@agent-native/core 0.98.5 → 0.98.7

package/dist/integrations/identity-links-store.js

@@ -0,0 +1,158 @@
+/**
+ * Durable links between a verified provider identity and an Agent Native user.
+ * Provider credentials and raw provider payloads never belong in this table.
+ */
+import { randomUUID } from "node:crypto";
+import { getDbExec, intType, isPostgres, isUniqueViolation, retryOnDdlRace, } from "../db/client.js";
+import { ensureIndexExists, ensureTableExists } from "../db/ddl-guard.js";
+const TABLE = "integration_identity_links";
+let _initPromise;
+function createSql() {
+    const integer = intType();
+    return `CREATE TABLE IF NOT EXISTS ${TABLE} (
+    id TEXT PRIMARY KEY,
+    platform TEXT NOT NULL,
+    tenant_id TEXT NOT NULL,
+    external_user_id TEXT NOT NULL,
+    user_email TEXT NOT NULL,
+    org_id TEXT NOT NULL,
+    created_at ${integer} NOT NULL,
+    updated_at ${integer} NOT NULL
+  )`;
+}
+const INDEXES = [
+    [
+        "idx_integration_identity_links_external",
+        `CREATE UNIQUE INDEX IF NOT EXISTS idx_integration_identity_links_external
+      ON ${TABLE}(platform, tenant_id, external_user_id)`,
+    ],
+    [
+        "idx_integration_identity_links_account",
+        `CREATE INDEX IF NOT EXISTS idx_integration_identity_links_account
+      ON ${TABLE}(org_id, user_email)`,
+    ],
+];
+async function ensureTable() {
+    if (!_initPromise) {
+        _initPromise = (async () => {
+            const client = getDbExec();
+            if (isPostgres()) {
+                await ensureTableExists(TABLE, createSql());
+                for (const [name, sql] of INDEXES) {
+                    await ensureIndexExists(name, sql);
+                }
+                return;
+            }
+            await retryOnDdlRace(() => client.execute(createSql()));
+            for (const [, sql] of INDEXES) {
+                await retryOnDdlRace(() => client.execute(sql));
+            }
+        })().catch((error) => {
+            _initPromise = undefined;
+            throw error;
+        });
+    }
+    return _initPromise;
+}
+function required(value, name) {
+    const normalized = value.trim();
+    if (!normalized)
+        throw new Error(`${name} is required`);
+    if (normalized.length > 512)
+        throw new Error(`${name} is too long`);
+    return normalized;
+}
+function normalizePlatform(value) {
+    return required(value, "platform").toLowerCase();
+}
+function normalizeEmail(value) {
+    const normalized = required(value, "userEmail").toLowerCase();
+    if (!normalized.includes("@"))
+        throw new Error("userEmail must be an email");
+    return normalized;
+}
+function rowToLink(row) {
+    return {
+        id: String(row.id),
+        platform: String(row.platform),
+        tenantId: String(row.tenant_id),
+        externalUserId: String(row.external_user_id),
+        userEmail: String(row.user_email),
+        orgId: String(row.org_id),
+        createdAt: Number(row.created_at ?? 0),
+        updatedAt: Number(row.updated_at ?? 0),
+    };
+}
+async function selectByExternalIdentity(platform, tenantId, externalUserId) {
+    await ensureTable();
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT * FROM ${TABLE}
+      WHERE platform = ? AND tenant_id = ? AND external_user_id = ?
+      LIMIT 1`,
+        args: [platform, tenantId, externalUserId],
+    });
+    return rows[0] ? rowToLink(rows[0]) : null;
+}
+function matchesVerifiedLink(row, input) {
+    return row.userEmail === input.userEmail && row.orgId === input.orgId;
+}
+/** Persist a verified mapping and fail closed if it changes identity later. */
+export async function upsertVerifiedIntegrationIdentity(input) {
+    const platform = normalizePlatform(input.platform);
+    const tenantId = required(input.tenantId, "tenantId");
+    const externalUserId = required(input.externalUserId, "externalUserId");
+    const userEmail = normalizeEmail(input.userEmail);
+    const orgId = required(input.orgId, "orgId");
+    const existing = await selectByExternalIdentity(platform, tenantId, externalUserId);
+    if (existing) {
+        if (!matchesVerifiedLink(existing, { userEmail, orgId })) {
+            throw new Error("This provider identity is already linked to a different Agent Native account.");
+        }
+        const updatedAt = Date.now();
+        await getDbExec().execute({
+            sql: `UPDATE ${TABLE} SET updated_at = ? WHERE id = ?`,
+            args: [updatedAt, existing.id],
+        });
+        return { ...existing, updatedAt };
+    }
+    const id = randomUUID();
+    const now = Date.now();
+    try {
+        await getDbExec().execute({
+            sql: `INSERT INTO ${TABLE} (
+        id, platform, tenant_id, external_user_id, user_email, org_id,
+        created_at, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+            args: [
+                id,
+                platform,
+                tenantId,
+                externalUserId,
+                userEmail,
+                orgId,
+                now,
+                now,
+            ],
+        });
+    }
+    catch (error) {
+        if (!isUniqueViolation(error))
+            throw error;
+        const raced = await selectByExternalIdentity(platform, tenantId, externalUserId);
+        if (!raced || !matchesVerifiedLink(raced, { userEmail, orgId })) {
+            throw new Error("This provider identity is already linked to a different Agent Native account.");
+        }
+        return raced;
+    }
+    return {
+        id,
+        platform,
+        tenantId,
+        externalUserId,
+        userEmail,
+        orgId,
+        createdAt: now,
+        updatedAt: now,
+    };
+}
+//# sourceMappingURL=identity-links-store.js.map

