@agent-native/core 0.112.0 → 0.114.0

package/dist/integrations/runtime.d.ts

@@ -0,0 +1,2 @@
+export * from "./index.js";
+//# sourceMappingURL=runtime.d.ts.map

package/dist/integrations/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/integrations/runtime.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC"}

package/dist/integrations/runtime.js

@@ -0,0 +1,2 @@
+export * from "./index.js";
+//# sourceMappingURL=runtime.js.map

package/dist/integrations/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/integrations/runtime.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC","sourcesContent":["export * from \"./index.js\";\n"]}

package/dist/integrations/slack-manifest.d.ts

@@ -46,7 +46,7 @@ export declare function buildSlackAgentManifest(urls: SlackAgentManifestUrls): {
     readonly oauth_config: {
         readonly redirect_urls: readonly [string];
         readonly scopes: {
-            readonly bot: readonly ["assistant:write", "app_mentions:read", "channels:read", "channels:history", "chat:write", "files:read", "groups:history", "groups:read", "im:history", "im:read", "mpim:history", "mpim:read", "pins:read", "reactions:read", "users:read", "users:read.email"];
+            readonly bot: readonly ["assistant:write", "app_mentions:read", "channels:join", "channels:read", "channels:history", "chat:write", "files:read", "groups:history", "groups:read", "im:history", "im:read", "mpim:history", "mpim:read", "pins:read", "reactions:read", "users:read", "users:read.email"];
         };
     };
     readonly settings: {

package/dist/integrations/slack-oauth.d.ts

@@ -5,7 +5,7 @@ export declare const SLACK_AUTHORIZE_URL = "https://slack.com/oauth/v2/authorize
 export declare const SLACK_TOKEN_URL = "https://slack.com/api/oauth.v2.access";
 export declare const SLACK_AUTH_TEST_URL = "https://slack.com/api/auth.test";
 /** Scopes needed for contextual, file-aware Agent Native conversations. */
-export declare const SLACK_AGENT_BOT_SCOPES: readonly ["assistant:write", "app_mentions:read", "channels:read", "channels:history", "chat:write", "files:read", "groups:history", "groups:read", "im:history", "im:read", "mpim:history", "mpim:read", "pins:read", "reactions:read", "users:read", "users:read.email"];
+export declare const SLACK_AGENT_BOT_SCOPES: readonly ["assistant:write", "app_mentions:read", "channels:join", "channels:read", "channels:history", "chat:write", "files:read", "groups:history", "groups:read", "im:history", "im:read", "mpim:history", "mpim:read", "pins:read", "reactions:read", "users:read", "users:read.email"];
 export interface SlackOAuthAccessResponse {
     ok?: boolean;
     error?: string;

package/dist/integrations/slack-oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack-oauth.d.ts","sourceRoot":"","sources":["../../src/integrations/slack-oauth.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EACV,6BAA6B,EAC7B,kCAAkC,EACnC,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,mBAAmB,yCAAyC,CAAC;AAC1E,eAAO,MAAM,eAAe,0CAA0C,CAAC;AACvE,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,YACjC,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,SAAS,EACT,cAAc,EACd,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,CACV,CAAC;AAEX,MAAM,WAAW,wBAAwB;IACvC,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,WAAW,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7C,UAAU,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACpD;AAcD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,6BAA6B,CAAC;IACtC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAQD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAaT;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA6BpC;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAgCpC;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,CAAC,CAmD1B;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,GAAG,MAAM,CAQT;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,wBAAwB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,GAAG,SAAa,GACf,kCAAkC,CAsCpC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAC9C,kBAAkB,CAqBpB"}
+{"version":3,"file":"slack-oauth.d.ts","sourceRoot":"","sources":["../../src/integrations/slack-oauth.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EACV,6BAA6B,EAC7B,kCAAkC,EACnC,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,mBAAmB,yCAAyC,CAAC;AAC1E,eAAO,MAAM,eAAe,0CAA0C,CAAC;AACvE,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,YACjC,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,SAAS,EACT,cAAc,EACd,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,CACV,CAAC;AAEX,MAAM,WAAW,wBAAwB;IACvC,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,WAAW,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7C,UAAU,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACpD;AAcD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,6BAA6B,CAAC;IACtC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAQD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAaT;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA6BpC;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAgCpC;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,CAAC,CAmD1B;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,GAAG,MAAM,CAQT;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,wBAAwB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,GAAG,SAAa,GACf,kCAAkC,CAsCpC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAC9C,kBAAkB,CAqBpB"}

package/dist/integrations/slack-oauth.js

@@ -6,6 +6,7 @@ export const SLACK_AUTH_TEST_URL = "https://slack.com/api/auth.test";
 export const SLACK_AGENT_BOT_SCOPES = [
     "assistant:write",
     "app_mentions:read",
+    "channels:join",
     "channels:read",
     "channels:history",
     "chat:write",

