@agent-native/core 0.92.12 → 0.93.0

package/dist/integrations/slack-oauth.d.ts

@@ -0,0 +1,99 @@
+/** Slack OAuth v2 helpers for managed Agent Native messaging installs. */
+import type { SecretScope } from "../secrets/register.js";
+import type { IntegrationInstallationHealth, UpsertIntegrationInstallationInput } from "./installations-store.js";
+export declare const SLACK_AUTHORIZE_URL = "https://slack.com/oauth/v2/authorize";
+export declare const SLACK_TOKEN_URL = "https://slack.com/api/oauth.v2.access";
+export declare const SLACK_AUTH_TEST_URL = "https://slack.com/api/auth.test";
+/** Scopes needed for contextual, file-aware Agent Native conversations. */
+export declare const SLACK_AGENT_BOT_SCOPES: readonly ["assistant:write", "app_mentions:read", "channels:read", "channels:history", "chat:write", "files:read", "groups:history", "groups:read", "im:history", "im:read", "mpim:history", "mpim:read", "pins:read", "reactions:read", "users:read", "users:read.email"];
+export interface SlackOAuthAccessResponse {
+    ok?: boolean;
+    error?: string;
+    access_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+    token_type?: string;
+    scope?: string;
+    bot_user_id?: string;
+    app_id?: string;
+    is_enterprise_install?: boolean;
+    authed_user?: {
+        id?: string;
+    };
+    team?: {
+        id?: string;
+        name?: string;
+    } | null;
+    enterprise?: {
+        id?: string;
+        name?: string;
+    } | null;
+}
+export interface SlackAuthHealth {
+    ok: boolean;
+    health: IntegrationInstallationHealth;
+    error: string | null;
+    checkedAt: number;
+    teamId: string | null;
+    enterpriseId: string | null;
+    botId: string | null;
+    userId: string | null;
+}
+export interface SlackInstallSession {
+    email?: string | null;
+    orgId?: string | null;
+    orgRole?: string | null;
+}
+export interface SlackInstallAccess {
+    ownerEmail: string;
+    orgId: string | null;
+    secretScope: SecretScope;
+    secretScopeId: string;
+}
+export declare function buildSlackAuthorizeUrl(options: {
+    clientId: string;
+    redirectUri: string;
+    state: string;
+    scopes?: readonly string[];
+    userScopes?: readonly string[];
+    teamId?: string;
+}): string;
+/** Exchange an OAuth code using Slack's preferred HTTP Basic authentication. */
+export declare function exchangeSlackOAuthCode(options: {
+    code: string;
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    fetchImpl?: typeof fetch;
+}): Promise<SlackOAuthAccessResponse>;
+/**
+ * Rotate an expiring Slack token. Slack refresh tokens are one-time-use, so
+ * callers must atomically persist the returned access/refresh pair together.
+ */
+export declare function refreshSlackOAuthToken(options: {
+    refreshToken: string;
+    clientId: string;
+    clientSecret: string;
+    fetchImpl?: typeof fetch;
+}): Promise<SlackOAuthAccessResponse>;
+/** Validate a bot token without ever including it in an error or result. */
+export declare function testSlackAuth(accessToken: string, fetchImpl?: typeof fetch): Promise<SlackAuthHealth>;
+/** Stable team/app key used by webhook payloads and the installation store. */
+export declare function slackInstallationKey(input: {
+    teamId?: string | null;
+    enterpriseId?: string | null;
+    apiAppId?: string | null;
+    isEnterpriseInstall?: boolean;
+}): string;
+/**
+ * Convert a successful Slack response to the generic managed-install input.
+ * The returned token bundle is server-only and must be passed directly to the
+ * encrypted installation store, never to a route response.
+ */
+export declare function slackOAuthResponseToInstallation(response: SlackOAuthAccessResponse, access: SlackInstallAccess, now?: number): UpsertIntegrationInstallationInput;
+/**
+ * Pure session/role gate for OAuth install routes. The caller must supply a
+ * server-verified session; org membership must be the active org context.