package/dist/integrations/identity-links-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-links-store.js","sourceRoot":"","sources":["../../src/integrations/identity-links-store.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EACL,SAAS,EACT,OAAO,EACP,UAAU,EACV,iBAAiB,EACjB,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE1E,MAAM,KAAK,GAAG,4BAA4B,CAAC;AAC3C,IAAI,YAAuC,CAAC;AAa5C,SAAS,SAAS;IAChB,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;IAC1B,OAAO,8BAA8B,KAAK;;;;;;;iBAO3B,OAAO;iBACP,OAAO;IACpB,CAAC;AACL,CAAC;AAED,MAAM,OAAO,GAAG;IACd;QACE,yCAAyC;QACzC;WACO,KAAK,yCAAyC;KACtD;IACD;QACE,wCAAwC;QACxC;WACO,KAAK,sBAAsB;KACnC;CACO,CAAC;AAEX,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,MAAM,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;oBAClC,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YACxD,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAClD,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACnB,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,IAAY;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,CAAC,CAAC;IACpE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC7E,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAAC,GAA4B;IAC7C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QAC/B,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC5C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACtC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,QAAgB,EAChB,QAAgB,EAChB,cAAsB;IAEtB,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE,iBAAiB,KAAK;;cAEjB;QACV,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,CAAC;KAC3C,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAA4B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAA4B,EAC5B,KAA2C;IAE3C,OAAO,GAAG,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,KAMvD;IACC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,QAAQ,EACR,QAAQ,EACR,cAAc,CACf,CAAC;IAEF,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACxB,GAAG,EAAE,UAAU,KAAK,kCAAkC;YACtD,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;IACpC,CAAC;IAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;YACxB,GAAG,EAAE,eAAe,KAAK;;;wCAGS;YAClC,IAAI,EAAE;gBACJ,EAAE;gBACF,QAAQ;gBACR,QAAQ;gBACR,cAAc;gBACd,SAAS;gBACT,KAAK;gBACL,GAAG;gBACH,GAAG;aACJ;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAC1C,QAAQ,EACR,QAAQ,EACR,cAAc,CACf,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,EAAE;QACF,QAAQ;QACR,QAAQ;QACR,cAAc;QACd,SAAS;QACT,KAAK;QACL,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;KACf,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Durable links between a verified provider identity and an Agent Native user.\n * Provider credentials and raw provider payloads never belong in this table.\n */\n\nimport { randomUUID } from \"node:crypto\";\n\nimport {\n  getDbExec,\n  intType,\n  isPostgres,\n  isUniqueViolation,\n  retryOnDdlRace,\n} from \"../db/client.js\";\nimport { ensureIndexExists, ensureTableExists } from \"../db/ddl-guard.js\";\n\nconst TABLE = \"integration_identity_links\";\nlet _initPromise: Promise<void> | undefined;\n\nexport interface IntegrationIdentityLink {\n  id: string;\n  platform: string;\n  tenantId: string;\n  externalUserId: string;\n  userEmail: string;\n  orgId: string;\n  createdAt: number;\n  updatedAt: number;\n}\n\nfunction createSql(): string {\n  const integer = intType();\n  return `CREATE TABLE IF NOT EXISTS ${TABLE} (\n    id TEXT PRIMARY KEY,\n    platform TEXT NOT NULL,\n    tenant_id TEXT NOT NULL,\n    external_user_id TEXT NOT NULL,\n    user_email TEXT NOT NULL,\n    org_id TEXT NOT NULL,\n    created_at ${integer} NOT NULL,\n    updated_at ${integer} NOT NULL\n  )`;\n}\n\nconst INDEXES = [\n  [\n    \"idx_integration_identity_links_external\",\n    `CREATE UNIQUE INDEX IF NOT EXISTS idx_integration_identity_links_external\n      ON ${TABLE}(platform, tenant_id, external_user_id)`,\n  ],\n  [\n    \"idx_integration_identity_links_account\",\n    `CREATE INDEX IF NOT EXISTS idx_integration_identity_links_account\n      ON ${TABLE}(org_id, user_email)`,\n  ],\n] as const;\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      if (isPostgres()) {\n        await ensureTableExists(TABLE, createSql());\n        for (const [name, sql] of INDEXES) {\n          await ensureIndexExists(name, sql);\n        }\n        return;\n      }\n      await retryOnDdlRace(() => client.execute(createSql()));\n      for (const [, sql] of INDEXES) {\n        await retryOnDdlRace(() => client.execute(sql));\n      }\n    })().catch((error) => {\n      _initPromise = undefined;\n      throw error;\n    });\n  }\n  return _initPromise;\n}\n\nfunction required(value: string, name: string): string {\n  const normalized = value.trim();\n  if (!normalized) throw new Error(`${name} is required`);\n  if (normalized.length > 512) throw new Error(`${name} is too long`);\n  return normalized;\n}\n\nfunction normalizePlatform(value: string): string {\n  return required(value, \"platform\").toLowerCase();\n}\n\nfunction normalizeEmail(value: string): string {\n  const normalized = required(value, \"userEmail\").toLowerCase();\n  if (!normalized.includes(\"@\")) throw new Error(\"userEmail must be an email\");\n  return normalized;\n}\n\nfunction rowToLink(row: Record<string, unknown>): IntegrationIdentityLink {\n  return {\n    id: String(row.id),\n    platform: String(row.platform),\n    tenantId: String(row.tenant_id),\n    externalUserId: String(row.external_user_id),\n    userEmail: String(row.user_email),\n    orgId: String(row.org_id),\n    createdAt: Number(row.created_at ?? 0),\n    updatedAt: Number(row.updated_at ?? 0),\n  };\n}\n\nasync function selectByExternalIdentity(\n  platform: string,\n  tenantId: string,\n  externalUserId: string,\n): Promise<IntegrationIdentityLink | null> {\n  await ensureTable();\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT * FROM ${TABLE}\n      WHERE platform = ? AND tenant_id = ? AND external_user_id = ?\n      LIMIT 1`,\n    args: [platform, tenantId, externalUserId],\n  });\n  return rows[0] ? rowToLink(rows[0] as Record<string, unknown>) : null;\n}\n\nfunction matchesVerifiedLink(\n  row: IntegrationIdentityLink,\n  input: { userEmail: string; orgId: string },\n): boolean {\n  return row.userEmail === input.userEmail && row.orgId === input.orgId;\n}\n\n/** Persist a verified mapping and fail closed if it changes identity later. */\nexport async function upsertVerifiedIntegrationIdentity(input: {\n  platform: string;\n  tenantId: string;\n  externalUserId: string;\n  userEmail: string;\n  orgId: string;\n}): Promise<IntegrationIdentityLink> {\n  const platform = normalizePlatform(input.platform);\n  const tenantId = required(input.tenantId, \"tenantId\");\n  const externalUserId = required(input.externalUserId, \"externalUserId\");\n  const userEmail = normalizeEmail(input.userEmail);\n  const orgId = required(input.orgId, \"orgId\");\n  const existing = await selectByExternalIdentity(\n    platform,\n    tenantId,\n    externalUserId,\n  );\n\n  if (existing) {\n    if (!matchesVerifiedLink(existing, { userEmail, orgId })) {\n      throw new Error(\n        \"This provider identity is already linked to a different Agent Native account.\",\n      );\n    }\n    const updatedAt = Date.now();\n    await getDbExec().execute({\n      sql: `UPDATE ${TABLE} SET updated_at = ? WHERE id = ?`,\n      args: [updatedAt, existing.id],\n    });\n    return { ...existing, updatedAt };\n  }\n\n  const id = randomUUID();\n  const now = Date.now();\n  try {\n    await getDbExec().execute({\n      sql: `INSERT INTO ${TABLE} (\n        id, platform, tenant_id, external_user_id, user_email, org_id,\n        created_at, updated_at\n      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n      args: [\n        id,\n        platform,\n        tenantId,\n        externalUserId,\n        userEmail,\n        orgId,\n        now,\n        now,\n      ],\n    });\n  } catch (error) {\n    if (!isUniqueViolation(error)) throw error;\n    const raced = await selectByExternalIdentity(\n      platform,\n      tenantId,\n      externalUserId,\n    );\n    if (!raced || !matchesVerifiedLink(raced, { userEmail, orgId })) {\n      throw new Error(\n        \"This provider identity is already linked to a different Agent Native account.\",\n      );\n    }\n    return raced;\n  }\n\n  return {\n    id,\n    platform,\n    tenantId,\n    externalUserId,\n    userEmail,\n    orgId,\n    createdAt: now,\n    updatedAt: now,\n  };\n}\n"]}

package/dist/integrations/identity.d.ts

@@ -0,0 +1,28 @@
+import type { IncomingMessage, IntegrationExecutionContext } from "./types.js";
+export type IntegrationIdentityDeclineReason = "unverified" | "guest" | "unlinked-workspace" | "membership-check-failed";
+/**
+ * Thrown when the default Slack DM identity ladder declines to run a message.
+ * `reason` is a stable machine-readable discriminator (used e.g. to dedupe
+ * decline replies); `userFacingMessage` is safe to send back to the sender as
+ * a polite reply; `message` stays log-only.
+ */
+export declare class IntegrationIdentityDeclinedError extends Error {
+    readonly reason: IntegrationIdentityDeclineReason;
+    readonly userFacingMessage: string;
+    constructor(reason: IntegrationIdentityDeclineReason, message: string, userFacingMessage: string);
+}
+/**
+ * Resolve the default integration principal.
+ *
+ * Slack DMs become a user principal only after the adapter has verified the
+ * sender email and the email is already a member of the managed installation's
+ * Agent Native organization. Hydrated full workspace members whose email is
+ * missing, unverified, or not an organization member run as an anonymous
+ * org-scoped service principal instead — the same visibility shared channels
+ * get. Hydration failures, guests/external members, and workspaces without a
+ * connected organization are declined with a user-facing message. Shared
+ * channels deliberately stay service-scoped so a channel message cannot borrow
+ * one participant's private permissions.
+ */
+export declare function resolveDefaultIntegrationExecutionContext(incoming: IncomingMessage): Promise<IntegrationExecutionContext>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/integrations/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/integrations/identity.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE/E,MAAM,MAAM,gCAAgC,GACxC,YAAY,GACZ,OAAO,GACP,oBAAoB,GACpB,yBAAyB,CAAC;AAE9B;;;;;GAKG;AACH,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAC;IAClD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IAEnC,YACE,MAAM,EAAE,gCAAgC,EACxC,OAAO,EAAE,MAAM,EACf,iBAAiB,EAAE,MAAM,EAM1B;CACF;AAmDD;;;;;;;;;;;;GAYG;AACH,wBAAsB,yCAAyC,CAC7D,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,2BAA2B,CAAC,CA8FtC"}