package/dist/integrations/slack-oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"slack-oauth.js","sourceRoot":"","sources":["../../src/integrations/slack-oauth.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAQ1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,uCAAuC,CAAC;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,iBAAiB;IACjB,mBAAmB;IACnB,eAAe;IACf,kBAAkB;IAClB,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,SAAS;IACT,cAAc;IACd,WAAW;IACX,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,kBAAkB;CACV,CAAC;AAsDX,SAAS,cAAc,CAAC,KAAc,EAAE,QAAgB;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QACrE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAOtC;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3D,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,GAAG,mBAAmB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAM5C;IACC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,EAC7C,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,aAAa,EAAE;YACvC,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,WAAW;SAClC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ;SACzB,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAoC,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,cAAc,CACZ,IAAI,EAAE,KAAK,EACX,gCAAgC,QAAQ,CAAC,MAAM,GAAG,CACnD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAK5C;IACC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,EAC7C,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,aAAa,EAAE;YACvC,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ;SACzB,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAoC,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,cAAc,CACZ,IAAI,EAAE,KAAK,EACX,qCAAqC,QAAQ,CAAC,MAAM,GAAG,CACxD,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,SAAS,GAAiB,KAAK;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ;aACzB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA4B,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,cAAc,CAC1B,IAAI,EAAE,KAAK,EACX,2BAA2B,QAAQ,CAAC,MAAM,GAAG,CAC9C,CAAC;YACF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,eAAe;oBACnD,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,UAAU;gBAChB,KAAK;gBACL,SAAS;gBACT,MAAM,EAAE,IAAI;gBACZ,YAAY,EAAE,IAAI;gBAClB,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;aACb,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,IAAI;YACX,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;YACxC,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC1B,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;SAC7B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,gCAAgC;YACvC,SAAS;YACT,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB;QAC3C,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,WAAW,QAAQ,KAAK,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;AAClH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAkC,EAClC,MAA0B,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC;QAC3C,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE;QACzB,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE;QACrC,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,mBAAmB,EAAE,QAAQ,CAAC,qBAAqB;KACpD,CAAC,CAAC;IACH,MAAM,SAAS,GACb,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC;QAChE,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,eAAe;QACf,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI;QACjC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI;QACrC,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI;QAC7C,cAAc,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,IAAI,IAAI;QACjD,mBAAmB,EAAE,QAAQ,CAAC,qBAAqB,KAAK,IAAI;QAC5D,QAAQ,EAAE,QAAQ,CAAC,MAAM,IAAI,IAAI;QACjC,SAAS,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;QACvC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;QACrE,yBAAyB,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI;QAC3D,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,WAAW,EAAE;YACX,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,YAAY,EAAE,QAAQ,CAAC,aAAa;YACpC,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,SAAS;SACV;QACD,cAAc,EAAE,SAAS,IAAI,IAAI;KAClC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA+C;IAE/C,MAAM,UAAU,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,UAAU;YACV,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,MAAM;YACnB,aAAa,EAAE,UAAU;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,KAAK,OAAO,IAAI,OAAO,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["/** Slack OAuth v2 helpers for managed Agent Native messaging installs. */\n\nimport type { SecretScope } from \"../secrets/register.js\";\nimport type {\n  IntegrationInstallationHealth,\n  UpsertIntegrationInstallationInput,\n} from \"./installations-store.js\";\n\nexport const SLACK_AUTHORIZE_URL = \"https://slack.com/oauth/v2/authorize\";\nexport const SLACK_TOKEN_URL = \"https://slack.com/api/oauth.v2.access\";\nexport const SLACK_AUTH_TEST_URL = \"https://slack.com/api/auth.test\";\n\n/** Scopes needed for contextual, file-aware Agent Native conversations. */\nexport const SLACK_AGENT_BOT_SCOPES = [\n  \"assistant:write\",\n  \"app_mentions:read\",\n  \"channels:read\",\n  \"channels:history\",\n  \"chat:write\",\n  \"files:read\",\n  \"groups:history\",\n  \"groups:read\",\n  \"im:history\",\n  \"im:read\",\n  \"mpim:history\",\n  \"mpim:read\",\n  \"pins:read\",\n  \"reactions:read\",\n  \"users:read\",\n  \"users:read.email\",\n] as const;\n\nexport interface SlackOAuthAccessResponse {\n  ok?: boolean;\n  error?: string;\n  access_token?: string;\n  refresh_token?: string;\n  expires_in?: number;\n  token_type?: string;\n  scope?: string;\n  bot_user_id?: string;\n  app_id?: string;\n  is_enterprise_install?: boolean;\n  authed_user?: { id?: string };\n  team?: { id?: string; name?: string } | null;\n  enterprise?: { id?: string; name?: string } | null;\n}\n\ninterface SlackApiResponse {\n  ok?: boolean;\n  error?: string;\n  team_id?: string;\n  team?: string;\n  enterprise_id?: string;\n  enterprise?: string;\n  user_id?: string;\n  bot_id?: string;\n  url?: string;\n}\n\nexport interface SlackAuthHealth {\n  ok: boolean;\n  health: IntegrationInstallationHealth;\n  error: string | null;\n  checkedAt: number;\n  teamId: string | null;\n  enterpriseId: string | null;\n  botId: string | null;\n  userId: string | null;\n}\n\nexport interface SlackInstallSession {\n  email?: string | null;\n  orgId?: string | null;\n  orgRole?: string | null;\n}\n\nexport interface SlackInstallAccess {\n  ownerEmail: string;\n  orgId: string | null;\n  secretScope: SecretScope;\n  secretScopeId: string;\n}\n\nfunction safeSlackError(value: unknown, fallback: string): string {\n  return typeof value === \"string\" && /^[a-z0-9_.-]{1,100}$/i.test(value)\n    ? value\n    : fallback;\n}\n\nexport function buildSlackAuthorizeUrl(options: {\n  clientId: string;\n  redirectUri: string;\n  state: string;\n  scopes?: readonly string[];\n  userScopes?: readonly string[];\n  teamId?: string;\n}): string {\n  const params = new URLSearchParams({\n    client_id: options.clientId,\n    redirect_uri: options.redirectUri,\n    response_type: \"code\",\n    scope: (options.scopes ?? SLACK_AGENT_BOT_SCOPES).join(\",\"),\n    state: options.state,\n  });\n  if (options.userScopes?.length) {\n    params.set(\"user_scope\", options.userScopes.join(\",\"));\n  }\n  if (options.teamId) params.set(\"team\", options.teamId);\n  return `${SLACK_AUTHORIZE_URL}?${params.toString()}`;\n}\n\n/** Exchange an OAuth code using Slack's preferred HTTP Basic authentication. */\nexport async function exchangeSlackOAuthCode(options: {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  fetchImpl?: typeof fetch;\n}): Promise<SlackOAuthAccessResponse> {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const authorization = Buffer.from(\n    `${options.clientId}:${options.clientSecret}`,\n    \"utf8\",\n  ).toString(\"base64\");\n  const response = await fetchImpl(SLACK_TOKEN_URL, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Basic ${authorization}`,\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n    },\n    body: new URLSearchParams({\n      code: options.code,\n      redirect_uri: options.redirectUri,\n    }),\n  });\n  const data = (await response\n    .json()\n    .catch(() => null)) as SlackOAuthAccessResponse | null;\n  if (!response.ok || !data?.ok) {\n    throw new Error(\n      safeSlackError(\n        data?.error,\n        `Slack OAuth exchange failed (${response.status})`,\n      ),\n    );\n  }\n  return data;\n}\n\n/**\n * Rotate an expiring Slack token. Slack refresh tokens are one-time-use, so\n * callers must atomically persist the returned access/refresh pair together.\n */\nexport async function refreshSlackOAuthToken(options: {\n  refreshToken: string;\n  clientId: string;\n  clientSecret: string;\n  fetchImpl?: typeof fetch;\n}): Promise<SlackOAuthAccessResponse> {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const authorization = Buffer.from(\n    `${options.clientId}:${options.clientSecret}`,\n    \"utf8\",\n  ).toString(\"base64\");\n  const response = await fetchImpl(SLACK_TOKEN_URL, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Basic ${authorization}`,\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n    },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: options.refreshToken,\n    }),\n  });\n  const data = (await response\n    .json()\n    .catch(() => null)) as SlackOAuthAccessResponse | null;\n  if (!response.ok || !data?.ok) {\n    throw new Error(\n      safeSlackError(\n        data?.error,\n        `Slack OAuth token refresh failed (${response.status})`,\n      ),\n    );\n  }\n  if (!data.access_token || !data.refresh_token) {\n    throw new Error(\"Slack OAuth token refresh returned an incomplete bundle\");\n  }\n  return data;\n}\n\n/** Validate a bot token without ever including it in an error or result. */\nexport async function testSlackAuth(\n  accessToken: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<SlackAuthHealth> {\n  const checkedAt = Date.now();\n  try {\n    const response = await fetchImpl(SLACK_AUTH_TEST_URL, {\n      method: \"POST\",\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n    const data = (await response\n      .json()\n      .catch(() => null)) as SlackApiResponse | null;\n    if (!response.ok || !data?.ok) {\n      const error = safeSlackError(\n        data?.error,\n        `Slack auth test failed (${response.status})`,\n      );\n      return {\n        ok: false,\n        health:\n          error === \"invalid_auth\" || error === \"token_revoked\"\n            ? \"revoked\"\n            : \"degraded\",\n        error,\n        checkedAt,\n        teamId: null,\n        enterpriseId: null,\n        botId: null,\n        userId: null,\n      };\n    }\n    return {\n      ok: true,\n      health: \"healthy\",\n      error: null,\n      checkedAt,\n      teamId: data.team_id ?? null,\n      enterpriseId: data.enterprise_id ?? null,\n      botId: data.bot_id ?? null,\n      userId: data.user_id ?? null,\n    };\n  } catch {\n    return {\n      ok: false,\n      health: \"degraded\",\n      error: \"Slack auth test request failed\",\n      checkedAt,\n      teamId: null,\n      enterpriseId: null,\n      botId: null,\n      userId: null,\n    };\n  }\n}\n\n/** Stable team/app key used by webhook payloads and the installation store. */\nexport function slackInstallationKey(input: {\n  teamId?: string | null;\n  enterpriseId?: string | null;\n  apiAppId?: string | null;\n  isEnterpriseInstall?: boolean;\n}): string {\n  const workspaceId = input.isEnterpriseInstall\n    ? input.enterpriseId\n    : (input.teamId ?? input.enterpriseId);\n  if (!workspaceId) {\n    throw new Error(\"Slack OAuth did not return a team or enterprise id\");\n  }\n  return `${input.isEnterpriseInstall ? \"enterprise\" : \"team\"}:${workspaceId}:app:${input.apiAppId || \"default\"}`;\n}\n\n/**\n * Convert a successful Slack response to the generic managed-install input.\n * The returned token bundle is server-only and must be passed directly to the\n * encrypted installation store, never to a route response.\n */\nexport function slackOAuthResponseToInstallation(\n  response: SlackOAuthAccessResponse,\n  access: SlackInstallAccess,\n  now = Date.now(),\n): UpsertIntegrationInstallationInput {\n  if (!response.ok || !response.access_token) {\n    throw new Error(\"Slack OAuth response did not include a bot access token\");\n  }\n  const installationKey = slackInstallationKey({\n    teamId: response.team?.id,\n    enterpriseId: response.enterprise?.id,\n    apiAppId: response.app_id,\n    isEnterpriseInstall: response.is_enterprise_install,\n  });\n  const expiresAt =\n    typeof response.expires_in === \"number\" && response.expires_in > 0\n      ? now + response.expires_in * 1000\n      : undefined;\n  return {\n    platform: \"slack\",\n    installationKey,\n    teamId: response.team?.id ?? null,\n    teamName: response.team?.name ?? null,\n    enterpriseId: response.enterprise?.id ?? null,\n    enterpriseName: response.enterprise?.name ?? null,\n    isEnterpriseInstall: response.is_enterprise_install === true,\n    apiAppId: response.app_id ?? null,\n    botUserId: response.bot_user_id ?? null,\n    scopes: response.scope?.split(\",\").map((scope) => scope.trim()) ?? [],\n    installedByExternalUserId: response.authed_user?.id ?? null,\n    ownerEmail: access.ownerEmail,\n    orgId: access.orgId,\n    secretScope: access.secretScope,\n    secretScopeId: access.secretScopeId,\n    tokenBundle: {\n      accessToken: response.access_token,\n      refreshToken: response.refresh_token,\n      tokenType: response.token_type,\n      expiresAt,\n    },\n    tokenExpiresAt: expiresAt ?? null,\n  };\n}\n\n/**\n * Pure session/role gate for OAuth install routes. The caller must supply a\n * server-verified session; org membership must be the active org context.\n */\nexport function assertSlackInstallAccess(\n  session: SlackInstallSession | null | undefined,\n): SlackInstallAccess {\n  const ownerEmail = session?.email?.trim().toLowerCase();\n  if (!ownerEmail) throw new Error(\"Sign in before connecting Slack.\");\n  const orgId = session?.orgId?.trim() || null;\n  if (!orgId) {\n    return {\n      ownerEmail,\n      orgId: null,\n      secretScope: \"user\",\n      secretScopeId: ownerEmail,\n    };\n  }\n  if (session?.orgRole !== \"owner\" && session?.orgRole !== \"admin\") {\n    throw new Error(\"Only organization owners and admins can connect Slack.\");\n  }\n  return {\n    ownerEmail,\n    orgId,\n    secretScope: \"org\",\n    secretScopeId: orgId,\n  };\n}\n"]}
+{"version":3,"file":"slack-oauth.js","sourceRoot":"","sources":["../../src/integrations/slack-oauth.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAQ1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,uCAAuC,CAAC;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,iBAAiB;IACjB,mBAAmB;IACnB,eAAe;IACf,eAAe;IACf,kBAAkB;IAClB,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,SAAS;IACT,cAAc;IACd,WAAW;IACX,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,kBAAkB;CACV,CAAC;AAsDX,SAAS,cAAc,CAAC,KAAc,EAAE,QAAgB;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QACrE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAOtC;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3D,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,GAAG,mBAAmB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAM5C;IACC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,EAC7C,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,aAAa,EAAE;YACvC,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,WAAW;SAClC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ;SACzB,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAoC,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,cAAc,CACZ,IAAI,EAAE,KAAK,EACX,gCAAgC,QAAQ,CAAC,MAAM,GAAG,CACnD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAK5C;IACC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,EAC7C,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,aAAa,EAAE;YACvC,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ;SACzB,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAoC,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,cAAc,CACZ,IAAI,EAAE,KAAK,EACX,qCAAqC,QAAQ,CAAC,MAAM,GAAG,CACxD,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,SAAS,GAAiB,KAAK;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ;aACzB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA4B,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,cAAc,CAC1B,IAAI,EAAE,KAAK,EACX,2BAA2B,QAAQ,CAAC,MAAM,GAAG,CAC9C,CAAC;YACF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,eAAe;oBACnD,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,UAAU;gBAChB,KAAK;gBACL,SAAS;gBACT,MAAM,EAAE,IAAI;gBACZ,YAAY,EAAE,IAAI;gBAClB,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;aACb,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,IAAI;YACX,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;YACxC,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC1B,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;SAC7B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,gCAAgC;YACvC,SAAS;YACT,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB;QAC3C,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,WAAW,QAAQ,KAAK,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;AAClH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAkC,EAClC,MAA0B,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC;QAC3C,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE;QACzB,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE;QACrC,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,mBAAmB,EAAE,QAAQ,CAAC,qBAAqB;KACpD,CAAC,CAAC;IACH,MAAM,SAAS,GACb,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC;QAChE,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,eAAe;QACf,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI;QACjC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI;QACrC,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI;QAC7C,cAAc,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,IAAI,IAAI;QACjD,mBAAmB,EAAE,QAAQ,CAAC,qBAAqB,KAAK,IAAI;QAC5D,QAAQ,EAAE,QAAQ,CAAC,MAAM,IAAI,IAAI;QACjC,SAAS,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;QACvC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;QACrE,yBAAyB,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI;QAC3D,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,WAAW,EAAE;YACX,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,YAAY,EAAE,QAAQ,CAAC,aAAa;YACpC,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,SAAS;SACV;QACD,cAAc,EAAE,SAAS,IAAI,IAAI;KAClC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA+C;IAE/C,MAAM,UAAU,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,UAAU;YACV,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,MAAM;YACnB,aAAa,EAAE,UAAU;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,KAAK,OAAO,IAAI,OAAO,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["/** Slack OAuth v2 helpers for managed Agent Native messaging installs. */\n\nimport type { SecretScope } from \"../secrets/register.js\";\nimport type {\n  IntegrationInstallationHealth,\n  UpsertIntegrationInstallationInput,\n} from \"./installations-store.js\";\n\nexport const SLACK_AUTHORIZE_URL = \"https://slack.com/oauth/v2/authorize\";\nexport const SLACK_TOKEN_URL = \"https://slack.com/api/oauth.v2.access\";\nexport const SLACK_AUTH_TEST_URL = \"https://slack.com/api/auth.test\";\n\n/** Scopes needed for contextual, file-aware Agent Native conversations. */\nexport const SLACK_AGENT_BOT_SCOPES = [\n  \"assistant:write\",\n  \"app_mentions:read\",\n  \"channels:join\",\n  \"channels:read\",\n  \"channels:history\",\n  \"chat:write\",\n  \"files:read\",\n  \"groups:history\",\n  \"groups:read\",\n  \"im:history\",\n  \"im:read\",\n  \"mpim:history\",\n  \"mpim:read\",\n  \"pins:read\",\n  \"reactions:read\",\n  \"users:read\",\n  \"users:read.email\",\n] as const;\n\nexport interface SlackOAuthAccessResponse {\n  ok?: boolean;\n  error?: string;\n  access_token?: string;\n  refresh_token?: string;\n  expires_in?: number;\n  token_type?: string;\n  scope?: string;\n  bot_user_id?: string;\n  app_id?: string;\n  is_enterprise_install?: boolean;\n  authed_user?: { id?: string };\n  team?: { id?: string; name?: string } | null;\n  enterprise?: { id?: string; name?: string } | null;\n}\n\ninterface SlackApiResponse {\n  ok?: boolean;\n  error?: string;\n  team_id?: string;\n  team?: string;\n  enterprise_id?: string;\n  enterprise?: string;\n  user_id?: string;\n  bot_id?: string;\n  url?: string;\n}\n\nexport interface SlackAuthHealth {\n  ok: boolean;\n  health: IntegrationInstallationHealth;\n  error: string | null;\n  checkedAt: number;\n  teamId: string | null;\n  enterpriseId: string | null;\n  botId: string | null;\n  userId: string | null;\n}\n\nexport interface SlackInstallSession {\n  email?: string | null;\n  orgId?: string | null;\n  orgRole?: string | null;\n}\n\nexport interface SlackInstallAccess {\n  ownerEmail: string;\n  orgId: string | null;\n  secretScope: SecretScope;\n  secretScopeId: string;\n}\n\nfunction safeSlackError(value: unknown, fallback: string): string {\n  return typeof value === \"string\" && /^[a-z0-9_.-]{1,100}$/i.test(value)\n    ? value\n    : fallback;\n}\n\nexport function buildSlackAuthorizeUrl(options: {\n  clientId: string;\n  redirectUri: string;\n  state: string;\n  scopes?: readonly string[];\n  userScopes?: readonly string[];\n  teamId?: string;\n}): string {\n  const params = new URLSearchParams({\n    client_id: options.clientId,\n    redirect_uri: options.redirectUri,\n    response_type: \"code\",\n    scope: (options.scopes ?? SLACK_AGENT_BOT_SCOPES).join(\",\"),\n    state: options.state,\n  });\n  if (options.userScopes?.length) {\n    params.set(\"user_scope\", options.userScopes.join(\",\"));\n  }\n  if (options.teamId) params.set(\"team\", options.teamId);\n  return `${SLACK_AUTHORIZE_URL}?${params.toString()}`;\n}\n\n/** Exchange an OAuth code using Slack's preferred HTTP Basic authentication. */\nexport async function exchangeSlackOAuthCode(options: {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  fetchImpl?: typeof fetch;\n}): Promise<SlackOAuthAccessResponse> {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const authorization = Buffer.from(\n    `${options.clientId}:${options.clientSecret}`,\n    \"utf8\",\n  ).toString(\"base64\");\n  const response = await fetchImpl(SLACK_TOKEN_URL, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Basic ${authorization}`,\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n    },\n    body: new URLSearchParams({\n      code: options.code,\n      redirect_uri: options.redirectUri,\n    }),\n  });\n  const data = (await response\n    .json()\n    .catch(() => null)) as SlackOAuthAccessResponse | null;\n  if (!response.ok || !data?.ok) {\n    throw new Error(\n      safeSlackError(\n        data?.error,\n        `Slack OAuth exchange failed (${response.status})`,\n      ),\n    );\n  }\n  return data;\n}\n\n/**\n * Rotate an expiring Slack token. Slack refresh tokens are one-time-use, so\n * callers must atomically persist the returned access/refresh pair together.\n */\nexport async function refreshSlackOAuthToken(options: {\n  refreshToken: string;\n  clientId: string;\n  clientSecret: string;\n  fetchImpl?: typeof fetch;\n}): Promise<SlackOAuthAccessResponse> {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const authorization = Buffer.from(\n    `${options.clientId}:${options.clientSecret}`,\n    \"utf8\",\n  ).toString(\"base64\");\n  const response = await fetchImpl(SLACK_TOKEN_URL, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Basic ${authorization}`,\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n    },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: options.refreshToken,\n    }),\n  });\n  const data = (await response\n    .json()\n    .catch(() => null)) as SlackOAuthAccessResponse | null;\n  if (!response.ok || !data?.ok) {\n    throw new Error(\n      safeSlackError(\n        data?.error,\n        `Slack OAuth token refresh failed (${response.status})`,\n      ),\n    );\n  }\n  if (!data.access_token || !data.refresh_token) {\n    throw new Error(\"Slack OAuth token refresh returned an incomplete bundle\");\n  }\n  return data;\n}\n\n/** Validate a bot token without ever including it in an error or result. */\nexport async function testSlackAuth(\n  accessToken: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<SlackAuthHealth> {\n  const checkedAt = Date.now();\n  try {\n    const response = await fetchImpl(SLACK_AUTH_TEST_URL, {\n      method: \"POST\",\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n    const data = (await response\n      .json()\n      .catch(() => null)) as SlackApiResponse | null;\n    if (!response.ok || !data?.ok) {\n      const error = safeSlackError(\n        data?.error,\n        `Slack auth test failed (${response.status})`,\n      );\n      return {\n        ok: false,\n        health:\n          error === \"invalid_auth\" || error === \"token_revoked\"\n            ? \"revoked\"\n            : \"degraded\",\n        error,\n        checkedAt,\n        teamId: null,\n        enterpriseId: null,\n        botId: null,\n        userId: null,\n      };\n    }\n    return {\n      ok: true,\n      health: \"healthy\",\n      error: null,\n      checkedAt,\n      teamId: data.team_id ?? null,\n      enterpriseId: data.enterprise_id ?? null,\n      botId: data.bot_id ?? null,\n      userId: data.user_id ?? null,\n    };\n  } catch {\n    return {\n      ok: false,\n      health: \"degraded\",\n      error: \"Slack auth test request failed\",\n      checkedAt,\n      teamId: null,\n      enterpriseId: null,\n      botId: null,\n      userId: null,\n    };\n  }\n}\n\n/** Stable team/app key used by webhook payloads and the installation store. */\nexport function slackInstallationKey(input: {\n  teamId?: string | null;\n  enterpriseId?: string | null;\n  apiAppId?: string | null;\n  isEnterpriseInstall?: boolean;\n}): string {\n  const workspaceId = input.isEnterpriseInstall\n    ? input.enterpriseId\n    : (input.teamId ?? input.enterpriseId);\n  if (!workspaceId) {\n    throw new Error(\"Slack OAuth did not return a team or enterprise id\");\n  }\n  return `${input.isEnterpriseInstall ? \"enterprise\" : \"team\"}:${workspaceId}:app:${input.apiAppId || \"default\"}`;\n}\n\n/**\n * Convert a successful Slack response to the generic managed-install input.\n * The returned token bundle is server-only and must be passed directly to the\n * encrypted installation store, never to a route response.\n */\nexport function slackOAuthResponseToInstallation(\n  response: SlackOAuthAccessResponse,\n  access: SlackInstallAccess,\n  now = Date.now(),\n): UpsertIntegrationInstallationInput {\n  if (!response.ok || !response.access_token) {\n    throw new Error(\"Slack OAuth response did not include a bot access token\");\n  }\n  const installationKey = slackInstallationKey({\n    teamId: response.team?.id,\n    enterpriseId: response.enterprise?.id,\n    apiAppId: response.app_id,\n    isEnterpriseInstall: response.is_enterprise_install,\n  });\n  const expiresAt =\n    typeof response.expires_in === \"number\" && response.expires_in > 0\n      ? now + response.expires_in * 1000\n      : undefined;\n  return {\n    platform: \"slack\",\n    installationKey,\n    teamId: response.team?.id ?? null,\n    teamName: response.team?.name ?? null,\n    enterpriseId: response.enterprise?.id ?? null,\n    enterpriseName: response.enterprise?.name ?? null,\n    isEnterpriseInstall: response.is_enterprise_install === true,\n    apiAppId: response.app_id ?? null,\n    botUserId: response.bot_user_id ?? null,\n    scopes: response.scope?.split(\",\").map((scope) => scope.trim()) ?? [],\n    installedByExternalUserId: response.authed_user?.id ?? null,\n    ownerEmail: access.ownerEmail,\n    orgId: access.orgId,\n    secretScope: access.secretScope,\n    secretScopeId: access.secretScopeId,\n    tokenBundle: {\n      accessToken: response.access_token,\n      refreshToken: response.refresh_token,\n      tokenType: response.token_type,\n      expiresAt,\n    },\n    tokenExpiresAt: expiresAt ?? null,\n  };\n}\n\n/**\n * Pure session/role gate for OAuth install routes. The caller must supply a\n * server-verified session; org membership must be the active org context.\n */\nexport function assertSlackInstallAccess(\n  session: SlackInstallSession | null | undefined,\n): SlackInstallAccess {\n  const ownerEmail = session?.email?.trim().toLowerCase();\n  if (!ownerEmail) throw new Error(\"Sign in before connecting Slack.\");\n  const orgId = session?.orgId?.trim() || null;\n  if (!orgId) {\n    return {\n      ownerEmail,\n      orgId: null,\n      secretScope: \"user\",\n      secretScopeId: ownerEmail,\n    };\n  }\n  if (session?.orgRole !== \"owner\" && session?.orgRole !== \"admin\") {\n    throw new Error(\"Only organization owners and admins can connect Slack.\");\n  }\n  return {\n    ownerEmail,\n    orgId,\n    secretScope: \"org\",\n    secretScopeId: orgId,\n  };\n}\n"]}

