });
}

export async function think(input: TurnInput) {
  try {
    const r = await withBackoff(() => grokTurn(input));
    return { ...r, provider: "xai" as const };
  } catch (err) {
    logProviderFailure("xai", err);
    try {
      const r = await claudeTurn(input);
      return { ...r, provider: "anthropic" as const };
    } catch (err2) {
      logProviderFailure("anthropic", err2);
      return {
        text: "Sorry — I'm having trouble right now. A colleague will reply shortly.",
        provider: "none" as const,
        usage: { inputTokens: 0, outputTokens: 0 },
      };
    }
  }
}