package/dist/integrations/identity.js

@@ -0,0 +1,142 @@
+import { getDbExec } from "../db/client.js";
+import { upsertVerifiedIntegrationIdentity } from "./identity-links-store.js";
+import { getActiveIntegrationInstallationByKey, getActiveIntegrationInstallationForTenant, } from "./installations-store.js";
+import { slackInstallationKey } from "./slack-oauth.js";
+/**
+ * Thrown when the default Slack DM identity ladder declines to run a message.
+ * `reason` is a stable machine-readable discriminator (used e.g. to dedupe
+ * decline replies); `userFacingMessage` is safe to send back to the sender as
+ * a polite reply; `message` stays log-only.
+ */
+export class IntegrationIdentityDeclinedError extends Error {
+    reason;
+    userFacingMessage;
+    constructor(reason, message, userFacingMessage) {
+        super(message);
+        this.name = "IntegrationIdentityDeclinedError";
+        this.reason = reason;
+        this.userFacingMessage = userFacingMessage;
+    }
+}
+function serviceOwner(platform) {
+    return `integration@${platform}`;
+}
+function normalizedEmail(value) {
+    if (typeof value !== "string")
+        return null;
+    const email = value.trim().toLowerCase();
+    if (!email || email.length > 320 || !email.includes("@"))
+        return null;
+    return email;
+}
+async function resolveSlackInstallation(incoming) {
+    const teamId = typeof incoming.platformContext.teamId === "string"
+        ? incoming.platformContext.teamId
+        : incoming.tenantId;
+    const enterpriseId = typeof incoming.platformContext.enterpriseId === "string"
+        ? incoming.platformContext.enterpriseId
+        : undefined;
+    const apiAppId = typeof incoming.platformContext.apiAppId === "string"
+        ? incoming.platformContext.apiAppId
+        : undefined;
+    if (apiAppId && (teamId || enterpriseId)) {
+        const byKey = await getActiveIntegrationInstallationByKey("slack", slackInstallationKey({ teamId, enterpriseId, apiAppId }));
+        if (byKey)
+            return byKey;
+    }
+    return teamId || enterpriseId
+        ? getActiveIntegrationInstallationForTenant("slack", teamId ?? enterpriseId)
+        : null;
+}
+async function isMemberOfOrg(email, orgId) {
+    const { rows } = await getDbExec().execute({
+        sql: `SELECT 1 FROM org_members
+        WHERE org_id = ? AND LOWER(email) = ?
+        LIMIT 1`,
+        args: [orgId, email],
+    });
+    return rows.length > 0;
+}
+/**
+ * Resolve the default integration principal.
+ *
+ * Slack DMs become a user principal only after the adapter has verified the
+ * sender email and the email is already a member of the managed installation's
+ * Agent Native organization. Hydrated full workspace members whose email is
+ * missing, unverified, or not an organization member run as an anonymous
+ * org-scoped service principal instead — the same visibility shared channels
+ * get. Hydration failures, guests/external members, and workspaces without a
+ * connected organization are declined with a user-facing message. Shared
+ * channels deliberately stay service-scoped so a channel message cannot borrow
+ * one participant's private permissions.
+ */
+export async function resolveDefaultIntegrationExecutionContext(incoming) {
+    const installation = incoming.platform === "slack"
+        ? await resolveSlackInstallation(incoming)
+        : null;
+    if (incoming.platform !== "slack" || incoming.conversationType !== "dm") {
+        return {
+            ownerEmail: serviceOwner(incoming.platform),
+            orgId: installation?.orgId ?? null,
+            principalType: "service",
+            ...(installation?.id ? { installationId: installation.id } : {}),
+        };
+    }
+    // Hydration check first: a transient users.info failure must land on the
+    // retry decline here, never on the anonymous org-scoped tier below.
+    if (incoming.actorTrust?.verified !== true) {
+        throw new IntegrationIdentityDeclinedError("unverified", "Slack DM sender identity could not be hydrated; declining instead of guessing a principal.", "I couldn't verify your Slack identity just now, so I can't run this request. Please try again in a moment.");
+    }
+    if (incoming.actorTrust.memberType === "guest" ||
+        incoming.actorTrust.memberType === "external") {
+        throw new IntegrationIdentityDeclinedError("guest", "External or guest Slack members cannot use this integration.", "This assistant is only available to members of this workspace's organization.");
+    }
+    if (!installation?.orgId) {
+        throw new IntegrationIdentityDeclinedError("unlinked-workspace", "Slack workspace is not connected to an Agent Native organization.", "This Slack workspace isn't connected to an organization yet.");
+    }
+    const email = normalizedEmail(incoming.senderEmail);
+    let isOrgMember = false;
+    if (email &&
+        incoming.senderVerified === true &&
+        incoming.senderId &&
+        incoming.tenantId) {
+        try {
+            isOrgMember = await isMemberOfOrg(email, installation.orgId);
+        }
+        catch {
+            // A membership-store outage is not evidence that the sender is merely
+            // unlinked. Fail closed instead of widening them to org-wide access.
+            throw new IntegrationIdentityDeclinedError("membership-check-failed", "Slack DM organization membership could not be verified.", "I couldn't verify your organization membership just now, so I can't run this request. Please try again in a moment.");
+        }
+    }
+    if (isOrgMember && email && incoming.senderId && incoming.tenantId) {
+        const link = await upsertVerifiedIntegrationIdentity({
+            platform: incoming.platform,
+            tenantId: incoming.tenantId,
+            externalUserId: incoming.senderId,
+            userEmail: email,
+            orgId: installation.orgId,
+        });
+        return {
+            ownerEmail: link.userEmail,
+            orgId: link.orgId,
+            principalType: "user",
+            installationId: installation.id,
+        };
+    }
+    // Hydrated full workspace member (member/admin/owner) whose email is
+    // unverified, missing (legacy install without users:read.email), or not an
+    // organization member: run with the anonymous org-scoped service principal —
+    // the same visibility shared channels get. Nothing user-private is
+    // accessible. One structured line keeps 100%-anonymous workspaces (legacy
+    // scope missing) visible in logs.
+    console.warn(`[integrations] anonymous org-scoped principal used: platform=${incoming.platform} teamId=${incoming.tenantId ?? "unknown"} emailPresent=${Boolean(email)} memberType=${incoming.actorTrust.memberType}`);
+    return {
+        ownerEmail: serviceOwner(incoming.platform),
+        orgId: installation.orgId,
+        principalType: "service",
+        installationId: installation.id,
+        anonymousMember: true,
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/integrations/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/integrations/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EACL,qCAAqC,EACrC,yCAAyC,GAC1C,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AASxD;;;;;GAKG;AACH,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAChD,MAAM,CAAmC;IACzC,iBAAiB,CAAS;IAEnC,YACE,MAAwC,EACxC,OAAe,EACf,iBAAyB;QAEzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;QAC/C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,eAAe,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,QAAyB;IAC/D,MAAM,MAAM,GACV,OAAO,QAAQ,CAAC,eAAe,CAAC,MAAM,KAAK,QAAQ;QACjD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM;QACjC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACxB,MAAM,YAAY,GAChB,OAAO,QAAQ,CAAC,eAAe,CAAC,YAAY,KAAK,QAAQ;QACvD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,QAAQ,GACZ,OAAO,QAAQ,CAAC,eAAe,CAAC,QAAQ,KAAK,QAAQ;QACnD,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ;QACnC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,QAAQ,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,qCAAqC,CACvD,OAAO,EACP,oBAAoB,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,CACzD,CAAC;QACF,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,IAAI,YAAY;QAC3B,CAAC,CAAC,yCAAyC,CACvC,OAAO,EACP,MAAM,IAAI,YAAa,CACxB;QACH,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAa,EAAE,KAAa;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC,OAAO,CAAC;QACzC,GAAG,EAAE;;gBAEO;QACZ,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC7D,QAAyB;IAEzB,MAAM,YAAY,GAChB,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAC3B,CAAC,CAAC,MAAM,wBAAwB,CAAC,QAAQ,CAAC;QAC1C,CAAC,CAAC,IAAI,CAAC;IAEX,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACxE,OAAO;YACL,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3C,KAAK,EAAE,YAAY,EAAE,KAAK,IAAI,IAAI;YAClC,aAAa,EAAE,SAAS;YACxB,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,QAAQ,CAAC,