package/dist/integrations/types.d.ts

@@ -348,8 +348,10 @@ export declare function assertPlatformCapability(adapter: PlatformAdapter, capab
 export interface IntegrationsPluginOptions {
     /** App identifier used by call-agent to prevent self-calls (e.g. "dispatch"). */
     appId?: string;
-    /** Platform adapters to enable. Default: all built-in adapters with configured env keys. */
+    /** Full adapter set to enable. Default: all built-in adapters. */
     adapters?: PlatformAdapter[];
+    /** Replace built-in adapters by platform without removing the other defaults. */
+    adapterOverrides?: PlatformAdapter[];
     /** System prompt for the agent (same as agent-chat). Inherited from agent-chat plugin if not set. */
     systemPrompt?: string;
     /** Actions registry (same as agent-chat). */

package/dist/integrations/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/integrations/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,MAAM,2BAA2B,GACnC,SAAS,GACT,iBAAiB,GACjB,IAAI,GACJ,UAAU,GACV,SAAS,CAAC;AAEd,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,IAAI,GAAG,cAAc,CAAC;AAEvE,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAC;IACzB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,yEAAyE;IACzE,eAAe,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC9C,wEAAwE;IACxE,KAAK,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACnC,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,2EAA2E;AAC3E,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;4EAEwE;IACxE,eAAe,CAAC,EAAE,OAAO,4BAA4B,EAAE,YAAY,EAAE,CAAC;CACvE;AAED,MAAM,WAAW,2BAA2B;IAC1C,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,yEAAyE;IACzE,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,uBAAuB,EAAE,OAAO,CAAC;IACjC,8EAA8E;IAC9E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,sEAAsE;IACtE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,sBAAsB,CAAC;IAC7B,+EAA+E;IAC/E,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrD,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,uBAAuB,CAAC,CAAC;IAC5E,iFAAiF;IACjF,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,qBAAa,kCAAmC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,2BAA2B;IAJxD,QAAQ,CAAC,IAAI,qCAAqC;IAElD,YACW,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,2BAA2B,EAIvD;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE7D,0DAA0D;IAC1D,kBAAkB,IAAI,YAAY,EAAE,CAAC;IAErC;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD;;;OAGG;IACH,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEtE;;;;OAIG;IACH,sBAAsB,CAAC,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7E;;;;OAIG;IACH,uBAAuB,CAAC,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE9E;;;;OAIG;IACH,2BAA2B,CAAC,CAC1B,QAAQ,EAAE,eAAe,GACxB,wBAAwB,GAAG,IAAI,CAAC;IAEnC;;;;OAIG;IACH,0BAA0B,CAAC,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,EAAE,CAAC;IAEjE;;;;;;;OAOG;IACH,YAAY,CACV,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GACjC,OAAO,CAAC,IAAI,GAAG,uBAAuB,CAAC,CAAC;IAE3C;;;;;;OAMG;IACH,gBAAgB,CAAC,CACf,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,2EAA2E;QAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;;OASG;IACH,yBAAyB,CAAC,CACxB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE9C,2EAA2E;IAC3E,gBAAgB,CAAC,CACf,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,iBAAiB,CAAC,CAChB,QAAQ,EAAE,eAAe,EACzB,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAEvC;;;OAGG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;OAQG;IACH,mBAAmB,CACjB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,eAAe,CAAC;IAEnB,0EAA0E;IAC1E,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACzD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,2BAA2B,GAC5C,IAAI,CAIN;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,qGAAqG;IACrG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,8BAA8B,EAAE,WAAW,CAAC,CAAC;IAC7E,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,MAAM,CAAC,EACH,OAAO,0BAA0B,EAAE,WAAW,GAC9C,MAAM,GACN;QACE,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;IACN;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,CACxB,QAAQ,EAAE,eAAe,KACtB,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxE;;;;;OAKG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC;;;OAGG;IACH,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,eAAe,KACrB,OAAO,CACR;QACE,OAAO,EAAE,IAAI,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACD;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CACrB,CAAC;CACH;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/integrations/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,MAAM,2BAA2B,GACnC,SAAS,GACT,iBAAiB,GACjB,IAAI,GACJ,UAAU,GACV,SAAS,CAAC;AAEd,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,IAAI,GAAG,cAAc,CAAC;AAEvE,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAC;IACzB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,yEAAyE;IACzE,eAAe,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC9C,wEAAwE;IACxE,KAAK,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACnC,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,2EAA2E;AAC3E,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;4EAEwE;IACxE,eAAe,CAAC,EAAE,OAAO,4BAA4B,EAAE,YAAY,EAAE,CAAC;CACvE;AAED,MAAM,WAAW,2BAA2B;IAC1C,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,yEAAyE;IACzE,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,uBAAuB,EAAE,OAAO,CAAC;IACjC,8EAA8E;IAC9E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,sEAAsE;IACtE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,GAAG,CAAC,EAAE,sBAAsB,CAAC;IAC7B,+EAA+E;IAC/E,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrD,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,uBAAuB,CAAC,CAAC;IAC5E,iFAAiF;IACjF,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,qBAAa,kCAAmC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,2BAA2B;IAJxD,QAAQ,CAAC,IAAI,qCAAqC;IAElD,YACW,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,2BAA2B,EAIvD;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE7D,0DAA0D;IAC1D,kBAAkB,IAAI,YAAY,EAAE,CAAC;IAErC;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD;;;OAGG;IACH,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEtE;;;;OAIG;IACH,sBAAsB,CAAC,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7E;;;;OAIG;IACH,uBAAuB,CAAC,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE9E;;;;OAIG;IACH,2BAA2B,CAAC,CAC1B,QAAQ,EAAE,eAAe,GACxB,wBAAwB,GAAG,IAAI,CAAC;IAEnC;;;;OAIG;IACH,0BAA0B,CAAC,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,EAAE,CAAC;IAEjE;;;;;;;OAOG;IACH,YAAY,CACV,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GACjC,OAAO,CAAC,IAAI,GAAG,uBAAuB,CAAC,CAAC;IAE3C;;;;;;OAMG;IACH,gBAAgB,CAAC,CACf,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,2EAA2E;QAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,GACA,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;;OASG;IACH,yBAAyB,CAAC,CACxB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE9C,2EAA2E;IAC3E,gBAAgB,CAAC,CACf,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,iBAAiB,CAAC,CAChB,QAAQ,EAAE,eAAe,EACzB,GAAG,EAAE,sBAAsB,GAC1B,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAEvC;;;OAGG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;OAQG;IACH,mBAAmB,CACjB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,eAAe,CAAC;IAEnB,0EAA0E;IAC1E,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACzD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,2BAA2B,GAC5C,IAAI,CAIN;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;IACrC,qGAAqG;IACrG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,8BAA8B,EAAE,WAAW,CAAC,CAAC;IAC7E,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,MAAM,CAAC,EACH,OAAO,0BAA0B,EAAE,WAAW,GAC9C,MAAM,GACN;QACE,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;IACN;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,CACxB,QAAQ,EAAE,eAAe,KACtB,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxE;;;;;OAKG;IACH,8BAA8B,CAAC,EAAE,OAAO,CAAC;IACzC;;;OAGG;IACH,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,eAAe,KACrB,OAAO,CACR;QACE,OAAO,EAAE,IAAI,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACD;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CACrB,CAAC;CACH;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B"}