+ */
+export declare function assertSlackInstallAccess(session: SlackInstallSession | null | undefined): SlackInstallAccess;
+//# sourceMappingURL=slack-oauth.d.ts.map

package/dist/integrations/slack-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-oauth.d.ts","sourceRoot":"","sources":["../../src/integrations/slack-oauth.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAE1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EACV,6BAA6B,EAC7B,kCAAkC,EACnC,MAAM,0BAA0B,CAAC;AAElC,eAAO,MAAM,mBAAmB,yCAAyC,CAAC;AAC1E,eAAO,MAAM,eAAe,0CAA0C,CAAC;AACvE,eAAO,MAAM,mBAAmB,oCAAoC,CAAC;AAErE,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,YACjC,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,SAAS,EACT,cAAc,EACd,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,CACV,CAAC;AAEX,MAAM,WAAW,wBAAwB;IACvC,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,WAAW,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7C,UAAU,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACpD;AAcD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,6BAA6B,CAAC;IACtC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;CACvB;AAQD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAaT;AAED,gFAAgF;AAChF,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA6BpC;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAgCpC;AAED,4EAA4E;AAC5E,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,CAAC,CAmD1B;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,GAAG,MAAM,CAQT;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,wBAAwB,EAClC,MAAM,EAAE,kBAAkB,EAC1B,GAAG,SAAa,GACf,kCAAkC,CAsCpC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GAC9C,kBAAkB,CAqBpB"}

package/dist/integrations/slack-oauth.js

@@ -0,0 +1,226 @@
+/** Slack OAuth v2 helpers for managed Agent Native messaging installs. */
+export const SLACK_AUTHORIZE_URL = "https://slack.com/oauth/v2/authorize";
+export const SLACK_TOKEN_URL = "https://slack.com/api/oauth.v2.access";
+export const SLACK_AUTH_TEST_URL = "https://slack.com/api/auth.test";
+/** Scopes needed for contextual, file-aware Agent Native conversations. */
+export const SLACK_AGENT_BOT_SCOPES = [
+    "assistant:write",
+    "app_mentions:read",
+    "channels:read",
+    "channels:history",
+    "chat:write",
+    "files:read",
+    "groups:history",
+    "groups:read",
+    "im:history",
+    "im:read",
+    "mpim:history",
+    "mpim:read",
+    "pins:read",
+    "reactions:read",
+    "users:read",
+    "users:read.email",
+];
+function safeSlackError(value, fallback) {
+    return typeof value === "string" && /^[a-z0-9_.-]{1,100}$/i.test(value)
+        ? value
+        : fallback;
+}
+export function buildSlackAuthorizeUrl(options) {
+    const params = new URLSearchParams({
+        client_id: options.clientId,
+        redirect_uri: options.redirectUri,
+        response_type: "code",
+        scope: (options.scopes ?? SLACK_AGENT_BOT_SCOPES).join(","),
+        state: options.state,
+    });
+    if (options.userScopes?.length) {
+        params.set("user_scope", options.userScopes.join(","));
+    }
+    if (options.teamId)
+        params.set("team", options.teamId);
+    return `${SLACK_AUTHORIZE_URL}?${params.toString()}`;
+}
+/** Exchange an OAuth code using Slack's preferred HTTP Basic authentication. */
+export async function exchangeSlackOAuthCode(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const authorization = Buffer.from(`${options.clientId}:${options.clientSecret}`, "utf8").toString("base64");
+    const response = await fetchImpl(SLACK_TOKEN_URL, {
+        method: "POST",
+        headers: {
+            Authorization: `Basic ${authorization}`,
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: new URLSearchParams({
+            code: options.code,
+            redirect_uri: options.redirectUri,
+        }),
+    });
+    const data = (await response
+        .json()
+        .catch(() => null));
+    if (!response.ok || !data?.ok) {
+        throw new Error(safeSlackError(data?.error, `Slack OAuth exchange failed (${response.status})`));
+    }
+    return data;
+}
+/**
+ * Rotate an expiring Slack token. Slack refresh tokens are one-time-use, so
+ * callers must atomically persist the returned access/refresh pair together.
+ */
+export async function refreshSlackOAuthToken(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const authorization = Buffer.from(`${options.clientId}:${options.clientSecret}`, "utf8").toString("base64");
+    const response = await fetchImpl(SLACK_TOKEN_URL, {
+        method: "POST",
+        headers: {
+            Authorization: `Basic ${authorization}`,
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body: new URLSearchParams({
+            grant_type: "refresh_token",
+            refresh_token: options.refreshToken,
+        }),
+    });
+    const data = (await response
+        .json()
+        .catch(() => null));
+    if (!response.ok || !data?.ok) {
+        throw new Error(safeSlackError(data?.error, `Slack OAuth token refresh failed (${response.status})`));
+    }
+    if (!data.access_token || !data.refresh_token) {
+        throw new Error("Slack OAuth token refresh returned an incomplete bundle");
+    }
+    return data;
+}
+/** Validate a bot token without ever including it in an error or result. */
+export async function testSlackAuth(accessToken, fetchImpl = fetch) {
+    const checkedAt = Date.now();
+    try {
+        const response = await fetchImpl(SLACK_AUTH_TEST_URL, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${accessToken}` },
+        });
+        const data = (await response
+            .json()
+            .catch(() => null));
+        if (!response.ok || !data?.ok) {
+            const error = safeSlackError(data?.error, `Slack auth test failed (${response.status})`);
+            return {
+                ok: false,
+                health: error === "invalid_auth" || error === "token_revoked"
+                    ? "revoked"
+                    : "degraded",
+                error,
+                checkedAt,
+                teamId: null,
+                enterpriseId: null,
+                botId: null,
+                userId: null,
+            };
+        }
+        return {
+            ok: true,
+            health: "healthy",
+            error: null,
+            checkedAt,
+            teamId: data.team_id ?? null,
+            enterpriseId: data.enterprise_id ?? null,
+            botId: data.bot_id ?? null,
+            userId: data.user_id ?? null,
+        };
+    }
+    catch {
+        return {
+            ok: false,
+            health: "degraded",
+            error: "Slack auth test request failed",
+            checkedAt,
+            teamId: null,
+            enterpriseId: null,
+            botId: null,
+            userId: null,
+        };
+    }
+}
+/** Stable team/app key used by webhook payloads and the installation store. */
+export function slackInstallationKey(input) {
+    const workspaceId = input.isEnterpriseInstall
+        ? input.enterpriseId
+        : (input.teamId ?? input.enterpriseId);
+    if (!workspaceId) {
+        throw new Error("Slack OAuth did not return a team or enterprise id");
+    }
+    return `${input.isEnterpriseInstall ? "enterprise" : "team"}:${workspaceId}:app:${input.apiAppId || "default"}`;
+}
+/**
+ * Convert a successful Slack response to the generic managed-install input.
+ * The returned token bundle is server-only and must be passed directly to the
+ * encrypted installation store, never to a route response.
