WhatsApp Business API Integration GuideArchitecture, Automation, Security, and Implementation

flowchart LR
  Customer["Customer"] --> WA["WhatsApp"]
  WA --> Hook["Webhook\nPOST /webhook"]
  Hook --> BE["Backend API\nNode.js / FastAPI"]
  BE --> SIG["Signature\nValidation"]
  BE --> Queue["Message Queue\nRedis / BullMQ"]
  Queue --> AI["AI Engine\nOpenAI / Claude"]
  Queue --> CRM["CRM\nHubSpot / Salesforce"]
  AI --> Send["Send Message\nGraph API"]
  CRM --> Send
  Send --> WA
  BE --> DB["Database\nPostgreSQL"]
  BE --> MON["Monitoring\nSentry / Datadog"]

import { useState, useEffect } from 'react'

interface Conversation {
  id: string
  phone: string
  contactName: string
  lastMessage: string
  lastMessageAt: string
  status: 'open' | 'resolved' | 'pending'
  assignedTo?: string
}

export function ConversationList() {
  const [conversations, setConversations] = useState<Conversation[]>([])
  const [selected, setSelected] = useState<string | null>(null)

  useEffect(() => {
    const fetchConversations = async () => {
      const res = await fetch('/api/whatsapp/conversations')
      const data = await res.json()
      setConversations(data)
    }

    fetchConversations()
    // Poll for new conversations every 5 seconds
    const interval = setInterval(fetchConversations, 5000)
    return () => clearInterval(interval)
  }, [])

  return (
    <div className="flex h-screen">
      <aside className="w-80 border-r overflow-y-auto">
        {conversations.map((c) => (
          <button
            key={c.id}
            onClick={() => setSelected(c.id)}
            className="w-full p-4 text-left hover:bg-gray-50 border-b"
          >
            <div className="font-semibold">{c.contactName || c.phone}</div>
            <div className="text-sm text-gray-500 truncate">{c.lastMessage}</div>
          </button>
        ))}
      </aside>
      <main className="flex-1">
        {selected ? <ChatWindow conversationId={selected} /> : (
          <div className="flex items-center justify-center h-full text-gray-400">
            Select a conversation
          </div>
        )}
      </main>
    </div>
  )
}

import { NextRequest, NextResponse } from 'next/server'
import { getServerSession } from 'next-auth'

export async function POST(req: NextRequest) {
  const session = await getServerSession()
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })

  const { phone, message, conversationId } = await req.json()

  if (!phone || !message) {
    return NextResponse.json({ error: 'Missing required fields' }, { status: 400 })
  }

  // Send via your backend WhatsApp service
  const res = await fetch(process.env.API_BASE_URL + '/whatsapp/send', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      Authorization: 'Bearer ' + process.env.INTERNAL_API_KEY,
    },
    body: JSON.stringify({ phone, message, conversationId, agentId: session.user?.email }),
  })

  if (!res.ok) return NextResponse.json({ error: 'Failed to send' }, { status: 502 })

  return NextResponse.json({ success: true })
}

import { ref, onUnmounted } from 'vue'

export function useWhatsAppChat(conversationId: string) {
  const messages = ref<{ from: string; body: string; timestamp: string }[]>([])
  const connected = ref(false)

  const ws = new WebSocket(
    (import.meta.env.VITE_WS_URL || 'ws://localhost:3001') + '/whatsapp/' + conversationId
  )

  ws.onopen = () => { connected.value = true }
  ws.onclose = () => { connected.value = false }

  ws.onmessage = (event) => {
    const msg = JSON.parse(event.data)
    messages.value.push(msg)
  }

  const sendReply = async (text: string) => {
    await fetch('/api/whatsapp/reply', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ conversationId, message: text }),
    })
  }

  onUnmounted(() => ws.close())

  return { messages, connected, sendReply }
}

import { Injectable } from '@angular/core'
import { HttpClient } from '@angular/common/http'
import { Observable } from 'rxjs'

interface Conversation { id: string; phone: string; lastMessage: string }

@Injectable({ providedIn: 'root' })
export class WhatsAppService {
  constructor(private http: HttpClient) {}

  getConversations(): Observable<Conversation[]> {
    return this.http.get<Conversation[]>('/api/whatsapp/conversations')
  }

  sendReply(conversationId: string, message: string): Observable<{ success: boolean }> {
    return this.http.post<{ success: boolean }>('/api/whatsapp/reply', { conversationId, message })
  }
}

