@agent-native/core 0.92.12 → 0.93.0

package/dist/integrations/scope-store.d.ts

@@ -0,0 +1,65 @@
+export type IntegrationConversationType = "channel" | "direct_message" | "group_direct_message";
+export type IntegrationConversationTrust = "trusted" | "guest" | "external_shared" | "unknown";
+export interface IntegrationScopeAccess {
+    ownerEmail: string;
+    orgId?: string | null;
+}
+export interface IntegrationScopeKey {
+    platform: string;
+    tenantId: string;
+    conversationId: string;
+}
+export interface IntegrationScopePolicy {
+    requireMention: boolean;
+    allowDirectMessages: boolean;
+    allowGuests: boolean;
+    allowExternalShared: boolean;
+    allowUnknownTrust: boolean;
+}
+export declare const DEFAULT_INTEGRATION_SCOPE_POLICY: Readonly<IntegrationScopePolicy>;
+export interface IntegrationScope extends IntegrationScopeKey {
+    id: string;
+    conversationType: IntegrationConversationType;
+    trust: IntegrationConversationTrust;
+    ownerEmail: string;
+    orgId: string | null;
+    installationId: string | null;
+    serviceOwnerEmail: string;
+    defaultModel: string | null;
+    policy: IntegrationScopePolicy;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface SaveIntegrationScopeInput extends IntegrationScopeKey {
+    conversationType: IntegrationConversationType;
+    trust?: IntegrationConversationTrust;
+    /**
+     * Omit to use the caller's active org, or pass null for a personal scope.
+     * Passing an org other than the caller's active org is always rejected.
+     */
+    orgId?: string | null;
+    installationId?: string | null;
+    defaultModel?: string | null;
+    policy?: Partial<IntegrationScopePolicy>;
+}
+/** A stable, non-secret subject key suitable for a scope budget. */
+export declare function integrationScopeSubjectKey(key: IntegrationScopeKey): string;
+export declare function getIntegrationScope(keyInput: IntegrationScopeKey, accessInput: IntegrationScopeAccess): Promise<IntegrationScope | null>;
+export declare function listIntegrationScopes(accessInput: IntegrationScopeAccess, filter?: {
+    platform?: string;
+    tenantId?: string;
+}): Promise<IntegrationScope[]>;
+export declare function saveIntegrationScope(input: SaveIntegrationScopeInput, accessInput: IntegrationScopeAccess): Promise<IntegrationScope>;
+export declare function deleteIntegrationScope(keyInput: IntegrationScopeKey, accessInput: IntegrationScopeAccess): Promise<boolean>;
+export type IntegrationScopePolicyDenial = "mention_required" | "direct_messages_disabled" | "guests_disabled" | "external_shared_disabled" | "unverified_conversation_disabled";
+export declare function evaluateIntegrationScopePolicy(scope: Pick<IntegrationScope, "conversationType" | "trust" | "policy">, context: {
+    mentioned: boolean;
+}): {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: IntegrationScopePolicyDenial;
+};
+/** Test-only reset for suites that swap the injected database. */
+export declare function _resetIntegrationScopeStoreForTests(): void;
+//# sourceMappingURL=scope-store.d.ts.map

package/dist/integrations/scope-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-store.d.ts","sourceRoot":"","sources":["../../src/integrations/scope-store.ts"],"names":[],"mappings":"AAWA,MAAM,MAAM,2BAA2B,GACnC,SAAS,GACT,gBAAgB,GAChB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,4BAA4B,GACpC,SAAS,GACT,OAAO,GACP,iBAAiB,GACjB,SAAS,CAAC;AAEd,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,EAAE,OAAO,CAAC;IACxB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;IACrB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,sBAAsB,CAO1E,CAAC;AAEL,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB;IAC3D,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB,EAAE,2BAA2B,CAAC;IAC9C,KAAK,EAAE,4BAA4B,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,sBAAsB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACpE,gBAAgB,EAAE,2BAA2B,CAAC;IAC9C,KAAK,CAAC,EAAE,4BAA4B,CAAC;IACrC;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAC1C;AAkHD,oEAAoE;AACpE,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAO3E;AA+FD,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,mBAAmB,EAC7B,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAoBlC;AAED,wBAAsB,qBAAqB,CACzC,WAAW,EAAE,sBAAsB,EACnC,MAAM,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GACpD,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAqB7B;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,gBAAgB,CAAC,CA0F3B;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,mBAAmB,EAC7B,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,OAAO,CAAC,CAgBlB;AAED,MAAM,MAAM,4BAA4B,GACpC,kBAAkB,GAClB,0BAA0B,GAC1B,iBAAiB,GACjB,0BAA0B,GAC1B,kCAAkC,CAAC;AAEvC,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,GAAG,OAAO,GAAG,QAAQ,CAAC,EACtE,OAAO,EAAE;IAAE,SAAS,EAAE,OAAO,CAAA;CAAE,GAE7B;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,4BAA4B,CAAA;CAAE,CAqB3D;AAED,kEAAkE;AAClE,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D"}

package/dist/integrations/scope-store.js

@@ -0,0 +1,361 @@
+import { createHash } from "node:crypto";
+import { getDbExec, intType, isPostgres } from "../db/client.js";
+import { ensureColumnExists, ensureIndexExists, ensureTableExists, } from "../db/ddl-guard.js";
+let initPromise;
+export const DEFAULT_INTEGRATION_SCOPE_POLICY = Object.freeze({
+    requireMention: true,
+    allowDirectMessages: false,
+    allowGuests: false,
+    allowExternalShared: false,
+    allowUnknownTrust: false,
+});
+const CONVERSATION_TYPES = new Set([
+    "channel",
+    "direct_message",
+    "group_direct_message",
+]);
+const TRUST_VALUES = new Set([
+    "trusted",
+    "guest",
+    "external_shared",
+    "unknown",
+]);
+async function ensureTable() {
+    if (!initPromise) {
+        initPromise = (async () => {
+            const db = getDbExec();
+            const createSql = `CREATE TABLE IF NOT EXISTS integration_conversation_scopes (
+        id TEXT PRIMARY KEY,
+        platform TEXT NOT NULL,
+        tenant_id TEXT NOT NULL,
+        conversation_id TEXT NOT NULL,
+        conversation_type TEXT NOT NULL,
+        trust_level TEXT NOT NULL DEFAULT 'unknown',
+        owner_email TEXT NOT NULL,
+        org_id TEXT,
+        installation_id TEXT,
+        service_owner_email TEXT NOT NULL,
+        default_model TEXT,
+        require_mention ${intType()} NOT NULL DEFAULT 1,
+        allow_direct_messages ${intType()} NOT NULL DEFAULT 0,
+        allow_guests ${intType()} NOT NULL DEFAULT 0,