+ */
+export function slackOAuthResponseToInstallation(response, access, now = Date.now()) {
+    if (!response.ok || !response.access_token) {
+        throw new Error("Slack OAuth response did not include a bot access token");
+    }
+    const installationKey = slackInstallationKey({
+        teamId: response.team?.id,
+        enterpriseId: response.enterprise?.id,
+        apiAppId: response.app_id,
+        isEnterpriseInstall: response.is_enterprise_install,
+    });
+    const expiresAt = typeof response.expires_in === "number" && response.expires_in > 0
+        ? now + response.expires_in * 1000
+        : undefined;
+    return {
+        platform: "slack",
+        installationKey,
+        teamId: response.team?.id ?? null,
+        teamName: response.team?.name ?? null,
+        enterpriseId: response.enterprise?.id ?? null,
+        enterpriseName: response.enterprise?.name ?? null,
+        isEnterpriseInstall: response.is_enterprise_install === true,
+        apiAppId: response.app_id ?? null,
+        botUserId: response.bot_user_id ?? null,
+        scopes: response.scope?.split(",").map((scope) => scope.trim()) ?? [],
+        installedByExternalUserId: response.authed_user?.id ?? null,
+        ownerEmail: access.ownerEmail,
+        orgId: access.orgId,
+        secretScope: access.secretScope,
+        secretScopeId: access.secretScopeId,
+        tokenBundle: {
+            accessToken: response.access_token,
+            refreshToken: response.refresh_token,
+            tokenType: response.token_type,
+            expiresAt,
+        },
+        tokenExpiresAt: expiresAt ?? null,
+    };
+}
+/**
+ * Pure session/role gate for OAuth install routes. The caller must supply a
+ * server-verified session; org membership must be the active org context.
+ */
+export function assertSlackInstallAccess(session) {
+    const ownerEmail = session?.email?.trim().toLowerCase();
+    if (!ownerEmail)
+        throw new Error("Sign in before connecting Slack.");
+    const orgId = session?.orgId?.trim() || null;
+    if (!orgId) {
+        return {
+            ownerEmail,
+            orgId: null,
+            secretScope: "user",
+            secretScopeId: ownerEmail,
+        };
+    }
+    if (session?.orgRole !== "owner" && session?.orgRole !== "admin") {
+        throw new Error("Only organization owners and admins can connect Slack.");
+    }
+    return {
+        ownerEmail,
+        orgId,
+        secretScope: "org",
+        secretScopeId: orgId,
+    };
+}
+//# sourceMappingURL=slack-oauth.js.map

package/dist/integrations/slack-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-oauth.js","sourceRoot":"","sources":["../../src/integrations/slack-oauth.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAQ1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,sCAAsC,CAAC;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,uCAAuC,CAAC;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,iCAAiC,CAAC;AAErE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,iBAAiB;IACjB,mBAAmB;IACnB,eAAe;IACf,kBAAkB;IAClB,YAAY;IACZ,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,YAAY;IACZ,SAAS;IACT,cAAc;IACd,WAAW;IACX,WAAW;IACX,gBAAgB;IAChB,YAAY;IACZ,kBAAkB;CACV,CAAC;AAsDX,SAAS,cAAc,CAAC,KAAc,EAAE,QAAgB;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC;QACrE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,QAAQ,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAOtC;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,sBAAsB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAC3D,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,GAAG,mBAAmB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAM5C;IACC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,EAC7C,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,aAAa,EAAE;YACvC,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,WAAW;SAClC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ;SACzB,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAoC,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,cAAc,CACZ,IAAI,EAAE,KAAK,EACX,gCAAgC,QAAQ,CAAC,MAAM,GAAG,CACnD,CACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAK5C;IACC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAC/B,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,YAAY,EAAE,EAC7C,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,SAAS,aAAa,EAAE;YACvC,cAAc,EAAE,mCAAmC;SACpD;QACD,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;SACpC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ;SACzB,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAoC,CAAC;IACzD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACb,cAAc,CACZ,IAAI,EAAE,KAAK,EACX,qCAAqC,QAAQ,CAAC,MAAM,GAAG,CACxD,CACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,SAAS,GAAiB,KAAK;IAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ;aACzB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA4B,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,cAAc,CAC1B,IAAI,EAAE,KAAK,EACX,2BAA2B,QAAQ,CAAC,MAAM,GAAG,CAC9C,CAAC;YACF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,KAAK,KAAK,cAAc,IAAI,KAAK,KAAK,eAAe;oBACnD,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,UAAU;gBAChB,KAAK;gBACL,SAAS;gBACT,MAAM,EAAE,IAAI;gBACZ,YAAY,EAAE,IAAI;gBAClB,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,IAAI;aACb,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,IAAI;YACX,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;YAC5B,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;YACxC,