UAAU,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,IAAI,gCAAgC,CACxC,YAAY,EACZ,4FAA4F,EAC5F,4GAA4G,CAC7G,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,UAAU,CAAC,UAAU,KAAK,OAAO;QAC1C,QAAQ,CAAC,UAAU,CAAC,UAAU,KAAK,UAAU,EAC7C,CAAC;QACD,MAAM,IAAI,gCAAgC,CACxC,OAAO,EACP,8DAA8D,EAC9D,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,gCAAgC,CACxC,oBAAoB,EACpB,mEAAmE,EACnE,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IACE,KAAK;QACL,QAAQ,CAAC,cAAc,KAAK,IAAI;QAChC,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,QAAQ,EACjB,CAAC;QACD,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,IAAI,gCAAgC,CACxC,yBAAyB,EACzB,yDAAyD,EACzD,qHAAqH,CACtH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,WAAW,IAAI,KAAK,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,iCAAiC,CAAC;YACnD,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,cAAc,EAAE,QAAQ,CAAC,QAAQ;YACjC,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,YAAY,CAAC,KAAK;SAC1B,CAAC,CAAC;QACH,OAAO;YACL,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,MAAM;YACrB,cAAc,EAAE,YAAY,CAAC,EAAE;SAChC,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,mEAAmE;IACnE,0EAA0E;IAC1E,kCAAkC;IAClC,OAAO,CAAC,IAAI,CACV,gEAAgE,QAAQ,CAAC,QAAQ,WAAW,QAAQ,CAAC,QAAQ,IAAI,SAAS,iBAAiB,OAAO,CAAC,KAAK,CAAC,eAAe,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,CACzM,CAAC;IACF,OAAO;QACL,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,aAAa,EAAE,SAAS;QACxB,cAAc,EAAE,YAAY,CAAC,EAAE;QAC/B,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC","sourcesContent":["import { getDbExec } from \"../db/client.js\";\nimport { upsertVerifiedIntegrationIdentity } from \"./identity-links-store.js\";\nimport {\n  getActiveIntegrationInstallationByKey,\n  getActiveIntegrationInstallationForTenant,\n} from \"./installations-store.js\";\nimport { slackInstallationKey } from \"./slack-oauth.js\";\nimport type { IncomingMessage, IntegrationExecutionContext } from \"./types.js\";\n\nexport type IntegrationIdentityDeclineReason =\n  | \"unverified\"\n  | \"guest\"\n  | \"unlinked-workspace\"\n  | \"membership-check-failed\";\n\n/**\n * Thrown when the default Slack DM identity ladder declines to run a message.\n * `reason` is a stable machine-readable discriminator (used e.g. to dedupe\n * decline replies); `userFacingMessage` is safe to send back to the sender as\n * a polite reply; `message` stays log-only.\n */\nexport class IntegrationIdentityDeclinedError extends Error {\n  readonly reason: IntegrationIdentityDeclineReason;\n  readonly userFacingMessage: string;\n\n  constructor(\n    reason: IntegrationIdentityDeclineReason,\n    message: string,\n    userFacingMessage: string,\n  ) {\n    super(message);\n    this.name = \"IntegrationIdentityDeclinedError\";\n    this.reason = reason;\n    this.userFacingMessage = userFacingMessage;\n  }\n}\n\nfunction serviceOwner(platform: string): string {\n  return `integration@${platform}`;\n}\n\nfunction normalizedEmail(value: unknown): string | null {\n  if (typeof value !== \"string\") return null;\n  const email = value.trim().toLowerCase();\n  if (!email || email.length > 320 || !email.includes(\"@\")) return null;\n  return email;\n}\n\nasync function resolveSlackInstallation(incoming: IncomingMessage) {\n  const teamId =\n    typeof incoming.platformContext.teamId === \"string\"\n      ? incoming.platformContext.teamId\n      : incoming.tenantId;\n  const enterpriseId =\n    typeof incoming.platformContext.enterpriseId === \"string\"\n      ? incoming.platformContext.enterpriseId\n      : undefined;\n  const apiAppId =\n    typeof incoming.platformContext.apiAppId === \"string\"\n      ? incoming.platformContext.apiAppId\n      : undefined;\n  if (apiAppId && (teamId || enterpriseId)) {\n    const byKey = await getActiveIntegrationInstallationByKey(\n      \"slack\",\n      slackInstallationKey({ teamId, enterpriseId, apiAppId }),\n    );\n    if (byKey) return byKey;\n  }\n  return teamId || enterpriseId\n    ? getActiveIntegrationInstallationForTenant(\n        \"slack\",\n        teamId ?? enterpriseId!,\n      )\n    : null;\n}\n\nasync function isMemberOfOrg(email: string, orgId: string): Promise<boolean> {\n  const { rows } = await getDbExec().execute({\n    sql: `SELECT 1 FROM org_members\n        WHERE org_id = ? AND LOWER(email) = ?\n        LIMIT 1`,\n    args: [orgId, email],\n  });\n  return rows.length > 0;\n}\n\n/**\n * Resolve the default integration principal.\n *\n * Slack DMs become a user principal only after the adapter has verified the\n * sender email and the email is already a member of the managed installation's\n * Agent Native organization. Hydrated full workspace members whose email is\n * missing, unverified, or not an organization member run as an anonymous\n * org-scoped service principal instead — the same visibility shared channels\n * get. Hydration failures, guests/external members, and workspaces without a\n * connected organization are declined with a user-facing message. Shared\n * channels deliberately stay service-scoped so a channel message cannot borrow\n * one participant's private permissions.\n */\nexport async function resolveDefaultIntegrationExecutionContext(\n  incoming: IncomingMessage,\n): Promise<IntegrationExecutionContext> {\n  const installation =\n    incoming.platform === \"slack\"\n      ? await resolveSlackInstallation(incoming)\n      : null;\n\n  if (incoming.platform !== \"slack\" || incoming.conversationType !== \"dm\") {\n    return {\n      ownerEmail: serviceOwner(incoming.platform),\n      orgId: installation?.orgId ?? null,\n      principalType: \"service\",\n      ...(installation?.id ? { installationId: installation.id } : {}),\n    };\n  }\n\n  // Hydration check first: a transient users.info failure must land on the\n  // retry decline here, never on the anonymous org-scoped tier below.\n  if (incoming.actorTrust?.verified !== true) {\n    throw new IntegrationIdentityDeclinedError(\n      \"unverified\",\n      \"Slack DM sender identity could not be hydrated; declining instead of guessing a principal.\",\n      \"I couldn't verify your Slack identity just now, so I can't run this request. Please try again in a moment.\",\n    );\n  }\n  if (\n    incoming.actorTrust.memberType === \"guest\" ||\n    incoming.actorTrust.memberType === \"external\"\n  ) {\n    throw new IntegrationIdentityDeclinedError(\n      \"guest\",\n      \"External or guest Slack members cannot use this integration.\",\n      \"This assistant is only available to members of this workspace's organization.\",\n    );\n  }\n  if (!installation?.orgId) {\n    throw new IntegrationIdentityDeclinedError(\n      \"unlinked-workspace\",\n      \"Slack workspace is not connected to an Agent Native organization.\",\n      \"This Slack workspace isn't connected to an organization yet.\",\n    );\n  }\n\n  const email = normalizedEmail(incoming.senderEmail);\n  let isOrgMember = false;\n  if (\n    email &&\n    incoming.senderVerified === true &&\n    incoming.senderId &&\n    incoming.tenantId\n  ) {\n    try {\n      isOrgMember = await isMemberOfOrg(email, installation.orgId);\n    } catch {\n      // A membership-store outage is not evidence that the sender is merely\n      // unlinked. Fail closed instead of widening them to org-wide access.\n      throw new IntegrationIdentityDeclinedError(\n        \"membership-check-failed\",\n        \"Slack DM organization membership could not be verified.\",\n        \"I couldn't verify your organization membership just now, so I can't run this request. Please try again in a moment.\",\n      );\n    }\n  }\n  if (isOrgMember && email && incoming.senderId && incoming.tenantId) {\n    const link = await upsertVerifiedIntegrationIdentity({\n      platform: incoming.platform,\n      tenantId: incoming.tenantId,\n      externalUserId: incoming.senderId,\n      userEmail: email,\n      orgId: installation.orgId,\n    });\n    return {\n      ownerEmail: link.userEmail,\n      orgId: link.orgId,\n      principalType: \"user\",\n      installationId: installation.id,\n    };\n  }\n\n  // Hydrated full workspace member (member/admin/owner) whose email is\n  // unverified, missing (legacy install without users:read.email), or not an\n  // organization member: run with the anonymous org-scoped service principal —\n  // the same visibility shared channels get. Nothing user-private is\n  // accessible. One structured line keeps 100%-anonymous workspaces (legacy\n  // scope missing) visible in logs.\n  console.warn(\n    `[integrations] anonymous org-scoped principal used: platform=${incoming.platform} teamId=${incoming.tenantId ?? \"unknown\"} emailPresent=${Boolean(email)} memberType=${incoming.actorTrust.memberType}`,\n  );\n  return {\n    ownerEmail: serviceOwner(incoming.platform),\n    orgId: installation.orgId,\n    principalType: \"service\",\n    installationId: installation.id,\n    anonymousMember: true,\n  };\n}\n"]}