+        allow_external_shared ${intType()} NOT NULL DEFAULT 0,
+        allow_unknown_trust ${intType()} NOT NULL DEFAULT 0,
+        created_at ${intType()} NOT NULL,
+        updated_at ${intType()} NOT NULL
+      )`;
+            const uniqueIndexSql = "CREATE UNIQUE INDEX IF NOT EXISTS idx_integration_scope_external_key ON integration_conversation_scopes(platform, tenant_id, conversation_id)";
+            const ownerIndexSql = "CREATE INDEX IF NOT EXISTS idx_integration_scope_owner ON integration_conversation_scopes(owner_email, platform, tenant_id)";
+            const orgIndexSql = "CREATE INDEX IF NOT EXISTS idx_integration_scope_org ON integration_conversation_scopes(org_id, platform, tenant_id)";
+            if (isPostgres()) {
+                await ensureTableExists("integration_conversation_scopes", createSql);
+                await ensureColumnExists("integration_conversation_scopes", "default_model", "ALTER TABLE integration_conversation_scopes ADD COLUMN IF NOT EXISTS default_model TEXT");
+                await ensureIndexExists("idx_integration_scope_external_key", uniqueIndexSql);
+                await ensureIndexExists("idx_integration_scope_owner", ownerIndexSql);
+                await ensureIndexExists("idx_integration_scope_org", orgIndexSql);
+                return;
+            }
+            await db.execute(createSql);
+            try {
+                await db.execute("ALTER TABLE integration_conversation_scopes ADD COLUMN default_model TEXT");
+            }
+            catch (error) {
+                if (!/duplicate/i.test(String(error?.message ?? error))) {
+                    throw error;
+                }
+            }
+            await db.execute(uniqueIndexSql);
+            await db.execute(ownerIndexSql);
+            await db.execute(orgIndexSql);
+        })().catch((error) => {
+            initPromise = undefined;
+            throw error;
+        });
+    }
+    return initPromise;
+}
+function requiredString(value, name, maxLength = 255) {
+    const normalized = String(value ?? "").trim();
+    if (!normalized)
+        throw new Error(`${name} is required`);
+    if (normalized.length > maxLength) {
+        throw new Error(`${name} must be at most ${maxLength} characters`);
+    }
+    return normalized;
+}
+function normalizeEmail(value, name) {
+    const email = requiredString(value, name, 320).toLowerCase();
+    if (!email.includes("@"))
+        throw new Error(`${name} must be an email address`);
+    return email;
+}
+function normalizeAccess(access) {
+    return {
+        ownerEmail: normalizeEmail(access.ownerEmail, "ownerEmail"),
+        orgId: access.orgId ? requiredString(access.orgId, "orgId") : null,
+    };
+}
+function normalizeKey(key) {
+    return {
+        platform: requiredString(key.platform, "platform", 80).toLowerCase(),
+        tenantId: requiredString(key.tenantId, "tenantId"),
+        conversationId: requiredString(key.conversationId, "conversationId"),
+    };
+}
+/** A stable, non-secret subject key suitable for a scope budget. */
+export function integrationScopeSubjectKey(key) {
+    const normalized = normalizeKey(key);
+    return JSON.stringify([
+        normalized.platform,
+        normalized.tenantId,
+        normalized.conversationId,
+    ]);
+}
+function scopeId(key) {
+    return `scope:${integrationScopeSubjectKey(key)}`;
+}
+function serviceOwnerForScope(key, access, orgId) {
+    if (!orgId)
+        return access.ownerEmail;
+    const subject = createHash("sha256")
+        .update(`${orgId}:${integrationScopeSubjectKey(key)}`)
+        .digest("hex")
+        .slice(0, 24);
+    return `integration+${subject}@service.agent-native.local`;
+}
+function authorizationSql(alias = "") {
+    const prefix = alias ? `${alias}.` : "";
+    return `((${prefix}org_id = ? AND ? IS NOT NULL) OR (${prefix}org_id IS NULL AND ${prefix}owner_email = ?))`;
+}
+function authorizationArgs(access) {
+    return [access.orgId, access.orgId, access.ownerEmail];
+}
+function policyFromRow(row) {
+    return {
+        requireMention: Number(row.require_mention) === 1,
+        allowDirectMessages: Number(row.allow_direct_messages) === 1,
+        allowGuests: Number(row.allow_guests) === 1,
+        allowExternalShared: Number(row.allow_external_shared) === 1,
+        allowUnknownTrust: Number(row.allow_unknown_trust) === 1,
+    };
+}
+function rowToScope(row) {
+    return {
+        id: String(row.id),
+        platform: String(row.platform),
+        tenantId: String(row.tenant_id),
+        conversationId: String(row.conversation_id),
+        conversationType: row.conversation_type,
+        trust: row.trust_level,
+        ownerEmail: String(row.owner_email),
+        orgId: row.org_id == null ? null : String(row.org_id),
+        installationId: row.installation_id == null ? null : String(row.installation_id),
+        serviceOwnerEmail: String(row.service_owner_email),
+        defaultModel: row.default_model == null ? null : String(row.default_model),
+        policy: policyFromRow(row),
+        createdAt: Number(row.created_at),
+        updatedAt: Number(row.updated_at),
+    };
+}
+const SELECT_COLUMNS = `id, platform, tenant_id, conversation_id,
+  conversation_type, trust_level, owner_email, org_id, installation_id,
+  service_owner_email, require_mention, allow_direct_messages, allow_guests,
+  allow_external_shared, allow_unknown_trust, default_model, created_at, updated_at`;
+function isUniqueViolation(error) {
+    const value = error;
+    if (value?.code === "23505")
+        return true;
+    return /unique|duplicate/i.test(String(value?.message ?? error ?? ""));
+}
+function normalizePolicy(policy) {
+    return {
+        ...DEFAULT_INTEGRATION_SCOPE_POLICY,
+        ...policy,
+    };
+}
+function resolveOrgId(requested, access) {
+    if (requested === null)
+        return null;
+    if (requested === undefined)
+        return access.orgId;
+    const normalized = requiredString(requested, "orgId");
+    if (!access.orgId || normalized !== access.orgId) {
+        throw new Error("Not authorized to manage an integration scope for that org");
+    }
+    return normalized;
+}
+export async function getIntegrationScope(keyInput, accessInput) {
+    await ensureTable();
+    const key = normalizeKey(keyInput);
+    const access = normalizeAccess(accessInput);
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT ${SELECT_COLUMNS}
+      FROM integration_conversation_scopes
+      WHERE platform = ? AND tenant_id = ? AND conversation_id = ?