KAAK,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC1B,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI;SAC7B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,gCAAgC;YACvC,SAAS;YACT,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,KAKpC;IACC,MAAM,WAAW,GAAG,KAAK,CAAC,mBAAmB;QAC3C,CAAC,CAAC,KAAK,CAAC,YAAY;QACpB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,IAAI,WAAW,QAAQ,KAAK,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;AAClH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC,CAC9C,QAAkC,EAClC,MAA0B,EAC1B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,eAAe,GAAG,oBAAoB,CAAC;QAC3C,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE;QACzB,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE;QACrC,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,mBAAmB,EAAE,QAAQ,CAAC,qBAAqB;KACpD,CAAC,CAAC;IACH,MAAM,SAAS,GACb,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,GAAG,CAAC;QAChE,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,IAAI;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,QAAQ,EAAE,OAAO;QACjB,eAAe;QACf,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI;QACjC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI;QACrC,YAAY,EAAE,QAAQ,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI;QAC7C,cAAc,EAAE,QAAQ,CAAC,UAAU,EAAE,IAAI,IAAI,IAAI;QACjD,mBAAmB,EAAE,QAAQ,CAAC,qBAAqB,KAAK,IAAI;QAC5D,QAAQ,EAAE,QAAQ,CAAC,MAAM,IAAI,IAAI;QACjC,SAAS,EAAE,QAAQ,CAAC,WAAW,IAAI,IAAI;QACvC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;QACrE,yBAAyB,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI;QAC3D,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,WAAW,EAAE;YACX,WAAW,EAAE,QAAQ,CAAC,YAAY;YAClC,YAAY,EAAE,QAAQ,CAAC,aAAa;YACpC,SAAS,EAAE,QAAQ,CAAC,UAAU;YAC9B,SAAS;SACV;QACD,cAAc,EAAE,SAAS,IAAI,IAAI;KAClC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA+C;IAE/C,MAAM,UAAU,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,UAAU;YACV,KAAK,EAAE,IAAI;YACX,WAAW,EAAE,MAAM;YACnB,aAAa,EAAE,UAAU;SAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,KAAK,OAAO,IAAI,OAAO,EAAE,OAAO,KAAK,OAAO,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO;QACL,UAAU;QACV,KAAK;QACL,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["/** Slack OAuth v2 helpers for managed Agent Native messaging installs. */\n\nimport type { SecretScope } from \"../secrets/register.js\";\nimport type {\n  IntegrationInstallationHealth,\n  UpsertIntegrationInstallationInput,\n} from \"./installations-store.js\";\n\nexport const SLACK_AUTHORIZE_URL = \"https://slack.com/oauth/v2/authorize\";\nexport const SLACK_TOKEN_URL = \"https://slack.com/api/oauth.v2.access\";\nexport const SLACK_AUTH_TEST_URL = \"https://slack.com/api/auth.test\";\n\n/** Scopes needed for contextual, file-aware Agent Native conversations. */\nexport const SLACK_AGENT_BOT_SCOPES = [\n  \"assistant:write\",\n  \"app_mentions:read\",\n  \"channels:read\",\n  \"channels:history\",\n  \"chat:write\",\n  \"files:read\",\n  \"groups:history\",\n  \"groups:read\",\n  \"im:history\",\n  \"im:read\",\n  \"mpim:history\",\n  \"mpim:read\",\n  \"pins:read\",\n  \"reactions:read\",\n  \"users:read\",\n  \"users:read.email\",\n] as const;\n\nexport interface SlackOAuthAccessResponse {\n  ok?: boolean;\n  error?: string;\n  access_token?: string;\n  refresh_token?: string;\n  expires_in?: number;\n  token_type?: string;\n  scope?: string;\n  bot_user_id?: string;\n  app_id?: string;\n  is_enterprise_install?: boolean;\n  authed_user?: { id?: string };\n  team?: { id?: string; name?: string } | null;\n  enterprise?: { id?: string; name?: string } | null;\n}\n\ninterface SlackApiResponse {\n  ok?: boolean;\n  error?: string;\n  team_id?: string;\n  team?: string;\n  enterprise_id?: string;\n  enterprise?: string;\n  user_id?: string;\n  bot_id?: string;\n  url?: string;\n}\n\nexport interface SlackAuthHealth {\n  ok: boolean;\n  health: IntegrationInstallationHealth;\n  error: string | null;\n  checkedAt: number;\n  teamId: string | null;\n  enterpriseId: string | null;\n  botId: string | null;\n  userId: string | null;\n}\n\nexport interface SlackInstallSession {\n  email?: string | null;\n  orgId?: string | null;\n  orgRole?: string | null;\n}\n\nexport interface SlackInstallAccess {\n  ownerEmail: string;\n  orgId: string | null;\n  secretScope: SecretScope;\n  secretScopeId: string;\n}\n\nfunction safeSlackError(value: unknown, fallback: string): string {\n  return typeof value === \"string\" && /^[a-z0-9_.-]{1,100}$/i.test(value)\n    ? value\n    : fallback;\n}\n\nexport function buildSlackAuthorizeUrl(options: {\n  clientId: string;\n  redirectUri: string;\n  state: string;\n  scopes?: readonly string[];\n  userScopes?: readonly string[];\n  teamId?: string;\n}): string {\n  const params = new URLSearchParams({\n    client_id: options.clientId,\n    redirect_uri: options.redirectUri,\n    response_type: \"code\",\n    scope: (options.scopes ?? SLACK_AGENT_BOT_SCOPES).join(\",\"),\n    state: options.state,\n  });\n  if (options.userScopes?.length) {\n    params.set(\"user_scope\", options.userScopes.join(\",\"));\n  }\n  if (options.teamId) params.set(\"team\", options.teamId);\n  return `${SLACK_AUTHORIZE_URL}?