package/dist/integrations/index.d.ts

@@ -1,5 +1,7 @@
 export type { PlatformAdapter, IncomingMessage, OutgoingMessage, IntegrationStatus, IntegrationsPluginOptions, ImmediateWebhookResponse, PlatformAdapterCapabilities, UnsupportedPlatformCapabilityError, IntegrationExecutionContext, IntegrationActorTrust, IntegrationContextMessage, IntegrationFileReference, IntegrationConversationType, IntegrationTriggerKind, PlatformRunProgress, } from "./types.js";
 export { assertPlatformCapability } from "./types.js";
+export { resolveDefaultIntegrationExecutionContext } from "./identity.js";
+export { upsertVerifiedIntegrationIdentity, type IntegrationIdentityLink, } from "./identity-links-store.js";
 export { BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, type BuiltInChannelId, type AutomationCapabilities, type ChannelCapabilities, type IntegrationAvailability, type IntegrationCatalogEntry, type IntegrationCategory, type IntegrationCredentialRequirement, type IntegrationIconKey, type IntegrationSupportMaturity, } from "./catalog.js";
 export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, } from "./plugin.js";
 export { getRemoteComputerCapabilities, listRemoteDevicesForOwner, revokeRemoteDeviceForOwner, unregisterRemoteDevice, } from "./remote-devices-store.js";

package/dist/integrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/integrations/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,kCAAkC,EAClC,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kCAAkC,EAClC,yBAAyB,EACzB,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,GAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,4BAA4B,EAC5B,8BAA8B,EAC9B,wCAAwC,EACxC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,kBAAkB,EAClB,0BAA0B,EAC1B,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iCAAiC,EACjC,qCAAqC,EACrC,yCAAyC,EACzC,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,gCAAgC,EAChC,aAAa,GACd,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,4BAA4B,EAC5B,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/integrations/index.ts"],"names":[],"mappings":"AACA,YAAY,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,kCAAkC,EAClC,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,EAAE,yCAAyC,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EACL,iCAAiC,EACjC,KAAK,uBAAuB,GAC7B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,gCAAgC,EACrC,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kCAAkC,EAClC,yBAAyB,EACzB,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,GAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,4BAA4B,EAC5B,8BAA8B,EAC9B,wCAAwC,EACxC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,kBAAkB,EAClB,0BAA0B,EAC1B,aAAa,EACb,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iCAAiC,EACjC,qCAAqC,EACrC,yCAAyC,EACzC,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,iBAAiB,EACjB,uBAAuB,EACvB,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,gCAAgC,EAChC,aAAa,GACd,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,4BAA4B,EAC5B,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,KAAK,aAAa,GACnB,MAAM,2BAA2B,CAAC"}

package/dist/integrations/index.js

@@ -1,4 +1,6 @@
 export { assertPlatformCapability } from "./types.js";
+export { resolveDefaultIntegrationExecutionContext } from "./identity.js";
+export { upsertVerifiedIntegrationIdentity, } from "./identity-links-store.js";
 export { BUILT_IN_INTEGRATION_CATALOG, INTEGRATION_CATEGORIES, getIntegrationCatalogEntry, listBuiltInChannelIntegrations, listIntegrationCatalog, } from "./catalog.js";
 // Plugin
 export { createIntegrationsPlugin, defaultIntegrationsPlugin, enqueueRemoteCommand, } from "./plugin.js";