+        AND ${authorizationSql()}
+      LIMIT 1`,
+        args: [
+            key.platform,
+            key.tenantId,
+            key.conversationId,
+            ...authorizationArgs(access),
+        ],
+    });
+    return rows.length > 0
+        ? rowToScope(rows[0])
+        : null;
+}
+export async function listIntegrationScopes(accessInput, filter = {}) {
+    await ensureTable();
+    const access = normalizeAccess(accessInput);
+    const clauses = [authorizationSql()];
+    const args = [...authorizationArgs(access)];
+    if (filter.platform) {
+        clauses.push("platform = ?");
+        args.push(requiredString(filter.platform, "platform", 80).toLowerCase());
+    }
+    if (filter.tenantId) {
+        clauses.push("tenant_id = ?");
+        args.push(requiredString(filter.tenantId, "tenantId"));
+    }
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT ${SELECT_COLUMNS}
+      FROM integration_conversation_scopes
+      WHERE ${clauses.join(" AND ")}
+      ORDER BY platform, tenant_id, conversation_id`,
+        args,
+    });
+    return rows.map((row) => rowToScope(row));
+}
+export async function saveIntegrationScope(input, accessInput) {
+    await ensureTable();
+    const key = normalizeKey(input);
+    const access = normalizeAccess(accessInput);
+    const orgId = resolveOrgId(input.orgId, access);
+    if (!CONVERSATION_TYPES.has(input.conversationType)) {
+        throw new Error("Unsupported integration conversation type");
+    }
+    const trust = input.trust ?? "unknown";
+    if (!TRUST_VALUES.has(trust)) {
+        throw new Error("Unsupported integration conversation trust level");
+    }
+    const serviceOwnerEmail = serviceOwnerForScope(key, access, orgId);
+    const installationId = input.installationId
+        ? requiredString(input.installationId, "installationId")
+        : null;
+    const defaultModel = input.defaultModel?.trim().slice(0, 200) || null;
+    const policy = normalizePolicy(input.policy);
+    const now = Date.now();
+    const db = getDbExec();
+    const updated = await db.execute({
+        sql: `UPDATE integration_conversation_scopes SET
+      conversation_type = ?, trust_level = ?, installation_id = ?,
+      service_owner_email = ?, require_mention = ?, allow_direct_messages = ?,
+      allow_guests = ?, allow_external_shared = ?, allow_unknown_trust = ?,
+      default_model = ?, updated_at = ?
+      WHERE platform = ? AND tenant_id = ? AND conversation_id = ?
+        AND ${authorizationSql()}`,
+        args: [
+            input.conversationType,
+            trust,
+            installationId,
+            serviceOwnerEmail,
+            policy.requireMention ? 1 : 0,
+            policy.allowDirectMessages ? 1 : 0,
+            policy.allowGuests ? 1 : 0,
+            policy.allowExternalShared ? 1 : 0,
+            policy.allowUnknownTrust ? 1 : 0,
+            defaultModel,
+            now,
+            key.platform,
+            key.tenantId,
+            key.conversationId,
+            ...authorizationArgs(access),
+        ],
+    });
+    if (updated.rowsAffected === 0) {
+        try {
+            await db.execute({
+                sql: `INSERT INTO integration_conversation_scopes (
+          id, platform, tenant_id, conversation_id, conversation_type,
+          trust_level, owner_email, org_id, installation_id,
+          service_owner_email, require_mention, allow_direct_messages,
+          allow_guests, allow_external_shared, allow_unknown_trust,
+          default_model, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+                args: [
+                    scopeId(key),
+                    key.platform,
+                    key.tenantId,
+                    key.conversationId,
+                    input.conversationType,
+                    trust,
+                    access.ownerEmail,
+                    orgId,
+                    installationId,
+                    serviceOwnerEmail,
+                    policy.requireMention ? 1 : 0,
+                    policy.allowDirectMessages ? 1 : 0,
+                    policy.allowGuests ? 1 : 0,
+                    policy.allowExternalShared ? 1 : 0,
+                    policy.allowUnknownTrust ? 1 : 0,
+                    defaultModel,
+                    now,
+                    now,
+                ],
+            });
+        }
+        catch (error) {
+            if (isUniqueViolation(error)) {
+                throw new Error("Integration scope is not available to this caller");
+            }
+            throw error;
+        }
+    }
+    const saved = await getIntegrationScope(key, access);
+    if (!saved)
+        throw new Error("Integration scope write could not be verified");
+    return saved;
+}
+export async function deleteIntegrationScope(keyInput, accessInput) {
+    await ensureTable();
+    const key = normalizeKey(keyInput);
+    const access = normalizeAccess(accessInput);
+    const result = await getDbExec().execute({
+        sql: `DELETE FROM integration_conversation_scopes
+      WHERE platform = ? AND tenant_id = ? AND conversation_id = ?
+        AND ${authorizationSql()}`,
+        args: [
+            key.platform,
+            key.tenantId,
+            key.conversationId,
+            ...authorizationArgs(access),
+        ],
+    });
+    return result.rowsAffected > 0;
+}
+export function evaluateIntegrationScopePolicy(scope, context) {
+    if (scope.policy.requireMention && !context.mentioned) {
+        return { allowed: false, reason: "mention_required" };
+    }
+    if ((scope.conversationType === "direct_message" ||
+        scope.conversationType === "group_direct_message") &&
+        !scope.policy.allowDirectMessages) {
+        return { allowed: false, reason: "direct_messages_disabled" };
+    }
+    if (scope.trust === "guest" && !scope.policy.allowGuests) {
+        return { allowed: false, reason: "guests_disabled" };
+    }
+    if (scope.trust === "external_shared" && !scope.policy.allowExternalShared) {
+        return { allowed: false, reason: "external_shared_disabled" };
+    }
+    if (scope.trust === "unknown" && !scope.policy.allowUnknownTrust) {
+        return { allowed: false, reason: "unverified_conversation_disabled" };
+    }
+    return { allowed: true };
+}
+/** Test-only reset for suites that swap the injected database. */
+export function _resetIntegrationScopeStoreForTests() {
+    initPromise = undefined;
+}
+//# sourceMappingURL=scope-store.js.map