${params.toString()}`;\n}\n\n/** Exchange an OAuth code using Slack's preferred HTTP Basic authentication. */\nexport async function exchangeSlackOAuthCode(options: {\n  code: string;\n  clientId: string;\n  clientSecret: string;\n  redirectUri: string;\n  fetchImpl?: typeof fetch;\n}): Promise<SlackOAuthAccessResponse> {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const authorization = Buffer.from(\n    `${options.clientId}:${options.clientSecret}`,\n    \"utf8\",\n  ).toString(\"base64\");\n  const response = await fetchImpl(SLACK_TOKEN_URL, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Basic ${authorization}`,\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n    },\n    body: new URLSearchParams({\n      code: options.code,\n      redirect_uri: options.redirectUri,\n    }),\n  });\n  const data = (await response\n    .json()\n    .catch(() => null)) as SlackOAuthAccessResponse | null;\n  if (!response.ok || !data?.ok) {\n    throw new Error(\n      safeSlackError(\n        data?.error,\n        `Slack OAuth exchange failed (${response.status})`,\n      ),\n    );\n  }\n  return data;\n}\n\n/**\n * Rotate an expiring Slack token. Slack refresh tokens are one-time-use, so\n * callers must atomically persist the returned access/refresh pair together.\n */\nexport async function refreshSlackOAuthToken(options: {\n  refreshToken: string;\n  clientId: string;\n  clientSecret: string;\n  fetchImpl?: typeof fetch;\n}): Promise<SlackOAuthAccessResponse> {\n  const fetchImpl = options.fetchImpl ?? fetch;\n  const authorization = Buffer.from(\n    `${options.clientId}:${options.clientSecret}`,\n    \"utf8\",\n  ).toString(\"base64\");\n  const response = await fetchImpl(SLACK_TOKEN_URL, {\n    method: \"POST\",\n    headers: {\n      Authorization: `Basic ${authorization}`,\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n    },\n    body: new URLSearchParams({\n      grant_type: \"refresh_token\",\n      refresh_token: options.refreshToken,\n    }),\n  });\n  const data = (await response\n    .json()\n    .catch(() => null)) as SlackOAuthAccessResponse | null;\n  if (!response.ok || !data?.ok) {\n    throw new Error(\n      safeSlackError(\n        data?.error,\n        `Slack OAuth token refresh failed (${response.status})`,\n      ),\n    );\n  }\n  if (!data.access_token || !data.refresh_token) {\n    throw new Error(\"Slack OAuth token refresh returned an incomplete bundle\");\n  }\n  return data;\n}\n\n/** Validate a bot token without ever including it in an error or result. */\nexport async function testSlackAuth(\n  accessToken: string,\n  fetchImpl: typeof fetch = fetch,\n): Promise<SlackAuthHealth> {\n  const checkedAt = Date.now();\n  try {\n    const response = await fetchImpl(SLACK_AUTH_TEST_URL, {\n      method: \"POST\",\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n    const data = (await response\n      .json()\n      .catch(() => null)) as SlackApiResponse | null;\n    if (!response.ok || !data?.ok) {\n      const error = safeSlackError(\n        data?.error,\n        `Slack auth test failed (${response.status})`,\n      );\n      return {\n        ok: false,\n        health:\n          error === \"invalid_auth\" || error === \"token_revoked\"\n            ? \"revoked\"\n            : \"degraded\",\n        error,\n        checkedAt,\n        teamId: null,\n        enterpriseId: null,\n        botId: null,\n        userId: null,\n      };\n    }\n    return {\n      ok: true,\n      health: \"healthy\",\n      error: null,\n      checkedAt,\n      teamId: data.team_id ?? null,\n      enterpriseId: data.enterprise_id ?? null,\n      botId: data.bot_id ?? null,\n      userId: data.user_id ?? null,\n    };\n  } catch {\n    return {\n      ok: false,\n      health: \"degraded\",\n      error: \"Slack auth test request failed\",\n      checkedAt,\n      teamId: null,\n      enterpriseId: null,\n      botId: null,\n      userId: null,\n    };\n  }\n}\n\n/** Stable team/app key used by webhook payloads and the installation store. */\nexport function slackInstallationKey(input: {\n  teamId?: string | null;\n  enterpriseId?: string | null;\n  apiAppId?: string | null;\n  isEnterpriseInstall?: boolean;\n}): string {\n  const workspaceId = input.isEnterpriseInstall\n    ? input.enterpriseId\n    : (input.teamId ?? input.enterpriseId);\n  if (!workspaceId) {\n    throw new Error(\"Slack OAuth did not return a team or enterprise id\");\n  }\n  return `${input.isEnterpriseInstall ? \"enterprise\" : \"team\"}:${workspaceId}:app:${input.apiAppId || \"default\"}`;\n}\n\n/**\n * Convert a successful Slack response to the generic managed-install input.\n * The returned token bundle is server-only and must be passed directly to the\n * encrypted installation store, never to a route response.\n */\nexport function slackOAuthResponseToInstallation(\n  response: SlackOAuthAccessResponse,\n  access: SlackInstallAccess,\n  now = Date.now(),\n): UpsertIntegrationInstallationInput {\n  if (!response.ok || !response.access_token) {\n    throw new Error(\"Slack OAuth response did not include a bot access token\");\n  }\n  const installationKey = slackInstallationKey({\n    teamId: response.team?.id,\n    enterpriseId: response.enterprise?.id,\n    apiAppId: response.app_id,\n    isEnterpriseInstall: response.is_enterprise_install,\n  });\n  const expiresAt =\n    typeof response.expires_in === \"number\" && response.expires_in > 0\n      ? now + response.expires_in * 1000\n      : undefined;\n  return {\n    platform: \"slack\",\n    installationKey,\n    teamId: response.team?.id ?? null,\n    teamName: response.team?.name ?? null,\n    enterpriseId: response.enterprise?.id ?? null,\n    enterpriseName: response.enterprise?.name ?? null,\n    isEnterpriseInstall: response.is_enterprise_install === true,\n    apiAppId: response.app_id ?? null,\n    botUserId: response.bot_user_id ?? null,\n    scopes: response.scope?.split(\",\").map((scope) => scope.trim()) ?? [],\n    installedByExternalUserId: response.authed_user?.id ?? null,\n    ownerEmail: access.ownerEmail,\n    orgId: access.orgId,\n    secretScope: access.secretScope,\n    secretScopeId: access.secretScopeId,\n    tokenBundle: {\n      accessToken: response.access_token,\n      refreshToken: response.refresh_token,\n      tokenType: response.token_type,\n      expiresAt,\n    },\n    tokenExpiresAt: expiresAt ?? null,\n  };\n}\n\n/**\n * Pure session/role gate for OAuth install routes. The caller must supply a\n * server-verified session; org membership must be the active org context.