package/dist/integrations/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/integrations/index.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,GAUvB,MAAM,cAAc,CAAC;AAEtB,SAAS;AACT,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kCAAkC,EAClC,yBAAyB,EACzB,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,4BAA4B,EAC5B,8BAA8B,EAC9B,wCAAwC,EACxC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAkBhC,WAAW;AACX,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,0BAA0B;AAC1B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,SAAS;AACT,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iCAAiC,EACjC,qCAAqC,EACrC,yCAAyC,EACzC,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AASlC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,gCAAgC,EAChC,aAAa,GACd,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,2BAA2B,CAAC","sourcesContent":["// Types\nexport type {\n  PlatformAdapter,\n  IncomingMessage,\n  OutgoingMessage,\n  IntegrationStatus,\n  IntegrationsPluginOptions,\n  ImmediateWebhookResponse,\n  PlatformAdapterCapabilities,\n  UnsupportedPlatformCapabilityError,\n  IntegrationExecutionContext,\n  IntegrationActorTrust,\n  IntegrationContextMessage,\n  IntegrationFileReference,\n  IntegrationConversationType,\n  IntegrationTriggerKind,\n  PlatformRunProgress,\n} from \"./types.js\";\nexport { assertPlatformCapability } from \"./types.js\";\n\nexport {\n  BUILT_IN_INTEGRATION_CATALOG,\n  INTEGRATION_CATEGORIES,\n  getIntegrationCatalogEntry,\n  listBuiltInChannelIntegrations,\n  listIntegrationCatalog,\n  type BuiltInChannelId,\n  type AutomationCapabilities,\n  type ChannelCapabilities,\n  type IntegrationAvailability,\n  type IntegrationCatalogEntry,\n  type IntegrationCategory,\n  type IntegrationCredentialRequirement,\n  type IntegrationIconKey,\n  type IntegrationSupportMaturity,\n} from \"./catalog.js\";\n\n// Plugin\nexport {\n  createIntegrationsPlugin,\n  defaultIntegrationsPlugin,\n  enqueueRemoteCommand,\n} from \"./plugin.js\";\n\nexport {\n  getRemoteComputerCapabilities,\n  listRemoteDevicesForOwner,\n  revokeRemoteDeviceForOwner,\n  unregisterRemoteDevice,\n} from \"./remote-devices-store.js\";\nexport {\n  claimNextComputerCommand,\n  enqueueComputerCommand,\n  listRemoteCommandsForOwner,\n} from \"./remote-commands-store.js\";\nexport {\n  assertValidComputerCommandEnvelope,\n  computeComputerActionHash,\n  computerOperationRequiresApproval,\n  ComputerSupervisionError,\n} from \"./computer-supervision.js\";\nexport {\n  authorizeComputerOperation,\n  createComputerApprovalRequest,\n  decideComputerApproval,\n  getComputerApprovalForOwner,\n  listComputerApprovalsForOwner,\n  type ComputerApprovalRecord,\n  type ComputerApprovalStatus,\n} from \"./computer-supervision-store.js\";\nexport { insertRemoteLiveViewEvents } from \"./remote-run-events-store.js\";\nexport {\n  listRemotePushNotificationsForOwner,\n  listRemotePushRegistrationsForOwner,\n  queueRemotePushNotifications,\n  toPublicRemotePushRegistration,\n  unregisterRemotePushRegistrationForOwner,\n  upsertRemotePushRegistration,\n} from \"./remote-push-store.js\";\nexport type {\n  ComputerApprovalScope,\n  ComputerCommandAction,\n  ComputerCommandEnvelope,\n  ComputerOperationClass,\n  PublicRemotePushRegistration,\n  PublicRemoteDevice,\n  RemoteComputerCapabilities,\n  RemoteCommand,\n  RemoteDevice,\n  RemoteDeviceMetadata,\n  RemoteLiveViewEvent,\n  RemotePushNotification,\n  RemotePushRegistration,\n  RemoteRunEvent,\n} from \"./remote-types.js\";\n\n// Adapters\nexport { slackAdapter } from \"./adapters/slack.js\";\nexport { telegramAdapter } from \"./adapters/telegram.js\";\nexport { whatsappAdapter } from \"./adapters/whatsapp.js\";\nexport { discordAdapter } from \"./adapters/discord.js\";\nexport {\n  clearMicrosoftTeamsAccessTokenCache,\n  getMicrosoftTeamsAccessToken,\n  microsoftTeamsAdapter,\n} from \"./adapters/microsoft-teams.js\";\nexport { googleDocsAdapter } from \"./adapters/google-docs.js\";\nexport { emailAdapter } from \"./adapters/email.js\";\n\n// Google Docs integration\nexport {\n  startGoogleDocsPoller,\n  stopGoogleDocsPoller,\n  handlePushNotification,\n} from \"./google-docs-poller.js\";\n\n// Stores\nexport {\n  getIntegrationConfig,\n  saveIntegrationConfig,\n  deleteIntegrationConfig,\n  listIntegrationConfigs,\n  type IntegrationConfig,\n} from \"./config-store.js\";\n\nexport {\n  disconnectIntegrationInstallation,\n  getActiveIntegrationInstallationByKey,\n  getActiveIntegrationInstallationForTenant,\n  getIntegrationInstallation,\n  listIntegrationInstallations,\n  resolveIntegrationTokenBundle,\n  updateIntegrationInstallation,\n  upsertIntegrationInstallation,\n} from \"./installations-store.js\";\nexport type {\n  InstallationActor,\n  IntegrationInstallation,\n  IntegrationInstallationHealth,\n  IntegrationInstallationStatus,\n  IntegrationTokenBundle,\n} from \"./installations-store.js\";\n\nexport {\n  assertSlackInstallAccess,\n  buildSlackAuthorizeUrl,\n  exchangeSlackOAuthCode,\n  refreshSlackOAuthToken,\n  slackInstallationKey,\n  slackOAuthResponseToInstallation,\n  testSlackAuth,\n} from \"./slack-oauth.js\";\n\nexport {\n  SLACK_AGENT_BOT_EVENTS,\n  buildSlackAgentManifest,\n  type SlackAgentManifestUrls,\n} from \"./slack-manifest.js\";\n\nexport {\n  DEFAULT_INTEGRATION_SCOPE_POLICY,\n  deleteIntegrationScope,\n  evaluateIntegrationScopePolicy,\n  getIntegrationScope,\n  integrationScopeSubjectKey,\n  listIntegrationScopes,\n  saveIntegrationScope,\n} from \"./scope-store.js\";\nexport type {\n  IntegrationConversationTrust,\n  IntegrationScope,\n  IntegrationScopeAccess,\n  IntegrationScopePolicy,\n} from \"./scope-store.js\";\n\nexport {\n  getIntegrationBudgetSnapshot,\n  getIntegrationUsageBudget,\n  listIntegrationUsageBudgets,\n  listIntegrationBudgetThresholdEvents,\n  releaseIntegrationUsageBudget,\n  reserveIntegrationUsageBudget,\n  saveIntegrationUsageBudget,\n  settleIntegrationUsageBudget,\n} from \"./usage-budget-store.js\";\nexport type {\n  IntegrationBudgetPeriod,\n  IntegrationBudgetSubject,\n  IntegrationUsageBudget,\n} from \"./usage-budget-store.js\";\n\nexport {\n  getThreadMapping,\n  saveThreadMapping,\n  deleteThreadMapping,\n  listThreadMappings,\n  type ThreadMapping,\n} from \"./thread-mapping-store.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/integrations/index.