package/dist/integrations/scope-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-store.js","sourceRoot":"","sources":["../../src/integrations/scope-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAE5B,IAAI,WAAsC,CAAC;AAgC3C,MAAM,CAAC,MAAM,gCAAgC,GAC3C,MAAM,CAAC,MAAM,CAAC;IACZ,cAAc,EAAE,IAAI;IACpB,mBAAmB,EAAE,KAAK;IAC1B,WAAW,EAAE,KAAK;IAClB,mBAAmB,EAAE,KAAK;IAC1B,iBAAiB,EAAE,KAAK;CACzB,CAAC,CAAC;AA6BL,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAA8B;IAC9D,SAAS;IACT,gBAAgB;IAChB,sBAAsB;CACvB,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAA+B;IACzD,SAAS;IACT,OAAO;IACP,iBAAiB;IACjB,SAAS;CACV,CAAC,CAAC;AAEH,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG;;;;;;;;;;;;0BAYE,OAAO,EAAE;gCACH,OAAO,EAAE;uBAClB,OAAO,EAAE;gCACA,OAAO,EAAE;8BACX,OAAO,EAAE;qBAClB,OAAO,EAAE;qBACT,OAAO,EAAE;QACtB,CAAC;YACH,MAAM,cAAc,GAClB,+IAA+I,CAAC;YAClJ,MAAM,aAAa,GACjB,6HAA6H,CAAC;YAChI,MAAM,WAAW,GACf,sHAAsH,CAAC;YAEzH,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,MAAM,iBAAiB,CAAC,iCAAiC,EAAE,SAAS,CAAC,CAAC;gBACtE,MAAM,kBAAkB,CACtB,iCAAiC,EACjC,eAAe,EACf,yFAAyF,CAC1F,CAAC;gBACF,MAAM,iBAAiB,CACrB,oCAAoC,EACpC,cAAc,CACf,CAAC;gBACF,MAAM,iBAAiB,CAAC,6BAA6B,EAAE,aAAa,CAAC,CAAC;gBACtE,MAAM,iBAAiB,CAAC,2BAA2B,EAAE,WAAW,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YAED,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,OAAO,CACd,2EAA2E,CAC5E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAE,KAAe,EAAE,OAAO,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;oBACnE,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC;YACD,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACjC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YAChC,MAAM,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnB,WAAW,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY,EAAE,SAAS,GAAG,GAAG;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,oBAAoB,SAAS,aAAa,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,2BAA2B,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CACtB,MAA8B;IAE9B,OAAO;QACL,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAwB;IAC5C,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;QACpE,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;QAClD,cAAc,EAAE,cAAc,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,0BAA0B,CAAC,GAAwB;IACjE,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,cAAc;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CAAC,GAAwB;IACvC,OAAO,SAAS,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAwB,EACxB,MAAwC,EACxC,KAAoB;IAEpB,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC;SACjC,MAAM,CAAC,GAAG,KAAK,IAAI,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC;SACrD,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,eAAe,OAAO,6BAA6B,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAK,GAAG,EAAE;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,OAAO,KAAK,MAAM,qCAAqC,MAAM,sBAAsB,MAAM,mBAAmB,CAAC;AAC/G,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAwC;IAExC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,aAAa,CAAC,GAA4B;IACjD,OAAO;QACL,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;QACjD,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC;QAC5D,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC;QAC3C,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC;QAC5D,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAA4B;IAC9C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QAC3C,gBAAgB,EAAE,GAAG,CAAC,iBAAgD;QACtE,KAAK,EAAE,GAAG,CAAC,WAA2C;QACtD,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QACnC,KAAK,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACrD,cAAc,EACZ,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QAClE,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAClD,YAAY,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC;QAC1E,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG;;;oFAG6D,CAAC;AAErF,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,KAAK,GAAG,KAAmD,CAAC;IAClE,IAAI,KAAK,EAAE,IAAI,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,eAAe,CACtB,MAAmD;IAEnD,OAAO;QACL,GAAG,gCAAgC;QACnC,GAAG,MAAM;KACV,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,SAAoC,EACpC,MAAwC;IAExC,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACjD,MAAM,UAAU,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,UAAU,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAA6B,EAC7B,WAAmC;IAEnC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE,UAAU,cAAc;;;cAGnB,gBAAgB,EAAE;cAClB;QACV,IAAI,EAAE;YACJ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,cAAc;YAClB,GAAG,iBAAiB,CAAC,MAAM,CAAC;SAC7B;KACF,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmC,EACnC,MAAM,GAA6C,EAAE;IAErD,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACrC,MAAM,IAAI,GAAc,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE,UAAU,cAAc;;cAEnB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;oDACiB;QAChD,IAAI;KACL,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAA8B,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAgC,EAChC,WAAmC;IAEnC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,SAAS,CAAC;IACvC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;QACzC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC;QACxD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;IACtE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC;IAEvB,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC;QAC/B,GAAG,EAAE;;;;;;cAMK,gBAAgB,EAAE,EAAE;QAC9B,IAAI,EAAE;YACJ,KAAK,CAAC,gBAAgB;YACtB,KAAK;YACL,cAAc;YACd,iBAAiB;YACjB,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,YAAY;YACZ,GAAG;YACH,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,cAAc;YAClB,GAAG,iBAAiB,CAAC,MAAM,CAAC;SAC7B;KACF,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,OAAO,CAAC;gBACf,GAAG,EAAE;;;;;;wEAM2D;gBAChE,IAAI,EAAE;oBACJ,OAAO,CAAC,GAAG,CAAC;oBACZ,GAAG,CAAC,QAAQ;oBACZ,GAAG,CAAC,QAAQ;oBACZ,GAAG,CAAC,cAAc;oBAClB,KAAK,CAAC,gBAAgB;oBACtB,KAAK;oBACL,MAAM,CAAC,UAAU;oBACjB,KAAK;oBACL,cAAc;oBACd,iBAAiB;oBACjB,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC7B,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1B,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAChC,YAAY;oBACZ,GAAG;oBACH,GAAG;iBACJ;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC7E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAA6B,EAC7B,WAAmC;IAEnC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACvC,GAAG,EAAE;;cAEK,gBAAgB,EAAE,EAAE;QAC9B,IAAI,EAAE;YACJ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,QAAQ;YACZ,GAAG,CAAC,cAAc;YAClB,GAAG,iBAAiB,CAAC,MAAM,CAAC;SAC7B;KACF,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC;AACjC,CAAC;AASD,MAAM,UAAU,8BAA8B,CAC5C,KAAsE,EACtE,OAA+B;IAI/B,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACxD,CAAC;IACD,IACE,CAAC,KAAK,CAAC,gBAAgB,KAAK,gBAAgB;QAC1C,KAAK,CAAC,gBAAgB,KAAK,sBAAsB,CAAC;QACpD,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,EACjC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,iBAAiB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mCAAmC;IACjD,WAAW,GAAG,SAAS,CAAC;AAC1B,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport { getDbExec, intType, isPostgres } from \"../db/client.js\";\nimport {\n  ensureColumnExists,\n  ensureIndexExists,\n  ensureTableExists,\n} from \"../db/ddl-guard.js\";\n\nlet initPromise: Promise<void> | undefined;\n\nexport type IntegrationConversationType =\n  | \"channel\"\n  | \"direct_message\"\n  | \"group_direct_message\";\n\nexport type IntegrationConversationTrust =\n  | \"trusted\"\n  | \"guest\"\n  | \"external_shared\"\n  | \"unknown\";\n\nexport interface IntegrationScopeAccess {\n  ownerEmail: string;\n  orgId?: string | null;\n}\n\nexport interface IntegrationScopeKey {\n  platform: string;\n  tenantId: string;\n  conversationId: string;\n}\n\nexport interface IntegrationScopePolicy {\n  requireMention: boolean;\n  allowDirectMessages: boolean;\n  allowGuests: boolean;\n  allowExternalShared: boolean;\n  allowUnknownTrust: boolean;\n}\n\nexport const DEFAULT_INTEGRATION_SCOPE_POLICY: Readonly<IntegrationScopePolicy> =\n  Object.freeze({\n    requireMention: true,\n    allowDirectMessages: false,\n    allowGuests: false,\n    allowExternalShared: false,\n    allowUnknownTrust: false,\n  });\n\nexport interface IntegrationScope extends IntegrationScopeKey {\n  id: string;\n  conversationType: IntegrationConversationType;\n  trust: IntegrationConversationTrust;\n  ownerEmail: string;\n  orgId: string | null;\n  installationId: string | null;\n  serviceOwnerEmail: string;\n  defaultModel: string | null;\n  policy: IntegrationScopePolicy;\n  createdAt: number;\n  updatedAt: number;\n}\n\nexport interface SaveIntegrationScopeInput extends IntegrationScopeKey {\n  conversationType: IntegrationConversationType;\n  trust?: IntegrationConversationTrust;\n  /**\n   * Omit to use the caller's active org, or pass null for a personal scope.\n   * Passing an org other than the caller's active org is always rejected.\n   */\n  orgId?: string | null;\n  installationId?: string | null;\n  defaultModel?: string | null;\n  policy?: Partial<IntegrationScopePolicy>;\n}\n\nconst CONVERSATION_TYPES = new Set<IntegrationConversationType>([\n  \"channel\",\n  \"direct_message\",\n  \"group_direct_message\",\n]);\nconst TRUST_VALUES = new Set<IntegrationConversationTrust>([\n  \"trusted\",\n  \"guest\",\n  \"external_shared\",\n  \"unknown\",\n]);\n\nasync function ensureTable(): Promise<void> {\n  if (!initPromise) {\n    initPromise = (async () => {\n      const db = getDbExec();\n      const createSql = `CREATE TABLE IF NOT EXISTS integration_conversation_scopes (\n        id TEXT PRIMARY KEY,\n        platform TEXT NOT NULL,\n        tenant_id TEXT NOT NULL,\n        conversation_id TEXT NOT NULL,\n        conversation_type TEXT NOT NULL,\n        trust_level TEXT NOT NULL DEFAULT 'unknown',\n        owner_email TEXT NOT NULL,\n        org_id TEXT,\n        installation_id TEXT,\n        service_owner_email TEXT NOT NULL,\n        default_model TEXT,\n        require_mention ${intType()} NOT NULL DEFAULT 1,\n        allow_direct_messages ${intType()} NOT NULL DEFAULT 0,\n        allow_guests ${intType()} NOT NULL DEFAULT 0,\n        allow_external_shared ${intType()} NOT NULL DEFAULT 0,\n        allow_unknown_trust ${intType()} NOT NULL DEFAULT 0,\n        created_at ${intType()} NOT NULL,\n        updated_at ${intType()} NOT NULL\n      )`;\n      const uniqueIndexSql =\n        \"CREATE UNIQUE INDEX IF NOT EXISTS idx_integration_scope_external_key ON integration_conversation_scopes(platform, tenant_id, conversation_id)\";\n      const ownerIndexSql =\n        \"CREATE INDEX IF NOT EXISTS idx_integration_scope_owner ON integration_conversation_scopes(owner_email, platform, tenant_id)\";\n      const orgIndexSql =\n        \"CREATE INDEX IF NOT EXISTS idx_integration_scope_org ON integration_conversation_scopes(org_id, platform, tenant_id)\";\n\n      if (isPostgres()) {\n        await ensureTableExists(\"integration_conversation_scopes\", createSql);\n        await ensureColumnExists(\n          \"integration_conversation_scopes\",\n          \"default_model\",\n          \"ALTER TABLE integration_conversation_scopes ADD COLUMN IF NOT EXISTS default_model TEXT\",\n        );\n        await ensureIndexExists(\n          \"idx_integration_scope_external_key\",\n          uniqueIndexSql,\n        );\n        await ensureIndexExists(\"idx_integration_scope_owner\", ownerIndexSql);\n        await ensureIndexExists(\"idx_integration_scope_org\", orgIndexSql);\n        return;\n      }\n\n      await db.execute(createSql);\n      try {\n        await db.execute(\n          \"ALTER TABLE integration_conversation_scopes ADD COLUMN default_model TEXT\",\n        );\n      } catch (error) {\n        if (!/duplicate/i.test(String((error as Error)?.message ?? error))) {\n          throw error;\n        }\n      }\n      await db.execute(uniqueIndexSql);\n      await db.execute(ownerIndexSql);\n      await db.execute(orgIndexSql);\n    })().catch((error) => {\n      initPromise = undefined;\n      throw error;\n    });\n  }\n  return initPromise;\n}\n\nfunction requiredString(value: unknown, name: string, maxLength = 255): string {\n  const normalized = String(value ?? \"\").trim();\n  if (!normalized) throw new Error(`${name} is required`);\n  if (normalized.length > maxLength) {\n    throw new Error(`${name} must be at most ${maxLength} characters`);\n  }\n  return normalized;\n}\n\nfunction normalizeEmail(value: unknown, name: string): string {\n  const email = requiredString(value, name, 320).toLowerCase();\n  if (!email.includes(\"@\")) throw new Error(`${name} must be an email address`);\n  return email;\n}\n\nfunction normalizeAccess(\n  access: IntegrationScopeAccess,\n): Required<IntegrationScopeAccess> {\n  return {\n    ownerEmail: normalizeEmail(access.ownerEmail, \"ownerEmail\"),\n    orgId: access.orgId ? requiredString(access.orgId, \"orgId\") : null,\n  };\n}\n\nfunction normalizeKey(key: IntegrationScopeKey): IntegrationScopeKey {\n  return {\n    platform: requiredString(key.platform, \"platform\", 80).toLowerCase(),\n    tenantId: requiredString(key.tenantId, \"tenantId\"),\n    conversationId: requiredString(key.conversationId, \"conversationId\"),\n  };\n}\n\n/** A stable, non-secret subject key suitable for a scope budget. */\nexport function integrationScopeSubjectKey(key: IntegrationScopeKey): string {\n  const normalized = normalizeKey(key);\n  return JSON.stringify([\n    normalized.platform,\n    normalized.tenantId,\n    normalized.conversationId,\n  ]);\n}\n\nfunction scopeId(key: IntegrationScopeKey): string {\n  return `scope:${integrationScopeSubjectKey(key)}`;\n}\n\nfunction serviceOwnerForScope(\n  key: IntegrationScopeKey,\n  access: Required<IntegrationScopeAccess>,\n  orgId: string | null,\n): string {\n  if (!orgId) return access.ownerEmail;\n  const subject = createHash(\"sha256\")\n    .update(`${orgId}:${integrationScopeSubjectKey(key)}`)\n    .digest(\"hex\")\n    .slice(0, 24);\n  return `integration+${subject}@service.agent-native.local`;\n}\n\nfunction authorizationSql(alias = \"\"): string {\n  const prefix = alias ? `${alias}.` : \"\";\n  return `((${prefix}org_id = ? AND ? IS NOT NULL) OR (${prefix}org_id IS NULL AND ${prefix}owner_email = ?))