<script lang="ts">
  export let conversationId: string
  let reply = ''
  let sending = false
  let sent = false

  async function send() {
    if (!reply.trim()) return
    sending = true
    await fetch('/api/whatsapp/reply', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ conversationId, message: reply }),
    })
    reply = ''
    sending = false
    sent = true
    setTimeout(() => (sent = false), 2000)
  }
</script>

<textarea bind:value={reply} placeholder="Type a reply..." />
<button on:click={send} disabled={sending}>
  {sending ? 'Sending...' : sent ? 'Sent ✓' : 'Send'}
</button>

import { createSignal } from 'solid-js'

export function ReplyBox({ conversationId }: { conversationId: string }) {
  const [reply, setReply] = createSignal('')
  const [sending, setSending] = createSignal(false)

  const send = async () => {
    if (!reply().trim()) return
    setSending(true)
    await fetch('/api/whatsapp/reply', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ conversationId, message: reply() }),
    })
    setReply('')
    setSending(false)
  }

  return (
    <div>
      <textarea value={reply()} onInput={(e) => setReply(e.currentTarget.value)} />
      <button onClick={send} disabled={sending()}>
        {sending() ? 'Sending...' : 'Send'}
      </button>
    </div>
  )
}

import { component$, useSignal, $ } from '@builder.io/qwik'

export const ReplyBox = component$<{ conversationId: string }>(({ conversationId }) => {
  const reply = useSignal('')
  const sending = useSignal(false)

  const send = $(async () => {
    if (!reply.value.trim()) return
    sending.value = true
    await fetch('/api/whatsapp/reply', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ conversationId, message: reply.value }),
    })
    reply.value = ''
    sending.value = false
  })

  return (
    <div>
      <textarea value={reply.value} onInput$={(e) => (reply.value = (e.target as HTMLTextAreaElement).value)} />
      <button onClick$={send} disabled={sending.value}>
        {sending.value ? 'Sending...' : 'Send'}
      </button>
    </div>
  )
})

---
const { conversationId } = Astro.props
---
<div data-conversation-id={conversationId}>
  <textarea id="reply-text" placeholder="Type a reply..."></textarea>
  <button id="reply-send">Send</button>
</div>

<script>
  const container = document.querySelector('[data-conversation-id]') as HTMLElement
  const conversationId = container?.dataset.conversationId

  document.getElementById('reply-send')?.addEventListener('click', async () => {
    const textarea = document.getElementById('reply-text') as HTMLTextAreaElement
    const message = textarea.value.trim()
    if (!message) return
    await fetch('/api/whatsapp/reply', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ conversationId, message }),
    })
    textarea.value = ''
  })
</script>

import crypto from 'crypto'
import axios from 'axios'
import type { Request, Response } from 'express'

const BASE_URL = 'https://graph.facebook.com/v19.0'

// GET, Meta sends this once to verify your endpoint
export function verifyWebhook(req: Request, res: Response) {
  const mode = req.query['hub.mode']
  const token = req.query['hub.verify_token']
  const challenge = req.query['hub.challenge']

  if (mode === 'subscribe' && token === process.env.WEBHOOK_VERIFY_TOKEN) {
    return res.status(200).send(challenge)
  }
  return res.status(403).send('Forbidden')
}

// POST, incoming messages and status updates
export async function handleWebhook(req: Request, res: Response) {
  // Always acknowledge immediately
  res.status(200).send('EVENT_RECEIVED')

  const body = req.body
  if (body.object !== 'whatsapp_business_account') return

  for (const entry of body.entry ?? []) {
    for (const change of entry.changes ?? []) {
      const value = change.value
      const phoneNumberId = value.metadata?.phone_number_id

      for (const message of value.messages ?? []) {
        await enqueueMessage({ message, phoneNumberId })
      }
    }
  }
}