package/dist/integrations/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/integrations/types.ts"],"names":[],"mappings":"AAqOA,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAIhD,QAAQ;IACR,UAAU;IAJZ,IAAI,GAAG,iCAAiC,CAAC;IAElD,YACW,QAAgB,EAChB,UAA6C;QAEtD,KAAK,CAAC,YAAY,QAAQ,qBAAqB,UAAU,EAAE,CAAC,CAAC;wBAHpD,QAAQ;0BACR,UAAU;QAGnB,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AAkKD,MAAM,UAAU,wBAAwB,CACtC,OAAwB,EACxB,UAA6C;IAE7C,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,kCAAkC,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\n\nimport type { AgentChatEvent } from \"../agent/types.js\";\nimport type { EnvKeyConfig } from \"../server/create-server.js\";\n\nexport type IntegrationConversationType =\n  | \"channel\"\n  | \"private_channel\"\n  | \"dm\"\n  | \"group_dm\"\n  | \"unknown\";\n\nexport type IntegrationTriggerKind = \"mention\" | \"dm\" | \"thread_reply\";\n\nexport interface IntegrationActorTrust {\n  memberType: \"owner\" | \"admin\" | \"member\" | \"guest\" | \"external\" | \"unknown\";\n  verified: boolean;\n}\n\nexport interface IntegrationContextMessage {\n  senderId?: string;\n  senderName?: string;\n  text: string;\n  timestamp: number;\n  sourceUrl?: string;\n  reactions?: Array<{ name: string; count: number }>;\n  files?: IntegrationFileReference[];\n}\n\nexport interface IntegrationFileReference {\n  id: string;\n  name?: string;\n  mimetype?: string;\n  size?: number;\n  permalink?: string;\n  downloadUrl?: string;\n}\n\n/**\n * Normalized incoming message from any messaging platform.\n */\nexport interface IncomingMessage {\n  /** Platform identifier (e.g., \"slack\", \"telegram\", \"whatsapp\") */\n  platform: string;\n  /** Platform-specific thread/conversation identifier */\n  externalThreadId: string;\n  /** Message text content */\n  text: string;\n  /** Display name of the sender */\n  senderName?: string;\n  /** Verified sender email, when the platform can provide one */\n  senderEmail?: string;\n  /** Platform-specific sender ID */\n  senderId?: string;\n  /** How this message intentionally invoked an agent. */\n  triggerKind?: IntegrationTriggerKind;\n  /** Normalized provider conversation type for policy evaluation. */\n  conversationType?: IntegrationConversationType;\n  /** Provider tenant/workspace identifier. */\n  tenantId?: string;\n  /** Authorized integration scope resolved before execution. */\n  integrationScopeId?: string;\n  /** Normalized actor trust; unknown/unverified callers fail closed. */\n  actorTrust?: IntegrationActorTrust;\n  /** Bounded provider-native conversation context hydrated at run time. */\n  contextMessages?: IntegrationContextMessage[];\n  /** Provider file references only. Raw file bodies never belong here. */\n  files?: IntegrationFileReference[];\n  /** Server-verified approval grants carried by an interaction continuation. */\n  approvedToolCalls?: string[];\n  /**\n   * Whether the platform cryptographically authenticated that the message\n   * genuinely came from the claimed sender (e.g. inbound email that passed\n   * DKIM, or an aligned SPF pass, for the From domain). Defaults to\n   * undefined/false for platforms that don't provide sender authentication.\n   *\n   * Owner-resolution paths that grant a real user's identity/credentials\n   * MUST treat a missing/false value as \"unverified\" and fail closed —\n   * never derive a privileged acting identity from an unverified sender.\n   */\n  senderVerified?: boolean;\n  /** Raw platform-specific context needed for routing responses */\n  platformContext: Record<string, unknown>;\n  /**\n   * Short-lived delivery context needed only while the queued task is active.\n   * Secrets such as Discord interaction tokens belong here, never in\n   * `platformContext`, thread mappings, logs, or agent-visible context.\n   */\n  responseContext?: Record<string, unknown>;\n  /** Provider-native thread/topic reference, when one exists. */\n  threadRef?: string;\n  /**\n   * Canonical provider URL for the originating message thread, when the\n   * provider can resolve one. This is safe agent-visible provenance (not a\n   * credential) and should be preserved across A2A delegation so created\n   * artifacts can link back to their request source.\n   */\n  sourceUrl?: string;\n  /**\n   * Trusted app-side routing guidance added after provider parsing. Adapters\n   * should not copy this from user-controlled webhook payload fields.\n   */\n  routingHint?: {\n    targetAgent?: string;\n    instruction: string;\n  };\n  /**\n   * Trusted app-side note about the caller's identity/visibility tier, set\n   * after execution-context resolution (e.g. an anonymous org-scoped Slack\n   * member). Surfaced to the agent as integration context. Adapters must not\n   * copy this from user-controlled webhook payload fields.\n   */\n  identityNote?: string;\n  /** Provider-native message/activity reference for contextual replies. */\n  replyRef?: string;\n  /** Message timestamp (epoch ms) */\n  timestamp: number;\n}\n\n/**\n * Outgoing message to send back to a messaging platform.\n */\nexport interface OutgoingMessage {\n  /** Text content of the response */\n  text: string;\n  /** Platform-specific payload (e.g., Slack blocks, Telegram parse_mode) */\n  platformContext: Record<string, unknown>;\n}\n\n/** Provider-confirmed references for a successfully delivered response. */\nexport interface PlatformDeliveryReceipt {\n  status: \"delivered\";\n  /** Opaque provider message ids/timestamps; never message content. */\n  messageRefs?: string[];\n}\n\n/**\n * Proactive outbound message target for a platform.\n * Used when the agent needs to send to a saved destination instead of replying\n * to the current inbound thread.\n */\nexport interface OutboundTarget {\n  /** Canonical platform-specific destination id (channel, chat, thread, etc.) */\n  destination: string;\n  /** Optional thread reference when the destination supports threading */\n  threadRef?: string | null;\n  /** Optional fallback display label */\n  label?: string;\n  /** Provider tenant/workspace used to select an installation credential. */\n  tenantId?: string;\n  /** Managed installation id when the caller already resolved it. */\n  installationId?: string;\n}\n\n/**\n * Connection status for a platform integration.\n */\nexport interface IntegrationStatus {\n  platform: string;\n  /** Human-readable label (e.g., \"Slack\", \"Telegram\") */\n  label: string;\n  /** Whether the integration is explicitly enabled */\n  enabled: boolean;\n  /** Whether all required credentials are configured */\n  configured: boolean;\n  /** Platform-specific details (workspace name, bot username, etc.) */\n  details?: Record<string, unknown>;\n  /** Error message if something is wrong */\n  error?: string;\n  /** The webhook URL that should be configured in the platform */\n  webhookUrl?: string;\n  /** The full list of env keys (required + optional) the adapter recognizes,\n   *  including UI hints. Surfaced on the integrations status endpoint so the\n   *  frontend can render fields without hard-coding them per platform. */\n  requiredEnvKeys?: import(\"../server/create-server.js\").EnvKeyConfig[];\n}\n\nexport interface PlatformAdapterCapabilities {\n  /** The adapter can deliver a response to the current inbound event. */\n  replyText: boolean;\n  /** The adapter can send without an active inbound event. */\n  proactiveMessages: boolean;\n  /** The adapter preserves a provider-native thread or topic reference. */\n  nativeThreads: boolean;\n  /** The adapter can quote/reply to a specific inbound message. */\n  contextualReplies: boolean;\n  /** The provider requires an immediate deferred webhook acknowledgement. */\n  deferredWebhookResponse: boolean;\n  /** The adapter only receives explicit interactions, not ordinary messages. */\n  interactionOnly?: boolean;\n  /** The adapter can hydrate bounded native thread/file/reaction context. */\n  nativeContextHydration?: boolean;\n  /** The adapter can surface live agent progress in the provider UI. */\n  liveRunProgress?: boolean;\n}\n\nexport interface PlatformRunProgress {\n  /**\n   * Opaque, provider-owned reference for resuming this progress surface from a\n   * durable continuation. It deliberately contains no user content,\n   * credentials, or provider payload.\n   */\n  ref?: PlatformRunProgressRef;\n  /** Receive normalized agent events. Implementations should throttle writes. */\n  onEvent(event: AgentChatEvent): Promise<void> | void;\n  /** Finalize the provider-native progress surface with the answer. */\n  complete(message: OutgoingMessage): Promise<void | PlatformDeliveryReceipt>;\n  /** Mark the provider-native surface failed and leave a retryable explanation. */\n  fail?(message: string): Promise<void>;\n}\n\n/**\n * Safe, minimal reference to a provider-native run-progress surface.\n *\n * The field values are opaque to the framework. Adapters may use `kind` to\n * distinguish their own resume strategy and `streamTs` to identify the\n * provider-side stream. No incoming message text, platform payload, or\n * credential belongs here.\n */\nexport interface PlatformRunProgressRef {\n  kind: string;\n  streamTs: string;\n}\n\nexport interface ImmediateWebhookResponse {\n  status: number;\n  body: unknown;\n}\n\nexport class UnsupportedPlatformCapabilityError extends Error {\n  readonly code = \"UNSUPPORTED_PLATFORM_CAPABILITY\";\n\n  constructor(\n    readonly platform: string,\n    readonly capability: keyof PlatformAdapterCapabilities,\n  ) {\n    super(`Platform ${platform} does not support ${capability}`);\n    this.name = \"UnsupportedPlatformCapabilityError\";\n  }\n}\n\n/**\n * Platform adapter interface — implement this for each messaging platform.\n *\n * Each adapter handles the platform-specific concerns:\n * - Webhook verification (HMAC signatures, challenge responses)\n * - Message parsing (platform events → normalized IncomingMessage)\n * - Response formatting (agent text → platform-specific format)\n * - Response delivery (POST back to platform API)\n */\nexport interface PlatformAdapter {\n  /** Unique platform identifier */\n  readonly platform: string;\n  /** Human-readable label */\n  readonly label: string;\n  /** Explicit runtime behavior. Missing fields are treated as unsupported. */\n  readonly capabilities?: Partial<PlatformAdapterCapabilities>;\n\n  /** Env keys this adapter needs (tokens, secrets, etc.) */\n  getRequiredEnvKeys(): EnvKeyConfig[];\n\n  /**\n   * Handle platform-specific verification challenges.\n   * For example, Slack sends a `url_verification` event when setting up.\n   * Return `{ handled: true, response }` to short-circuit the webhook handler.\n   */\n  handleVerification(event: H3Event): Promise<{\n    handled: boolean;\n    response?: unknown;\n  }>;\n\n  /**\n   * Validate the webhook request signature.\n   * Returns true if the request is authentic.\n   */\n  verifyWebhook(event: H3Event): Promise<boolean>;\n\n  /**\n   * Parse the webhook payload into a normalized IncomingMessage.\n   * Return null to silently ignore the event (bot messages, edits, etc.).\n   */\n  parseIncomingMessage(event: H3Event): Promise<IncomingMessage | null>;\n\n  /**\n   * Hydrate bounded provider-native context after durable enqueue, outside the\n   * provider acknowledgement budget. Implementations must return references,\n   * metadata, and text only — never persist file bodies or credentials.\n   */\n  hydrateIncomingMessage?(incoming: IncomingMessage): Promise<IncomingMessage>;\n\n  /**\n   * Hydrate only verified sender identity before execution-context selection.\n   * This runs on the provider acknowledgement path and must avoid fetching\n   * conversation history or file bodies.\n   */\n  hydrateIncomingIdentity?(incoming: IncomingMessage): Promise<IncomingMessage>;\n\n  /**\n   * Provider-specific response returned only after a message is verified and\n   * durably enqueued. Discord uses this to return a type-5 deferred response\n   * within its three-second interaction deadline.\n   */\n  getImmediateWebhookResponse?(\n    incoming: IncomingMessage,\n  ): ImmediateWebhookResponse | null;\n\n  /**\n   * Return pre-canonical thread ids used by older adapter versions. The\n   * integration handler checks these only when the canonical mapping is\n   * missing, then aliases a match to the canonical id without forking history.\n   */\n  getLegacyExternalThreadIds?(incoming: IncomingMessage): string[];\n\n  /**\n   * Send the agent's response back to the messaging platform.\n   *\n   * If `opts.placeholderRef` is provided (returned earlier by\n   * `postProcessingPlaceholder`), adapters that support in-place edits should\n   * update that placeholder message rather than posting a new one. Adapters\n   * without an \"update message\" API can ignore the ref and post fresh.\n   */\n  sendResponse(\n    message: OutgoingMessage,\n    context: IncomingMessage,\n    opts?: { placeholderRef?: string },\n  ): Promise<void | PlatformDeliveryReceipt>;\n\n  /**\n   * Send a short best-effort system notice to the conversation the incoming\n   * message arrived on (polite identity declines, one-time access guidance).\n   * Bypasses agent formatting. When `dedupeKey` is provided, the adapter may\n   * drop the notice if the same key was sent recently. Callers must treat\n   * failures as non-fatal.\n   */\n  sendSystemNotice?(\n    incoming: IncomingMessage,\n    text: string,\n    opts?: {\n      dedupeKey?: string;\n      /** Dedupe window for `dedupeKey`. Adapters pick a default when omitted. */\n      dedupeTtlMs?: number;\n    },\n  ): Promise<void>;\n\n  /**\n   * Optionally post a \"working on it…\" placeholder message immediately when a\n   * webhook arrives, before the agent loop runs. Adapters that support\n   * in-place message edits (Slack via `chat.update`, etc.) return an opaque\n   * `placeholderRef` that the webhook flow threads through to `sendResponse`\n   * so the same message is updated with the final answer once ready.\n   *\n   * Adapters without edit support should leave this undefined; the webhook\n   * handler will skip the placeholder step entirely.\n   */\n  postProcessingPlaceholder?(\n    incoming: IncomingMessage,\n  ): Promise<{ placeholderRef: string } | null>;\n\n  /** Start a provider-native progress/streaming surface for an agent run. */\n  startRunProgress?(\n    incoming: IncomingMessage,\n  ): Promise<PlatformRunProgress | null>;\n\n  /**\n   * Reattach a durable continuation to a provider-native progress surface\n   * previously started by this adapter. Adapters that cannot resume a native\n   * surface should omit this and the continuation will use its normal reply\n   * path instead.\n   */\n  resumeRunProgress?(\n    incoming: IncomingMessage,\n    ref: PlatformRunProgressRef,\n  ): Promise<PlatformRunProgress | null>;\n\n  /**\n   * Send a proactive outbound message to a platform destination. Adapters that\n   * only support direct replies can omit this.\n   */\n  sendMessageToTarget?(\n    message: OutgoingMessage,\n    target: OutboundTarget,\n  ): Promise<void>;\n\n  /**\n   * Format plain agent response text into a platform-appropriate message.\n   * Handles markdown conversion, message splitting for length limits, etc.\n   *\n   * `opts.threadDeepLinkUrl`, when present, is a URL back to the originating\n   * thread in the dispatch UI. Adapters that support rich blocks should\n   * render this as a button (Slack); adapters that don't may inline it as a\n   * link or simply omit it.\n   */\n  formatAgentResponse(\n    text: string,\n    opts?: { threadDeepLinkUrl?: string },\n  ): OutgoingMessage;\n\n  /** Return current connection/configuration status for the settings UI. */\n  getStatus(baseUrl?: string): Promise<IntegrationStatus>;\n}\n\nexport function assertPlatformCapability(\n  adapter: PlatformAdapter,\n  capability: keyof PlatformAdapterCapabilities,\n): void {\n  if (adapter.capabilities?.[capability] !== true) {\n    throw new UnsupportedPlatformCapabilityError(adapter.platform, capability);\n  }\n}\n\n/**\n * Options for the integrations plugin.\n */\nexport interface IntegrationsPluginOptions {\n  /** App identifier used by call-agent to prevent self-calls (e.g. \"dispatch\"). */\n  appId?: string;\n  /** Platform adapters to enable. Default: all built-in adapters with configured env keys. */\n  adapters?: PlatformAdapter[];\n  /** System prompt for the agent (same as agent-chat). Inherited from agent-chat plugin if not set. */\n  systemPrompt?: string;\n  /** Actions registry (same as agent-chat). */\n  actions?: Record<string, import(\"../agent/production-agent.js\").ActionEntry>;\n  /** Model to use. Defaults to the resolved engine's default model. */\n  model?: string;\n  /** Anthropic API key. Falls back to ANTHROPIC_API_KEY env var. */\n  apiKey?: string;\n  /** Agent engine to use. Defaults to the same engine resolver as web chat. */\n  engine?:\n    | import(\"../agent/engine/types.js\").AgentEngine\n    | string\n    | {\n        name: string;\n        config: Record<string, unknown>;\n      };\n  /**\n   * Resolve which owner should receive personal resource context and own the\n   * created chat thread for an incoming platform message.\n   */\n  resolveOwner?: (incoming: IncomingMessage) => string | Promise<string>;\n  /**\n   * Resolve the durable execution principal for an inbound provider message.\n   * Shared channels should use a service principal; DMs may use a verified\n   * linked user. When present this supersedes `resolveOwner`.\n   */\n  resolveExecutionContext?: (\n    incoming: IncomingMessage,\n  ) => IntegrationExecutionContext | Promise<IntegrationExecutionContext>;\n  /**\n   * Explicitly allow an unlinked, verified Slack workspace member to run a DM\n   * with the installation organization's shared/service visibility. Disabled\n   * by default: DM identity resolution fails closed unless an app deliberately\n   * accepts this wider access tier.\n   */\n  allowAnonymousOrgScopedSlackDm?: boolean;\n  /**\n   * Optional preprocessor for inbound platform messages. Can intercept special\n   * commands (such as `/link`) before the agent loop runs.\n   */\n  beforeProcess?: (\n    incoming: IncomingMessage,\n    adapter: PlatformAdapter,\n  ) => Promise<\n    | {\n        handled: true;\n        responseText?: string;\n      }\n    | { handled: false }\n  >;\n}\n\nexport interface IntegrationExecutionContext {\n  ownerEmail: string;\n  orgId: string | null;\n  principalType: \"user\" | \"service\";\n  installationId?: string;\n  scopeId?: string;\n  /**\n   * True when a hydrated full workspace member could not be matched to an\n   * organization member and runs with the anonymous org-scoped service\n   * principal (org-wide visibility only, nothing user-private).