\n */\nexport function assertSlackInstallAccess(\n  session: SlackInstallSession | null | undefined,\n): SlackInstallAccess {\n  const ownerEmail = session?.email?.trim().toLowerCase();\n  if (!ownerEmail) throw new Error(\"Sign in before connecting Slack.\");\n  const orgId = session?.orgId?.trim() || null;\n  if (!orgId) {\n    return {\n      ownerEmail,\n      orgId: null,\n      secretScope: \"user\",\n      secretScopeId: ownerEmail,\n    };\n  }\n  if (session?.orgRole !== \"owner\" && session?.orgRole !== \"admin\") {\n    throw new Error(\"Only organization owners and admins can connect Slack.\");\n  }\n  return {\n    ownerEmail,\n    orgId,\n    secretScope: \"org\",\n    secretScopeId: orgId,\n  };\n}\n"]}

package/dist/integrations/types.d.ts

@@ -1,5 +1,32 @@
 import type { H3Event } from "h3";
+import type { AgentChatEvent } from "../agent/types.js";
 import type { EnvKeyConfig } from "../server/create-server.js";
+export type IntegrationConversationType = "channel" | "private_channel" | "dm" | "group_dm" | "unknown";
+export type IntegrationTriggerKind = "mention" | "dm" | "thread_reply";
+export interface IntegrationActorTrust {
+    memberType: "owner" | "admin" | "member" | "guest" | "external" | "unknown";
+    verified: boolean;
+}
+export interface IntegrationContextMessage {
+    senderId?: string;
+    senderName?: string;
+    text: string;
+    timestamp: number;
+    sourceUrl?: string;
+    reactions?: Array<{
+        name: string;
+        count: number;
+    }>;
+    files?: IntegrationFileReference[];
+}
+export interface IntegrationFileReference {
+    id: string;
+    name?: string;
+    mimetype?: string;
+    size?: number;
+    permalink?: string;
+    downloadUrl?: string;
+}
 /**
  * Normalized incoming message from any messaging platform.
  */
@@ -16,6 +43,22 @@ export interface IncomingMessage {
     senderEmail?: string;
     /** Platform-specific sender ID */
     senderId?: string;
+    /** How this message intentionally invoked an agent. */
+    triggerKind?: IntegrationTriggerKind;
+    /** Normalized provider conversation type for policy evaluation. */
+    conversationType?: IntegrationConversationType;
+    /** Provider tenant/workspace identifier. */
+    tenantId?: string;
+    /** Authorized integration scope resolved before execution. */
+    integrationScopeId?: string;
+    /** Normalized actor trust; unknown/unverified callers fail closed. */
+    actorTrust?: IntegrationActorTrust;
+    /** Bounded provider-native conversation context hydrated at run time. */
+    contextMessages?: IntegrationContextMessage[];
+    /** Provider file references only. Raw file bodies never belong here. */
+    files?: IntegrationFileReference[];
+    /** Server-verified approval grants carried by an interaction continuation. */
+    approvedToolCalls?: string[];
     /**
      * Whether the platform cryptographically authenticated that the message
      * genuinely came from the claimed sender (e.g. inbound email that passed
@@ -29,6 +72,31 @@ export interface IncomingMessage {
     senderVerified?: boolean;
     /** Raw platform-specific context needed for routing responses */
     platformContext: Record<string, unknown>;
+    /**
+     * Short-lived delivery context needed only while the queued task is active.
+     * Secrets such as Discord interaction tokens belong here, never in
+     * `platformContext`, thread mappings, logs, or agent-visible context.
+     */
+    responseContext?: Record<string, unknown>;
+    /** Provider-native thread/topic reference, when one exists. */
+    threadRef?: string;
+    /**
+     * Canonical provider URL for the originating message thread, when the
+     * provider can resolve one. This is safe agent-visible provenance (not a
+     * credential) and should be preserved across A2A delegation so created
+     * artifacts can link back to their request source.
+     */
+    sourceUrl?: string;
+    /**
+     * Trusted app-side routing guidance added after provider parsing. Adapters
+     * should not copy this from user-controlled webhook payload fields.
+     */
+    routingHint?: {
+        targetAgent?: string;
+        instruction: string;
+    };
+    /** Provider-native message/activity reference for contextual replies. */
+    replyRef?: string;
     /** Message timestamp (epoch ms) */
     timestamp: number;
 }
@@ -53,6 +121,10 @@ export interface OutboundTarget {
     threadRef?: string | null;
     /** Optional fallback display label */
     label?: string;
+    /** Provider tenant/workspace used to select an installation credential. */
+    tenantId?: string;
+    /** Managed installation id when the caller already resolved it. */
+    installationId?: string;
 }
 /**
  * Connection status for a platform integration.