// Send a plain text message
export async function sendTextMessage(to: string, text: string, phoneNumberId: string) {
  await axios.post(
    BASE_URL + '/' + phoneNumberId + '/messages',
    {
      messaging_product: 'whatsapp',
      recipient_type: 'individual',
      to,
      type: 'text',
      text: { preview_url: false, body: text },
    },
    { headers: { Authorization: 'Bearer ' + process.env.WHATSAPP_ACCESS_TOKEN } }
  )
}

// Send a pre-approved template message
export async function sendTemplate(to: string, template: string, params: string[]) {
  await axios.post(
    BASE_URL + '/' + process.env.PHONE_NUMBER_ID + '/messages',
    {
      messaging_product: 'whatsapp',
      to,
      type: 'template',
      template: {
        name: template,
        language: { code: 'en_US' },
        components: [{
          type: 'body',
          parameters: params.map((text) => ({ type: 'text', text })),
        }],
      },
    },
    { headers: { Authorization: 'Bearer ' + process.env.WHATSAPP_ACCESS_TOKEN } }
  )
}

import { Injectable, Logger } from '@nestjs/common'
import { HttpService } from '@nestjs/axios'
import { firstValueFrom } from 'rxjs'

@Injectable()
export class WhatsAppService {
  private readonly logger = new Logger(WhatsAppService.name)
  private readonly baseUrl = 'https://graph.facebook.com/v19.0'

  constructor(private readonly http: HttpService) {}

  async sendMessage(to: string, text: string): Promise<void> {
    const url = this.baseUrl + '/' + process.env.PHONE_NUMBER_ID + '/messages'
    try {
      await firstValueFrom(
        this.http.post(
          url,
          { messaging_product: 'whatsapp', to, type: 'text', text: { body: text } },
          { headers: { Authorization: 'Bearer ' + process.env.WHATSAPP_ACCESS_TOKEN } }
        )
      )
    } catch (error) {
      this.logger.error('Failed to send WhatsApp message', { to, error })
      throw error
    }
  }

  async sendTemplate(to: string, name: string, params: string[]): Promise<void> {
    const url = this.baseUrl + '/' + process.env.PHONE_NUMBER_ID + '/messages'
    await firstValueFrom(
      this.http.post(
        url,
        {
          messaging_product: 'whatsapp',
          to,
          type: 'template',
          template: {
            name,
            language: { code: 'en_US' },
            components: [{ type: 'body', parameters: params.map((t) => ({ type: 'text', text: t })) }],
          },
        },
        { headers: { Authorization: 'Bearer ' + process.env.WHATSAPP_ACCESS_TOKEN } }
      )
    )
  }
}

import os, hashlib, hmac, httpx
from fastapi import APIRouter, Request, Response, HTTPException, BackgroundTasks

router = APIRouter()
BASE_URL = "https://graph.facebook.com/v19.0"

@router.get("/webhook")
async def verify(request: Request):
    p = dict(request.query_params)
    if p.get("hub.mode") == "subscribe" and p.get("hub.verify_token") == os.environ["WEBHOOK_VERIFY_TOKEN"]:
        return Response(content=p["hub.challenge"])
    raise HTTPException(status_code=403)

@router.post("/webhook")
async def handle(request: Request, background: BackgroundTasks):
    body = await request.json()
    # Respond immediately, process in background
    if body.get("object") == "whatsapp_business_account":
        for entry in body.get("entry", []):
            for change in entry.get("changes", []):
                for msg in change.get("value", {}).get("messages", []):
                    background.add_task(process_message, msg)
    return {"status": "ok"}

async def send_message(to: str, text: str):
    url = f"{BASE_URL}/{os.environ['PHONE_NUMBER_ID']}/messages"
    async with httpx.AsyncClient() as client:
        await client.post(
            url,
            json={"messaging_product": "whatsapp", "to": to, "type": "text", "text": {"body": text}},
            headers={"Authorization": "Bearer " + os.environ["WHATSAPP_ACCESS_TOKEN"]},
        )