\n   */\n  anonymousMember?: boolean;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/integrations/types.ts"],"names":[],"mappings":"AAqOA,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAIhD,QAAQ;IACR,UAAU;IAJZ,IAAI,GAAG,iCAAiC,CAAC;IAElD,YACW,QAAgB,EAChB,UAA6C;QAEtD,KAAK,CAAC,YAAY,QAAQ,qBAAqB,UAAU,EAAE,CAAC,CAAC;wBAHpD,QAAQ;0BACR,UAAU;QAGnB,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IACnD,CAAC;CACF;AAkKD,MAAM,UAAU,wBAAwB,CACtC,OAAwB,EACxB,UAA6C;IAE7C,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,IAAI,kCAAkC,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC","sourcesContent":["import type { H3Event } from \"h3\";\n\nimport type { AgentChatEvent } from \"../agent/types.js\";\nimport type { EnvKeyConfig } from \"../server/create-server.js\";\n\nexport type IntegrationConversationType =\n  | \"channel\"\n  | \"private_channel\"\n  | \"dm\"\n  | \"group_dm\"\n  | \"unknown\";\n\nexport type IntegrationTriggerKind = \"mention\" | \"dm\" | \"thread_reply\";\n\nexport interface IntegrationActorTrust {\n  memberType: \"owner\" | \"admin\" | \"member\" | \"guest\" | \"external\" | \"unknown\";\n  verified: boolean;\n}\n\nexport interface IntegrationContextMessage {\n  senderId?: string;\n  senderName?: string;\n  text: string;\n  timestamp: number;\n  sourceUrl?: string;\n  reactions?: Array<{ name: string; count: number }>;\n  files?: IntegrationFileReference[];\n}\n\nexport interface IntegrationFileReference {\n  id: string;\n  name?: string;\n  mimetype?: string;\n  size?: number;\n  permalink?: string;\n  downloadUrl?: string;\n}\n\n/**\n * Normalized incoming message from any messaging platform.\n */\nexport interface IncomingMessage {\n  /** Platform identifier (e.g., \"slack\", \"telegram\", \"whatsapp\") */\n  platform: string;\n  /** Platform-specific thread/conversation identifier */\n  externalThreadId: string;\n  /** Message text content */\n  text: string;\n  /** Display name of the sender */\n  senderName?: string;\n  /** Verified sender email, when the platform can provide one */\n  senderEmail?: string;\n  /** Platform-specific sender ID */\n  senderId?: string;\n  /** How this message intentionally invoked an agent. */\n  triggerKind?: IntegrationTriggerKind;\n  /** Normalized provider conversation type for policy evaluation. */\n  conversationType?: IntegrationConversationType;\n  /** Provider tenant/workspace identifier. */\n  tenantId?: string;\n  /** Authorized integration scope resolved before execution. */\n  integrationScopeId?: string;\n  /** Normalized actor trust; unknown/unverified callers fail closed. */\n  actorTrust?: IntegrationActorTrust;\n  /** Bounded provider-native conversation context hydrated at run time. */\n  contextMessages?: IntegrationContextMessage[];\n  /** Provider file references only. Raw file bodies never belong here. */\n  files?: IntegrationFileReference[];\n  /** Server-verified approval grants carried by an interaction continuation. */\n  approvedToolCalls?: string[];\n  /**\n   * Whether the platform cryptographically authenticated that the message\n   * genuinely came from the claimed sender (e.g. inbound email that passed\n   * DKIM, or an aligned SPF pass, for the From domain). Defaults to\n   * undefined/false for platforms that don't provide sender authentication.\n   *\n   * Owner-resolution paths that grant a real user's identity/credentials\n   * MUST treat a missing/false value as \"unverified\" and fail closed —\n   * never derive a privileged acting identity from an unverified sender.\n   */\n  senderVerified?: boolean;\n  /** Raw platform-specific context needed for routing responses */\n  platformContext: Record<string, unknown>;\n  /**\n   * Short-lived delivery context needed only while the queued task is active.\n   * Secrets such as Discord interaction tokens belong here, never in\n   * `platformContext`, thread mappings, logs, or agent-visible context.\n   */\n  responseContext?: Record<string, unknown>;\n  /** Provider-native thread/topic reference, when one exists. */\n  threadRef?: string;\n  /**\n   * Canonical provider URL for the originating message thread, when the\n   * provider can resolve one. This is safe agent-visible provenance (not a\n   * credential) and should be preserved across A2A delegation so created\n   * artifacts can link back to their request source.\n   */\n  sourceUrl?: string;\n  /**\n   * Trusted app-side routing guidance added after provider parsing. Adapters\n   * should not copy this from user-controlled webhook payload fields.\n   */\n  routingHint?: {\n    targetAgent?: string;\n    instruction: string;\n  };\n  /**\n   * Trusted app-side note about the caller's identity/visibility tier, set\n   * after execution-context resolution (e.g. an anonymous org-scoped Slack\n   * member). Surfaced to the agent as integration context. Adapters must not\n   * copy this from user-controlled webhook payload fields.\n   */\n  identityNote?: string;\n  /** Provider-native message/activity reference for contextual replies. */\n  replyRef?: string;\n  /** Message timestamp (epoch ms) */\n  timestamp: number;\n}\n\n/**\n * Outgoing message to send back to a messaging platform.\n */\nexport interface OutgoingMessage {\n  /** Text content of the response */\n  text: string;\n  /** Platform-specific payload (e.g., Slack blocks, Telegram parse_mode) */\n  platformContext: Record<string, unknown>;\n}\n\n/** Provider-confirmed references for a successfully delivered response. */\nexport interface PlatformDeliveryReceipt {\n  status: \"delivered\";\n  /** Opaque provider message ids/timestamps; never message content. */\n  messageRefs?: string[];\n}\n\n/**\n * Proactive outbound message target for a platform.\n * Used when the agent needs to send to a saved destination instead of replying\n * to the current inbound thread.\n */\nexport interface OutboundTarget {\n  /** Canonical platform-specific destination id (channel, chat, thread, etc.) */\n  destination: string;\n  /** Optional thread reference when the destination supports threading */\n  threadRef?: string | null;\n  /** Optional fallback display label */\n  label?: string;\n  /** Provider tenant/workspace used to select an installation credential. */\n  tenantId?: string;\n  /** Managed installation id when the caller already resolved it. */\n  installationId?: string;\n}\n\n/**\n * Connection status for a platform integration.\n */\nexport interface IntegrationStatus {\n  platform: string;\n  /** Human-readable label (e.g., \"Slack\", \"Telegram\") */\n  label: string;\n  /** Whether the integration is explicitly enabled */\n  enabled: boolean;\n  /** Whether all required credentials are configured */\n  configured: boolean;\n  /** Platform-specific details (workspace name, bot username, etc.) */\n  details?: Record<string, unknown>;\n  /** Error message if something is wrong */\n  error?: string;\n  /** The webhook URL that should be configured in the platform */\n  webhookUrl?: string;\n  /** The full list of env keys (required + optional) the adapter recognizes,\n   *  including UI hints. Surfaced on the integrations status endpoint so the\n   *  frontend can render fields without hard-coding them per platform. */\n  requiredEnvKeys?: import(\"../server/create-server.js\").EnvKeyConfig[];\n}\n\nexport interface PlatformAdapterCapabilities {\n  /** The adapter can deliver a response to the current inbound event. */\n  replyText: boolean;\n  /** The adapter can send without an active inbound event. */\n  proactiveMessages: boolean;\n  /** The adapter preserves a provider-native thread or topic reference. */\n  nativeThreads: boolean;\n  /** The adapter can quote/reply to a specific inbound message. */\n  contextualReplies: boolean;\n  /** The provider requires an immediate deferred webhook acknowledgement. */\n  deferredWebhookResponse: boolean;\n  /** The adapter only receives explicit interactions, not ordinary messages. */\n  interactionOnly?: boolean;\n  /** The adapter can hydrate bounded native thread/file/reaction context. */\n  nativeContextHydration?: boolean;\n  /** The adapter can surface live agent progress in the provider UI. */\n  liveRunProgress?: boolean;\n}\n\nexport interface PlatformRunProgress {\n  /**\n   * Opaque, provider-owned reference for resuming this progress surface from a\n   * durable continuation. It deliberately contains no user content,\n   * credentials, or provider payload.\n   */\n  ref?: PlatformRunProgressRef;\n  /** Receive normalized agent events. Implementations should throttle writes. */\n  onEvent(event: AgentChatEvent): Promise<void> | void;\n  /** Finalize the provider-native progress surface with the answer. */\n  complete(message: OutgoingMessage): Promise<void | PlatformDeliveryReceipt>;\n  /** Mark the provider-native surface failed and leave a retryable explanation. */\n  fail?(message: string): Promise<void>;\n}\n\n/**\n * Safe, minimal reference to a provider-native run-progress surface.\n *\n * The field values are opaque to the framework. Adapters may use `kind` to\n * distinguish their own resume strategy and `streamTs` to identify the\n * provider-side stream. No incoming message text, platform payload, or\n * credential belongs here.\n */\nexport interface PlatformRunProgressRef {\n  kind: string;\n  streamTs: string;\n}\n\nexport interface ImmediateWebhookResponse {\n  status: number;\n  body: unknown;\n}\n\nexport class UnsupportedPlatformCapabilityError extends Error {\n  readonly code = \"UNSUPPORTED_PLATFORM_CAPABILITY\";\n\n  constructor(\n    readonly platform: string,\n    readonly capability: keyof PlatformAdapterCapabilities,\n  ) {\n    super(`Platform ${platform} does not support ${capability}`);\n    this.name = \"UnsupportedPlatformCapabilityError\";\n  }\n}\n\n/**\n * Platform adapter interface — implement this for each messaging platform.\n *\n * Each adapter handles the platform-specific concerns:\n * - Webhook verification (HMAC signatures, challenge responses)\n * - Message parsing (platform events → normalized IncomingMessage)\n * - Response formatting (agent text → platform-specific format)\n * - Response delivery (POST back to platform API)\n */\nexport interface PlatformAdapter {\n  /** Unique platform identifier */\n  readonly platform: string;\n  /** Human-readable label */\n  readonly label: string;\n  /** Explicit runtime behavior. Missing fields are treated as unsupported. */\n  readonly capabilities?: Partial<PlatformAdapterCapabilities>;\n\n  /** Env keys this adapter needs (tokens, secrets, etc.) */\n  getRequiredEnvKeys(): EnvKeyConfig[];\n\n  /**\n   * Handle platform-specific verification challenges.\n   * For example, Slack sends a `url_verification` event when setting up.\n   * Return `{ handled: true, response }` to short-circuit the webhook handler.\n   */\n  handleVerification(event: H3Event): Promise<{\n    handled: boolean;\n    response?: unknown;\n  }>;\n\n  /**\n   * Validate the webhook request signature.\n   * Returns true if the request is authentic.\n   */\n  verifyWebhook(event: H3Event): Promise<boolean>;\n\n  /**\n   * Parse the webhook payload into a normalized IncomingMessage.\n   * Return null to silently ignore the event (bot messages, edits, etc.).\n   */\n  parseIncomingMessage(event: H3Event): Promise<IncomingMessage | null>;\n\n  /**\n   * Hydrate bounded provider-native context after durable enqueue, outside the\n   * provider acknowledgement budget. Implementations must return references,\n   * metadata, and text only — never persist file bodies or credentials.\n   */\n  hydrateIncomingMessage?(incoming: IncomingMessage): Promise<IncomingMessage>;\n\n  /**\n   * Hydrate only verified sender identity before execution-context selection.\n   * This runs on the provider acknowledgement path and must avoid fetching\n   * conversation history or file bodies.\n   */\n  hydrateIncomingIdentity?(incoming: IncomingMessage): Promise<IncomingMessage>;\n\n  /**\n   * Provider-specific response returned only after a message is verified and\n   * durably enqueued. Discord uses this to return a type-5 deferred response\n   * within its three-second interaction deadline.\n   */\n  getImmediateWebhookResponse?(\n    incoming: IncomingMessage,\n  ): ImmediateWebhookResponse | null;\n\n  /**\n   * Return pre-canonical thread ids used by older adapter versions. The\n   * integration handler checks these only when the canonical mapping is\n   * missing, then aliases a match to the canonical id without forking history.\n   */\n  getLegacyExternalThreadIds?(incoming: IncomingMessage): string[];\n\n  /**\n   * Send the agent's response back to the messaging platform.\n   *\n   * If `opts.placeholderRef` is provided (returned earlier by\n   * `postProcessingPlaceholder`), adapters that support in-place edits should\n   * update that placeholder message rather than posting a new one. Adapters\n   * without an \"update message\" API can ignore the ref and post fresh.\n   */\n  sendResponse(\n    message: OutgoingMessage,\n    context: IncomingMessage,\n    opts?: { placeholderRef?: string },\n  ): Promise<void | PlatformDeliveryReceipt>;\n\n  /**\n   * Send a short best-effort system notice to the conversation the incoming\n   * message arrived on (polite identity declines, one-time access guidance).\n   * Bypasses agent formatting. When `dedupeKey` is provided, the adapter may\n   * drop the notice if the same key was sent recently. Callers must treat\n   * failures as non-fatal.\n   */\n  sendSystemNotice?(\n    incoming: IncomingMessage,\n    text: string,\n    opts?: {\n      dedupeKey?: string;\n      /** Dedupe window for `dedupeKey`. Adapters pick a default when omitted. */\n      dedupeTtlMs?: number;\n    },\n  ): Promise<void>;\n\n  /**\n   * Optionally post a \"working on it…\" placeholder message immediately when a\n   * webhook arrives, before the agent loop runs. Adapters that support\n   * in-place message edits (Slack via `chat.update`, etc.) return an opaque\n   * `placeholderRef` that the webhook flow threads through to `sendResponse`\n   * so the same message is updated with the final answer once ready.\n   *\n   * Adapters without edit support should leave this undefined; the webhook\n   * handler will skip the placeholder step entirely.\n   */\n  postProcessingPlaceholder?(\n    incoming: IncomingMessage,\n  ): Promise<{ placeholderRef: string } | null>;\n\n  /** Start a provider-native progress/streaming surface for an agent run. */\n  startRunProgress?(\n    incoming: IncomingMessage,\n  ): Promise<PlatformRunProgress | null>;\n\n  /**\n   * Reattach a durable continuation to a provider-native progress surface\n   * previously started by this adapter. Adapters that cannot resume a native\n   * surface should omit this and the continuation will use its normal reply\n   * path instead.\n   */\n  resumeRunProgress?(\n    incoming: IncomingMessage,\n    ref: PlatformRunProgressRef,\n  ): Promise<PlatformRunProgress | null>;\n\n  /**\n   * Send a proactive outbound message to a platform destination. Adapters that\n   * only support direct replies can omit this.\n   */\n  sendMessageToTarget?(\n    message: OutgoingMessage,\n    target: OutboundTarget,\n  ): Promise<void>;\n\n  /**\n   * Format plain agent response text into a platform-appropriate message.\n   * Handles markdown conversion, message splitting for length limits, etc.\n   *\n   * `opts.threadDeepLinkUrl`, when present, is a URL back to the originating\n   * thread in the dispatch UI. Adapters that support rich blocks should\n   * render this as a button (Slack); adapters that don't may inline it as a\n   * link or simply omit it.\n   */\n  formatAgentResponse(\n    text: string,\n    opts?: { threadDeepLinkUrl?: string },\n  ): OutgoingMessage;\n\n  /** Return current connection/configuration status for the settings UI. */\n  getStatus(baseUrl?: string): Promise<IntegrationStatus>;\n}\n\nexport function assertPlatformCapability(\n  adapter: PlatformAdapter,\n  capability: keyof PlatformAdapterCapabilities,\n): void {\n  if (adapter.capabilities?.[capability] !== true) {\n    throw new UnsupportedPlatformCapabilityError(adapter.platform, capability);\n  }\n}\n\n/**\n * Options for the integrations plugin.\n */\nexport interface IntegrationsPluginOptions {\n  /** App identifier used by call-agent to prevent self-calls (e.g. \"dispatch\"). */\n  appId?: string;\n  /** Full adapter set to enable. Default: all built-in adapters. */\n  adapters?: PlatformAdapter[];\n  /** Replace built-in adapters by platform without removing the other defaults. */\n  adapterOverrides?: PlatformAdapter[];\n  /** System prompt for the agent (same as agent-chat). Inherited from agent-chat plugin if not set. */\n  systemPrompt?: string;\n  /** Actions registry (same as agent-chat). */\n  actions?: Record<string, import(\"../agent/production-agent.js\").ActionEntry>;\n  /** Model to use. Defaults to the resolved engine's default model. */\n  model?: string;\n  /** Anthropic API key. Falls back to ANTHROPIC_API_KEY env var. */\n  apiKey?: string;\n  /** Agent engine to use. Defaults to the same engine resolver as web chat. */\n  engine?:\n    | import(\"../agent/engine/types.js\").AgentEngine\n    | string\n    | {\n        name: string;\n        config: Record<string, unknown>;\n      };\n  /**\n   * Resolve which owner should receive personal resource context and own the\n   * created chat thread for an incoming platform message.\n   */\n  resolveOwner?: (incoming: IncomingMessage) => string | Promise<string>;\n  /**\n   * Resolve the durable execution principal for an inbound provider message.\n   * Shared channels should use a service principal; DMs may use a verified\n   * linked user. When present this supersedes `resolveOwner`.\n   */\n  resolveExecutionContext?: (\n    incoming: IncomingMessage,\n  ) => IntegrationExecutionContext | Promise<IntegrationExecutionContext>;\n  /**\n   * Explicitly allow an unlinked, verified Slack workspace member to run a DM\n   * with the installation organization's shared/service visibility. Disabled\n   * by default: DM identity resolution fails closed unless an app deliberately\n   * accepts this wider access tier.\n   */\n  allowAnonymousOrgScopedSlackDm?: boolean;\n  /**\n   * Optional preprocessor for inbound platform messages. Can intercept special\n   * commands (such as `/link`) before the agent loop runs.\n   */\n  beforeProcess?: (\n    incoming: IncomingMessage,\n    adapter: PlatformAdapter,\n  ) => Promise<\n    | {\n        handled: true;\n        responseText?: string;\n      }\n    | { handled: false }\n  >;\n}\n\nexport interface IntegrationExecutionContext {\n  ownerEmail: string;\n  orgId: string | null;\n  principalType: \"user\" | \"service\";\n  installationId?: string;\n  scopeId?: string;\n  /**\n   * True when a hydrated full workspace member could not be matched to an\n   * organization member and runs with the anonymous org-scoped service\n   * principal (org-wide visibility only, nothing user-private).\n   */\n  anonymousMember?: boolean;\n}\n"]}