`;\n}\n\nfunction authorizationArgs(\n  access: Required<IntegrationScopeAccess>,\n): unknown[] {\n  return [access.orgId, access.orgId, access.ownerEmail];\n}\n\nfunction policyFromRow(row: Record<string, unknown>): IntegrationScopePolicy {\n  return {\n    requireMention: Number(row.require_mention) === 1,\n    allowDirectMessages: Number(row.allow_direct_messages) === 1,\n    allowGuests: Number(row.allow_guests) === 1,\n    allowExternalShared: Number(row.allow_external_shared) === 1,\n    allowUnknownTrust: Number(row.allow_unknown_trust) === 1,\n  };\n}\n\nfunction rowToScope(row: Record<string, unknown>): IntegrationScope {\n  return {\n    id: String(row.id),\n    platform: String(row.platform),\n    tenantId: String(row.tenant_id),\n    conversationId: String(row.conversation_id),\n    conversationType: row.conversation_type as IntegrationConversationType,\n    trust: row.trust_level as IntegrationConversationTrust,\n    ownerEmail: String(row.owner_email),\n    orgId: row.org_id == null ? null : String(row.org_id),\n    installationId:\n      row.installation_id == null ? null : String(row.installation_id),\n    serviceOwnerEmail: String(row.service_owner_email),\n    defaultModel: row.default_model == null ? null : String(row.default_model),\n    policy: policyFromRow(row),\n    createdAt: Number(row.created_at),\n    updatedAt: Number(row.updated_at),\n  };\n}\n\nconst SELECT_COLUMNS = `id, platform, tenant_id, conversation_id,\n  conversation_type, trust_level, owner_email, org_id, installation_id,\n  service_owner_email, require_mention, allow_direct_messages, allow_guests,\n  allow_external_shared, allow_unknown_trust, default_model, created_at, updated_at`;\n\nfunction isUniqueViolation(error: unknown): boolean {\n  const value = error as { code?: string; message?: string } | null;\n  if (value?.code === \"23505\") return true;\n  return /unique|duplicate/i.test(String(value?.message ?? error ?? \"\"));\n}\n\nfunction normalizePolicy(\n  policy: Partial<IntegrationScopePolicy> | undefined,\n): IntegrationScopePolicy {\n  return {\n    ...DEFAULT_INTEGRATION_SCOPE_POLICY,\n    ...policy,\n  };\n}\n\nfunction resolveOrgId(\n  requested: string | null | undefined,\n  access: Required<IntegrationScopeAccess>,\n): string | null {\n  if (requested === null) return null;\n  if (requested === undefined) return access.orgId;\n  const normalized = requiredString(requested, \"orgId\");\n  if (!access.orgId || normalized !== access.orgId) {\n    throw new Error(\n      \"Not authorized to manage an integration scope for that org\",\n    );\n  }\n  return normalized;\n}\n\nexport async function getIntegrationScope(\n  keyInput: IntegrationScopeKey,\n  accessInput: IntegrationScopeAccess,\n): Promise<IntegrationScope | null> {\n  await ensureTable();\n  const key = normalizeKey(keyInput);\n  const access = normalizeAccess(accessInput);\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT ${SELECT_COLUMNS}\n      FROM integration_conversation_scopes\n      WHERE platform = ? AND tenant_id = ? AND conversation_id = ?\n        AND ${authorizationSql()}\n      LIMIT 1`,\n    args: [\n      key.platform,\n      key.tenantId,\n      key.conversationId,\n      ...authorizationArgs(access),\n    ],\n  });\n  return rows.length > 0\n    ? rowToScope(rows[0] as Record<string, unknown>)\n    : null;\n}\n\nexport async function listIntegrationScopes(\n  accessInput: IntegrationScopeAccess,\n  filter: { platform?: string; tenantId?: string } = {},\n): Promise<IntegrationScope[]> {\n  await ensureTable();\n  const access = normalizeAccess(accessInput);\n  const clauses = [authorizationSql()];\n  const args: unknown[] = [...authorizationArgs(access)];\n  if (filter.platform) {\n    clauses.push(\"platform = ?\");\n    args.push(requiredString(filter.platform, \"platform\", 80).toLowerCase());\n  }\n  if (filter.tenantId) {\n    clauses.push(\"tenant_id = ?\");\n    args.push(requiredString(filter.tenantId, \"tenantId\"));\n  }\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT ${SELECT_COLUMNS}\n      FROM integration_conversation_scopes\n      WHERE ${clauses.join(\" AND \")}\n      ORDER BY platform, tenant_id, conversation_id`,\n    args,\n  });\n  return rows.map((row) => rowToScope(row as Record<string, unknown>));\n}\n\nexport async function saveIntegrationScope(\n  input: SaveIntegrationScopeInput,\n  accessInput: IntegrationScopeAccess,\n): Promise<IntegrationScope> {\n  await ensureTable();\n  const key = normalizeKey(input);\n  const access = normalizeAccess(accessInput);\n  const orgId = resolveOrgId(input.orgId, access);\n  if (!CONVERSATION_TYPES.has(input.conversationType)) {\n    throw new Error(\"Unsupported integration conversation type\");\n  }\n  const trust = input.trust ?? \"unknown\";\n  if (!TRUST_VALUES.has(trust)) {\n    throw new Error(\"Unsupported integration conversation trust level\");\n  }\n  const serviceOwnerEmail = serviceOwnerForScope(key, access, orgId);\n  const installationId = input.installationId\n    ? requiredString(input.installationId, \"installationId\")\n    : null;\n  const defaultModel = input.defaultModel?.trim().slice(0, 200) || null;\n  const policy = normalizePolicy(input.policy);\n  const now = Date.now();\n  const db = getDbExec();\n\n  const updated = await db.execute({\n    sql: `UPDATE integration_conversation_scopes SET\n      conversation_type = ?, trust_level = ?, installation_id = ?,\n      service_owner_email = ?, require_mention = ?, allow_direct_messages = ?,\n      allow_guests = ?, allow_external_shared = ?, allow_unknown_trust = ?,\n      default_model = ?, updated_at = ?\n      WHERE platform = ? AND tenant_id = ? AND conversation_id = ?\n        AND ${authorizationSql()}`,\n    args: [\n      input.conversationType,\n      trust,\n      installationId,\n      serviceOwnerEmail,\n      policy.requireMention ? 1 : 0,\n      policy.allowDirectMessages ? 1 : 0,\n      policy.allowGuests ? 1 : 0,\n      policy.allowExternalShared ? 1 : 0,\n      policy.allowUnknownTrust ? 1 : 0,\n      defaultModel,\n      now,\n      key.platform,\n      key.tenantId,\n      key.conversationId,\n      ...authorizationArgs(access),\n    ],\n  });\n\n  if (updated.rowsAffected === 0) {\n    try {\n      await db.execute({\n        sql: `INSERT INTO integration_conversation_scopes (\n          id, platform, tenant_id, conversation_id, conversation_type,\n          trust_level, owner_email, org_id, installation_id,\n          service_owner_email, require_mention, allow_direct_messages,\n          allow_guests, allow_external_shared, allow_unknown_trust,\n          default_model, created_at, updated_at\n        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n        args: [\n          scopeId(key),\n          key.platform,\n          key.tenantId,\n          key.conversationId,\n          input.conversationType,\n          trust,\n          access.ownerEmail,\n          orgId,\n          installationId,\n          serviceOwnerEmail,\n          policy.requireMention ? 1 : 0,\n          policy.allowDirectMessages ? 1 : 0,\n          policy.allowGuests ? 1 : 0,\n          policy.allowExternalShared ? 1 : 0,\n          policy.allowUnknownTrust ? 