th3saquib/wato

Purpose and Entry Points

wacrm is a self-hosted, account-scoped WhatsApp CRM: shared inbox, contacts, pipelines, broadcasts, visual automations/flows, AI assistance, and public integrations. The primary runtime is a Next.js App Router application rooted at src/app/layout.tsx, with authentication/dashboard route groups in src/app/(auth) and src/app/(dashboard). HTTP integration entry points are Next route handlers under src/app/api, notably WhatsApp webhooks and the versioned REST API.

Application Shell, Identity, and Tenancy

Supabase Auth establishes user identity; middleware protects navigation and redirects unauthenticated users. Account membership, roles, invitations, ownership, and scoped API access form the core multi-user boundary. Database RLS is the principal data-isolation mechanism.

• src/middleware.ts

• src/lib/auth/api-context.ts

• src/app/api/account/members/route.ts

• supabase/migrations/017_account_sharing.sql

CRM Workspace and Realtime Inbox

Dashboard pages compose client-facing CRM modules: inbox, contacts, pipelines, activity, notifications, and settings. Inbox operations resolve WhatsApp messages to conversations and contacts; browser-side realtime/presence hooks keep shared-agent views current.

• src/app/(dashboard)/inbox/page.tsx

• src/components/inbox/message-thread.tsx

• src/lib/inbox/conversations.ts

• src/hooks/use-realtime.ts

WhatsApp Boundary

The Meta Cloud API is isolated behind WhatsApp library code and route handlers. Outbound sends, reactions, media, template lifecycle, broadcast delivery, registration/configuration, and inbound webhook verification are handled at this boundary. Credentials/tokens require encryption, while inbound public webhooks require signature verification.

• src/app/api/whatsapp/webhook/route.ts

• src/lib/whatsapp/meta-api.ts

• src/lib/whatsapp/send-message.ts

• src/lib/whatsapp/encryption.ts

Campaigns, Automations, and Flows

Broadcasts use approved templates, recipient selection/personalization, scheduling, and status tracking. Automations and flows are separately modeled visual execution systems: API routes invoke validation and engines; cron endpoints advance scheduled or waiting work; actions can send through Meta and trigger webhooks.

• src/lib/automations/engine.ts

• src/app/api/automations/cron/route.ts

• src/lib/flows/engine.ts

• src/app/api/flows/cron/route.ts

• src/components/flows/flow-builder.tsx

AI Assistance and Knowledge Retrieval

AI features support generated drafts, constrained auto-replies with human handoff, usage tracking, and account-managed knowledge. Providers are OpenAI and Anthropic; retrieval uses Postgres full-text search and optionally pgvector embeddings. AI configuration and keys are administrative/account-scoped.

• src/app/api/ai/autoreply/[conversationId]/route.ts

• src/lib/ai/auto-reply.ts

• src/lib/ai/query.ts

• src/lib/ai/providers/openai.ts

External API, MCP, and Event Delivery

/api/v1 exposes authenticated CRM resources using scoped, revocable API keys. Registered outbound webhooks deliver signed events with SSRF protections. A distinct Node/TypeScript MCP server connects AI clients to this public API, defaulting to read-only operations with explicit write tooling.

• src/app/api/v1/contacts/route.ts

• src/lib/api-keys/keys.ts

• src/lib/webhooks/deliver.ts

• mcp-server/src/index.ts

Persistence and Deployment

Supabase provides Postgres, Auth, Storage, Realtime, RPCs, and RLS; migrations are the authoritative schema evolution path. The app runs on Node.js/Next.js and can deploy to Hostinger or other Node hosts. Meta Cloud API, Supabase, and optional OpenAI/Anthropic services are required material external dependencies.

• src/lib/supabase/server.ts

• src/lib/storage/upload-media.ts

• supabase/migrations/001_initial_schema.sql

• supabase/migrations/010_flows.sql