package/dist/integrations/webhook-delivery.d.ts

@@ -0,0 +1,23 @@
+export declare function escapeSlackMrkdwn(value: string): string;
+export declare function isWebhookUrlAllowed(url: string): boolean;
+export interface DeliverJsonWebhookOptions {
+    url: string;
+    payload: unknown;
+    headers?: Record<string, string>;
+    timeoutMs?: number;
+    maxRedirects?: number;
+}
+export type JsonWebhookDeliveryResult = {
+    ok: true;
+    status: number;
+} | {
+    ok: false;
+    blocked: true;
+} | {
+    ok: false;
+    blocked: false;
+    status?: number;
+    error?: unknown;
+};
+export declare function deliverJsonWebhook(options: DeliverJsonWebhookOptions): Promise<JsonWebhookDeliveryResult>;
+//# sourceMappingURL=webhook-delivery.d.ts.map

package/dist/integrations/webhook-delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-delivery.d.ts","sourceRoot":"","sources":["../../src/integrations/webhook-delivery.ts"],"names":[],"mappings":"AAKA,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKvD;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpE,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,yBAAyB,CAAC,CAuBpC"}

package/dist/integrations/webhook-delivery.js

@@ -0,0 +1,32 @@
+import { isBlockedExtensionUrl, ssrfSafeFetch, } from "../extensions/url-safety.js";
+export function escapeSlackMrkdwn(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;");
+}
+export function isWebhookUrlAllowed(url) {
+    return !isBlockedExtensionUrl(url);
+}
+export async function deliverJsonWebhook(options) {
+    if (!isWebhookUrlAllowed(options.url))
+        return { ok: false, blocked: true };
+    try {
+        const response = await ssrfSafeFetch(options.url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                ...options.headers,
+            },
+            body: JSON.stringify(options.payload),
+            signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),
+        }, { maxRedirects: options.maxRedirects ?? 3 });
+        return response.ok
+            ? { ok: true, status: response.status }
+            : { ok: false, blocked: false, status: response.status };
+    }
+    catch (error) {
+        return { ok: false, blocked: false, error };
+    }
+}
+//# sourceMappingURL=webhook-delivery.js.map

package/dist/integrations/webhook-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-delivery.js","sourceRoot":"","sources":["../../src/integrations/webhook-delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,aAAa,GACd,MAAM,6BAA6B,CAAC;AAErC,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAkC;IAElC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE3E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,OAAO,CAAC,GAAG,EACX;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,OAAO,CAAC,OAAO;aACnB;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;YACrC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;SACzD,EACD,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC,EAAE,CAC5C,CAAC;QACF,OAAO,QAAQ,CAAC,EAAE;YAChB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;YACvC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC","sourcesContent":["import {\n  isBlockedExtensionUrl,\n  ssrfSafeFetch,\n} from \"../extensions/url-safety.js\";\n\nexport function escapeSlackMrkdwn(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\");\n}\n\nexport function isWebhookUrlAllowed(url: string): boolean {\n  return !isBlockedExtensionUrl(url);\n}\n\nexport interface DeliverJsonWebhookOptions {\n  url: string;\n  payload: unknown;\n  headers?: Record<string, string>;\n  timeoutMs?: number;\n  maxRedirects?: number;\n}\n\nexport type JsonWebhookDeliveryResult =\n  | { ok: true; status: number }\n  | { ok: false; blocked: true }\n  | { ok: false; blocked: false; status?: number; error?: unknown };\n\nexport async function deliverJsonWebhook(\n  options: DeliverJsonWebhookOptions,\n): Promise<JsonWebhookDeliveryResult> {\n  if (!isWebhookUrlAllowed(options.url)) return { ok: false, blocked: true };\n\n  try {\n    const response = await ssrfSafeFetch(\n      options.url,\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\",\n          ...options.headers,\n        },\n        body: JSON.stringify(options.payload),\n        signal: AbortSignal.timeout(options.timeoutMs ?? 10_000),\n      },\n      { maxRedirects: options.maxRedirects ?? 3 },\n    );\n    return response.ok\n      ? { ok: true, status: response.status }\n      : { ok: false, blocked: false, status: response.status };\n  } catch (error) {\n    return { ok: false, blocked: false, error };\n  }\n}\n"]}

package/dist/notifications/channels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../../src/notifications/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAeH,wBAAgB,mCAAmC,IAAI,IAAI,CAa1D"}
+{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../../src/notifications/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAgBH,wBAAgB,mCAAmC,IAAI,IAAI,CAa1D"}

package/dist/notifications/channels.js

@@ -27,6 +27,7 @@
  *                              `metadata.emailRecipients`.
  */
 import { ssrfSafeFetch } from "../extensions/url-safety.js";
+import { escapeSlackMrkdwn } from "../integrations/webhook-delivery.js";
 import { getKeyAllowlist, getResolvedKeyAllowlist, resolveKeyReferencesWithRequestScopes, validateUrlAllowlist, } from "../secrets/substitution.js";
 import { sendEmail } from "../server/email.js";
 import { registerNotificationChannel } from "./registry.js";
@@ -95,7 +96,7 @@ function createSlackWebhookChannel(envUrlTemplate) {
                             type: "section",
                             text: {
                                 type: "mrkdwn",
-                                text: `*${escapeSlack(input.title)}*`,
+                                text: `*${escapeSlackMrkdwn(input.title)}*`,
                             },
                         },
                         ...(input.body
@@ -104,7 +105,7 @@ function createSlackWebhookChannel(envUrlTemplate) {
                                     type: "section",
                                     text: {
                                         type: "mrkdwn",
-                                        text: escapeSlack(input.body),
+                                        text: escapeSlackMrkdwn(input.body),
                                     },
                                 },
                             ]
@@ -114,7 +115,7 @@ function createSlackWebhookChannel(envUrlTemplate) {
                             elements: [
                                 {
                                     type: "mrkdwn",
-                                    text: `Severity: \`${input.severity}\`  Owner: ${escapeSlack(meta.owner)}`,
+                                    text: `Severity: \`${input.severity}\`  Owner: ${escapeSlackMrkdwn(meta.owner)}`,
                                 },
                             ],
                         },
@@ -261,12 +262,6 @@ function commaList(value) {
 function slackText(severity, title, body) {
     return `[${severity}] ${title}${body ? `\n${body}` : ""}`;
 }
-function escapeSlack(value) {
-    return value
-        .replace(/&/g, "&")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;");
-}
 function escapeHtml(value) {
     return value
         .replace(/&/g, "&amp;")