@@ -76,6 +148,42 @@ export interface IntegrationStatus {
      *  frontend can render fields without hard-coding them per platform. */
     requiredEnvKeys?: import("../server/create-server.js").EnvKeyConfig[];
 }
+export interface PlatformAdapterCapabilities {
+    /** The adapter can deliver a response to the current inbound event. */
+    replyText: boolean;
+    /** The adapter can send without an active inbound event. */
+    proactiveMessages: boolean;
+    /** The adapter preserves a provider-native thread or topic reference. */
+    nativeThreads: boolean;
+    /** The adapter can quote/reply to a specific inbound message. */
+    contextualReplies: boolean;
+    /** The provider requires an immediate deferred webhook acknowledgement. */
+    deferredWebhookResponse: boolean;
+    /** The adapter only receives explicit interactions, not ordinary messages. */
+    interactionOnly?: boolean;
+    /** The adapter can hydrate bounded native thread/file/reaction context. */
+    nativeContextHydration?: boolean;
+    /** The adapter can surface live agent progress in the provider UI. */
+    liveRunProgress?: boolean;
+}
+export interface PlatformRunProgress {
+    /** Receive normalized agent events. Implementations should throttle writes. */
+    onEvent(event: AgentChatEvent): Promise<void> | void;
+    /** Finalize the provider-native progress surface with the answer. */
+    complete(message: OutgoingMessage): Promise<void>;
+    /** Mark the provider-native surface failed and leave a retryable explanation. */
+    fail?(message: string): Promise<void>;
+}
+export interface ImmediateWebhookResponse {
+    status: number;
+    body: unknown;
+}
+export declare class UnsupportedPlatformCapabilityError extends Error {
+    readonly platform: string;
+    readonly capability: keyof PlatformAdapterCapabilities;
+    readonly code = "UNSUPPORTED_PLATFORM_CAPABILITY";
+    constructor(platform: string, capability: keyof PlatformAdapterCapabilities);
+}
 /**
  * Platform adapter interface — implement this for each messaging platform.
  *
@@ -90,6 +198,8 @@ export interface PlatformAdapter {
     readonly platform: string;
     /** Human-readable label */
     readonly label: string;
+    /** Explicit runtime behavior. Missing fields are treated as unsupported. */
+    readonly capabilities?: Partial<PlatformAdapterCapabilities>;
     /** Env keys this adapter needs (tokens, secrets, etc.) */
     getRequiredEnvKeys(): EnvKeyConfig[];
     /**
@@ -111,6 +221,24 @@ export interface PlatformAdapter {
      * Return null to silently ignore the event (bot messages, edits, etc.).
      */
     parseIncomingMessage(event: H3Event): Promise<IncomingMessage | null>;
+    /**
+     * Hydrate bounded provider-native context after durable enqueue, outside the
+     * provider acknowledgement budget. Implementations must return references,
+     * metadata, and text only — never persist file bodies or credentials.
+     */
+    hydrateIncomingMessage?(incoming: IncomingMessage): Promise<IncomingMessage>;
+    /**
+     * Provider-specific response returned only after a message is verified and
+     * durably enqueued. Discord uses this to return a type-5 deferred response
+     * within its three-second interaction deadline.
+     */
+    getImmediateWebhookResponse?(incoming: IncomingMessage): ImmediateWebhookResponse | null;
+    /**
+     * Return pre-canonical thread ids used by older adapter versions. The
+     * integration handler checks these only when the canonical mapping is
+     * missing, then aliases a match to the canonical id without forking history.
+     */
+    getLegacyExternalThreadIds?(incoming: IncomingMessage): string[];
     /**
      * Send the agent's response back to the messaging platform.
      *
@@ -135,6 +263,8 @@ export interface PlatformAdapter {
     postProcessingPlaceholder?(incoming: IncomingMessage): Promise<{
         placeholderRef: string;
     } | null>;
+    /** Start a provider-native progress/streaming surface for an agent run. */
+    startRunProgress?(incoming: IncomingMessage): Promise<PlatformRunProgress | null>;
     /**
      * Send a proactive outbound message to a platform destination. Adapters that
      * only support direct replies can omit this.
@@ -155,6 +285,7 @@ export interface PlatformAdapter {
     /** Return current connection/configuration status for the settings UI. */
     getStatus(baseUrl?: string): Promise<IntegrationStatus>;
 }
+export declare function assertPlatformCapability(adapter: PlatformAdapter, capability: keyof PlatformAdapterCapabilities): void;
 /**
  * Options for the integrations plugin.
  */
@@ -181,6 +312,12 @@ export interface IntegrationsPluginOptions {
      * created chat thread for an incoming platform message.
      */
     resolveOwner?: (incoming: IncomingMessage) => string | Promise<string>;
+    /**
+     * Resolve the durable execution principal for an inbound provider message.
+     * Shared channels should use a service principal; DMs may use a verified
+     * linked user. When present this supersedes `resolveOwner`.
+     */
+    resolveExecutionContext?: (incoming: IncomingMessage) => IntegrationExecutionContext | Promise<IntegrationExecutionContext>;
     /**
      * Optional preprocessor for inbound platform messages. Can intercept special
      * commands (such as `/link`) before the agent loop runs.