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,EAAE,yCAAyC,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EACL,iCAAiC,GAElC,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAC9B,sBAAsB,GAUvB,MAAM,cAAc,CAAC;AAEtB,SAAS;AACT,OAAO,EACL,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,6BAA6B,EAC7B,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,kCAAkC,EAClC,yBAAyB,EACzB,iCAAiC,EACjC,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAC;AAC1E,OAAO,EACL,mCAAmC,EACnC,mCAAmC,EACnC,4BAA4B,EAC5B,8BAA8B,EAC9B,wCAAwC,EACxC,4BAA4B,GAC7B,MAAM,wBAAwB,CAAC;AAkBhC,WAAW;AACX,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,0BAA0B;AAC1B,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,SAAS;AACT,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,iCAAiC,EACjC,qCAAqC,EACrC,yCAAyC,EACzC,0BAA0B,EAC1B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AASlC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,oBAAoB,EACpB,gCAAgC,EAChC,aAAa,GACd,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,gCAAgC,EAChC,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,oCAAoC,EACpC,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AAOjC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GAEnB,MAAM,2BAA2B,CAAC","sourcesContent":["// Types\nexport type {\n  PlatformAdapter,\n  IncomingMessage,\n  OutgoingMessage,\n  IntegrationStatus,\n  IntegrationsPluginOptions,\n  ImmediateWebhookResponse,\n  PlatformAdapterCapabilities,\n  UnsupportedPlatformCapabilityError,\n  IntegrationExecutionContext,\n  IntegrationActorTrust,\n  IntegrationContextMessage,\n  IntegrationFileReference,\n  IntegrationConversationType,\n  IntegrationTriggerKind,\n  PlatformRunProgress,\n} from \"./types.js\";\nexport { assertPlatformCapability } from \"./types.js\";\n\nexport { resolveDefaultIntegrationExecutionContext } from \"./identity.js\";\nexport {\n  upsertVerifiedIntegrationIdentity,\n  type IntegrationIdentityLink,\n} from \"./identity-links-store.js\";\n\nexport {\n  BUILT_IN_INTEGRATION_CATALOG,\n  INTEGRATION_CATEGORIES,\n  getIntegrationCatalogEntry,\n  listBuiltInChannelIntegrations,\n  listIntegrationCatalog,\n  type BuiltInChannelId,\n  type AutomationCapabilities,\n  type ChannelCapabilities,\n  type IntegrationAvailability,\n  type IntegrationCatalogEntry,\n  type IntegrationCategory,\n  type IntegrationCredentialRequirement,\n  type IntegrationIconKey,\n  type IntegrationSupportMaturity,\n} from \"./catalog.js\";\n\n// Plugin\nexport {\n  createIntegrationsPlugin,\n  defaultIntegrationsPlugin,\n  enqueueRemoteCommand,\n} from \"./plugin.js\";\n\nexport {\n  getRemoteComputerCapabilities,\n  listRemoteDevicesForOwner,\n  revokeRemoteDeviceForOwner,\n  unregisterRemoteDevice,\n} from \"./remote-devices-store.js\";\nexport {\n  claimNextComputerCommand,\n  enqueueComputerCommand,\n  listRemoteCommandsForOwner,\n} from \"./remote-commands-store.js\";\nexport {\n  assertValidComputerCommandEnvelope,\n  computeComputerActionHash,\n  computerOperationRequiresApproval,\n  ComputerSupervisionError,\n} from \"./computer-supervision.js\";\nexport {\n  authorizeComputerOperation,\n  createComputerApprovalRequest,\n  decideComputerApproval,\n  getComputerApprovalForOwner,\n  listComputerApprovalsForOwner,\n  type ComputerApprovalRecord,\n  type ComputerApprovalStatus,\n} from \"./computer-supervision-store.js\";\nexport { insertRemoteLiveViewEvents } from \"./remote-run-events-store.js\";\nexport {\n  listRemotePushNotificationsForOwner,\n  listRemotePushRegistrationsForOwner,\n  queueRemotePushNotifications,\n  toPublicRemotePushRegistration,\n  unregisterRemotePushRegistrationForOwner,\n  upsertRemotePushRegistration,\n} from \"./remote-push-store.js\";\nexport type {\n  ComputerApprovalScope,\n  ComputerCommandAction,\n  ComputerCommandEnvelope,\n  ComputerOperationClass,\n  PublicRemotePushRegistration,\n  PublicRemoteDevice,\n  RemoteComputerCapabilities,\n  RemoteCommand,\n  RemoteDevice,\n  RemoteDeviceMetadata,\n  RemoteLiveViewEvent,\n  RemotePushNotification,\n  RemotePushRegistration,\n  RemoteRunEvent,\n} from \"./remote-types.js\";\n\n// Adapters\nexport { slackAdapter } from \"./adapters/slack.js\";\nexport { telegramAdapter } from \"./adapters/telegram.js\";\nexport { whatsappAdapter } from \"./adapters/whatsapp.js\";\nexport { discordAdapter } from \"./adapters/discord.js\";\nexport {\n  clearMicrosoftTeamsAccessTokenCache,\n  getMicrosoftTeamsAccessToken,\n  microsoftTeamsAdapter,\n} from \"./adapters/microsoft-teams.js\";\nexport { googleDocsAdapter } from \"./adapters/google-docs.js\";\nexport { emailAdapter } from \"./adapters/email.js\";\n\n// Google Docs integration\nexport {\n  startGoogleDocsPoller,\n  stopGoogleDocsPoller,\n  handlePushNotification,\n} from \"./google-docs-poller.js\";\n\n// Stores\nexport {\n  getIntegrationConfig,\n  saveIntegrationConfig,\n  deleteIntegrationConfig,\n  listIntegrationConfigs,\n  type IntegrationConfig,\n} from \"./config-store.js\";\n\nexport {\n  disconnectIntegrationInstallation,\n  getActiveIntegrationInstallationByKey,\n  getActiveIntegrationInstallationForTenant,\n  getIntegrationInstallation,\n  listIntegrationInstallations,\n  resolveIntegrationTokenBundle,\n  updateIntegrationInstallation,\n  upsertIntegrationInstallation,\n} from \"./installations-store.js\";\nexport type {\n  InstallationActor,\n  IntegrationInstallation,\n  IntegrationInstallationHealth,\n  IntegrationInstallationStatus,\n  IntegrationTokenBundle,\n} from \"./installations-store.js\";\n\nexport {\n  assertSlackInstallAccess,\n  buildSlackAuthorizeUrl,\n  exchangeSlackOAuthCode,\n  refreshSlackOAuthToken,\n  slackInstallationKey,\n  slackOAuthResponseToInstallation,\n  testSlackAuth,\n} from \"./slack-oauth.js\";\n\nexport {\n  SLACK_AGENT_BOT_EVENTS,\n  buildSlackAgentManifest,\n  type SlackAgentManifestUrls,\n} from \"./slack-manifest.js\";\n\nexport {\n  DEFAULT_INTEGRATION_SCOPE_POLICY,\n  deleteIntegrationScope,\n  evaluateIntegrationScopePolicy,\n  getIntegrationScope,\n  integrationScopeSubjectKey,\n  listIntegrationScopes,\n  saveIntegrationScope,\n} from \"./scope-store.js\";\nexport type {\n  IntegrationConversationTrust,\n  IntegrationScope,\n  IntegrationScopeAccess,\n  IntegrationScopePolicy,\n} from \"./scope-store.js\";\n\nexport {\n  getIntegrationBudgetSnapshot,\n  getIntegrationUsageBudget,\n  listIntegrationUsageBudgets,\n  listIntegrationBudgetThresholdEvents,\n  releaseIntegrationUsageBudget,\n  reserveIntegrationUsageBudget,\n  saveIntegrationUsageBudget,\n  settleIntegrationUsageBudget,\n} from \"./usage-budget-store.js\";\nexport type {\n  IntegrationBudgetPeriod,\n  IntegrationBudgetSubject,\n  IntegrationUsageBudget,\n} from \"./usage-budget-store.js\";\n\nexport {\n  getThreadMapping,\n  saveThreadMapping,\n  deleteThreadMapping,\n  listThreadMappings,\n  type ThreadMapping,\n} from \"./thread-mapping-store.js\";\n"]}