1 : 0,\n          defaultModel,\n          now,\n          now,\n        ],\n      });\n    } catch (error) {\n      if (isUniqueViolation(error)) {\n        throw new Error(\"Integration scope is not available to this caller\");\n      }\n      throw error;\n    }\n  }\n\n  const saved = await getIntegrationScope(key, access);\n  if (!saved) throw new Error(\"Integration scope write could not be verified\");\n  return saved;\n}\n\nexport async function deleteIntegrationScope(\n  keyInput: IntegrationScopeKey,\n  accessInput: IntegrationScopeAccess,\n): Promise<boolean> {\n  await ensureTable();\n  const key = normalizeKey(keyInput);\n  const access = normalizeAccess(accessInput);\n  const result = await getDbExec().execute({\n    sql: `DELETE FROM integration_conversation_scopes\n      WHERE platform = ? AND tenant_id = ? AND conversation_id = ?\n        AND ${authorizationSql()}`,\n    args: [\n      key.platform,\n      key.tenantId,\n      key.conversationId,\n      ...authorizationArgs(access),\n    ],\n  });\n  return result.rowsAffected > 0;\n}\n\nexport type IntegrationScopePolicyDenial =\n  | \"mention_required\"\n  | \"direct_messages_disabled\"\n  | \"guests_disabled\"\n  | \"external_shared_disabled\"\n  | \"unverified_conversation_disabled\";\n\nexport function evaluateIntegrationScopePolicy(\n  scope: Pick<IntegrationScope, \"conversationType\" | \"trust\" | \"policy\">,\n  context: { mentioned: boolean },\n):\n  | { allowed: true }\n  | { allowed: false; reason: IntegrationScopePolicyDenial } {\n  if (scope.policy.requireMention && !context.mentioned) {\n    return { allowed: false, reason: \"mention_required\" };\n  }\n  if (\n    (scope.conversationType === \"direct_message\" ||\n      scope.conversationType === \"group_direct_message\") &&\n    !scope.policy.allowDirectMessages\n  ) {\n    return { allowed: false, reason: \"direct_messages_disabled\" };\n  }\n  if (scope.trust === \"guest\" && !scope.policy.allowGuests) {\n    return { allowed: false, reason: \"guests_disabled\" };\n  }\n  if (scope.trust === \"external_shared\" && !scope.policy.allowExternalShared) {\n    return { allowed: false, reason: \"external_shared_disabled\" };\n  }\n  if (scope.trust === \"unknown\" && !scope.policy.allowUnknownTrust) {\n    return { allowed: false, reason: \"unverified_conversation_disabled\" };\n  }\n  return { allowed: true };\n}\n\n/** Test-only reset for suites that swap the injected database. */\nexport function _resetIntegrationScopeStoreForTests(): void {\n  initPromise = undefined;\n}\n"]}

package/dist/integrations/slack-manifest.d.ts

@@ -0,0 +1,66 @@
+export declare const SLACK_AGENT_BOT_EVENTS: readonly ["app_home_opened", "app_context_changed", "app_mention", "message.channels", "message.groups", "message.im", "message.mpim"];
+export interface SlackAgentManifestUrls {
+    oauthRedirectUrl: string;
+    eventsRequestUrl: string;
+    interactivityRequestUrl: string;
+}
+/**
+ * Build the canonical Slack app manifest for Agent Native.
+ *
+ * Slack app capabilities are controlled by the app configuration, not by an
+ * individual workspace's OAuth install. Keeping this manifest in core gives
+ * self-hosted apps one exact, versioned configuration for Agent View, writable
+ * DMs, channel mentions, contextual messages, and interactive run controls.
+ */
+export declare function buildSlackAgentManifest(urls: SlackAgentManifestUrls): {
+    readonly _metadata: {
+        readonly major_version: 2;
+        readonly minor_version: 1;
+    };
+    readonly display_information: {
+        readonly name: "Agent Native";
+        readonly description: "Delegate work to your Agent Native apps from Slack.";
+        readonly background_color: "#0f172a";
+    };
+    readonly features: {
+        readonly bot_user: {
+            readonly display_name: "agent-native";
+            readonly always_online: false;
+        };
+        readonly app_home: {
+            readonly home_tab_enabled: false;
+            readonly messages_tab_enabled: true;
+            readonly messages_tab_read_only_enabled: false;
+        };
+        readonly agent_view: {
+            readonly agent_description: "Delegate work to your Agent Native apps from Slack.";
+            readonly suggested_prompts: readonly [{
+                readonly title: "Start a task";
+                readonly message: "What can you help me accomplish?";
+            }, {
+                readonly title: "Check work";
+                readonly message: "What work is currently in progress?";
+            }];
+        };
+    };
+    readonly oauth_config: {
+        readonly redirect_urls: readonly [string];
+        readonly scopes: {
+            readonly bot: readonly ["assistant:write", "app_mentions:read", "channels:read", "channels:history", "chat:write", "files:read", "groups:history", "groups:read", "im:history", "im:read", "mpim:history", "mpim:read", "pins:read", "reactions:read", "users:read", "users:read.email"];
+        };
+    };
+    readonly settings: {
+        readonly event_subscriptions: {
+            readonly request_url: string;
+            readonly bot_events: readonly ["app_home_opened", "app_context_changed", "app_mention", "message.channels", "message.groups", "message.im", "message.mpim"];
+        };
+        readonly interactivity: {
+            readonly is_enabled: true;
+            readonly request_url: string;
+        };
+        readonly org_deploy_enabled: false;
+        readonly socket_mode_enabled: false;
+        readonly token_rotation_enabled: false;
+    };
+};
+//# sourceMappingURL=slack-manifest.d.ts.map

package/dist/integrations/slack-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-manifest.d.ts","sourceRoot":"","sources":["../../src/integrations/slack-manifest.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,sBAAsB,YACjC,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,YAAY,EACZ,cAAc,CACN,CAAC;AAEX,MAAM,WAAW,sBAAsB;IACrC,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,sBAAsB;aAEhE,SAAS;iBAAI,aAAa,EAAE,CAAC;iBAAE,aAAa,EAAE,CAAC;;aAC/C,mBAAmB;iBACjB,IAAI,EAAE,cAAc;iBACpB,WAAW,EAAE,qDAAqD;iBAClE,gBAAgB,EAAE,SAAS;;aAE7B,QAAQ;iBACN,QAAQ;qBACN,YAAY,EAAE,cAAc;qBAC5B,aAAa;;iBAEf,QAAQ;qBACN,gBAAgB;qBAChB,oBAAoB;qBACpB,8BAA8B;;iBAEhC,UAAU;qBACR,iBAAiB,EACf,qDAAqD;qBACvD,iBAAiB;yBAEb,KAAK,EAAE,cAAc;yBACrB,OAAO,EAAE,kCAAkC;;yBAG3C,KAAK,EAAE,YAAY;yBACnB,OAAO,EAAE,qCAAqC;;;;aAKtD,YAAY;iBACV,aAAa;iBACb,MAAM;qBAAI,GAAG;;;aAEf,QAAQ;iBACN,mBAAmB;qBACjB,WAAW;qBACX,UAAU;;iBAEZ,aAAa;qBACX,UAAU;qBACV,WAAW;;iBAEb,kBAAkB;iBAClB,mBAAmB;iBACnB,sBAAsB;;EAG3B"}

package/dist/integrations/slack-manifest.js

@@ -0,0 +1,70 @@
+import { SLACK_AGENT_BOT_SCOPES } from "./slack-oauth.js";
+export const SLACK_AGENT_BOT_EVENTS = [
+    "app_home_opened",
+    "app_context_changed",
+    "app_mention",
+    "message.channels",
+    "message.groups",
+    "message.im",
+    "message.mpim",
+];
+/**
+ * Build the canonical Slack app manifest for Agent Native.