@@ -192,4 +329,11 @@ export interface IntegrationsPluginOptions {
         handled: false;
     }>;
 }
+export interface IntegrationExecutionContext {
+    ownerEmail: string;
+    orgId: string | null;
+    principalType: "user" | "service";
+    installationId?: string;
+    scopeId?: string;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/integrations/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/integrations/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAC;IACzB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;4EAEwE;IACxE,eAAe,CAAC,EAAE,OAAO,4BAA4B,EAAE,YAAY,EAAE,CAAC;CACvE;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,0DAA0D;IAC1D,kBAAkB,IAAI,YAAY,EAAE,CAAC;IAErC;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD;;;OAGG;IACH,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEtE;;;;;;;OAOG;IACH,YAAY,CACV,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;;OASG;IACH,yBAAyB,CAAC,CACxB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE9C;;;OAGG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;OAQG;IACH,mBAAmB,CACjB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,eAAe,CAAC;IAEnB,0EAA0E;IAC1E,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACzD;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,qGAAqG;IACrG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,8BAA8B,EAAE,WAAW,CAAC,CAAC;IAC7E,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,MAAM,CAAC,EACH,OAAO,0BAA0B,EAAE,WAAW,GAC9C,MAAM,GACN;QACE,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;IACN;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE;;;OAGG;IACH,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,eAAe,KACrB,OAAO,CACR;QACE,OAAO,EAAE,IAAI,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACD;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CACrB,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/integrations/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAElC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAE/D,MAAM,MAAM,2BAA2B,GACnC,SAAS,GACT,iBAAiB,GACjB,IAAI,GACJ,UAAU,GACV,SAAS,CAAC;AAEd,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,IAAI,GAAG,cAAc,CAAC;AAEvE,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,wBAAwB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,gBAAgB,EAAE,MAAM,CAAC;IACzB,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IAC/C,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,sEAAsE;IACtE,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,yEAAyE;IACzE,eAAe,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC9C,wEAAwE;IACxE,KAAK,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACnC,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iEAAiE;IACjE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sCAAsC;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,UAAU,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;4EAEwE;IACxE,eAAe,CAAC,EAAE,OAAO,4BAA4B,EAAE,YAAY,EAAE,CAAC;CACvE;AAED,MAAM,WAAW,2BAA2B;IAC1C,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,4DAA4D;IAC5D,iBAAiB,EAAE,OAAO,CAAC;IAC3B,yEAAyE;IACzE,aAAa,EAAE,OAAO,CAAC;IACvB,iEAAiE;IACjE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,2EAA2E;IAC3E,uBAAuB,EAAE,OAAO,CAAC;IACjC,8EAA8E;IAC9E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,2EAA2E;IAC3E,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,sEAAsE;IACtE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,+EAA+E;IAC/E,OAAO,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACrD,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,iFAAiF;IACjF,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;CACf;AAED,qBAAa,kCAAmC,SAAQ,KAAK;IAIzD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,2BAA2B;IAJxD,QAAQ,CAAC,IAAI,qCAAqC;IAElD,YACW,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,2BAA2B,EAIvD;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2BAA2B;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE7D,0DAA0D;IAC1D,kBAAkB,IAAI,YAAY,EAAE,CAAC;IAErC;;;;OAIG;IACH,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,CAAC;IAEH;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhD;;;OAGG;IACH,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAEtE;;;;OAIG;IACH,sBAAsB,CAAC,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAE7E;;;;OAIG;IACH,2BAA2B,CAAC,CAC1B,QAAQ,EAAE,eAAe,GACxB,wBAAwB,GAAG,IAAI,CAAC;IAEnC;;;;OAIG;IACH,0BAA0B,CAAC,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,EAAE,CAAC;IAEjE;;;;;;;OAOG;IACH,YAAY,CACV,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,eAAe,EACxB,IAAI,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,GACjC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;;OASG;IACH,yBAAyB,CAAC,CACxB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAE9C,2EAA2E;IAC3E,gBAAgB,CAAC,CACf,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAEvC;;;OAGG;IACH,mBAAmB,CAAC,CAClB,OAAO,EAAE,eAAe,EACxB,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;OAQG;IACH,mBAAmB,CACjB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,eAAe,CAAC;IAEnB,0EAA0E;IAC1E,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACzD;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,2BAA2B,GAC5C,IAAI,CAIN;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,QAAQ,CAAC,EAAE,eAAe,EAAE,CAAC;IAC7B,qGAAqG;IACrG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,8BAA8B,EAAE,WAAW,CAAC,CAAC;IAC7E,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,MAAM,CAAC,EACH,OAAO,0BAA0B,EAAE,WAAW,GAC9C,MAAM,GACN;QACE,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;IACN;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,eAAe,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvE;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,CACxB,QAAQ,EAAE,eAAe,KACtB,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACxE;;;OAGG;IACH,aAAa,CAAC,EAAE,CACd,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,eAAe,KACrB,OAAO,CACR;QACE,OAAO,EAAE,IAAI,CAAC;QACd,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,GACD;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,CACrB,CAAC;CACH;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}

package/dist/integrations/types.js

@@ -1,2 +1,17 @@
-export {};
+export class UnsupportedPlatformCapabilityError extends Error {
+    platform;
+    capability;
+    code = "UNSUPPORTED_PLATFORM_CAPABILITY";
+    constructor(platform, capability) {
+        super(`Platform ${platform} does not support ${capability}`);
+        this.platform = platform;
+        this.capability = capability;
+        this.name = "UnsupportedPlatformCapabilityError";
+    }
+}
+export function assertPlatformCapability(adapter, capability) {
+    if (adapter.capabilities?.[capability] !== true) {
+        throw new UnsupportedPlatformCapabilityError(adapter.platform, capability);
+    }
+}
 //# sourceMappingURL=types.js.map