<?php

namespace App\Services;

use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Log;

class WhatsAppService
{
    private string $baseUrl;
    private string $token;

    public function __construct()
    {
        $phoneId = config('whatsapp.phone_number_id');
        $this->baseUrl = "https://graph.facebook.com/v19.0/{$phoneId}";
        $this->token = config('whatsapp.access_token');
    }

    public function sendMessage(string $to, string $text): void
    {
        Http::withToken($this->token)
            ->post("{$this->baseUrl}/messages", [
                'messaging_product' => 'whatsapp',
                'to' => $to,
                'type' => 'text',
                'text' => ['body' => $text],
            ]);
    }

    public function sendTemplate(string $to, string $template, array $params = []): void
    {
        Http::withToken($this->token)
            ->post("{$this->baseUrl}/messages", [
                'messaging_product' => 'whatsapp',
                'to' => $to,
                'type' => 'template',
                'template' => [
                    'name' => $template,
                    'language' => ['code' => 'en_US'],
                    'components' => [[
                        'type' => 'body',
                        'parameters' => array_map(
                            fn($p) => ['type' => 'text', 'text' => $p],
                            $params
                        ),
                    ]],
                ],
            ]);
    }
}

import os, json, hmac, hashlib, requests
from django.http import JsonResponse, HttpResponse
from django.views.decorators.csrf import csrf_exempt

BASE_URL = f"https://graph.facebook.com/v19.0/{os.environ['PHONE_NUMBER_ID']}"
HEADERS = {"Authorization": f"Bearer {os.environ['WHATSAPP_ACCESS_TOKEN']}"}

@csrf_exempt
def webhook(request):
    if request.method == 'GET':
        p = request.GET
        if p.get('hub.mode') == 'subscribe' and p.get('hub.verify_token') == os.environ['WEBHOOK_VERIFY_TOKEN']:
            return HttpResponse(p['hub.challenge'])
        return HttpResponse(status=403)

    body = json.loads(request.body)
    for entry in body.get('entry', []):
        for change in entry.get('changes', []):
            for msg in change.get('value', {}).get('messages', []):
                process_message(msg)
    return JsonResponse({'status': 'ok'})

def send_message(to: str, text: str):
    requests.post(f"{BASE_URL}/messages", headers=HEADERS, json={
        'messaging_product': 'whatsapp', 'to': to,
        'type': 'text', 'text': {'body': text},
    })

def process_message(msg: dict):
    if msg.get('type') == 'text':
        send_message(msg['from'], f"Thanks for your message: {msg['text']['body']}")

package handlers

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
    "os"
)

var (
    baseURL = fmt.Sprintf("https://graph.facebook.com/v19.0/%s", os.Getenv("PHONE_NUMBER_ID"))
    token   = os.Getenv("WHATSAPP_ACCESS_TOKEN")
)

func Webhook(w http.ResponseWriter, r *http.Request) {
    if r.Method == http.MethodGet {
        q := r.URL.Query()
        if q.Get("hub.mode") == "subscribe" && q.Get("hub.verify_token") == os.Getenv("WEBHOOK_VERIFY_TOKEN") {
            w.Write([]byte(q.Get("hub.challenge")))
            return
        }
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }

    var body map[string]any
    json.NewDecoder(r.Body).Decode(&body)
    // Process messages asynchronously
    go processWebhook(body)
    w.WriteHeader(http.StatusOK)
}

func SendMessage(to, text string) error {
    payload, _ := json.Marshal(map[string]any{
        "messaging_product": "whatsapp", "to": to,
        "type": "text", "text": map[string]string{"body": text},
    })
    req, _ := http.NewRequest(http.MethodPost, baseURL+"/messages", bytes.NewBuffer(payload))
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer "+token)
    _, err := http.DefaultClient.Do(req)
    return err
}

@RestController
@RequestMapping("/api/whatsapp")
public class WhatsAppController {

    private final String baseUrl;
    private final String token;

    public WhatsAppController() {
        this.baseUrl = "https://graph.facebook.com/v19.0/" + System.getenv("PHONE_NUMBER_ID");
        this.token = System.getenv("WHATSAPP_ACCESS_TOKEN");
    }

    @GetMapping("/webhook")
    public ResponseEntity<String> verify(@RequestParam Map<String, String> params) {
        if ("subscribe".equals(params.get("hub.mode")) &&
            System.getenv("WEBHOOK_VERIFY_TOKEN").equals(params.get("hub.verify_token"))) {
            return ResponseEntity.ok(params.get("hub.challenge"));
        }
        return ResponseEntity.status(403).build();
    }