package/dist/notifications/channels.js.map

@@ -1 +1 @@
-{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../src/notifications/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,qCAAqC,EACrC,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAG5D,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,MAAM,UAAU,mCAAmC;IACjD,IAAI,WAAW;QAAE,OAAO;IACxB,WAAW,GAAG,IAAI,CAAC;IAEnB,2BAA2B,CACzB,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAC5D,CAAC;IACF,2BAA2B,CACzB,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CACvE,CAAC;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,2BAA2B,CAAC,kBAAkB,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,oBAAoB,CAC3B,cAAkC;IAElC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC5D,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;YACvB,MAAM,mBAAmB,GAAG,sBAAsB,CAChD,KAAK,CAAC,QAAQ,EACd,YAAY,CACb,CAAC;YACF,MAAM,WAAW,GACf,mBAAmB;gBACnB,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC;gBAC5C,cAAc,EAAE,IAAI,EAAE,CAAC;YACzB,mEAAmE;YACnE,uEAAuE;YACvE,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC/B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,MAAM,qBAAqB,CACpE,WAAW,EACX,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,EAC9C,IAAI,CAAC,KAAK,EACV,SAAS,CACV,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAC/C,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;aACH,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,CACtC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,GACnE,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EACnC,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,cAAkC;IAElC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IAClE,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;YACvB,MAAM,mBAAmB,GAAG,sBAAsB,CAChD,KAAK,CAAC,QAAQ,EACd,iBAAiB,CAClB,CAAC;YACF,MAAM,WAAW,GACf,mBAAmB;gBACnB,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACjD,cAAc,EAAE,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC/B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,MAAM,qBAAqB,CACpE,WAAW,EACX,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,EAC9C,IAAI,CAAC,KAAK,EACV,eAAe,CAChB,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC;oBACxD,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE;gCACJ,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;6BACtC;yBACF;wBACD,GAAG,CAAC,KAAK,CAAC,IAAI;4BACZ,CAAC,CAAC;gCACE;oCACE,IAAI,EAAE,SAAS;oCACf,IAAI,EAAE;wCACJ,IAAI,EAAE,QAAQ;wCACd,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC;qCAC9B;iCACF;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;wBACP;4BACE,IAAI,EAAE,SAAS;4BACf,QAAQ,EAAE;gCACR;oCACE,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,eAAe,KAAK,CAAC,QAAQ,cAAc,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;iCAC3E;6BACF;yBACF;qBACF;iBACF,CAAC;aACH,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,CACtC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,GACzE,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EACnC,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,QAAQ,EAAE,YAAY,KAAK,QAAQ;gBAChD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE;gBAChC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE;gBACpC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG;gBACX,cAAc,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe;gBACpD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEX,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,SAAS,CAAC;gBACR,EAAE;gBACF,OAAO;gBACP,IAAI;gBACJ,IAAI;aACL,CAAC,CACH,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,WAAmB,EACnB,YAAgC,EAChC,KAAa,EACb,KAAa;IAMb,mEAAmE;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,4DAA4D;IAC5D,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,MAAM,qCAAqC,CAC3D,WAAW,EACX,KAAK,CACN,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC;IAC/B,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,UAES,CAAC;IACd,IAAI,YAAY,EAAE,CAAC;QACjB,UAAU,GAAG,MAAM,qCAAqC,CACtD,YAAY,EACZ,KAAK,CACN,CAAC;QACF,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;IAC9C,CAAC;IASD,MAAM,SAAS,GAAG,IAAI,GAAG,EAGtB,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CACjD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAC3B,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,SAAS,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,SAAS;YACX,CAAC;YACD,KAAK,MAAM,WAAW,IAAI,QAAQ,EAAE,CAAC;gBACnC,SAAS,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,OAAO,IAAI,IAAI,EAAE,EAAE;oBACnE,IAAI;oBACJ,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CACnC,WAAW;QACT,CAAC,CAAC,uBAAuB,CAAC,WAAW,CAAC;QACtC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CACzC,CACF,CAAC;IACF,MAAM,gBAAgB,GAAG,CAAC,YAAoB,EAAQ,EAAE;QACtD,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;YAC7B,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,qCAAqC,IAAI,GAAG,CACzG,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CACrB,QAAuC,EACvC,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAuC,EACvC,GAAW;IAEX,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACpC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAI,QAAoC,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAA6C;IAE7C,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC7C,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CACR,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,iBAAiB,CAC1E,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,SAAS,2BAA2B,CAClC,QAA6C;IAE7C,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB;IAC1C,OAAO,KAAK;QACV,CAAC,CAAC,KAAK;aACF,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,KAAa,EACb,IAAwB;IAExB,OAAO,IAAI,QAAQ,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAa;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC;IACjB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC","sourcesContent":["/**\n * Built-in notification channels.\n *\n * Webhook and Slack are always registered. Delivery uses (in order):\n *   1. per-notification `metadata.webhookUrl` / `metadata.slackWebhookUrl`\n *   2. the matching `NOTIFICATIONS_*` env URL (workspace default)\n * If neither is set, that channel no-ops for the emission.\n *\n * Extra channels can be registered at any time via\n * `registerNotificationChannel()` from a server plugin.\n *\n * NOTIFICATIONS_WEBHOOK_URL  → default POST JSON URL when metadata omits one.\n *                              Supports `${keys.NAME}` substitution — the raw\n *                              value never enters the agent context.\n * NOTIFICATIONS_WEBHOOK_AUTH → optional `Authorization` header value (also\n *                              supports `${keys.NAME}`).\n * NOTIFICATIONS_SLACK_WEBHOOK_URL\n *                            → default Slack incoming webhook when metadata\n *                              omits `slackWebhookUrl`.\n *                              Supports `${keys.NAME}` substitution.\n * NOTIFICATIONS_EMAIL_CHANNEL=1\n *                            → enable the built-in email channel for\n *                              per-notification recipients.\n * NOTIFICATIONS_EMAIL_RECIPIENTS\n *                            → comma-separated fallback recipients for email\n *                              notifications that do not pass\n *                              `metadata.emailRecipients`.\n */\n\nimport { ssrfSafeFetch } from \"../extensions/url-safety.js\";\nimport {\n  getKeyAllowlist,\n  getResolvedKeyAllowlist,\n  resolveKeyReferencesWithRequestScopes,\n  validateUrlAllowlist,\n} from \"../secrets/substitution.js\";\nimport { sendEmail } from \"../server/email.js\";\nimport { registerNotificationChannel } from \"./registry.js\";\nimport type { NotificationChannel, NotificationInput } from \"./types.js\";\n\nlet _registered = false;\n\nexport function registerBuiltinNotificationChannels(): void {\n  if (_registered) return;\n  _registered = true;\n\n  registerNotificationChannel(\n    createWebhookChannel(process.env.NOTIFICATIONS_WEBHOOK_URL),\n  );\n  registerNotificationChannel(\n    createSlackWebhookChannel(process.env.NOTIFICATIONS_SLACK_WEBHOOK_URL),\n  );\n  // Email is always registered so per-notification `metadata.emailRecipients`\n  // work without a workspace-wide env flag (same pattern as webhook/slack).\n  registerNotificationChannel(createEmailChannel());\n}\n\nfunction createWebhookChannel(\n  envUrlTemplate: string | undefined,\n): NotificationChannel {\n  const authTemplate = process.env.NOTIFICATIONS_WEBHOOK_AUTH;\n  return {\n    name: \"webhook\",\n    async deliver(input, meta) {\n      const overrideUrlTemplate = deliveryMetadataString(\n        input.metadata,\n        \"webhookUrl\",\n      );\n      const urlTemplate =\n        overrideUrlTemplate ??\n        metadataString(input.metadata, \"webhookUrl\") ??\n        envUrlTemplate?.trim();\n      // No-op when neither a per-notification nor workspace URL is set —\n      // mirrors email's empty-recipients behavior so notify-all stays quiet.\n      if (!urlTemplate) return false;\n      const { url, headers, assertUrlAllowed } = await resolveWebhookRequest(\n        urlTemplate,\n        overrideUrlTemplate ? undefined : authTemplate,\n        meta.owner,\n        \"webhook\",\n      );\n      const res = await ssrfSafeFetch(\n        url,\n        {\n          method: \"POST\",\n          headers,\n          body: JSON.stringify({\n            severity: input.severity,\n            title: input.title,\n            body: input.body,\n            metadata: scrubDeliveryMetadata(input.metadata),\n            owner: meta.owner,\n            emittedAt: new Date().toISOString(),\n          }),\n        },\n        { maxRedirects: 3, assertUrlAllowed },\n      );\n      if (!res.ok) {\n        throw new Error(\n          `[notifications] webhook ${new URL(url).origin} returned ${res.status}${\n            (await readErrorSnippet(res)) || \"\"\n          }`,\n        );\n      }\n    },\n  };\n}\n\nfunction createSlackWebhookChannel(\n  envUrlTemplate: string | undefined,\n): NotificationChannel {\n  const authTemplate = process.env.NOTIFICATIONS_SLACK_WEBHOOK_AUTH;\n  return {\n    name: \"slack\",\n    async deliver(input, meta) {\n      const overrideUrlTemplate = deliveryMetadataString(\n        input.metadata,\n        \"slackWebhookUrl\",\n      );\n      const urlTemplate =\n        overrideUrlTemplate ??\n        metadataString(input.metadata, \"slackWebhookUrl\") ??\n        envUrlTemplate?.trim();\n      if (!urlTemplate) return false;\n      const { url, headers, assertUrlAllowed } = await resolveWebhookRequest(\n        urlTemplate,\n        overrideUrlTemplate ? undefined : authTemplate,\n        meta.owner,\n        \"Slack webhook\",\n      );\n      const res = await ssrfSafeFetch(\n        url,\n        {\n          method: \"POST\",\n          headers,\n          body: JSON.stringify({\n            text: slackText(input.severity, input.title, input.body),\n            blocks: [\n              {\n                type: \"section\",\n                text: {\n                  type: \"mrkdwn\",\n                  text: `*${escapeSlack(input.title)}*`,\n                },\n              },\n              ...(input.body\n                ? [\n                    {\n                      type: \"section\",\n                      text: {\n                        type: \"mrkdwn\",\n                        text: escapeSlack(input.body),\n                      },\n                    },\n                  ]\n                : []),\n              {\n                type: \"context\",\n                elements: [\n                  {\n                    type: \"mrkdwn\",\n                    text: `Severity: \\`${input.severity}\\`  Owner: ${escapeSlack(meta.owner)}`,\n                  },\n                ],\n              },\n            ],\n          }),\n        },\n        { maxRedirects: 3, assertUrlAllowed },\n      );\n      if (!res.ok) {\n        throw new Error(\n          `[notifications] Slack webhook ${new URL(url).origin} returned ${res.status}${\n            (await readErrorSnippet(res)) || \"\"\n          }`,\n        );\n      }\n    },\n  };\n}\n\nfunction createEmailChannel(): NotificationChannel {\n  return {\n    name: \"email\",\n    async deliver(input) {\n      const recipients = notificationEmailRecipients(input.metadata);\n      if (recipients.length === 0) return false;\n      const subject =\n        typeof input.metadata?.emailSubject === \"string\" &&\n        input.metadata.emailSubject.trim()\n          ? input.metadata.emailSubject.trim()\n          : `[${input.severity}] ${input.title}`;\n      const text = `${input.title}\\n\\n${input.body ?? \"\"}`;\n      const html = [\n        `<p><strong>${escapeHtml(input.title)}</strong></p>`,\n        input.body ? `<p>${escapeHtml(input.body)}</p>` : \"\",\n      ].join(\"\");\n\n      await Promise.all(\n        recipients.map((to) =>\n          sendEmail({\n            to,\n            subject,\n            text,\n            html,\n          }),\n        ),\n      );\n    },\n  };\n}\n\nasync function resolveWebhookRequest(\n  urlTemplate: string,\n  authTemplate: string | undefined,\n  owner: string,\n  label: string,\n): Promise<{\n  url: string;\n  headers: Record<string, string>;\n  assertUrlAllowed: (url: string) => void;\n}> {\n  // Resolve `${keys.NAME}` references through the same request-scope\n  // cascade already used by extension fetches (extensions/routes.ts) and\n  // automation connector headers (automation/index.ts): user scope first\n  // (a personal override always wins), then the active org scope — where\n  // the Dispatch vault syncs workspace secrets — then workspace scope.\n  // Org/workspace vault rows are write-gated (org-admin + Dispatch vault\n  // UI), so reading them here is safe by default; this is unrelated to the\n  // opt-in-only user→workspace fallback in resolveKeyReferences (audit 05\n  // H2 in secrets/substitution.ts), which stays off. In headless contexts\n  // (e.g. a scheduled monitor check) getRequestOrgId() may be unset, in\n  // which case the cascade checks user + solo-workspace scopes only — a\n  // strict superset of the previous user-scope-only behavior.\n  // Missing keys throw — the error surfaces in logs and the channel is marked\n  // un-delivered, but other channels still run.\n  const urlResult = await resolveKeyReferencesWithRequestScopes(\n    urlTemplate,\n    owner,\n  );\n  const url = urlResult.resolved;\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n  };\n  let authResult:\n    | Awaited<ReturnType<typeof resolveKeyReferencesWithRequestScopes>>\n    | undefined;\n  if (authTemplate) {\n    authResult = await resolveKeyReferencesWithRequestScopes(\n      authTemplate,\n      owner,\n    );\n    headers.Authorization = authResult.resolved;\n  }\n\n  // If the user set an allowlist on a referenced key, enforce it here —\n  // origin-level check, same rule the automations fetch-tool applies.\n  // Validate URL and Authorization keys independently so an allowlisted auth\n  // token cannot be sent to a metadata-provided destination. Keep scope in the\n  // dedupe key because the same key name can resolve at a different scope if a\n  // credential changes between the two substitutions.\n  type ResolvedKey = NonNullable<typeof urlResult.resolvedKeys>[number];\n  const keyUsages = new Map<\n    string,\n    { name: string; resolvedKey?: ResolvedKey }\n  >();\n  for (const result of authResult ? [urlResult, authResult] : [urlResult]) {\n    for (const name of result.usedKeys) {\n      const resolved = (result.resolvedKeys ?? []).filter(\n        (ref) => ref.name === name,\n      );\n      if (resolved.length === 0) {\n        keyUsages.set(`user:${owner}:${name}`, { name });\n        continue;\n      }\n      for (const resolvedKey of resolved) {\n        keyUsages.set(`${resolvedKey.scope}:${resolvedKey.scopeId}:${name}`, {\n          name,\n          resolvedKey,\n        });\n      }\n    }\n  }\n  const usages = Array.from(keyUsages.values());\n  const allowlists = await Promise.all(\n    usages.map(({ name, resolvedKey }) =>\n      resolvedKey\n        ? getResolvedKeyAllowlist(resolvedKey)\n        : getKeyAllowlist(name, \"user\", owner),\n    ),\n  );\n  const assertUrlAllowed = (candidateUrl: string): void => {\n    usages.forEach(({ name }, i) => {\n      if (!validateUrlAllowlist(candidateUrl, allowlists[i])) {\n        throw new Error(\n          `[notifications] ${label} URL ${new URL(candidateUrl).origin} is not in the allowlist for key \"${name}\"`,\n        );\n      }\n    });\n  };\n  assertUrlAllowed(url);\n  return { url, headers, assertUrlAllowed };\n}\n\nfunction metadataString(\n  metadata: NotificationInput[\"metadata\"],\n  key: string,\n): string | undefined {\n  const value = metadata?.[key];\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed || undefined;\n}\n\nfunction deliveryMetadataString(\n  metadata: NotificationInput[\"metadata\"],\n  key: string,\n): string | undefined {\n  const delivery = metadata?.delivery;\n  if (!delivery || typeof delivery !== \"object\" || Array.isArray(delivery)) {\n    return undefined;\n  }\n  const value = (delivery as Record<string, unknown>)[key];\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed || undefined;\n}\n\nfunction scrubDeliveryMetadata(\n  metadata: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!metadata) return undefined;\n  const entries = Object.entries(metadata).filter(\n    ([key]) =>\n      key !== \"delivery\" && key !== \"webhookUrl\" && key !== \"slackWebhookUrl\",\n  );\n  return entries.length ? Object.fromEntries(entries) : undefined;\n}\n\nfunction notificationEmailRecipients(\n  metadata: Record<string, unknown> | undefined,\n): string[] {\n  const fromMetadata = stringArray(metadata?.emailRecipients);\n  const fromEnv = commaList(process.env.NOTIFICATIONS_EMAIL_RECIPIENTS);\n  const seen = new Set<string>();\n  const recipients: string[] = [];\n  for (const raw of [...fromMetadata, ...fromEnv]) {\n    const email = raw.trim().toLowerCase();\n    if (!email || seen.has(email)) continue;\n    seen.add(email);\n    recipients.push(email);\n  }\n  return recipients;\n}\n\nfunction stringArray(value: unknown): string[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is string => typeof item === \"string\");\n}\n\nfunction commaList(value: string | undefined): string[] {\n  return value\n    ? value\n        .split(\",\")\n        .map((item) => item.trim())\n        .filter(Boolean)\n    : [];\n}\n\nfunction slackText(\n  severity: string,\n  title: string,\n  body: string | undefined,\n): string {\n  return `[${severity}] ${title}${body ? `\\n${body}` : \"\"}`;\n}\n\nfunction escapeSlack(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\");\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\");\n}\n\n/**\n * Read up to ~1 KB from the body for error context. Streams chunks so a\n * misbehaving endpoint returning a large error page doesn't pin that whole\n * payload in memory per failed webhook.\n */\nasync function readErrorSnippet(res: Response): Promise<string> {\n  const reader = res.body?.getReader();\n  if (!reader) return \"\";\n  const decoder = new TextDecoder();\n  const MAX = 1024;\n  let buf = \"\";\n  try {\n    while (buf.length < MAX) {\n      const { value, done } = await reader.read();\n      if (done) break;\n      buf += decoder.decode(value, { stream: true });\n    }\n    reader.cancel().catch(() => {});\n  } catch {\n    return \"\";\n  }\n  if (!buf) return \"\";\n  return `: ${buf.slice(0, 200)}`;\n}\n"]}