package/dist/integrations/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/integrations/plugin.ts"],"names":[],"mappings":"AAqIA,OAAO,KAAK,EAEV,yBAAyB,EAG1B,MAAM,YAAY,CAAC;AAOpB,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AA4F9D,KAAK,yBAAyB,GAAG;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAUF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsFlC;AA+ND;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,yBAAyB,GAClC,cAAc,CAq6DhB;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,gBAA6B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/integrations/plugin.ts"],"names":[],"mappings":"AAyIA,OAAO,KAAK,EAEV,yBAAyB,EAG1B,MAAM,YAAY,CAAC;AAOpB,KAAK,cAAc,GAAG,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AA4F9D,KAAK,yBAAyB,GAAG;IAC/B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AAeF,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,yBAAyB,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsFlC;AA+ND;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,CAAC,EAAE,yBAAyB,GAClC,cAAc,CA6hEhB;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,gBAA6B,CAAC"}

package/dist/integrations/plugin.js

@@ -26,6 +26,7 @@ import { ComputerSupervisionError } from "./computer-supervision.js";
 import { getIntegrationConfig, saveIntegrationConfig } from "./config-store.js";
 import { claimIntegrationControl } from "./controls-store.js";
 import { startGoogleDocsPoller, handlePushNotification, } from "./google-docs-poller.js";
+import { IntegrationIdentityDeclinedError, resolveDefaultIntegrationExecutionContext, } from "./identity.js";
 import { disconnectIntegrationInstallation, listIntegrationInstallations, resolveIntegrationTokenBundle, updateIntegrationInstallation, upsertIntegrationInstallation, } from "./installations-store.js";
 import { forgetIntegrationMemory, integrationMemoryActions, listIntegrationMemory, rememberForIntegrationScope, } from "./integration-memory.js";
 import { extractBearerToken, signInternalToken, verifyInternalToken, } from "./internal-token.js";
@@ -123,6 +124,10 @@ Keep responses concise — messaging platforms have character limits and users e
 
 If a task requires many steps, summarize what you did rather than streaming every detail.`;
 const REMOTE_DEVICE_ONLINE_MS = 90_000;
+// One decline reply per sender + decline reason per window: during a Slack
+// API outage every message would otherwise get another identical "try again"
+// reply. Short enough that a persistent condition still reminds the sender.
+const DECLINE_NOTICE_DEDUPE_TTL_MS = 5 * 60 * 1_000;
 export async function enqueueRemoteCommand(envelope) {
     const ownerEmail = readString(envelope.ownerEmail);
     if (!ownerEmail)
@@ -1888,11 +1893,61 @@ export function createIntegrationsPlugin(options) {
                     setResponseStatus(event, 404);
                     return { error: `Integration ${platform} is not enabled` };
                 }
-                const incoming = await withCredentialContext(credentialContext, () => adapter.parseIncomingMessage(event));
+                let incoming = await withCredentialContext(credentialContext, () => adapter.parseIncomingMessage(event));
                 if (!incoming) {
                     setResponseStatus(event, 200);
                     return "ok";
                 }
+                if (adapter.hydrateIncomingIdentity) {
+                    try {
+                        incoming = await withCredentialContext(credentialContext, () => adapter.hydrateIncomingIdentity(incoming));
+                    }
+                    catch (err) {
+                        // Identity hydration is best-effort for platforms that have an
+                        // app-specific resolver. Slack's default DM resolver below will
+                        // still fail closed when the identity is absent or unverified.
+                        console.warn(`[integrations] Could not hydrate ${platform} sender identity:`, err instanceof Error ? err.message : err);
+                    }
+                }
+                let defaultExecutionContext = null;
+                if (incoming.platform === "slack" &&
+                    incoming.conversationType === "dm") {
+                    try {
+                        defaultExecutionContext = await withCredentialContext(credentialContext, () => resolveDefaultIntegrationExecutionContext(incoming));
+                    }
+                    catch (err) {
+                        // Only an explicit execution-context resolver may override the
+                        // default Slack identity ladder. The legacy owner-only resolver
+                        // predates org-bound identities and must not turn a rejected DM
+                        // into an authenticated owner run.
+                        if (!options?.resolveExecutionContext) {
+                            const declined = err instanceof IntegrationIdentityDeclinedError ? err : null;
+                            if (declined) {
+                                console.warn(`[integrations] default Slack DM identity declined message:`, declined.message);
+                                // Best-effort polite reply back to the DM, deduped per
+                                // sender + reason so an outage doesn't produce an identical
+                                // reply for every message. Do not await Slack's API: webhook
+                                // acknowledgement has a stricter deadline than notice
+                                // delivery and must not be delayed by a slow postMessage.
+                                void withCredentialContext(credentialContext, () => adapter.sendSystemNotice
+                                    ? adapter.sendSystemNotice(incoming, declined.userFacingMessage, {
+                                        dedupeKey: `decline:${incoming.tenantId ?? "unknown"}:${incoming.senderId ?? "unknown"}:${declined.reason}`,
+                                        dedupeTtlMs: DECLINE_NOTICE_DEDUPE_TTL_MS,
+                                    })
+                                    : Promise.resolve()).catch((noticeErr) => {
+                                    console.warn(`[integrations] decline notice failed:`, noticeErr instanceof Error
+                                        ? noticeErr.message
+                                        : noticeErr);
+                                });
+                            }
+                            else {
+                                console.error(`[integrations] default Slack DM identity denied message:`, err);
+                            }
+                            setResponseStatus(event, 200);
+                            return "ok";
+                        }
+                    }
+                }
                 let executionContext = {
                     ownerEmail: `integration@${platform}`,
                     orgId: null,
@@ -1908,6 +1963,33 @@ export function createIntegrationsPlugin(options) {
                         return "ok";
                     }
                 }
+                else if (defaultExecutionContext) {
+                    executionContext = defaultExecutionContext;
+                    if (defaultExecutionContext.anonymousMember) {
+                        // The anonymous tier must never be silent. (1) The agent run
+                        // can tell: the note rides the serialized `incoming` into the
+                        // queued task and surfaces via <integration-context>.
+                        incoming.identityNote =
+                            "Caller is an unlinked Slack workspace member running with organization-wide visibility only; personal or privately-shared data is not accessible. They can get personal access by having an admin add their Slack email to the organization (or by reconnecting Slack with the users:read.email scope).";
+                        // (2) The sender gets a one-time heads-up (adapter-throttled per
+                        // sender). Fire-and-forget so it never delays or replaces the
+                        // normal agent run.
+                        if (adapter.sendSystemNotice) {
+                            const senderEmail = typeof incoming.senderEmail === "string" &&
+                                incoming.senderEmail.trim()
+                                ? incoming.senderEmail.trim()
+                                : null;
+                            const noticeText = senderEmail
+                                ? `Heads up: I couldn't match your Slack account to an organization member, so I can only use org-wide data. Ask an admin to add ${senderEmail} to the organization for personal access.`
+                                : "Heads up: I couldn't verify your Slack account's email, so I can only use org-wide data. Ask an admin to update the Slack connection with the users:read.email scope for personal access.";
+                            void withCredentialContext(credentialContext, () => adapter.sendSystemNotice(incoming, noticeText, {
+                                dedupeKey: `anonymous-tier:${incoming.tenantId ?? "unknown"}:${incoming.senderId ?? "unknown"}`,
+                            })).catch((noticeErr) => {
+                                console.warn(`[integrations] anonymous-tier notice failed:`, noticeErr instanceof Error ? noticeErr.message : noticeErr);
+                            });
+                        }
+                    }
+                }
                 else if (options?.resolveOwner) {
                     try {
                         executionContext.ownerEmail = await withCredentialContext(credentialContext, () => Promise.resolve(options.resolveOwner(incoming)));
@@ -1916,6 +1998,16 @@ export function createIntegrationsPlugin(options) {
                         console.error(`[integrations] resolveOwner failed, using default:`, err);
                     }
                 }
+                else {
+                    try {
+                        executionContext = await withCredentialContext(credentialContext, () => resolveDefaultIntegrationExecutionContext(incoming));
+                    }
+                    catch (err) {
+                        console.error(`[integrations] default execution identity denied message:`, err);
+                        setResponseStatus(event, 200);
+                        return "ok";
+                    }
+                }
                 if (executionContext.scopeId) {
                     incoming.integrationScopeId = executionContext.scopeId;
                 }