    @PostMapping("/webhook")
    public ResponseEntity<Map<String, String>> handle(@RequestBody Map<String, Object> body) {
        // Process async in production
        return ResponseEntity.ok(Map.of("status", "ok"));
    }

    public void sendMessage(String to, String text) {
        HttpHeaders headers = new HttpHeaders();
        headers.setContentType(MediaType.APPLICATION_JSON);
        headers.setBearerAuth(token);
        Map<String, Object> payload = Map.of(
            "messaging_product", "whatsapp", "to", to,
            "type", "text", "text", Map.of("body", text)
        );
        new RestTemplate().exchange(baseUrl + "/messages", HttpMethod.POST, new HttpEntity<>(payload, headers), Map.class);
    }
}

[ApiController]
[Route("api/whatsapp")]
public class WhatsAppController : ControllerBase
{
    private readonly HttpClient _http;
    private readonly string _baseUrl;

    public WhatsAppController(IHttpClientFactory factory)
    {
        _http = factory.CreateClient();
        _http.DefaultRequestHeaders.Authorization =
            new AuthenticationHeaderValue("Bearer", Environment.GetEnvironmentVariable("WHATSAPP_ACCESS_TOKEN"));
        _baseUrl = $"https://graph.facebook.com/v19.0/{Environment.GetEnvironmentVariable("PHONE_NUMBER_ID")}";
    }

    [HttpGet("webhook")]
    public IActionResult Verify([FromQuery(Name = "hub.mode")] string mode,
                                 [FromQuery(Name = "hub.verify_token")] string verifyToken,
                                 [FromQuery(Name = "hub.challenge")] string challenge)
    {
        if (mode == "subscribe" && verifyToken == Environment.GetEnvironmentVariable("WEBHOOK_VERIFY_TOKEN"))
            return Content(challenge);
        return Forbid();
    }

    [HttpPost("webhook")]
    public async Task<IActionResult> Handle([FromBody] JsonElement body)
    {
        // Parse and dispatch messages asynchronously
        return Ok(new { status = "ok" });
    }

    public async Task SendMessage(string to, string text)
    {
        var payload = new { messaging_product = "whatsapp", to, type = "text", text = new { body = text } };
        await _http.PostAsJsonAsync(_baseUrl + "/messages", payload);
    }
}

use axum::{extract::Query, Json};
use reqwest::Client;
use serde::{Deserialize, Serialize};
use serde_json::{json, Value};
use std::collections::HashMap;

#[derive(Deserialize)]
pub struct VerifyQuery {
    #[serde(rename = "hub.mode")]
    pub mode: Option<String>,
    #[serde(rename = "hub.verify_token")]
    pub verify_token: Option<String>,
    #[serde(rename = "hub.challenge")]
    pub challenge: Option<String>,
}

pub async fn verify(Query(params): Query<VerifyQuery>) -> String {
    let expected = std::env::var("WEBHOOK_VERIFY_TOKEN").unwrap();
    if params.mode.as_deref() == Some("subscribe") && params.verify_token.as_deref() == Some(&expected) {
        return params.challenge.unwrap_or_default();
    }
    "Forbidden".to_string()
}

pub async fn send_whatsapp_message(client: &Client, to: &str, text: &str) {
    let phone_id = std::env::var("PHONE_NUMBER_ID").unwrap();
    let token = std::env::var("WHATSAPP_ACCESS_TOKEN").unwrap();
    let _ = client
        .post(format!("https://graph.facebook.com/v19.0/{phone_id}/messages"))
        .bearer_auth(&token)
        .json(&json!({"messaging_product": "whatsapp", "to": to, "type": "text", "text": {"body": text}}))
        .send().await;
}

# Meta / WhatsApp credentials, never commit these
WHATSAPP_ACCESS_TOKEN=EAAxxxxxxxxxxxxxx
WHATSAPP_APP_SECRET=xxxxxxxxxxxxxxxx
PHONE_NUMBER_ID=1234567890
WHATSAPP_BUSINESS_ACCOUNT_ID=0987654321