+{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../src/notifications/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,qCAAqC,EACrC,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAG5D,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,MAAM,UAAU,mCAAmC;IACjD,IAAI,WAAW;QAAE,OAAO;IACxB,WAAW,GAAG,IAAI,CAAC;IAEnB,2BAA2B,CACzB,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAC5D,CAAC;IACF,2BAA2B,CACzB,yBAAyB,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CACvE,CAAC;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,2BAA2B,CAAC,kBAAkB,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,oBAAoB,CAC3B,cAAkC;IAElC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IAC5D,OAAO;QACL,IAAI,EAAE,SAAS;QACf,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;YACvB,MAAM,mBAAmB,GAAG,sBAAsB,CAChD,KAAK,CAAC,QAAQ,EACd,YAAY,CACb,CAAC;YACF,MAAM,WAAW,GACf,mBAAmB;gBACnB,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC;gBAC5C,cAAc,EAAE,IAAI,EAAE,CAAC;YACzB,mEAAmE;YACnE,uEAAuE;YACvE,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC/B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,MAAM,qBAAqB,CACpE,WAAW,EACX,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,EAC9C,IAAI,CAAC,KAAK,EACV,SAAS,CACV,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,qBAAqB,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAC/C,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC;aACH,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,CACtC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,GACnE,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EACnC,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,cAAkC;IAElC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;IAClE,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;YACvB,MAAM,mBAAmB,GAAG,sBAAsB,CAChD,KAAK,CAAC,QAAQ,EACd,iBAAiB,CAClB,CAAC;YACF,MAAM,WAAW,GACf,mBAAmB;gBACnB,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC;gBACjD,cAAc,EAAE,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC/B,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,MAAM,qBAAqB,CACpE,WAAW,EACX,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,EAC9C,IAAI,CAAC,KAAK,EACV,eAAe,CAChB,CAAC;YACF,MAAM,GAAG,GAAG,MAAM,aAAa,CAC7B,GAAG,EACH;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC;oBACxD,MAAM,EAAE;wBACN;4BACE,IAAI,EAAE,SAAS;4BACf,IAAI,EAAE;gCACJ,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,IAAI,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;6BAC5C;yBACF;wBACD,GAAG,CAAC,KAAK,CAAC,IAAI;4BACZ,CAAC,CAAC;gCACE;oCACE,IAAI,EAAE,SAAS;oCACf,IAAI,EAAE;wCACJ,IAAI,EAAE,QAAQ;wCACd,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;qCACpC;iCACF;6BACF;4BACH,CAAC,CAAC,EAAE,CAAC;wBACP;4BACE,IAAI,EAAE,SAAS;4BACf,QAAQ,EAAE;gCACR;oCACE,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,eAAe,KAAK,CAAC,QAAQ,cAAc,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;iCACjF;6BACF;yBACF;qBACF;iBACF,CAAC;aACH,EACD,EAAE,YAAY,EAAE,CAAC,EAAE,gBAAgB,EAAE,CACtC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,GACzE,CAAC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EACnC,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC1C,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,QAAQ,EAAE,YAAY,KAAK,QAAQ;gBAChD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE;gBAChC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,EAAE;gBACpC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG;gBACX,cAAc,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe;gBACpD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;aACrD,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEX,MAAM,OAAO,CAAC,GAAG,CACf,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CACpB,SAAS,CAAC;gBACR,EAAE;gBACF,OAAO;gBACP,IAAI;gBACJ,IAAI;aACL,CAAC,CACH,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,WAAmB,EACnB,YAAgC,EAChC,KAAa,EACb,KAAa;IAMb,mEAAmE;IACnE,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,sEAAsE;IACtE,4DAA4D;IAC5D,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,SAAS,GAAG,MAAM,qCAAqC,CAC3D,WAAW,EACX,KAAK,CACN,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC;IAC/B,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,IAAI,UAES,CAAC;IACd,IAAI,YAAY,EAAE,CAAC;QACjB,UAAU,GAAG,MAAM,qCAAqC,CACtD,YAAY,EACZ,KAAK,CACN,CAAC;QACF,OAAO,CAAC,aAAa,GAAG,UAAU,CAAC,QAAQ,CAAC;IAC9C,CAAC;IASD,MAAM,SAAS,GAAG,IAAI,GAAG,EAGtB,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CACjD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAC3B,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,SAAS,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjD,SAAS;YACX,CAAC;YACD,KAAK,MAAM,WAAW,IAAI,QAAQ,EAAE,CAAC;gBACnC,SAAS,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,OAAO,IAAI,IAAI,EAAE,EAAE;oBACnE,IAAI;oBACJ,WAAW;iBACZ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CACnC,WAAW;QACT,CAAC,CAAC,uBAAuB,CAAC,WAAW,CAAC;QACtC,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CACzC,CACF,CAAC;IACF,MAAM,gBAAgB,GAAG,CAAC,YAAoB,EAAQ,EAAE;QACtD,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE;YAC7B,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,QAAQ,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,qCAAqC,IAAI,GAAG,CACzG,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CACrB,QAAuC,EACvC,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,sBAAsB,CAC7B,QAAuC,EACvC,GAAW;IAEX,MAAM,QAAQ,GAAG,QAAQ,EAAE,QAAQ,CAAC;IACpC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAI,QAAoC,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAA6C;IAE7C,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC7C,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CACR,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,KAAK,iBAAiB,CAC1E,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,SAAS,2BAA2B,CAClC,QAA6C;IAE7C,MAAM,YAAY,GAAG,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB;IAC1C,OAAO,KAAK;QACV,CAAC,CAAC,KAAK;aACF,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,KAAa,EACb,IAAwB;IAExB,OAAO,IAAI,QAAQ,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAa;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC;IACjB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACxB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC","sourcesContent":["/**\n * Built-in notification channels.\n *\n * Webhook and Slack are always registered. Delivery uses (in order):\n *   1. per-notification `metadata.webhookUrl` / `metadata.slackWebhookUrl`\n *   2. the matching `NOTIFICATIONS_*` env URL (workspace default)\n * If neither is set, that channel no-ops for the emission.\n *\n * Extra channels can be registered at any time via\n * `registerNotificationChannel()` from a server plugin.\n *\n * NOTIFICATIONS_WEBHOOK_URL  → default POST JSON URL when metadata omits one.\n *                              Supports `${keys.NAME}` substitution — the raw\n *                              value never enters the agent context.\n * NOTIFICATIONS_WEBHOOK_AUTH → optional `Authorization` header value (also\n *                              supports `${keys.NAME}`).\n * NOTIFICATIONS_SLACK_WEBHOOK_URL\n *                            → default Slack incoming webhook when metadata\n *                              omits `slackWebhookUrl`.\n *                              Supports `${keys.NAME}` substitution.\n * NOTIFICATIONS_EMAIL_CHANNEL=1\n *                            → enable the built-in email channel for\n *                              per-notification recipients.\n * NOTIFICATIONS_EMAIL_RECIPIENTS\n *                            → comma-separated fallback recipients for email\n *                              notifications that do not pass\n *                              `metadata.emailRecipients`.\n */\n\nimport { ssrfSafeFetch } from \"../extensions/url-safety.js\";\nimport { escapeSlackMrkdwn } from \"../integrations/webhook-delivery.js\";\nimport {\n  getKeyAllowlist,\n  getResolvedKeyAllowlist,\n  resolveKeyReferencesWithRequestScopes,\n  validateUrlAllowlist,\n} from \"../secrets/substitution.js\";\nimport { sendEmail } from \"../server/email.js\";\nimport { registerNotificationChannel } from \"./registry.js\";\nimport type { NotificationChannel, NotificationInput } from \"./types.js\";\n\nlet _registered = false;\n\nexport function registerBuiltinNotificationChannels(): void {\n  if (_registered) return;\n  _registered = true;\n\n  registerNotificationChannel(\n    createWebhookChannel(process.env.NOTIFICATIONS_WEBHOOK_URL),\n  );\n  registerNotificationChannel(\n    createSlackWebhookChannel(process.env.NOTIFICATIONS_SLACK_WEBHOOK_URL),\n  );\n  // Email is always registered so per-notification `metadata.emailRecipients`\n  // work without a workspace-wide env flag (same pattern as webhook/slack).\n  registerNotificationChannel(createEmailChannel());\n}\n\nfunction createWebhookChannel(\n  envUrlTemplate: string | undefined,\n): NotificationChannel {\n  const authTemplate = process.env.NOTIFICATIONS_WEBHOOK_AUTH;\n  return {\n    name: \"webhook\",\n    async deliver(input, meta) {\n      const overrideUrlTemplate = deliveryMetadataString(\n        input.metadata,\n        \"webhookUrl\",\n      );\n      const urlTemplate =\n        overrideUrlTemplate ??\n        metadataString(input.metadata, \"webhookUrl\") ??\n        envUrlTemplate?.trim();\n      // No-op when neither a per-notification nor workspace URL is set —\n      // mirrors email's empty-recipients behavior so notify-all stays quiet.\n      if (!urlTemplate) return false;\n      const { url, headers, assertUrlAllowed } = await resolveWebhookRequest(\n        urlTemplate,\n        overrideUrlTemplate ? undefined : authTemplate,\n        meta.owner,\n        \"webhook\",\n      );\n      const res = await ssrfSafeFetch(\n        url,\n        {\n          method: \"POST\",\n          headers,\n          body: JSON.stringify({\n            severity: input.severity,\n            title: input.title,\n            body: input.body,\n            metadata: scrubDeliveryMetadata(input.metadata),\n            owner: meta.owner,\n            emittedAt: new Date().toISOString(),\n          }),\n        },\n        { maxRedirects: 3, assertUrlAllowed },\n      );\n      if (!res.ok) {\n        throw new Error(\n          `[notifications] webhook ${new URL(url).origin} returned ${res.status}${\n            (await readErrorSnippet(res)) || \"\"\n          }`,\n        );\n      }\n    },\n  };\n}\n\nfunction createSlackWebhookChannel(\n  envUrlTemplate: string | undefined,\n): NotificationChannel {\n  const authTemplate = process.env.NOTIFICATIONS_SLACK_WEBHOOK_AUTH;\n  return {\n    name: \"slack\",\n    async deliver(input, meta) {\n      const overrideUrlTemplate = deliveryMetadataString(\n        input.metadata,\n        \"slackWebhookUrl\",\n      );\n      const urlTemplate =\n        overrideUrlTemplate ??\n        metadataString(input.metadata, \"slackWebhookUrl\") ??\n        envUrlTemplate?.trim();\n      if (!urlTemplate) return false;\n      const { url, headers, assertUrlAllowed } = await resolveWebhookRequest(\n        urlTemplate,\n        overrideUrlTemplate ? undefined : authTemplate,\n        meta.owner,\n        \"Slack webhook\",\n      );\n      const res = await ssrfSafeFetch(\n        url,\n        {\n          method: \"POST\",\n          headers,\n          body: JSON.stringify({\n            text: slackText(input.severity, input.title, input.body),\n            blocks: [\n              {\n                type: \"section\",\n                text: {\n                  type: \"mrkdwn\",\n                  text: `*${escapeSlackMrkdwn(input.title)}*`,\n                },\n              },\n              ...(input.body\n                ? [\n                    {\n                      type: \"section\",\n                      text: {\n                        type: \"mrkdwn\",\n                        text: escapeSlackMrkdwn(input.body),\n                      },\n                    },\n                  ]\n                : []),\n              {\n                type: \"context\",\n                elements: [\n                  {\n                    type: \"mrkdwn\",\n                    text: `Severity: \\`${input.severity}\\`  Owner: ${escapeSlackMrkdwn(meta.owner)}`,\n                  },\n                ],\n              },\n            ],\n          }),\n        },\n        { maxRedirects: 3, assertUrlAllowed },\n      );\n      if (!res.ok) {\n        throw new Error(\n          `[notifications] Slack webhook ${new URL(url).origin} returned ${res.status}${\n            (await readErrorSnippet(res)) || \"\"\n          }`,\n        );\n      }\n    },\n  };\n}\n\nfunction createEmailChannel(): NotificationChannel {\n  return {\n    name: \"email\",\n    async deliver(input) {\n      const recipients = notificationEmailRecipients(input.metadata);\n      if (recipients.length === 0) return false;\n      const subject =\n        typeof input.metadata?.emailSubject === \"string\" &&\n        input.metadata.emailSubject.trim()\n          ? input.metadata.emailSubject.trim()\n          : `[${input.severity}] ${input.title}`;\n      const text = `${input.title}\\n\\n${input.body ?? \"\"}`;\n      const html = [\n        `<p><strong>${escapeHtml(input.title)}</strong></p>`,\n        input.body ? `<p>${escapeHtml(input.body)}</p>` : \"\",\n      ].join(\"\");\n\n      await Promise.all(\n        recipients.map((to) =>\n          sendEmail({\n            to,\n            subject,\n            text,\n            html,\n          }),\n        ),\n      );\n    },\n  };\n}\n\nasync function resolveWebhookRequest(\n  urlTemplate: string,\n  authTemplate: string | undefined,\n  owner: string,\n  label: string,\n): Promise<{\n  url: string;\n  headers: Record<string, string>;\n  assertUrlAllowed: (url: string) => void;\n}> {\n  // Resolve `${keys.NAME}` references through the same request-scope\n  // cascade already used by extension fetches (extensions/routes.ts) and\n  // automation connector headers (automation/index.ts): user scope first\n  // (a personal override always wins), then the active org scope — where\n  // the Dispatch vault syncs workspace secrets — then workspace scope.\n  // Org/workspace vault rows are write-gated (org-admin + Dispatch vault\n  // UI), so reading them here is safe by default; this is unrelated to the\n  // opt-in-only user→workspace fallback in resolveKeyReferences (audit 05\n  // H2 in secrets/substitution.ts), which stays off. In headless contexts\n  // (e.g. a scheduled monitor check) getRequestOrgId() may be unset, in\n  // which case the cascade checks user + solo-workspace scopes only — a\n  // strict superset of the previous user-scope-only behavior.\n  // Missing keys throw — the error surfaces in logs and the channel is marked\n  // un-delivered, but other channels still run.\n  const urlResult = await resolveKeyReferencesWithRequestScopes(\n    urlTemplate,\n    owner,\n  );\n  const url = urlResult.resolved;\n  const headers: Record<string, string> = {\n    \"Content-Type\": \"application/json\",\n  };\n  let authResult:\n    | Awaited<ReturnType<typeof resolveKeyReferencesWithRequestScopes>>\n    | undefined;\n  if (authTemplate) {\n    authResult = await resolveKeyReferencesWithRequestScopes(\n      authTemplate,\n      owner,\n    );\n    headers.Authorization = authResult.resolved;\n  }\n\n  // If the user set an allowlist on a referenced key, enforce it here —\n  // origin-level check, same rule the automations fetch-tool applies.\n  // Validate URL and Authorization keys independently so an allowlisted auth\n  // token cannot be sent to a metadata-provided destination. Keep scope in the\n  // dedupe key because the same key name can resolve at a different scope if a\n  // credential changes between the two substitutions.\n  type ResolvedKey = NonNullable<typeof urlResult.resolvedKeys>[number];\n  const keyUsages = new Map<\n    string,\n    { name: string; resolvedKey?: ResolvedKey }\n  >();\n  for (const result of authResult ? [urlResult, authResult] : [urlResult]) {\n    for (const name of result.usedKeys) {\n      const resolved = (result.resolvedKeys ?? []).filter(\n        (ref) => ref.name === name,\n      );\n      if (resolved.length === 0) {\n        keyUsages.set(`user:${owner}:${name}`, { name });\n        continue;\n      }\n      for (const resolvedKey of resolved) {\n        keyUsages.set(`${resolvedKey.scope}:${resolvedKey.scopeId}:${name}`, {\n          name,\n          resolvedKey,\n        });\n      }\n    }\n  }\n  const usages = Array.from(keyUsages.values());\n  const allowlists = await Promise.all(\n    usages.map(({ name, resolvedKey }) =>\n      resolvedKey\n        ? getResolvedKeyAllowlist(resolvedKey)\n        : getKeyAllowlist(name, \"user\", owner),\n    ),\n  );\n  const assertUrlAllowed = (candidateUrl: string): void => {\n    usages.forEach(({ name }, i) => {\n      if (!validateUrlAllowlist(candidateUrl, allowlists[i])) {\n        throw new Error(\n          `[notifications] ${label} URL ${new URL(candidateUrl).origin} is not in the allowlist for key \"${name}\"`,\n        );\n      }\n    });\n  };\n  assertUrlAllowed(url);\n  return { url, headers, assertUrlAllowed };\n}\n\nfunction metadataString(\n  metadata: NotificationInput[\"metadata\"],\n  key: string,\n): string | undefined {\n  const value = metadata?.[key];\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed || undefined;\n}\n\nfunction deliveryMetadataString(\n  metadata: NotificationInput[\"metadata\"],\n  key: string,\n): string | undefined {\n  const delivery = metadata?.delivery;\n  if (!delivery || typeof delivery !== \"object\" || Array.isArray(delivery)) {\n    return undefined;\n  }\n  const value = (delivery as Record<string, unknown>)[key];\n  if (typeof value !== \"string\") return undefined;\n  const trimmed = value.trim();\n  return trimmed || undefined;\n}\n\nfunction scrubDeliveryMetadata(\n  metadata: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!metadata) return undefined;\n  const entries = Object.entries(metadata).filter(\n    ([key]) =>\n      key !== \"delivery\" && key !== \"webhookUrl\" && key !== \"slackWebhookUrl\",\n  );\n  return entries.length ? Object.fromEntries(entries) : undefined;\n}\n\nfunction notificationEmailRecipients(\n  metadata: Record<string, unknown> | undefined,\n): string[] {\n  const fromMetadata = stringArray(metadata?.emailRecipients);\n  const fromEnv = commaList(process.env.NOTIFICATIONS_EMAIL_RECIPIENTS);\n  const seen = new Set<string>();\n  const recipients: string[] = [];\n  for (const raw of [...fromMetadata, ...fromEnv]) {\n    const email = raw.trim().toLowerCase();\n    if (!email || seen.has(email)) continue;\n    seen.add(email);\n    recipients.push(email);\n  }\n  return recipients;\n}\n\nfunction stringArray(value: unknown): string[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is string => typeof item === \"string\");\n}\n\nfunction commaList(value: string | undefined): string[] {\n  return value\n    ? value\n        .split(\",\")\n        .map((item) => item.trim())\n        .filter(Boolean)\n    : [];\n}\n\nfunction slackText(\n  severity: string,\n  title: string,\n  body: string | undefined,\n): string {\n  return `[${severity}] ${title}${body ? `\\n${body}` : \"\"}`;\n}\n\nfunction escapeHtml(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\")\n    .replace(/\"/g, \"&quot;\");\n}\n\n/**\n * Read up to ~1 KB from the body for error context. Streams chunks so a\n * misbehaving endpoint returning a large error page doesn't pin that whole\n * payload in memory per failed webhook.\n */\nasync function readErrorSnippet(res: Response): Promise<string> {\n  const reader = res.body?.getReader();\n  if (!reader) return \"\";\n  const decoder = new TextDecoder();\n  const MAX = 1024;\n  let buf = \"\";\n  try {\n    while (buf.length < MAX) {\n      const { value, done } = await reader.read();\n      if (done) break;\n      buf += decoder.decode(value, { stream: true });\n    }\n    reader.cancel().catch(() => {});\n  } catch {\n    return \"\";\n  }\n  if (!buf) return \"\";\n  return `: ${buf.slice(0, 200)}`;\n}\n"]}

package/dist/notifications/routes.d.ts

@@ -11,14 +11,14 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
-    error?: undefined;
     count: number;
     updated?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated: number;
+    error?: undefined;
     ok?: undefined;
 } | {
     count?: undefined;
@@ -26,9 +26,9 @@ export declare function createNotificationsHandler(): import("h3").EventHandlerW
     error: string;
     ok?: undefined;
 } | {
-    error?: undefined;
     count?: undefined;
     updated?: undefined;
+    error?: undefined;
     ok: boolean;
 }>>;
 //# sourceMappingURL=routes.d.ts.map