+ *
+ * Slack app capabilities are controlled by the app configuration, not by an
+ * individual workspace's OAuth install. Keeping this manifest in core gives
+ * self-hosted apps one exact, versioned configuration for Agent View, writable
+ * DMs, channel mentions, contextual messages, and interactive run controls.
+ */
+export function buildSlackAgentManifest(urls) {
+    return {
+        _metadata: { major_version: 2, minor_version: 1 },
+        display_information: {
+            name: "Agent Native",
+            description: "Delegate work to your Agent Native apps from Slack.",
+            background_color: "#0f172a",
+        },
+        features: {
+            bot_user: {
+                display_name: "agent-native",
+                always_online: false,
+            },
+            app_home: {
+                home_tab_enabled: false,
+                messages_tab_enabled: true,
+                messages_tab_read_only_enabled: false,
+            },
+            agent_view: {
+                agent_description: "Delegate work to your Agent Native apps from Slack.",
+                suggested_prompts: [
+                    {
+                        title: "Start a task",
+                        message: "What can you help me accomplish?",
+                    },
+                    {
+                        title: "Check work",
+                        message: "What work is currently in progress?",
+                    },
+                ],
+            },
+        },
+        oauth_config: {
+            redirect_urls: [urls.oauthRedirectUrl],
+            scopes: { bot: [...SLACK_AGENT_BOT_SCOPES] },
+        },
+        settings: {
+            event_subscriptions: {
+                request_url: urls.eventsRequestUrl,
+                bot_events: [...SLACK_AGENT_BOT_EVENTS],
+            },
+            interactivity: {
+                is_enabled: true,
+                request_url: urls.interactivityRequestUrl,
+            },
+            org_deploy_enabled: false,
+            socket_mode_enabled: false,
+            token_rotation_enabled: false,
+        },
+    };
+}
+//# sourceMappingURL=slack-manifest.js.map

package/dist/integrations/slack-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-manifest.js","sourceRoot":"","sources":["../../src/integrations/slack-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,iBAAiB;IACjB,qBAAqB;IACrB,aAAa;IACb,kBAAkB;IAClB,gBAAgB;IAChB,YAAY;IACZ,cAAc;CACN,CAAC;AAQX;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA4B;IAClE,OAAO;QACL,SAAS,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE;QACjD,mBAAmB,EAAE;YACnB,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,qDAAqD;YAClE,gBAAgB,EAAE,SAAS;SAC5B;QACD,QAAQ,EAAE;YACR,QAAQ,EAAE;gBACR,YAAY,EAAE,cAAc;gBAC5B,aAAa,EAAE,KAAK;aACrB;YACD,QAAQ,EAAE;gBACR,gBAAgB,EAAE,KAAK;gBACvB,oBAAoB,EAAE,IAAI;gBAC1B,8BAA8B,EAAE,KAAK;aACtC;YACD,UAAU,EAAE;gBACV,iBAAiB,EACf,qDAAqD;gBACvD,iBAAiB,EAAE;oBACjB;wBACE,KAAK,EAAE,cAAc;wBACrB,OAAO,EAAE,kCAAkC;qBAC5C;oBACD;wBACE,KAAK,EAAE,YAAY;wBACnB,OAAO,EAAE,qCAAqC;qBAC/C;iBACF;aACF;SACF;QACD,YAAY,EAAE;YACZ,aAAa,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACtC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,sBAAsB,CAAC,EAAE;SAC7C;QACD,QAAQ,EAAE;YACR,mBAAmB,EAAE;gBACnB,WAAW,EAAE,IAAI,CAAC,gBAAgB;gBAClC,UAAU,EAAE,CAAC,GAAG,sBAAsB,CAAC;aACxC;YACD,aAAa,EAAE;gBACb,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,IAAI,CAAC,uBAAuB;aAC1C;YACD,kBAAkB,EAAE,KAAK;YACzB,mBAAmB,EAAE,KAAK;YAC1B,sBAAsB,EAAE,KAAK;SAC9B;KACO,CAAC;AACb,CAAC","sourcesContent":["import { SLACK_AGENT_BOT_SCOPES } from \"./slack-oauth.js\";\n\nexport const SLACK_AGENT_BOT_EVENTS = [\n  \"app_home_opened\",\n  \"app_context_changed\",\n  \"app_mention\",\n  \"message.channels\",\n  \"message.groups\",\n  \"message.im\",\n  \"message.mpim\",\n] as const;\n\nexport interface SlackAgentManifestUrls {\n  oauthRedirectUrl: string;\n  eventsRequestUrl: string;\n  interactivityRequestUrl: string;\n}\n\n/**\n * Build the canonical Slack app manifest for Agent Native.\n *\n * Slack app capabilities are controlled by the app configuration, not by an\n * individual workspace's OAuth install. Keeping this manifest in core gives\n * self-hosted apps one exact, versioned configuration for Agent View, writable\n * DMs, channel mentions, contextual messages, and interactive run controls.\n */\nexport function buildSlackAgentManifest(urls: SlackAgentManifestUrls) {\n  return {\n    _metadata: { major_version: 2, minor_version: 1 },\n    display_information: {\n      name: \"Agent Native\",\n      description: \"Delegate work to your Agent Native apps from Slack.\",\n      background_color: \"#0f172a\",\n    },\n    features: {\n      bot_user: {\n        display_name: \"agent-native\",\n        always_online: false,\n      },\n      app_home: {\n        home_tab_enabled: false,\n        messages_tab_enabled: true,\n        messages_tab_read_only_enabled: false,\n      },\n      agent_view: {\n        agent_description:\n          \"Delegate work to your Agent Native apps from Slack.\",\n        suggested_prompts: [\n          {\n            title: \"Start a task\",\n            message: \"What can you help me accomplish?\",\n          },\n          {\n            title: \"Check work\",\n            message: \"What work is currently in progress?\",\n          },\n        ],\n      },\n    },\n    oauth_config: {\n      redirect_urls: [urls.oauthRedirectUrl],\n      scopes: { bot: [...SLACK_AGENT_BOT_SCOPES] },\n    },\n    settings: {\n      event_subscriptions: {\n        request_url: urls.eventsRequestUrl,\n        bot_events: [...SLACK_AGENT_BOT_EVENTS],\n      },\n      interactivity: {\n        is_enabled: true,\n        request_url: urls.interactivityRequestUrl,\n      },\n      org_deploy_enabled: false,\n      socket_mode_enabled: false,\n      token_rotation_enabled: false,\n    },\n  } as const;\n}\n"]}