# Token you define, must match what you enter in the Meta dashboard
WEBHOOK_VERIFY_TOKEN=my-secret-verify-token-2026

# Optional: rate limiting and session management
REDIS_URL=redis://localhost:6379

import crypto from 'crypto'
import type { Request, Response, NextFunction } from 'express'

export function validateWhatsAppWebhook(req: Request, res: Response, next: NextFunction) {
  const signature = req.headers['x-hub-signature-256'] as string

  if (!signature) {
    return res.status(401).json({ error: 'Missing signature header' })
  }

  const expected =
    'sha256=' +
    crypto
      .createHmac('sha256', process.env.WHATSAPP_APP_SECRET!)
      .update(JSON.stringify(req.body))
      .digest('hex')

  // Use timingSafeEqual to prevent timing attacks
  const sigBuffer = Buffer.from(signature)
  const expBuffer = Buffer.from(expected)

  if (sigBuffer.length !== expBuffer.length || !crypto.timingSafeEqual(sigBuffer, expBuffer)) {
    return res.status(401).json({ error: 'Invalid signature' })
  }

  next()
}

const FLOW: Record<string, { question: string; nextStage: string }> = {
  START:   { question: 'Welcome! What is your name?', nextStage: 'NAME' },
  NAME:    { question: 'Great! What is your company name?', nextStage: 'COMPANY' },
  COMPANY: { question: 'What is your estimated budget?

1. Under $5k
2. $5k – $20k
3. Over $20k', nextStage: 'BUDGET' },
  BUDGET:  { question: 'What problem are you trying to solve?', nextStage: 'PROBLEM' },
  PROBLEM: { question: '', nextStage: 'COMPLETE' },
}

export async function handleLeadFlow(phone: string, message: string) {
  const session = await getSession(phone) ?? { stage: 'START', data: {} }
  const { stage, data } = session

  // Save the user's answer for the current stage
  const updatedData = { ...data, [stage.toLowerCase()]: message.trim() }

  const next = FLOW[stage]
  if (!next) return

  if (next.nextStage === 'COMPLETE') {
    const score = scoreLead(updatedData)
    await syncToHubSpot(phone, updatedData, score)
    await sendTextMessage(phone,
      'Thank you, ' + updatedData.name + '! Our team will reach out within 24 hours.'
    )
    await clearSession(phone)
  } else {
    await setSession(phone, { stage: next.nextStage, data: updatedData })
    await sendTextMessage(phone, FLOW[next.nextStage].question)
  }
}

function scoreLead(data: Record<string, string>): number {
  let score = 50
  if (data.budget === '3') score += 30   // Over $20k
  if (data.budget === '2') score += 15   // $5k–$20k
  if (data.company?.length > 3) score += 10
  if (data.problem?.length > 30) score += 10
  return Math.min(score, 100)
}

export async function handleBookingFlow(phone: string, message: string) {
  const session = await getSession(phone)

  if (!session?.bookingStage) {
    const slots = await getAvailableSlots() // fetches from your calendar API
    const slotList = slots.map((s, i) => (i + 1) + '. ' + s.label).join('
')
    await sendTextMessage(phone, 'Available slots:

' + slotList + '

Reply with a number to book.')
    await setSession(phone, { bookingStage: 'SELECT_SLOT', slots })
    return
  }

  if (session.bookingStage === 'SELECT_SLOT') {
    const index = parseInt(message.trim(), 10) - 1
    const slot = session.slots?.[index]

    if (!slot) {
      await sendTextMessage(phone, 'Please reply with a number from the list.')
      return
    }

    const booking = await createCalendarEvent(phone, slot)

    // Send pre-approved confirmation template
    await sendTemplate(phone, 'booking_confirmation', [
      slot.label,
      booking.confirmationCode,
      booking.meetingLink,
    ])

    await clearSession(phone)
  }
}

import OpenAI from 'openai'

const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY })

export async function handleAISupport(phone: string, userMessage: string) {
  // Check if already escalated to human
  const session = await getSession(phone)
  if (session?.escalated) {
    await notifyAgent(phone, userMessage)
    return
  }

  const history = await getConversationHistory(phone)

  const completion = await openai.chat.completions.create({
    model: 'gpt-4o',
    messages: [
      {
        role: 'system',
        content:
          'You are a WhatsApp support agent. Answer concisely, under 200 words. ' +
          'If you cannot help or the user asks for a human, reply with exactly: ESCALATE',
      },
      ...history,
      { role: 'user', content: userMessage },
    ],
    max_tokens: 300,
  })

  const reply = completion.choices[0].message.content ?? ''

  if (reply.trim() === 'ESCALATE' || userMessage.toLowerCase().includes('human')) {
    await setSession(phone, { escalated: true })
    await sendTextMessage(phone, 'Connecting you with a team member. Average wait: 2 minutes.')
    await createSupportTicket(phone, history, userMessage)
    return
  }

  await sendTextMessage(phone, reply)
  await appendToHistory(phone, userMessage, reply)
}

import { Client } from '@hubspot/api-client'

const hubspot = new Client({ accessToken: process.env.HUBSPOT_ACCESS_TOKEN })

export async function upsertHubSpotContact(phone: string, data: {
  name?: string
  company?: string
  leadScore?: number
}) {
  const search = await hubspot.crm.contacts.searchApi.doSearch({
    filterGroups: [{ filters: [{ propertyName: 'phone', operator: 'EQ', value: phone }] }],
    properties: ['phone', 'firstname', 'hs_lead_status'],
    limit: 1,
    after: 0,
    sorts: [],
  })

  const properties = {
    phone,
    firstname: data.name ?? '',
    company: data.company ?? '',
    hs_lead_status: 'NEW',
    whatsapp_lead: 'true',
    lead_score: String(data.leadScore ?? 0),
  }

  if (search.results.length > 0) {
    await hubspot.crm.contacts.basicApi.update(search.results[0].id, { properties })
  } else {
    await hubspot.crm.contacts.basicApi.create({ properties })
  }
}

import jsforce from 'jsforce'

const conn = new jsforce.Connection({
  loginUrl: process.env.SF_LOGIN_URL,
})

async function getSalesforceConnection() {
  await conn.login(process.env.SF_USERNAME!, process.env.SF_PASSWORD! + process.env.SF_TOKEN!)
  return conn
}

export async function createSalesforceLead(phone: string, data: {
  name: string
  company: string
  description: string
}) {
  const sf = await getSalesforceConnection()

  await sf.sobject('Lead').upsert(
    {
      Phone: phone,
      FirstName: data.name.split(' ')[0] ?? data.name,
      LastName: data.name.split(' ').slice(1).join(' ') || 'Unknown',
      Company: data.company,
      Description: data.description,
      LeadSource: 'WhatsApp',
    },
    'Phone'
  )
}

import Anthropic from '@anthropic-ai/sdk'

const claude = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY })

export async function summarizeConversation(messages: { from: string; body: string }[]) {
  const transcript = messages.map((m) => m.from + ': ' + m.body).join('
')

  const response = await claude.messages.create({
    model: 'claude-opus-4-8',
    max_tokens: 300,
    messages: [{
      role: 'user',
      content:
        'Summarize this WhatsApp support conversation as: issue (one sentence), ' +
        'urgency (low/medium/high), category, and suggested resolution.

' + transcript,
    }],
  })

  return response.content[0].type === 'text' ? response.content[0].text : ''
}

interface WhatsAppAuditLog {
  event: 'message_received' | 'message_sent' | 'template_sent' | 'escalation' | 'lead_created' | 'error'
  phone: string
  agentId?: string
  templateName?: string
  durationMs?: number
  errorCode?: string
}

export function auditLog(entry: WhatsAppAuditLog) {
  console.log(JSON.stringify({
    ...entry,
    service: 'whatsapp',
    timestamp: new Date().toISOString(),
    env: process.env.NODE_ENV,
  }))
}

// Usage
auditLog({ event: 'message_received', phone: '+1234567890' })
auditLog({ event: 'lead_created', phone: '+1234567890', durationMs: 342 })
auditLog({ event: 'escalation', phone: '+1234567890', agentId: 'agent@company.com' })